@noy-db/hub 0.7.0-pre.8 → 0.7.0

package/dist/{fanout-sidecar-BRQHWTZQ.js → fanout-sidecar-WUFXNYP4.js}

@@ -1,20 +1,19 @@
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-BYBB4ABD.js";
+} from "./chunk-77K4PG6P.js";
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
+} from "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "./chunk-W5LHQXZU.js";
-import "./chunk-GU3LQYW2.js";
-import "./chunk-JBIV4FLR.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
 var FANOUT_DEK_COLLECTION = "_meta";
@@ -62,4 +61,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-BRQHWTZQ.js.map
+//# sourceMappingURL=fanout-sidecar-WUFXNYP4.js.map

package/dist/{fanout-sidecar-BRQHWTZQ.js.map → fanout-sidecar-WUFXNYP4.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/{fence-watcher-ZVSMLKQD.js → fence-watcher-U2PW6JU5.js}

@@ -1,5 +1,3 @@
-import "./chunk-PZ5AY32C.js";
-
 // src/with-shape/schema-update/fence-watcher.ts
 var FenceWatcher = class {
   #coordination;
@@ -66,4 +64,4 @@ var FenceWatcher = class {
 export {
   FenceWatcher
 };
-//# sourceMappingURL=fence-watcher-ZVSMLKQD.js.map
+//# sourceMappingURL=fence-watcher-U2PW6JU5.js.map

