@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.20

package/dist/directory/index.js

@@ -1,7 +1,7 @@
 import "../chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "../chunk-KCQX65FU.js";
+} from "../chunk-CVYXIN5B.js";
 import {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,
@@ -16,16 +16,16 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "../chunk-UIBGXRDD.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-JHO6FGZX.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DIRECTORY_RECORD_ID,

package/dist/{dispatch-BDVGYC6X.js → dispatch-3EN6YCCS.js}

@@ -1,26 +1,26 @@
 import {
   markStale
-} from "./chunk-4HDYQL3J.js";
+} from "./chunk-AQF7JSQR.js";
 import {
   putDerivedOutput,
   selfWriteFieldEqual
-} from "./chunk-ZNACADFG.js";
+} from "./chunk-ICCRAPWD.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-PRDRGL73.js";
-import "./chunk-7G6VDWXB.js";
-import "./chunk-UHXCLPGC.js";
-import "./chunk-VW6ZZGCG.js";
-import "./chunk-VN45YLWM.js";
-import "./chunk-NWCGDAV6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+import "./chunk-GYUCRDAU.js";
+import "./chunk-437FDIHO.js";
+import "./chunk-KDX6VEYV.js";
+import "./chunk-RNSC2ARR.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-VCETL77O.js";
-import "./chunk-W5W6KHN2.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
 import {
   DerivationCapExceededError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/dispatch.ts
@@ -28,7 +28,7 @@ async function dispatchArrayDerivationsOnDelete(ctx, id, eraseRecordShapeToo = f
   const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx;
   const strategies = derivationSource.registry().strategiesForSource(collectionName);
   if (strategies.length === 0) return 0;
-  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-DTBIDOWF.js");
+  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-TFPWDOME.js");
   const txCtx = derivationSource.getActiveTxContext();
   let erased = 0;
   for (const { spec } of strategies) {
@@ -114,7 +114,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
     }
     if (executorClass === null) {
       ;
-      ({ DerivationExecutor: executorClass } = await import("./executor-S4QIKEHW.js"));
+      ({ DerivationExecutor: executorClass } = await import("./executor-GPM6DNWV.js"));
     }
     for (const run of runs) {
       const ctx2 = { vault: derivationSource.getReadOnlyFacade() };
@@ -134,7 +134,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
         const outputCollection = derivationSource.getCollection(outSpec.collection);
         const txCtx = derivationSource.getActiveTxContext();
         if (out.kind === "array") {
-          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-DTBIDOWF.js");
+          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-TFPWDOME.js");
           const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext);
           const prevKeys = new Set(prior?.keys ?? []);
           const newKeysList = out.entries.map((e) => e.key);
@@ -191,4 +191,4 @@ export {
   dispatchArrayDerivationsOnDelete,
   dispatchDerivations
 };
-//# sourceMappingURL=dispatch-BDVGYC6X.js.map
+//# sourceMappingURL=dispatch-3EN6YCCS.js.map

package/dist/{dispatch-RE74SH6L.js → dispatch-ASL257KG.js}

@@ -15,7 +15,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-FHHLXO4Y.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-SHUVRZUJ.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -24,7 +24,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-ZWXSOWJI.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-PQYPVCER.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -44,7 +44,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-FHHLXO4Y.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-SHUVRZUJ.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -57,7 +57,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-ZWXSOWJI.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-PQYPVCER.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -69,4 +69,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-RE74SH6L.js.map
+//# sourceMappingURL=dispatch-ASL257KG.js.map

package/dist/{enclave-52VUXNRL.js → enclave-ZJS5R5RH.js}

@@ -2,6 +2,7 @@ import {
   RecordCodec,
   SEALED_CEK_NS,
   applyRewrappedBody,
+  buildRecordAad,
   computeBrokerProof,
   deriveBrokerProofBits,
   deriveBrokerProofKey,
@@ -9,11 +10,15 @@ import {
   envelopeBodySize,
   findByDet,
   hasPerRecordKey,
+  hasSealedBody,
   isRewrappedUnder,
   issueChallenge,
   makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
+  recordAadFor,
+  rekeyEnvelopeIfNeeded,
+  rekeyEnvelopeToDek,
   resolveStableCek,
   revokeSealedRecord,
   rewrapBodyToDek,
@@ -21,27 +26,30 @@ import {
   rotateRecordCek,
   sealRecordToHost,
   verifyBrokerProof,
+  verifyRecordIdentity,
   writeEnvelopeBody
-} from "./chunk-VN45YLWM.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildDeleteMarker,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-NWCGDAV6.js";
+} from "./chunk-ZVAFJQZB.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
   evaluateKofN
-} from "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
+} from "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
 import {
   computeBidxTarget,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag
-} from "./chunk-747LRSOO.js";
+} from "./chunk-SFD2LL7G.js";
 import {
   pbkdf2VerifyDigest
 } from "./chunk-LP7BEXCT.js";
@@ -74,9 +82,9 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "./chunk-VCETL77O.js";
-import "./chunk-W5W6KHN2.js";
-import "./chunk-HNGSV2YC.js";
+} from "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -85,6 +93,9 @@ export {
   base64ToBuffer,
   bufferToBase64,
   buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   buildTombstone,
   computeBidxTarget,
   computeBrokerProof,
@@ -118,6 +129,7 @@ export {
   generateIV,
   generateSalt,
   hasPerRecordKey,
+  hasSealedBody,
   hmacSha256Hex,
   importCek,
   isDeleteMarker,
@@ -130,6 +142,9 @@ export {
   openEnvelopeJson,
   pbkdf2VerifyDigest,
   queryByDet,
+  recordAadFor,
+  rekeyEnvelopeIfNeeded,
+  rekeyEnvelopeToDek,
   resolveStableCek,
   revokeSealedRecord,
   rewrapBodyToDek,
@@ -140,8 +155,9 @@ export {
   unwrapCek,
   unwrapKey,
   verifyBrokerProof,
+  verifyRecordIdentity,
   wrapCek,
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-52VUXNRL.js.map
+//# sourceMappingURL=enclave-ZJS5R5RH.js.map

