@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "../chunk-WQDTCJ6W.js";
+} from "../chunk-45YHJ3GV.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -31,8 +31,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-VRA4Q7DA.js";
-import "../chunk-PJNTR2NV.js";
+} from "../chunk-NCCEDL2K.js";
+import "../chunk-3ENNPCIW.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -53,20 +53,21 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-ERB6NDDW.js";
-import "../chunk-UIBGXRDD.js";
-import "../chunk-AHLJSVRL.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-CAGI4LLJ.js";
+import "../chunk-LX46B56Q.js";
+import "../chunk-NW4TY6VC.js";
+import "../chunk-PPCOKVFA.js";
+import "../chunk-OHOKBMTM.js";
+import "../chunk-PENPHA45.js";
+import "../chunk-GQXFOAYZ.js";
+import "../chunk-KV6JM2IA.js";
+import "../chunk-TMBSPLUG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
+import "../chunk-AU3AUJIZ.js";
+import "../chunk-IGNJOJEP.js";
 import {
   TeamNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryDeviceSealProvider,

package/dist/tiers/index.js

@@ -11,19 +11,20 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-C2OOEM57.js";
-import "../chunk-AHLJSVRL.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-4YL2LMXK.js";
+import "../chunk-NW4TY6VC.js";
+import "../chunk-PPCOKVFA.js";
+import "../chunk-OHOKBMTM.js";
+import "../chunk-PENPHA45.js";
+import "../chunk-GQXFOAYZ.js";
+import "../chunk-KV6JM2IA.js";
+import "../chunk-TMBSPLUG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
+import "../chunk-AU3AUJIZ.js";
+import "../chunk-IGNJOJEP.js";
 import {
   TiersNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -1,17 +1,26 @@
 import {
-  BundleVersionConflictError,
   ConflictError,
   DuplicateStoreKindError,
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError,
   UnknownStoreKindError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/to/locator.ts
+function isPodStore(store) {
+  return store.kind === "bundle";
+}
 function createStoreLocator() {
   const factories = /* @__PURE__ */ new Map();
+  function lookup(kind) {
+    const factory = factories.get(kind);
+    if (!factory) {
+      throw new UnknownStoreKindError(kind, [...factories.keys()].sort());
+    }
+    return factory;
+  }
   return {
     register(kind, factory) {
       if (factories.has(kind)) {
@@ -20,22 +29,21 @@ function createStoreLocator() {
       factories.set(kind, factory);
     },
     resolve(descriptor, opts = {}) {
-      const factory = factories.get(descriptor.kind);
-      if (!factory) {
-        throw new UnknownStoreKindError(descriptor.kind, [...factories.keys()].sort());
-      }
-      return factory(descriptor, opts);
+      return lookup(descriptor.kind)(descriptor, opts);
+    },
+    resolveAny(descriptor, opts = {}) {
+      return lookup(descriptor.kind)(descriptor, opts);
     }
   };
 }
 export {
-  BundleVersionConflictError,
   ConflictError,
   DuplicateStoreKindError,
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError,
   UnknownStoreKindError,
-  createStoreLocator
+  createStoreLocator,
+  isPodStore
 };
 //# sourceMappingURL=index.js.map