package/dist/{fence-watcher-ZVSMLKQD.js.map → fence-watcher-U2PW6JU5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/schema-update/fence-watcher.ts"],"sourcesContent":["/**\n * Per-client schema-fence watcher. Watches the fence via the injected\n * {@link NoydbMesh}; on `draining` it drains in-flight writes\n * and reports presence (its ack); emits a same-instance signal on every\n * state transition (for UI). Driven by an interval in production and by\n * explicit `check()`/`beat()` in tests.\n *\n * The transport is the coordination port: the default\n * {@link StoreMesh} maps `reportPresence` →\n * `_meta/schema-fence:client:<id>` and `readFence` → `_meta/schema-fence`,\n * so behavior is byte-for-byte the same; `by-tabs` / `by-peer` swap in\n * real-time push transports.\n */\nimport { type FenceState } from './fence.js'\nimport type { NoydbMesh } from '../../port/by/index.js'\n\nexport interface FenceWatcherEvent {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n}\n\nexport class FenceWatcher {\n  readonly #coordination: NoydbMesh\n  readonly #vault: string\n  readonly #writerId: string\n  readonly #sessionId: string\n  readonly #onFlush: () => Promise<void>\n  readonly #now: () => number\n  readonly #emit: (e: FenceWatcherEvent) => void\n  #lastState: FenceState | null = null\n  #quiescedAtVersion: number | null = null\n  #timer: ReturnType<typeof setInterval> | undefined\n\n  constructor(opts: {\n    coordination: NoydbMesh\n    vault: string\n    clientId: string\n    sessionId?: string\n    onFlush: () => Promise<void>\n    now?: () => number\n    emit?: (e: FenceWatcherEvent) => void\n  }) {\n    this.#coordination = opts.coordination\n    this.#vault = opts.vault\n    this.#writerId = opts.clientId\n    this.#sessionId = opts.sessionId ?? opts.clientId\n    this.#onFlush = opts.onFlush\n    this.#now = opts.now ?? (() => Date.now())\n    this.#emit = opts.emit ?? (() => {})\n  }\n\n  /** Publish liveness (and the current ack) without changing quiesce state. */\n  async beat(): Promise<void> {\n    await this.#coordination.reportPresence(this.#vault, {\n      writerId: this.#writerId,\n      sessionId: this.#sessionId,\n      lastSeen: this.#now(),\n      quiescedAtVersion: this.#quiescedAtVersion,\n    })\n  }\n\n  /** Poll the fence; quiesce on draining; emit on transitions. */\n  async check(): Promise<void> {\n    const fence = await this.#coordination.readFence(this.#vault)\n    if (fence.fenceState !== this.#lastState) {\n      this.#lastState = fence.fenceState\n      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState })\n    }\n    if (fence.fenceState === 'draining' && this.#quiescedAtVersion !== fence.currentSchemaVersion) {\n      await this.#onFlush()\n      this.#quiescedAtVersion = fence.currentSchemaVersion\n      await this.beat()\n    }\n    if (fence.fenceState === 'normal') {\n      this.#quiescedAtVersion = null\n    }\n  }\n\n  start(intervalMs: number): void {\n    if (this.#timer) return\n    this.#timer = setInterval(() => { void this.beat(); void this.check() }, intervalMs)\n    const timer = this.#timer as unknown as { unref?: () => void }\n    if (typeof timer.unref === 'function') timer.unref() // don't keep the process alive\n  }\n\n  stop(): void {\n    if (this.#timer) { clearInterval(this.#timer); this.#timer = undefined }\n  }\n}\n"],"mappings":";;;AAqBO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,aAAgC;AAAA,EAChC,qBAAoC;AAAA,EACpC;AAAA,EAEA,YAAY,MAQT;AACD,SAAK,gBAAgB,KAAK;AAC1B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,WAAW,KAAK;AACrB,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,SAAK,QAAQ,KAAK,SAAS,MAAM;AAAA,IAAC;AAAA,EACpC;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,UAAM,KAAK,cAAc,eAAe,KAAK,QAAQ;AAAA,MACnD,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK,KAAK;AAAA,MACpB,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,KAAK,MAAM;AAC5D,QAAI,MAAM,eAAe,KAAK,YAAY;AACxC,WAAK,aAAa,MAAM;AACxB,WAAK,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,YAAY,MAAM,WAAW,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,eAAe,cAAc,KAAK,uBAAuB,MAAM,sBAAsB;AAC7F,YAAM,KAAK,SAAS;AACpB,WAAK,qBAAqB,MAAM;AAChC,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,QAAI,MAAM,eAAe,UAAU;AACjC,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,YAA0B;AAC9B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS,YAAY,MAAM;AAAE,WAAK,KAAK,KAAK;AAAG,WAAK,KAAK,MAAM;AAAA,IAAE,GAAG,UAAU;AACnF,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EACrD;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,QAAQ;AAAE,oBAAc,KAAK,MAAM;AAAG,WAAK,SAAS;AAAA,IAAU;AAAA,EACzE;AACF;","names":[]}