package/dist/executor-GPM6DNWV.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-JIF3IBRK.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-GPM6DNWV.js.map

package/dist/executor-LJSMZ4IB.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-RORE2GX2.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-LJSMZ4IB.js.map

package/dist/executor-SHUVRZUJ.js

@@ -0,0 +1,29 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-EG6AQBYW.js";
+import "./chunk-5J5TTSGW.js";
+import "./chunk-IPDS2TYW.js";
+import "./chunk-ICCRAPWD.js";
+import "./chunk-L6FSZFG7.js";
+import "./chunk-A4K5GLE6.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-CADUYBQD.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-GYUCRDAU.js";
+import "./chunk-437FDIHO.js";
+import "./chunk-KDX6VEYV.js";
+import "./chunk-RNSC2ARR.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-SHUVRZUJ.js.map

package/dist/export-accessible-GNY6DC6U.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-ZPMXYPBR.js";
+import "./chunk-2IK6AC6A.js";
+import "./chunk-DYASJSKI.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-GNY6DC6U.js.map

package/dist/extract-partition-BG3AF4NZ.js

@@ -0,0 +1,38 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-CV7WXCZD.js";
+import "./chunk-YVTADFTC.js";
+import "./chunk-2IK6AC6A.js";
+import "./chunk-DYASJSKI.js";
+import "./chunk-IOURTXTM.js";
+import "./chunk-HTMQBBF3.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-RNSC2ARR.js";
+import "./chunk-47ZFULEZ.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-BG3AF4NZ.js.map

package/dist/{fanout-sidecar-DTBIDOWF.js → fanout-sidecar-TFPWDOME.js}

@@ -1,18 +1,19 @@
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-VN45YLWM.js";
-import "./chunk-NWCGDAV6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-D5UDZANO.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "./chunk-VCETL77O.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
-import "./chunk-HNGSV2YC.js";
+} from "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
@@ -23,7 +24,7 @@ function recordId(source, sourceId, outputKey) {
 async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
   const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
   if (!envelope) return void 0;
-  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson({ collection: "_meta", id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION));
   const parsed = JSON.parse(json);
   if (parsed._noydb_fanout !== 1) return void 0;
   if (!Array.isArray(parsed.keys)) return void 0;
@@ -42,24 +43,14 @@ async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
   const id = recordId(payload.source, payload.sourceId, payload.outputKey);
   const prior = await store.get(vault, "_meta", id);
   const json = JSON.stringify(doc);
+  const version = (prior?._v ?? 0) + 1;
+  const identity = { collection: "_meta", id, version };
   let envelope;
   if (!encrypted) {
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: json
-    };
+    envelope = buildRecordEnvelope(identity, { iv: "", data: json });
   } else {
-    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: iv,
-      _data: data
-    };
+    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity));
+    envelope = buildRecordEnvelope(identity, { iv, data });
   }
   await store.put(vault, "_meta", id, envelope);
 }
@@ -71,4 +62,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-DTBIDOWF.js.map
+//# sourceMappingURL=fanout-sidecar-TFPWDOME.js.map

package/dist/fanout-sidecar-TFPWDOME.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/find-KX6OKHDP.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-KX6OKHDP.js.map

package/dist/forget/index.js

@@ -1,16 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-HFQ6LGIO.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-TENLCGYD.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts

package/dist/guards/index.js

@@ -2,13 +2,13 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-LWSJG3LI.js";
+} from "../chunk-5EJQNA26.js";
 import {
   GuardExecutor
-} from "../chunk-WLYIROCJ.js";
+} from "../chunk-RORE2GX2.js";
 import {
   GuardRegistry
-} from "../chunk-KUDZVJKQ.js";
+} from "../chunk-BP4I7IBK.js";
 import {
   ReadOnlyVaultFacade
 } from "../chunk-JK733I5V.js";
@@ -18,7 +18,7 @@ import {
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,

package/dist/history/index.js

@@ -1,31 +1,31 @@
 import {
   CollectionInstant,
-  VaultInstant,
+  VaultInstant
+} from "../chunk-SA77BQ7F.js";
+import {
+  diff,
+  formatDiff
+} from "../chunk-SVLR4POP.js";
+import {
+  NO_HISTORY,
   clearHistory,
   getHistory,
   getVersionEnvelope,
+  historyIdentity,
   pruneHistory,
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-WHJKIZS7.js";
-import {
-  diff,
-  formatDiff
-} from "../chunk-SVLR4POP.js";
-import {
-  NO_HISTORY
-} from "../chunk-AFHQATY4.js";
+} from "../chunk-YOT7D63X.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-NIVEDYJZ.js";
+} from "../chunk-MNUTPZRQ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "../chunk-I7FD46FF.js";
-import "../chunk-3FSX6LDG.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -33,22 +33,24 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-VW6ZZGCG.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-RNSC2ARR.js";
+import "../chunk-47ZFULEZ.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/history/active.ts
 function withHistory() {
   return {
     saveHistory,
+    historyIdentity,
     getHistoryEntries: getHistory,
     getVersionEnvelope,
     pruneHistory,
@@ -89,6 +91,7 @@ export {
   getHistory,
   getVersionEnvelope,
   hashEntry,
+  historyIdentity,
   paddedIndex,
   parseIndex,
   pruneHistory,

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}