package/dist/to/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/to/locator.ts"],"sourcesContent":["/**\n * The Locator seam (#945 Task 1): a serializable, CREDENTIALLESS store\n * descriptor plus a factory registry that reconstructs a `NoydbStore` from\n * data.\n *\n * A `StoreDescriptor` is the pod-portable \"what store and where\" — kind,\n * broad topology class, and a kind-specific serializable address/options\n * bag. It is deliberately dumb data: no field on it is ever typed as a\n * function, a `StoreCredentialSource`, or a `StoreCredentials` value, so a\n * descriptor can be written into a pod / manifest / sync payload without an\n * audit for leaked secrets. Anything that must resolve device-side or\n * user-side — a short-lived credential, a device-local directory override,\n * a mounted drive handle — travels out-of-band via `resolve()`'s `opts`,\n * never through the descriptor itself.\n *\n * This module is pure TypeScript: no imports beyond the kernel's own types\n * and errors, no Node built-ins, no crypto. It adds zero runtime\n * dependencies to `@noy-db/hub/to`.\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport { DuplicateStoreKindError, UnknownStoreKindError } from '../../kernel/errors.js'\n\n/**\n * The broad topology bucket a store descriptor's kind falls into —\n * used by callers/UI to group or filter descriptors without knowing every\n * concrete `kind` string.\n */\nexport type StoreClass = 'local' | 'browser' | 'lan' | 'cloud'\n\n/**\n * A serializable, CREDENTIALLESS description of a store instance: enough\n * data to reconstruct a `NoydbStore` via a registered `StoreFactory`, and\n * safe to persist or transmit as-is.\n *\n * CREDENTIALLESS BY CONSTRUCTION: no field here may be typed as a function,\n * a `StoreCredentialSource`, or a `StoreCredentials` value. Credentials\n * NEVER ride the descriptor — they are supplied separately (as a\n * `StoreCredentialSource`) to `StoreLocator.resolve()` at resolve time.\n */\nexport interface StoreDescriptor {\n  /** The registered factory key (e.g. `'file'`, `'aws-s3'`, `'webdav'`). */\n  readonly kind: string\n  /** The broad topology bucket this kind falls into. */\n  readonly class: StoreClass\n  /** Kind-specific serializable location (e.g. `{ dir }`, `{ bucket, region }`). */\n  readonly address: unknown\n  /** Kind-specific serializable tuning options. */\n  readonly options?: unknown\n}\n\n/**\n * A kind-specific, device-local supplement to a `StoreDescriptor` — a\n * directory override, a mount point, a drive handle — that is resolved\n * device-side and never carried inside a pod alongside the descriptor.\n */\nexport type StoreBinding = unknown\n\n/**\n * Reconstructs a live `NoydbStore` from a `StoreDescriptor`. Registered\n * against a `StoreLocator` under the descriptor's `kind`.\n */\nexport type StoreFactory = (\n  descriptor: StoreDescriptor,\n  opts: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n) => NoydbStore | Promise<NoydbStore>\n\n/** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */\nexport interface StoreLocator {\n  /** Register a factory for `kind`. Throws if `kind` is already registered. */\n  register(kind: string, factory: StoreFactory): void\n  /** Resolve `descriptor` to a live store via its kind's registered factory. */\n  resolve(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): NoydbStore | Promise<NoydbStore>\n}\n\n/**\n * Creates a fresh, empty `StoreLocator`.\n *\n * DUPLICATE REGISTRATION: `register()` throws if `kind` is already\n * registered, rather than silently overwriting it (last-wins). A\n * composition root that registers the same kind twice is almost always a\n * mistake — a copy-pasted setup block, two satellite packages fighting\n * over the same kind string — and last-wins would hide it behind whichever\n * registration happened to run last. This mirrors the\n * `DuplicateBehaviorNameError` philosophy (#947): fail loudly at the\n * mistake's source instead of silently at some unrelated `resolve()` call\n * later.