+{"version":3,"sources":["../src/with-shape/schema-update/fence-watcher.ts"],"sourcesContent":["/**\n * Per-client schema-fence watcher. Watches the fence via the injected\n * {@link NoydbMesh}; on `draining` it drains in-flight writes\n * and reports presence (its ack); emits a same-instance signal on every\n * state transition (for UI). Driven by an interval in production and by\n * explicit `check()`/`beat()` in tests.\n *\n * The transport is the coordination port: the default\n * {@link StoreMesh} maps `reportPresence` →\n * `_meta/schema-fence:client:<id>` and `readFence` → `_meta/schema-fence`,\n * so behavior is byte-for-byte the same; `by-tabs` / `by-peer` swap in\n * real-time push transports.\n */\nimport { type FenceState } from './fence.js'\nimport type { NoydbMesh } from '../../port/by/index.js'\n\nexport interface FenceWatcherEvent {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n}\n\nexport class FenceWatcher {\n  readonly #coordination: NoydbMesh\n  readonly #vault: string\n  readonly #writerId: string\n  readonly #sessionId: string\n  readonly #onFlush: () => Promise<void>\n  readonly #now: () => number\n  readonly #emit: (e: FenceWatcherEvent) => void\n  #lastState: FenceState | null = null\n  #quiescedAtVersion: number | null = null\n  #timer: ReturnType<typeof setInterval> | undefined\n\n  constructor(opts: {\n    coordination: NoydbMesh\n    vault: string\n    clientId: string\n    sessionId?: string\n    onFlush: () => Promise<void>\n    now?: () => number\n    emit?: (e: FenceWatcherEvent) => void\n  }) {\n    this.#coordination = opts.coordination\n    this.#vault = opts.vault\n    this.#writerId = opts.clientId\n    this.#sessionId = opts.sessionId ?? opts.clientId\n    this.#onFlush = opts.onFlush\n    this.#now = opts.now ?? (() => Date.now())\n    this.#emit = opts.emit ?? (() => {})\n  }\n\n  /** Publish liveness (and the current ack) without changing quiesce state. */\n  async beat(): Promise<void> {\n    await this.#coordination.reportPresence(this.#vault, {\n      writerId: this.#writerId,\n      sessionId: this.#sessionId,\n      lastSeen: this.#now(),\n      quiescedAtVersion: this.#quiescedAtVersion,\n    })\n  }\n\n  /** Poll the fence; quiesce on draining; emit on transitions. */\n  async check(): Promise<void> {\n    const fence = await this.#coordination.readFence(this.#vault)\n    if (fence.fenceState !== this.#lastState) {\n      this.#lastState = fence.fenceState\n      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState })\n    }\n    if (fence.fenceState === 'draining' && this.#quiescedAtVersion !== fence.currentSchemaVersion) {\n      await this.#onFlush()\n      this.#quiescedAtVersion = fence.currentSchemaVersion\n      await this.beat()\n    }\n    if (fence.fenceState === 'normal') {\n      this.#quiescedAtVersion = null\n    }\n  }\n\n  start(intervalMs: number): void {\n    if (this.#timer) return\n    this.#timer = setInterval(() => { void this.beat(); void this.check() }, intervalMs)\n    const timer = this.#timer as unknown as { unref?: () => void }\n    if (typeof timer.unref === 'function') timer.unref() // don't keep the process alive\n  }\n\n  stop(): void {\n    if (this.#timer) { clearInterval(this.#timer); this.#timer = undefined }\n  }\n}\n"],"mappings":";AAqBO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,aAAgC;AAAA,EAChC,qBAAoC;AAAA,EACpC;AAAA,EAEA,YAAY,MAQT;AACD,SAAK,gBAAgB,KAAK;AAC1B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,WAAW,KAAK;AACrB,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,SAAK,QAAQ,KAAK,SAAS,MAAM;AAAA,IAAC;AAAA,EACpC;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,UAAM,KAAK,cAAc,eAAe,KAAK,QAAQ;AAAA,MACnD,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK,KAAK;AAAA,MACpB,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,KAAK,MAAM;AAC5D,QAAI,MAAM,eAAe,KAAK,YAAY;AACxC,WAAK,aAAa,MAAM;AACxB,WAAK,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,YAAY,MAAM,WAAW,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,eAAe,cAAc,KAAK,uBAAuB,MAAM,sBAAsB;AAC7F,YAAM,KAAK,SAAS;AACpB,WAAK,qBAAqB,MAAM;AAChC,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,QAAI,MAAM,eAAe,UAAU;AACjC,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,YAA0B;AAC9B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS,YAAY,MAAM;AAAE,WAAK,KAAK,KAAK;AAAG,WAAK,KAAK,MAAM;AAAA,IAAE,GAAG,UAAU;AACnF,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EACrD;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,QAAQ;AAAE,oBAAc,KAAK,MAAM;AAAG,WAAK,SAAS;AAAA,IAAU;AAAA,EACzE;AACF;","names":[]}

