@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/{fanout-sidecar-DTBIDOWF.js → fanout-sidecar-NLQ7QAYW.js}

@@ -1,18 +1,19 @@
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-VN45YLWM.js";
-import "./chunk-NWCGDAV6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-OHOKBMTM.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
+import "./chunk-GQXFOAYZ.js";
+import "./chunk-KV6JM2IA.js";
+import "./chunk-TMBSPLUG.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "./chunk-VCETL77O.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
-import "./chunk-HNGSV2YC.js";
+} from "./chunk-AU3AUJIZ.js";
+import "./chunk-IGNJOJEP.js";
+import "./chunk-CWM4GQD2.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
@@ -23,7 +24,7 @@ function recordId(source, sourceId, outputKey) {
 async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
   const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
   if (!envelope) return void 0;
-  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson({ collection: "_meta", id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION));
   const parsed = JSON.parse(json);
   if (parsed._noydb_fanout !== 1) return void 0;
   if (!Array.isArray(parsed.keys)) return void 0;
@@ -42,24 +43,14 @@ async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
   const id = recordId(payload.source, payload.sourceId, payload.outputKey);
   const prior = await store.get(vault, "_meta", id);
   const json = JSON.stringify(doc);
+  const version = (prior?._v ?? 0) + 1;
+  const identity = { collection: "_meta", id, version };
   let envelope;
   if (!encrypted) {
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: json
-    };
+    envelope = buildRecordEnvelope(identity, { iv: "", data: json });
   } else {
-    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: iv,
-      _data: data
-    };
+    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity));
+    envelope = buildRecordEnvelope(identity, { iv, data });
   }
   await store.put(vault, "_meta", id, envelope);
 }
@@ -71,4 +62,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-DTBIDOWF.js.map
+//# sourceMappingURL=fanout-sidecar-NLQ7QAYW.js.map

package/dist/fanout-sidecar-NLQ7QAYW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/find-WSARMJBW.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-TMBSPLUG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AU3AUJIZ.js";
+import "./chunk-CWM4GQD2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-WSARMJBW.js.map

package/dist/forget/index.js

@@ -1,16 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-HFQ6LGIO.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-U27Y4DJZ.js";
+import "../chunk-OHOKBMTM.js";
+import "../chunk-PENPHA45.js";
+import "../chunk-GQXFOAYZ.js";
+import "../chunk-KV6JM2IA.js";
+import "../chunk-TMBSPLUG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-AU3AUJIZ.js";
+import "../chunk-IGNJOJEP.js";
+import "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts

package/dist/guards/index.js

@@ -2,23 +2,23 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-LWSJG3LI.js";
+} from "../chunk-TQPASLY4.js";
+import {
+  ReadOnlyVaultFacade
+} from "../chunk-JK733I5V.js";
 import {
   GuardExecutor
-} from "../chunk-WLYIROCJ.js";
+} from "../chunk-6YD5SYQS.js";
 import {
   GuardRegistry
-} from "../chunk-KUDZVJKQ.js";
-import {
-  ReadOnlyVaultFacade
-} from "../chunk-JK733I5V.js";
+} from "../chunk-IJ46VCWD.js";
 import {
   AmendmentForbiddenError,
   FieldFrozenError,
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,