\n */\nexport function createStoreLocator(): StoreLocator {\n  const factories = new Map<string, StoreFactory>()\n\n  return {\n    register(kind, factory) {\n      if (factories.has(kind)) {\n        throw new DuplicateStoreKindError(kind)\n      }\n      factories.set(kind, factory)\n    },\n    resolve(descriptor, opts = {}) {\n      const factory = factories.get(descriptor.kind)\n      if (!factory) {\n        throw new UnknownStoreKindError(descriptor.kind, [...factories.keys()].sort())\n      }\n      return factory(descriptor, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA0FO,SAAS,qBAAmC;AACjD,QAAM,YAAY,oBAAI,IAA0B;AAEhD,SAAO;AAAA,IACL,SAAS,MAAM,SAAS;AACtB,UAAI,UAAU,IAAI,IAAI,GAAG;AACvB,cAAM,IAAI,wBAAwB,IAAI;AAAA,MACxC;AACA,gBAAU,IAAI,MAAM,OAAO;AAAA,IAC7B;AAAA,IACA,QAAQ,YAAY,OAAO,CAAC,GAAG;AAC7B,YAAM,UAAU,UAAU,IAAI,WAAW,IAAI;AAC7C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,sBAAsB,WAAW,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,MAC/E;AACA,aAAO,QAAQ,YAAY,IAAI;AAAA,IACjC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/to/locator.ts"],"sourcesContent":["/**\n * The Locator seam (#945 Task 1): a serializable, CREDENTIALLESS store\n * descriptor plus a factory registry that reconstructs a `NoydbStore` from\n * data.\n *\n * A `StoreDescriptor` is the pod-portable \"what store and where\" — kind,\n * broad topology class, and a kind-specific serializable address/options\n * bag. It is deliberately dumb data: no field on it is ever typed as a\n * function, a `StoreCredentialSource`, or a `StoreCredentials` value, so a\n * descriptor can be written into a pod / manifest / sync payload without an\n * audit for leaked secrets. Anything that must resolve device-side or\n * user-side — a short-lived credential, a device-local directory override,\n * a mounted drive handle — travels out-of-band via `resolve()`'s `opts`,\n * never through the descriptor itself.\n *\n * This module is pure TypeScript: no imports beyond the kernel's own types\n * and errors, no Node built-ins, no crypto. It adds zero runtime\n * dependencies to `@noy-db/hub/to`.\n */\nimport type { NoydbStore, NoydbPodStore, StoreCredentialSource } from '../../kernel/types.js'\nimport { DuplicateStoreKindError, UnknownStoreKindError } from '../../kernel/errors.js'\n\n/**\n * The broad topology bucket a store descriptor's kind falls into —\n * used by callers/UI to group or filter descriptors without knowing every\n * concrete `kind` string.\n */\nexport type StoreClass = 'local' | 'browser' | 'lan' | 'cloud'\n\n/**\n * A serializable, CREDENTIALLESS description of a store instance: enough\n * data to reconstruct a `NoydbStore` via a registered `StoreFactory`, and\n * safe to persist or transmit as-is.\n *\n * CREDENTIALLESS BY CONSTRUCTION: no field here may be typed as a function,\n * a `StoreCredentialSource`, or a `StoreCredentials` value. Credentials\n * NEVER ride the descriptor — they are supplied separately (as a\n * `StoreCredentialSource`) to `StoreLocator.resolve()` at resolve time.\n */\nexport interface StoreDescriptor {\n  /** The registered factory key (e.g. `'file'`, `'aws-s3'`, `'webdav'`). */\n  readonly kind: string\n  /** The broad topology bucket this kind falls into. */\n  readonly class: StoreClass\n  /** Kind-specific serializable location (e.g. `{ dir }`, `{ bucket, region }`). */\n  readonly address: unknown\n  /** Kind-specific serializable tuning options. */\n  readonly options?: unknown\n}\n\n/**\n * A kind-specific, device-local supplement to a `StoreDescriptor` — a\n * directory override, a mount point, a drive handle — that is resolved\n * device-side and never carried inside a pod alongside the descriptor.\n */\nexport type StoreBinding = unknown\n\n/**\n * Either store shape a factory may produce: the 6-method KV `NoydbStore`, or\n * the whole-vault `NoydbPodStore` implemented by `to-drive` / `to-icloud`.\n *\n * The two are DISJOINT, not sub/supertypes — a pod store has none of the six\n * KV methods — which is why moving between them needs a double cast and why\n * `isPodStore()` exists to narrow instead.\n */\nexport type AnyNoydbStore = NoydbStore | NoydbPodStore\n\n/**\n * Narrow an `AnyNoydbStore` to the pod shape. Discriminates on the\n * `kind: 'bundle'` tag `NoydbPodStore` carries for exactly this purpose; a\n * `NoydbStore` has no `kind` field at all.\n *\n * Use this at a `resolve()` boundary instead of casting — a store resolved\n * from a descriptor read out of a pod is only known to be one of the two\n * shapes at runtime.