package/dist/find-2ABFCZX4.js

@@ -0,0 +1,10 @@
+import {
+  computeBidxTarget
+} from "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-2ABFCZX4.js.map

package/dist/forget/index.js

@@ -1,17 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-EO2KGKEJ.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-7V4TP3AF.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
-import "../chunk-JBIV4FLR.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
+import "../chunk-7O3Y4PPD.js";
 
 // src/with-audit/forget/active.ts
 function withForget(opts) {

package/dist/forget/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForget` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForget(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects }, ...(opts.scopedPurge !== undefined ? { scopedPurge: opts.scopedPurge } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BO,SAAS,WAAW,MAA0C;AACnE,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,GAAG,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC,EAAG;AACxH;","names":[]}
+{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForget` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForget(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects }, ...(opts.scopedPurge !== undefined ? { scopedPurge: opts.scopedPurge } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA+BO,SAAS,WAAW,MAA0C;AACnE,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,GAAG,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC,EAAG;AACxH;","names":[]}

package/dist/guards/index.js

@@ -2,13 +2,13 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-NLKLXXTO.js";
+} from "../chunk-YYP7WSEB.js";
 import {
   GuardExecutor
-} from "../chunk-AB5P32RE.js";
+} from "../chunk-4OZNXTO4.js";
 import {
   GuardRegistry
-} from "../chunk-SHILAQH5.js";
+} from "../chunk-DGOZ4UZD.js";
 import {
   ReadOnlyVaultFacade
 } from "../chunk-JK733I5V.js";
@@ -18,8 +18,7 @@ import {
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-JBIV4FLR.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   AmendmentForbiddenError,
   FieldFrozenError,

package/dist/history/index.js

@@ -1,7 +1,7 @@
 import {
   CollectionInstant,
   VaultInstant
-} from "../chunk-HSGEIMJS.js";
+} from "../chunk-KUJDV5QH.js";
 import {
   diff,
   formatDiff
@@ -16,12 +16,12 @@ import {
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-U6GCYG2T.js";
+} from "../chunk-X2DLENDQ.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-UPJMBMCR.js";
+} from "../chunk-L742JPKZ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -33,18 +33,17 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-WLFABTZ6.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-BOET4NA4.js";
+import "../chunk-JMGDHKQF.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
-import "../chunk-JBIV4FLR.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
+import "../chunk-7O3Y4PPD.js";
 
 // src/with-commit/history/active.ts
 function withHistory() {

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-4JDIRUTT.js";
+} from "../chunk-K7NTTA6P.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-2GXEQUEX.js";
+} from "../chunk-MVMXZYXT.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-XBFEKTIY.js";
+} from "../chunk-6I2RQCET.js";
 import {
   NO_I18N,
   applyI18nLocale,
@@ -26,17 +26,17 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-X67FCULK.js";
-import "../chunk-XDVVBETV.js";
-import "../chunk-WLFABTZ6.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-BOET4NA4.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -47,8 +47,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-JBIV4FLR.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 
 // src/via/i18n/densify.ts
 var MARKER = "_i18nFilled";