package/dist/history/index.js

@@ -1,31 +1,31 @@
 import {
   CollectionInstant,
-  VaultInstant,
+  VaultInstant
+} from "../chunk-TDSN2O2V.js";
+import {
+  diff,
+  formatDiff
+} from "../chunk-SVLR4POP.js";
+import {
+  NO_HISTORY,
   clearHistory,
   getHistory,
   getVersionEnvelope,
+  historyIdentity,
   pruneHistory,
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-WHJKIZS7.js";
-import {
-  diff,
-  formatDiff
-} from "../chunk-SVLR4POP.js";
-import {
-  NO_HISTORY
-} from "../chunk-AFHQATY4.js";
+} from "../chunk-LN7P6MZB.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-NIVEDYJZ.js";
+} from "../chunk-4A34KWOU.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "../chunk-I7FD46FF.js";
-import "../chunk-3FSX6LDG.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -33,22 +33,24 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-VW6ZZGCG.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-ZLHHE5XZ.js";
+import "../chunk-PPCOKVFA.js";
+import "../chunk-OHOKBMTM.js";
+import "../chunk-PENPHA45.js";
+import "../chunk-GQXFOAYZ.js";
+import "../chunk-KV6JM2IA.js";
+import "../chunk-TMBSPLUG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-AU3AUJIZ.js";
+import "../chunk-IGNJOJEP.js";
+import "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/history/active.ts
 function withHistory() {
   return {
     saveHistory,
+    historyIdentity,
     getHistoryEntries: getHistory,
     getVersionEnvelope,
     pruneHistory,
@@ -89,6 +91,7 @@ export {
   getHistory,
   getVersionEnvelope,
   hashEntry,
+  historyIdentity,
   paddedIndex,
   parseIndex,
   pruneHistory,

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-7NXHMW6Y.js";
+} from "../chunk-SYS46BL7.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-MSWYQLMQ.js";
+} from "../chunk-3B6S6RSI.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-PRDRGL73.js";
+} from "../chunk-6KTVJ5ZZ.js";
 import {
   NO_I18N,
   applyI18nLocale,
@@ -26,17 +26,17 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-7G6VDWXB.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-VW6ZZGCG.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-WVE6YKMX.js";
+import "../chunk-JNMTN5D5.js";
+import "../chunk-ZLHHE5XZ.js";
+import "../chunk-OHOKBMTM.js";
+import "../chunk-PENPHA45.js";
+import "../chunk-GQXFOAYZ.js";
+import "../chunk-KV6JM2IA.js";
+import "../chunk-TMBSPLUG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
+import "../chunk-AU3AUJIZ.js";
+import "../chunk-IGNJOJEP.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -47,7 +47,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/i18n/densify.ts