\n */\nexport function isPodStore(store: AnyNoydbStore): store is NoydbPodStore {\n  return (store as NoydbPodStore).kind === 'bundle'\n}\n\n/**\n * Reconstructs a live store from a `StoreDescriptor`. Registered against a\n * `StoreLocator` under the descriptor's `kind`.\n *\n * The type parameter says WHICH shape this factory builds. It defaults to\n * `NoydbStore`, so a bare `StoreFactory` means exactly what it always has;\n * a pod-store factory declares `StoreFactory<NoydbPodStore>` and registers\n * without a cast (#988).\n */\nexport type StoreFactory<S extends AnyNoydbStore = NoydbStore> = (\n  descriptor: StoreDescriptor,\n  opts: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n) => S | Promise<S>\n\n/** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */\nexport interface StoreLocator {\n  /**\n   * Register a factory for `kind`. Throws if `kind` is already registered.\n   *\n   * Accepts a factory building EITHER store shape — `S` is inferred from the\n   * factory's own return type, so a `NoydbPodStore` factory needs no cast.\n   */\n  register<S extends AnyNoydbStore>(kind: string, factory: StoreFactory<S>): void\n  /**\n   * Resolve `descriptor` to a live store via its kind's registered factory.\n   *\n   * Returns `NoydbStore`. If the `kind` was registered with a pod-store\n   * factory, the resolved value is really a `NoydbPodStore`: this signature\n   * is the seam's remaining unsoundness, kept because widening it to\n   * `AnyNoydbStore` would break every existing caller. Where the descriptor's\n   * kind is not statically known, prefer `resolveAny()` and `isPodStore()`.\n   */\n  resolve(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): NoydbStore | Promise<NoydbStore>\n  /**\n   * As `resolve()`, but typed honestly: the registry is keyed by a runtime\n   * `kind` string, so which of the two shapes comes back is not knowable\n   * statically. Narrow the result with `isPodStore()`.\n   */\n  resolveAny(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): AnyNoydbStore | Promise<AnyNoydbStore>\n}\n\n/**\n * Creates a fresh, empty `StoreLocator`.\n *\n * DUPLICATE REGISTRATION: `register()` throws if `kind` is already\n * registered, rather than silently overwriting it (last-wins). A\n * composition root that registers the same kind twice is almost always a\n * mistake — a copy-pasted setup block, two satellite packages fighting\n * over the same kind string — and last-wins would hide it behind whichever\n * registration happened to run last. This mirrors the\n * `DuplicateBehaviorNameError` philosophy (#947): fail loudly at the\n * mistake's source instead of silently at some unrelated `resolve()` call\n * later.\n */\nexport function createStoreLocator(): StoreLocator {\n  const factories = new Map<string, StoreFactory<AnyNoydbStore>>()\n\n  function lookup(kind: string): StoreFactory<AnyNoydbStore> {\n    const factory = factories.get(kind)\n    if (!factory) {\n      throw new UnknownStoreKindError(kind, [...factories.keys()].sort())\n    }\n    return factory\n  }\n\n  return {\n    register(kind, factory) {\n      if (factories.has(kind)) {\n        throw new DuplicateStoreKindError(kind)\n      }\n      factories.set(kind, factory)\n    },\n    resolve(descriptor, opts = {}) {\n      // The one place the seam's `resolve(): NoydbStore` signature is paid\n      // for. A pod-store `kind` really returns a `NoydbPodStore`; the registry\n      // is keyed by a runtime string so nothing here can prove otherwise.\n      // Concentrated in the module that owns the invariant rather than\n      // duplicated as `as unknown as StoreFactory` in every pod-store package\n      // (#988). `resolveAny()` is the honest signature over the same call.\n      return lookup(descriptor.kind)(descriptor, opts) as NoydbStore | Promise<NoydbStore>\n    },\n    resolveAny(descriptor, opts = {}) {\n      return lookup(descriptor.kind)(descriptor, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AA4EO,SAAS,WAAW,OAA8C;AACvE,SAAQ,MAAwB,SAAS;AAC3C;AA8DO,SAAS,qBAAmC;AACjD,QAAM,YAAY,oBAAI,IAAyC;AAE/D,WAAS,OAAO,MAA2C;AACzD,UAAM,UAAU,UAAU,IAAI,IAAI;AAClC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS;AACtB,UAAI,UAAU,IAAI,IAAI,GAAG;AACvB,cAAM,IAAI,wBAAwB,IAAI;AAAA,MACxC;AACA,gBAAU,IAAI,MAAM,OAAO;AAAA,IAC7B;AAAA,IACA,QAAQ,YAAY,OAAO,CAAC,GAAG;AAO7B,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,IACA,WAAW,YAAY,OAAO,CAAC,GAAG;AAChC,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}