package/dist/i18n/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/i18n/densify.ts","../../src/via/i18n/active.ts"],"sourcesContent":["/**\n * `densifyOnWrite` — eager-fill empty i18n slots from each field's\n * substitute chain at write time, recording provenance in the internal\n * `_i18nFilled` marker (decision A: dense map + prior-read).\n *\n * Pure functions over plain records; all DB wiring lives in collection.ts.\n * Only single-leaf i18n fields are supported (array-wildcard paths are\n * skipped, mirroring auto-translate).\n */\nimport { getAtPath, resolveI18nText } from './core.js'\nimport type { I18nTextDescriptor } from './core.js'\n\nconst MARKER = '_i18nFilled'\n\ntype Leaf = Record<string, string>\n\n/** Locales recorded as densify-filled on the prior record for `field`. */\nfunction priorFilled(prior: Record<string, unknown> | undefined, field: string): Set<string> {\n  if (!prior) return new Set()\n  const marker = prior[MARKER] as Record<string, string[]> | undefined\n  return new Set(marker?.[field] ?? [])\n}\n\n/** The single leaf map for `field`, or undefined for absent / array-wildcard / non-object. */\nfunction singleLeaf(record: Record<string, unknown>, field: string): Leaf | undefined {\n  const leaves = getAtPath(record, field)\n  if (leaves.length !== 1) return undefined\n  const leaf = leaves[0]\n  if (!leaf || typeof leaf !== 'object' || Array.isArray(leaf)) return undefined\n  return leaf as Leaf\n}\n\n/**\n * Per field, the locales that are UNCHANGED round-tripped densify fills — i.e.\n * marked filled on the prior record AND identical in the incoming record.\n * These are exempt from write-time script enforcement (they are derived copies,\n * not authored text). Slots the user changed are NOT exempt (validated as authored).\n */\nexport function computeExemptFills(\n  prior: Record<string, unknown> | undefined,\n  incoming: Record<string, unknown>,\n  fields: Record<string, I18nTextDescriptor>,\n): Map<string, Set<string>> {\n  const out = new Map<string, Set<string>>()\n  if (!prior) return out\n  for (const field of Object.keys(fields)) {\n    const filled = priorFilled(prior, field)\n    if (filled.size === 0) continue\n    const priorLeaf = singleLeaf(prior, field)\n    const incLeaf = singleLeaf(incoming, field)\n    if (!priorLeaf || !incLeaf) continue\n    const exempt = new Set<string>()\n    for (const loc of filled) {\n      if (incLeaf[loc] !== undefined && incLeaf[loc] !== '' && incLeaf[loc] === priorLeaf[loc]) {\n        exempt.add(loc)\n      }\n    }\n    if (exempt.size > 0) out.set(field, exempt)\n  }\n  return out\n}\n\n/**\n * Mutate `record` in place: fill empty declared-language slots for each\n * densify-enabled field from the field's substitute chain, recompute unchanged\n * prior fills, clear marks for slots that became authored, and write the\n * resulting `_i18nFilled` marker (removed when empty).\n *\n * `prior` is read-only — it is never mutated.\n *\n * Provenance uses value-equality (decision A): a slot counts as an unchanged\n * fill when it was prior-marked AND its value still equals the prior value. A\n * consequence is that re-authoring a value byte-identical to the existing fill\n * keeps it classified as a fill (the visible value is unchanged either way; the\n * slot stays script-exempt and will auto-refresh if its source later changes).\n * This is inherent to value-equality provenance, not a bug.\n */\nexport function densify(\n  record: Record<string, unknown>,\n  prior: Record<string, unknown> | undefined,\n  fields: Record<string, I18nTextDescriptor>,\n): void {\n  let marker = record[MARKER] as Record<string, string[]> | undefined\n\n  for (const [field, descriptor] of Object.entries(fields)) {\n    const leaf = singleLeaf(record, field)\n    if (!leaf) continue\n    const { languages, substitute, smartSubstitute } = descriptor.options\n    const filledSet = priorFilled(prior, field)\n    const priorLeaf = singleLeaf(prior ?? {}, field)\n    const isUnchangedFill = (loc: string): boolean =>\n      filledSet.has(loc) && priorLeaf?.[loc] !== undefined && leaf[loc] === priorLeaf[loc]\n\n    // Authored source = present, non-empty, NOT an unchanged prior fill.\n    const authored: Leaf = {}\n    for (const [loc, val] of Object.entries(leaf)) {\n      if (typeof val === 'string' && val !== '' && !isUnchangedFill(loc)) authored[loc] = val\n    }\n\n    const filled: string[] = []\n    for (const loc of languages) {\n      if (authored[loc] !== undefined) continue // real value present → not a fill\n      const sub = resolveI18nText(authored, loc, undefined, field, {\n        policy: 'substitute',\n        substitute: substitute ?? ['any'],\n        ...(smartSubstitute ? { smartSubstitute } : {}),\n      })\n      if (typeof sub === 'string' && sub !