package/dist/index.d.ts

@@ -71,10 +71,10 @@
  * @packageDocumentation
  */
 import './kernel/env-check.js';
-export type { Role, Permission, Permissions, EncryptedEnvelope, KeyringAuthenticator, KeyringAuthenticatorWrappingKEK, KeyringAuthenticatorWrappingDEKs, VaultPolicyOnDisk, VaultSnapshot, NoydbStore, ListPageResult, KeyringFile, VaultBackup, DirtyEntry, SyncMetadata, Conflict, ErasureEnforcement, ConflictStrategy, ConflictPolicy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncTransactionResult, SyncStatus, ChangeEvent, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, NoydbOptions, HistoryConfig, HistoryOptions, HistoryEntry, PruneOptions, PutManyItemOptions, PutManyOptions, PutManyResult, DeleteManyResult, ExportStreamOptions, ExportChunk, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, SessionPolicy, ReAuthOperation, PlaintextTranslatorContext, PlaintextTranslatorFn, TranslatorAuditEntry, ExportCapability, ExportFormat, ImportCapability, } from './kernel/types.js';
+export type { Role, Permission, Permissions, EncryptedEnvelope, KeyringAuthenticator, KeyringAuthenticatorWrappingKEK, KeyringAuthenticatorWrappingDEKs, VaultPolicyOnDisk, VaultSnapshot, NoydbStore, ListPageResult, KeyringFile, VaultBackup, DirtyEntry, SyncMetadata, Conflict, ErasureEnforcement, ConflictStrategy, ConflictPolicy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncTransactionResult, SyncStatus, SyncTargetStatus, ChangeEvent, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, NoydbOptions, HistoryConfig, HistoryOptions, HistoryEntry, PruneOptions, PutManyItemOptions, PutManyOptions, PutManyResult, DeleteManyResult, ExportStreamOptions, ExportChunk, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, SessionPolicy, ReAuthOperation, PlaintextTranslatorContext, PlaintextTranslatorFn, TranslatorAuditEntry, ExportCapability, ExportFormat, ImportCapability, } from './kernel/types.js';
 export { NOYDB_FORMAT_VERSION, NOYDB_KEYRING_VERSION, NOYDB_BACKUP_VERSION, NOYDB_SYNC_VERSION, createStore, } from './kernel/types.js';
 export type { StoreAuthKind, StoreAuth, StoreCapabilities, StoreCredentials, StoreCredentialSource, } from './kernel/types.js';
-export type { NoydbPodStore, NoydbBundleStore, BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from './kernel/types.js';
+export type { NoydbPodStore, BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from './kernel/types.js';
 export { BlobSet } from './with-shape/blobs/blob-set.js';
 export { memoryObjectProjection } from './with-shape/blobs/object-projection.js';
 export type { ObjectProjection, ObjectMeta, ObjectListEntry, PutObjectOptions, ObjectUrlOptions, PutUrlOptions, } from './with-shape/blobs/object-projection.js';
@@ -85,8 +85,8 @@ export { detectMimeType, detectMagic, isPreCompressed } from './with-shape/blobs
 export { BLOB_INTENT_COLLECTION, getIntent, createIntent, deleteIntent, sweepBlobIntents, } from './with-shape/blobs/blob-intent.js';
 export type { BlobIntent, BlobIntentHold, BlobIntentResume } from './with-shape/blobs/blob-intent.js';
 export { BlobIntentPendingError, BlobOfflineError } from './kernel/errors.js';
-export { wrapPodStore, createPodStore, wrapBundleStore, createBundleStore } from './with-pod/pod-store.js';
-export type { WrappedPodNoydbStore, WrapPodStoreOptions, WrappedBundleNoydbStore, WrapBundleStoreOptions, } from './with-pod/pod-store.js';
+export { wrapPodStore, createPodStore } from './with-pod/pod-store.js';
+export type { WrappedPodNoydbStore, WrapPodStoreOptions, } from './with-pod/pod-store.js';
 export type { WriteQueue } from './kernel/write-queue.js';
 export type { WriteEvent, WriteHook } from './port/with/write-hooks.js';
 /** #841 — the option shape `vault.collection()` takes, so callers can name it. */
@@ -105,14 +105,14 @@ export type { SchemaDelta, FieldChange, UpdateContext, UpdateDecision, SchemaUpd
 export { blindUpdate, additiveOnly, lockSchema, coordinatedCutover } from './with-shape/schema-update/index.js';
 export type { FenceState, FenceDoc } from './with-shape/schema-update/fence.js';
 export type { SyncPolicy, PushPolicy, PullPolicy, PushMode, PullMode, SyncSchedulerStatus, ReadinessState } from './kernel/sync-policy.js';