package/dist/transactions/index.js

@@ -3,16 +3,16 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-35EBKWQU.js";
+} from "../chunk-2LFOMUEA.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
-import "../chunk-ZJADGNYF.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-4AOERLTV.js";
+import "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-CYJQLKKI.js"));
+var loadGuardExecutor = lazy(() => import("../executor-DVJAWN3B.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/{ulid-PTAIMDG4.js → ulid-VQW6ERQN.js}

@@ -1,10 +1,10 @@
 import {
   generateULID,
   isULID
-} from "./chunk-ZJADGNYF.js";
+} from "./chunk-4AOERLTV.js";
 import "./chunk-PZ5AY32C.js";
 export {
   generateULID,
   isULID
 };
-//# sourceMappingURL=ulid-PTAIMDG4.js.map
+//# sourceMappingURL=ulid-VQW6ERQN.js.map

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-CWM4GQD2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/vault-head/index.js

@@ -0,0 +1,115 @@
+import {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION
+} from "../chunk-HK67PX4J.js";
+import {
+  buildRecordAad,
+  openEnvelopeJson
+} from "../chunk-OHOKBMTM.js";
+import {
+  buildRecordEnvelope
+} from "../chunk-PENPHA45.js";
+import "../chunk-GQXFOAYZ.js";
+import "../chunk-KV6JM2IA.js";
+import "../chunk-TMBSPLUG.js";
+import "../chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "../chunk-AU3AUJIZ.js";
+import "../chunk-IGNJOJEP.js";
+import "../chunk-CWM4GQD2.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-commit/vault-head/head.ts
+function bucketIndex(collection, id, buckets) {
+  let h = 2166136261;
+  const s = `${collection}/${id}`;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h % buckets;
+}
+function bucketId(collection, id, buckets) {
+  return `${collection}::${String(bucketIndex(collection, id, buckets))}`;
+}
+async function readBucket(store, vault, dek, bucket) {
+  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket);
+  if (!env) return { body: {}, version: 0 };
+  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek);
+  return { body: JSON.parse(json), version: env._v };
+}
+async function writeBucket(store, vault, dek, bucket, body, expectedVersion) {
+  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 };
+  const json = JSON.stringify(body);
+  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+  const env = buildRecordEnvelope(identity, { iv, data });
+  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || void 0);
+}
+
+// src/with-commit/vault-head/active.ts
+function withVaultHead(opts = {}) {
+  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS;
+  const dekFor = (getDEK) => getDEK(VAULT_HEAD_COLLECTION);
+  return {
+    enabled: true,
+    bucketFor: (collection, id) => bucketId(collection, id, buckets),
+    async note(store, vault, getDEK, entry) {
+      const dek = await dekFor(getDEK);
+      const bucket = bucketId(entry.collection, entry.id, buckets);
+      const { body, version } = await readBucket(store, vault, dek, bucket);
+      const key = `${entry.collection}/${entry.id}`;
+      if ((body[key] ?? -1) >= entry.version) return;
+      body[key] = entry.version;
+      await writeBucket(store, vault, dek, bucket, body, version);
+    },
+    async expected(store, vault, getDEK, collection, id) {
+      const dek = await dekFor(getDEK);
+      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets));
+      return body[`${collection}/${id}`] ?? null;
+    },
+    async knownIn(store, vault, getDEK, collection) {
+      const dek = await dekFor(getDEK);
+      const out = /* @__PURE__ */ new Map();
+      const prefix = `${collection}/`;
+      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {
+        if (!bucket.startsWith(`${collection}::`)) continue;
+        const { body } = await readBucket(store, vault, dek, bucket);
+        for (const [k, v] of Object.entries(body)) {
+          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v);
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/with-commit/vault-head/verify.ts
+async function verifyVaultHead(head, store, vault, getDEK, collection) {
+  const known = await head.knownIn(store, vault, getDEK, collection);
+  const discrepancies = [];
+  const because = [];
+  if (known.size === 0) because.push("no-expectations");
+  if (store.capabilities?.casAtomic !== true) because.push("store-cannot-cas");
+  for (const [id, expected] of known) {
+    const env = await store.get(vault, collection, id);
+    if (env === null) {
+      discrepancies.push({ collection, id, expected, actual: null, kind: "withheld" });
+      continue;
+    }
+    if (env._v < expected) {
+      discrepancies.push({ collection, id, expected, actual: env._v, kind: "rolled-back" });
+    }
+  }
+  const verdict = discrepancies.length > 0 ? "tampered" : because.length > 0 ? "unverifiable" : "verified";
+  return { verdict, checked: known.size, discrepancies, because };
+}
+export {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION,
+  verifyVaultHead,
+  withVaultHead
+};
+//# sourceMappingURL=index.js.map

package/dist/vault-head/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}

package/dist/{verify-RO5RTZOJ.js → verify-6J2YLKSO.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-HXGUIPQB.js";
+} from "./chunk-GQXFOAYZ.js";
 import {
   dualReadSealedSlot
-} from "./chunk-AR2JDFAE.js";
+} from "./chunk-KV6JM2IA.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-VCETL77O.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-RO5RTZOJ.js.map
+//# sourceMappingURL=verify-6J2YLKSO.js.map

package/dist/via/lookup/handle.d.ts

@@ -132,7 +132,10 @@ export declare class LookupHandle<Keys extends string = string> {
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
      * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
      */
-    buildDeleteMarker: (version: number, actor: string) => EncryptedEnvelope, 
+    buildDeleteMarker: (identity: {
+        collection: string;
+        id: string;
+    }, version: number, actor: string) => EncryptedEnvelope, 
     /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */
     onDirty?: ((collection: string, id: string, action: "put" | "delete", version: number) => Promise<void>) | undefined, 
     /** #650 Task 4 — thin `graphDispatch.collect`-equivalent; opens/collects/flushes a one-shot wave for this touch. */