-export { SyncScheduler, INDEXED_STORE_POLICY, POD_STORE_POLICY, BUNDLE_STORE_POLICY } from './kernel/sync-policy.js';
+export { SyncScheduler, INDEXED_STORE_POLICY, POD_STORE_POLICY } from './kernel/sync-policy.js';
 export type { SyncTarget, SyncTargetInfo, SyncTargetRole } from './kernel/types.js';
 export { memoryStore } from './kernel/memory-store.js';
 export { routeStore } from './with-store/route-store.js';
 export type { RouteStoreOptions, RoutedNoydbStore, BlobStoreRoute, AgeRoute, BlobLifecyclePolicy, OverrideTarget, OverrideOptions, SuspendOptions, RouteStatus, } from './with-store/route-store.js';
 export { wrapStore, withRetry, withLogging, withMetrics, withCircuitBreaker, withCache, withHealthCheck } from './with-store/store-middleware.js';
 export type { StoreMiddleware, RetryOptions, LoggingOptions, LogLevel, MetricsOptions, StoreOperation, CircuitBreakerOptions, StoreCacheOptions, HealthCheckOptions, } from './with-store/store-middleware.js';
-export { NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, PermissionDeniedError, PrivilegeEscalationError, StoreCapabilityError, UnknownStoreKindError, DuplicateStoreKindError, ConflictError, isConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, GroupCardinalityError, BackupLedgerError, BackupCorruptedError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, ElevationExpiredError, AlreadyElevatedError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, SequenceNotEnabledError, BundleIntegrityError, BundleSealMismatchError, PodVersionConflictError, BundleVersionConflictError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, ExportCapabilityError, ImportCapabilityError, KeyringExpiredError, ReadOnlyAtInstantError, ReadOnlyFrameError, RecordLockedError, FieldFrozenError, IllegalTransitionError, InvariantError, AmendmentForbiddenError, AttestationError, AttestationNotEnabledError, ClassifiedNotEnabledError, TiersNotEnabledError, PortabilityNotEnabledError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, } from './kernel/errors.js';
+export { NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, KeyringTamperedError, NoAccessError, ReadOnlyError, PermissionDeniedError, PrivilegeEscalationError, StoreCapabilityError, UnknownStoreKindError, DuplicateStoreKindError, ConflictError, isConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, GroupCardinalityError, BackupLedgerError, BackupCorruptedError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, ElevationExpiredError, AlreadyElevatedError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, SequenceNotEnabledError, PodIntegrityError, PodSealMismatchError, PodVersionConflictError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, ExportCapabilityError, ImportCapabilityError, KeyringExpiredError, ReadOnlyAtInstantError, ReadOnlyFrameError, RecordLockedError, FieldFrozenError, IllegalTransitionError, InvariantError, AmendmentForbiddenError, AttestationError, AttestationNotEnabledError, ClassifiedNotEnabledError, TiersNotEnabledError, PortabilityNotEnabledError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, } from './kernel/errors.js';
 export { SnapshotNotFoundError } from './kernel/errors.js';
 export type { SnapshotMeta, RetentionPolicy } from './with-fork/snapshots/strategy.js';
 export { withArchive } from './with-fork/archive/index.js';
@@ -130,21 +130,21 @@ export { STATE_VAULT_NAME } from './kernel/constants.js';
 export { UnknownShardError, ShardProvisioningError, VaultTemplateNotFoundError, ReservedVaultNameError, DataResidencyError } from './kernel/errors.js';
 export { ForgetStrategyNotConfiguredError } from './kernel/errors.js';
 export { SealedRecordExpiredError, SealedRecordMismatchError, RecordCekNotFoundError, SealedRecordNotEnabledError } from './kernel/errors.js';
-export { writePod, readPod, readPodHeader, writeNoydbBundle, readNoydbBundle, readNoydbBundleHeader, verifyPodHeader, } from './with-pod/bundle.js';
+export { writePod, readPod, readPodHeader, verifyPodHeader, } from './with-pod/pod.js';
 export { exportAccessibleData } from './with-audit/portability/export-accessible.js';