package/dist/via/money/exact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Exact decimal arithmetic for post-aggregate row math (#1007).
+ *
+ * Money leaves a reducer as a `MoneyString` — a decimal string, exact by
+ * construction. Doing `Number(a) - Number(b)` on two of those re-introduces
+ * binary floating point at the one step the money type exists to protect:
+ * `10.05 - 0.10` becomes `9.950000000000001`, which `quantizeMoneyFields`
+ * then correctly REFUSES rather than silently storing drift.
+ *
+ * So `derive` is handed these instead. Everything runs in scaled BigInt at the
+ * widest scale of its inputs and formats back to a decimal string, which means
+ * no operation here can introduce a representation error. Deliberately just
+ * the additive set — `add` / `sub` / `neg` / `min` / `max` / `cmp`. Anything
+ * needing multiplication or division needs a rounding policy, and a rounding
+ * policy is a decision the caller must make explicitly, not one this module
+ * should guess.
+ *
+ * @module
+ */
+/** A value these helpers accept: a decimal string, a number, or a bigint of whole units. */
+export type ExactOperand = string | number | bigint;
+/**
+ * Exact decimal helpers handed to an MV `derive` as its second argument.
+ *
+ * Every result is a decimal string, so results compose without ever passing
+ * through a float. Declare the derived field in the MV's `moneyFields` and the
+ * final value is quantised to that descriptor's scale on the way to storage.
+ */
+export interface ExactMath {
+    /** `a + b`, exact. */
+    add(a: ExactOperand, b: ExactOperand): string;
+    /** `a - b`, exact. */
+    sub(a: ExactOperand, b: ExactOperand): string;
+    /** `-a`, exact. */
+    neg(a: ExactOperand): string;
+    /** The larger of `a` and `b`. */
+    max(a: ExactOperand, b: ExactOperand): string;
+    /** The smaller of `a` and `b`. */
+    min(a: ExactOperand, b: ExactOperand): string;
+    /** `-1` when `a < b`, `0` when equal, `1` when `a > b`. */
+    cmp(a: ExactOperand, b: ExactOperand): -1 | 0 | 1;
+}
+/** The singleton passed to `derive` — stateless, so there is nothing to construct per row. */
+export declare const exactMath: ExactMath;

package/dist/via/money/index.d.ts

@@ -13,3 +13,5 @@ export { mulRate, allocate } from './arith.js';
 export type { MulRateOptions, AllocateOptions } from './arith.js';
 export { asMoney, isMoneyString, moneyNumber } from './branded.js';
 export type { MoneyString } from './branded.js';
+export { exactMath } from './exact.js';
+export type { ExactMath, ExactOperand } from './exact.js';

package/dist/via/money/normalize.d.ts

@@ -40,6 +40,26 @@ export declare function canonicalizeStoredMoney(record: unknown, moneyFields: Re
  * `MoneyPrecisionError`/`TypeError`.
  */
 export declare function canonicalizeIncomingMoney(record: unknown, moneyFields: Record<string, MoneyDescriptor> | undefined): unknown;
+/**
+ * Canonicalize money values for a MATERIALIZED-VIEW row (#1018).
+ *
+ * A money field in an MV row is NOT in the scaled-integer storage form a
+ * collection uses — the money-aware reducers emit `formatScaledInt(...)`, an
+ * exact decimal string, and that is what lands in the output collection. So a
+ * derived money field has to be canonicalized into the same shape as the
+ * aggregated ones beside it.
+ *
+ * Quantizing it into storage form instead is what #1018 reported: `toPay` came
+ * back as `"1000000"` where `netTotal` in the SAME row read `"10000.00"` —
+ * 100× the true value, and a string that looks like a plausible amount rather
+ * than an obvious error.
+ *
+ * Precision handling is identical to {@link quantizeMoneyFields} — the same
+ * `parseToScaledInt` and the same `MoneyPrecisionError` — so a value that
+ * cannot be represented at the declared scale is still refused rather than
+ * silently rounded. Only the OUTPUT shape differs: decimal, not scaled.
+ */
+export declare function canonicalizeMoneyFieldsAsDecimal<T extends Record<string, unknown>>(record: T, moneyFields: Record<string, MoneyDescriptor>): T;
 /**
  * Convert money fields in `record` from user input to their canonical
  * stored form. Returns a shallow clone (deep along declared nested