 export type { ExportAccessibleOptions } from './with-audit/portability/export-accessible.js';
 export { withdrawAccessibleData } from './with-audit/portability/withdraw-accessible.js';
 export type { WithdrawAccessibleOptions, WithdrawResult, FrozenSnapshotRef } from './with-audit/portability/withdraw-accessible.js';
 export { requestWithdrawal, listWithdrawalRequests, approveWithdrawal, rejectWithdrawal, WithdrawalRequestError, } from './with-audit/portability/request-withdrawal.js';
 export type { RequestWithdrawalOptions, RequestWithdrawalResult, WithdrawalRequest, WithdrawalRequestStatus, ApproveWithdrawalOptions, RejectWithdrawalOptions, } from './with-audit/portability/request-withdrawal.js';
-export type { NoydbPodHeader, NoydbBundleHeader, CompressionAlgo, UnlockMethod, } from './with-pod/format.js';
-export type { WritePodOptions, WriteNoydbBundleOptions, ReadNoydbBundleOptions, NoydbBundleReadResult, AutoCredentialKind, AutoCredential, PodVerifyResult, } from './with-pod/bundle.js';
-export { NOYDB_BUNDLE_MAGIC, NOYDB_BUNDLE_PREFIX_BYTES, NOYDB_BUNDLE_FORMAT_VERSION, hasNoydbBundleMagic, } from './with-pod/format.js';
+export type { NoydbPodHeader, CompressionAlgo, UnlockMethod, } from './with-pod/format.js';
+export type { WritePodOptions, ReadPodOptions, PodReadResult, AutoCredentialKind, AutoCredential, PodVerifyResult, } from './with-pod/pod.js';
+export { NOYDB_POD_MAGIC, NOYDB_POD_PREFIX_BYTES, NOYDB_POD_FORMAT_VERSION, hasNoydbPodMagic, } from './with-pod/format.js';
 export { generateULID, isULID } from './with-pod/ulid.js';
 export { signRecord, verifyRecord, signedBytes, POD_SIG_ALG } from './with-pod/signature.js';
 export { decryptExtractedPartition } from './with-cargo/decrypt-partition.js';
 export type { DecryptedRecord } from './with-cargo/decrypt-partition.js';
-export { readPodRedirect } from './with-pod/bundle.js';
+export { readPodRedirect } from './with-pod/pod.js';
 export { signRedirect, verifyRedirect, followRedirects } from './with-pod/redirect.js';
 export type { Redirect, RedirectHop, FollowRedirectsResult } from './with-pod/redirect.js';
 export type { DocSigner } from './with-audit/attestation/signer.js';
@@ -181,6 +181,7 @@ export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions,
 export { QuickUnlockStore } from './with-party/session/unlock-state.js';
 export type { QuickUnlockState } from './with-party/session/unlock-state.js';
 export { rotateSecret as keyringRotateSecret } from './with-party/team/rotate-recover.js';
+export { recoverSecret as keyringRecoverSecret } from './with-party/team/rotate-recover.js';
 export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './with-party/team/rotate-recover.js';
 export { buildEchoBlock, verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './with-party/team/echo-secret.js';
 export type { EchoRevealChoice } from './with-party/team/echo-secret.js';
@@ -194,7 +195,7 @@ export type { EchoRecipientSecret } from './with-party/team/keyring.js';
 export { EchoCeremonyRequiredError, WrongPromptError, WrongEchoError } from './kernel/errors.js';
 export { loadCover, saveCover, readCover, resolveSchema as resolveCoverSchema, validateCoverInput, isCover, COVER_FIELDS, DEFAULT_COVER_SCHEMA, COVER_RECORD_ID, } from './with-party/directory/cover/index.js';
 export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, SetCoverInput, } from './with-party/directory/cover/index.js';
-export { readPodCover } from './with-pod/bundle.js';
+export { readPodCover } from './with-pod/pod.js';
 export { USER_ENVELOPE_COLLECTION, USER_ENVELOPE_MAX_BYTES, } from './kernel/constants.js';
 export { UserEnvelopeOversizedError } from './kernel/errors.js';
 export { loadUserEnvelope, saveUserEnvelope, deleteUserEnvelope, listUserEnvelopeIds, } from './with-party/directory/user-envelope/index.js';
@@ -219,6 +220,7 @@ export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUse
 export { loadPaperRecoveryEntries, savePaperRecoveryEntries, burnPaperRecoveryEntry, mintPaperRecoveryEntry, unwrapDeksFromPaperEntry, } from './with-party/team/recovery.js';
 export type { PaperRecoveryEntry } from './with-party/team/recovery.js';
 export { mintWrappedDeksBlob, unwrapDeksFromBlob } from './with-party/team/wrapped-deks.js';
+export { assertRosterAuthenticated } from './with-party/team/roster-tag.js';
 export type { WrappedDeksBlob } from './with-party/team/wrapped-deks.js';
 export type { SealingKeyProvider, RecipientHint, RecipientSealer } from './with-party/team/managed-secret.js';
 export type { ShamirRecoveryProvider } from './with-party/team/shamir-recovery-provider.js';
@@ -227,7 +229,7 @@ export { recoverUser } from './with-party/team/peer-recover.js';
 export type { RecoverUserOptions } from './with-party/team/peer-recover.js';
 export { hasExportCapability, evaluateExportCapability } from './with-party/team/keyring.js';
 export { hasImportCapability, evaluateImportCapability } from './with-party/team/keyring.js';
-export type { BundleRecipient } from './with-party/team/keyring.js';
+export type { PodRecipient } from './with-party/team/keyring.js';
 export { buildRecipientKeyringFile } from './with-party/team/keyring.js';
 export { listUsers, listUsersWithEnvelopes } from './with-party/team/keyring.js';
 export type { ListUsersOptions } from './with-party/team/keyring.js';
@@ -276,8 +278,8 @@ export { dictKey, isDictKeyDescriptor, staticDict, isStaticDictDescriptor, isDic
 export type { DictKeyDescriptor, StaticDictDescriptor, DictEntry, DictionaryOptions, } from './via/i18n/dictionary.js';
 export { i18nText, isI18nTextDescriptor, validateI18nTextValue, resolveI18nText, applyI18nLocale, } from './via/i18n/core.js';
 export type { I18nTextOptions, I18nTextDescriptor, ResolveI18nOptions, I18nMap } from './via/i18n/core.js';
-export { money, isMoneyDescriptor, MoneyPrecisionError, MoneyCurrencyError, MoneyUnsupportedError, scaleForCurrency, mulRate, allocate, asMoney, isMoneyString, moneyNumber, } from './via/money/index.js';
-export type { MoneyDescriptor, MoneyOptions, MoneyOptionsFixed, MoneyOptionsMulti, RoundingMode, FxRates, MulRateOptions, AllocateOptions, MoneyString, } from './via/money/index.js';
+export { money, isMoneyDescriptor, MoneyPrecisionError, MoneyCurrencyError, MoneyUnsupportedError, scaleForCurrency, mulRate, allocate, asMoney, isMoneyString, moneyNumber, exactMath, } from './via/money/index.js';
+export type { MoneyDescriptor, MoneyOptions, MoneyOptionsFixed, MoneyOptionsMulti, RoundingMode, FxRates, MulRateOptions, AllocateOptions, MoneyString, ExactMath, ExactOperand, } from './via/money/index.js';
 export { via, isViaFieldSpec } from './kernel/via/compose.js';
 export type { ViaFieldSpec } from './kernel/via/compose.js';
 export type { ViaPosture, ViaDescriptor } from './kernel/via/index.js';
@@ -305,6 +307,22 @@ export type { SessionToken, CreateSessionResult, CreateSessionOptions, } from '.
 export { enableDevUnlock, loadDevUnlock, clearDevUnlock, isDevUnlockActive, } from './with-party/session/dev-unlock.js';
 export type { DevUnlockOptions } from './with-party/session/dev-unlock.js';
 export { isDiscriminant } from './kernel/util/discriminant.js';
+/**
+ * Record-identity AAD (#1041) — **public because a raw DEK is no longer enough
+ * to read a record.**
+ *
+ * Every record body is sealed with additional authenticated data derived from
+ * `{collection, id, _tier, _by}`, so a holder of a delegated DEK — a magic-link
+ * grantee, an `at-*` host, external tooling reading a backup — must be able to
+ * reproduce it. Without this export a delegated key opens nothing, which would
+ * silently break delegation rather than merely inconvenience it.
+ *
+ * `recordAadFor(address, envelope)` is the reader's form: it takes the address
+ * the envelope was fetched from and reads `_tier`/`_by` off the envelope
+ * itself, so callers thread two fields rather than four.
+ */
+export { recordAadFor } from './kernel/enclave/index.js';
+export type { RecordIdentity, RecordRef } from './kernel/enclave/index.js';
 export { bufferToBase64, base64ToBuffer, encryptBytes, decryptBytes } from './kernel/enclave/index.js';
 export { encryptDeterministic, decryptDeterministic } from './kernel/enclave/index.js';
 export { EnclaveNotSupportedError } from './kernel/errors.js';