package/dist/walk-WRA7RAPY.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-DXKLLKME.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-ONVD6GBY.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-6WO62AJW.js";
+import "./chunk-OHOKBMTM.js";
+import "./chunk-PENPHA45.js";
+import "./chunk-GQXFOAYZ.js";
+import "./chunk-KV6JM2IA.js";
+import "./chunk-TMBSPLUG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AU3AUJIZ.js";
+import "./chunk-IGNJOJEP.js";
+import "./chunk-CWM4GQD2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-WRA7RAPY.js.map

package/dist/with-audit/guards/immutable-guard.d.ts

@@ -29,6 +29,20 @@ import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
 export interface ImmutableGuardConfig<T extends Record<string, unknown>> {
     /** The collection to make WORM. */
     collection: string;
+    /**
+     * Optional stable per-vault identifier, forwarded verbatim to the
+     * underlying {@link GuardSpec.name} — `immutableGuard` is a wrapper
+     * around `withGuard` and grants the same identity affordance (#1006).
+     *
+     * Omit and `vault.listBehaviors()` falls back to a POSITIONAL
+     * `${collection}#${occurrence}` key, which renumbers when another
+     * guard on the same collection is registered ahead of this one. Pass
+     * a name whenever something joins to the behavior manifest by key —
+     * a generated rulebook, a diff between two vault versions, an audit
+     * report — so the identifier tracks the rule rather than its
+     * registration order.
+     */
+    readonly name?: string;
     /**
      * A record becomes immutable once this predicate holds. Evaluated on
      * the *existing* (already-persisted) record, so the write that first

package/dist/with-audit/periods/active.d.ts

@@ -2,10 +2,37 @@
  * Active periods strategy factory. Only reachable through the
  * `@noy-db/hub/periods` subpath.
  */
+import type { PeriodPartition } from './periods.js';
 import type { PeriodsStrategy } from './strategy.js';
+/** Options for {@link withPeriods}. */
+export interface WithPeriodsOptions {
+    /**
+     * Maps a collection to the timeline each of its records belongs to (#1005) —
+     * the answer to "which close calendar governs THIS record".
+     *
+     * ```ts
+     * withPeriods({
+     *   subjects: { receipts: (r) => [r.clientId, layerOf(r)] },
+     * })
+     * ```
+     *
+     * Same shape as `withForget({ subjects })`, which answers the same question
+     * for erasure. A collection with no entry — and every collection when
+     * `subjects` is omitted entirely — stays on the vault-wide timeline, so an
+     * existing vault behaves exactly as it did before partitions existed.
+     *
+     * Return `undefined` from a mapper to put an individual record back on the
+     * vault-wide timeline (e.g. a record that predates the field the mapping
+     * reads).
+     */
+    readonly subjects?: Readonly<Record<string, (record: Record<string, unknown>) => PeriodPartition | undefined>>;
+}
 /**
  * Build the default periods strategy. Pass into
  * `createNoydb({ periodsStrategy: withPeriods() })` to enable
  * `vault.closePeriod()` / `vault.openPeriod()` / write-guards.
+ *
+ * Pass `subjects` to run more than one close calendar in a single vault — see
+ * {@link WithPeriodsOptions.subjects}.
  */
-export declare function withPeriods(): PeriodsStrategy;
+export declare function withPeriods(options?: WithPeriodsOptions): PeriodsStrategy;

package/dist/with-audit/periods/index.d.ts

@@ -13,8 +13,10 @@
  * Vault can call them without TypeScript barrel gymnastics.
  */
 export { withPeriods } from './active.js';
+export type { WithPeriodsOptions } from './active.js';
 export type { PeriodsStrategy } from './strategy.js';
-export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, purgeMarkersOn, } from './periods.js';
-export type { PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
+export type { PeriodScope, PeriodScopeWithReason, ReopenPeriodOptions } from './vault-facade.js';
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, resolvePeriodKey, samePartition, resolveReopenState, isEffectivelyReopened, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, purgeMarkersOn, } from './periods.js';
+export type { PeriodPartition, PartitionResolver, PeriodReopenEvent, PeriodReopenRecord, PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_PERIODS } from './strategy.js';