== '') {\n        leaf[loc] = sub\n        filled.push(loc)\n      } else if (isUnchangedFill(loc)) {\n        delete leaf[loc] // stale fill with no source left → drop it\n      }\n    }\n\n    if (filled.length > 0) {\n      marker ??= {}\n      marker[field] = filled\n    } else if (marker) {\n      delete marker[field]\n    }\n  }\n\n  if (marker && Object.keys(marker).length > 0) {\n    record[MARKER] = marker\n  } else {\n    delete record[MARKER]\n  }\n}\n","/**\n * Active i18n strategy — `withI18n()` returns the real implementation\n * that wires multi-locale resolution, i18nText validation, and the\n * `DictionaryHandle` for `dictKey` fields into the core read/write\n * paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withI18n } from '@noy-db/hub/i18n'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   i18nStrategy: withI18n(),\n * })\n * ```\n *\n * The factory delegates to the existing `core.ts` and `dictionary.ts`\n * modules. Splitting the import chain through this file is what lets\n * tsup tree-shake the `~854 LOC` of dictionary + locale resolution\n * out of the default bundle when no `withI18n()` import is present.\n *\n * @public\n */\n\nimport type { I18nStrategy, BuildDictionaryHandleOptions } from './strategy.js'\nimport { applyI18nLocale, validateI18nTextValue } from './core.js'\nimport { enforceScript } from './script.js'\nimport { computeExemptFills, densify } from './densify.js'\nimport type { DictionaryHandle } from './dictionary.js'\nimport { withLookup } from '../lookup/active.js'\n\nexport function withI18n(): I18nStrategy {\n  // #650 Task 1: the handle-construction logic moved to\n  // via/lookup/active.ts (LookupHandle, renamed from\n  // DictionaryHandle, new home). buildDictionaryHandle below is now a\n  // thin field-name translator over buildLookupHandle — same handle.\n  const lookup = withLookup()\n  return {\n    applyI18nLocale,\n    validateI18nTextValue,\n    enforceScript,\n    computeExemptFills,\n    densify,\n    buildDictionaryHandle<Keys extends string = string>(\n      opts: BuildDictionaryHandleOptions<Keys>,\n    ): DictionaryHandle<Keys> {\n      return lookup.buildLookupHandle<Keys>({\n        adapter: opts.adapter,\n        compartmentName: opts.compartmentName,\n        dimensionName: opts.dictionaryName,\n        keyring: opts.keyring,\n        reservedEnvelopes: opts.reservedEnvelopes,\n        encrypted: opts.encrypted,\n        ledger: opts.ledger,\n        options: opts.options,\n        findAndUpdateReferences: opts.findAndUpdateReferences,\n        emitter: opts.emitter,\n        buildDeleteMarker: opts.buildDeleteMarker, // #647 fix wave 1\n        onDirty: opts.onDirty, // #650 Task 4\n        onRecordMutated: opts.onRecordMutated, // #650 Task 4\n        checkReferencesOnDelete: opts.checkReferencesOnDelete, // #650 Task 5\n      })\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAM,SAAS;AAKf,SAAS,YAAY,OAA4C,OAA4B;AAC3F,MAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,QAAM,SAAS,MAAM,MAAM;AAC3B,SAAO,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC;AACtC;AAGA,SAAS,WAAW,QAAiC,OAAiC;AACpF,QAAM,SAAS,UAAU,QAAQ,KAAK;AACtC,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,OAAO,OAAO,CAAC;AACrB,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,SAAO;AACT;AAQO,SAAS,mBACd,OACA,UACA,QAC0B;AAC1B,QAAM,MAAM,oBAAI,IAAyB;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AACvC,UAAM,SAAS,YAAY,OAAO,KAAK;AACvC,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,YAAY,WAAW,OAAO,KAAK;AACzC,UAAM,UAAU,WAAW,UAAU,KAAK;AAC1C,QAAI,CAAC,aAAa,CAAC,QAAS;AAC5B,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,QAAQ;AACxB,UAAI,QAAQ,GAAG,MAAM,UAAa,QAAQ,GAAG,MAAM,MAAM,QAAQ,GAAG,MAAM,UAAU,GAAG,GAAG;AACxF,eAAO,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,OAAO,OAAO,EAAG,KAAI,IAAI,OAAO,MAAM;AAAA,EAC5C;AACA,SAAO;AACT;AAiBO,SAAS,QACd,QACA,OACA,QACM;AACN,MAAI,SAAS,OAAO,MAAM;AAE1B,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxD,UAAM,OAAO,WAAW,QAAQ,KAAK;AACrC,QAAI,CAAC,KAAM;AACX,UAAM,EAAE,WAAW,YAAY,gBAAgB,IAAI,WAAW;AAC9D,UAAM,YAAY,YAAY,OAAO,KAAK;AAC1C,UAAM,YAAY,WAAW,SAAS,CAAC,GAAG,KAAK;AAC/C,UAAM,kBAAkB,CAAC,QACvB,UAAU,IAAI,GAAG,KAAK,YAAY,GAAG,MAAM,UAAa,KAAK,GAAG,MAAM,UAAU,GAAG;AAGrF,UAAM,WAAiB,CAAC;AACxB,eAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC7C,UAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,CAAC,gBAAgB,GAAG,EAAG,UAAS,GAAG,IAAI;AAAA,IACtF;AAEA,UAAM,SAAmB,CAAC;AAC1B,eAAW,OAAO,WAAW;AAC3B,UAAI,SAAS,GAAG,MAAM,OAAW;AACjC,YAAM,MAAM,gBAAgB,UAAU,KAAK,QAAW,OAAO;AAAA,QAC3D,QAAQ;AAAA,QACR,YAAY,cAAc,CAAC,KAAK;AAAA,QAChC,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAC/C,CAAC;AACD,UAAI,OAAO,QAAQ,YAAY,QAAQ,IAAI;AACzC,aAAK,GAAG,IAAI;AACZ,eAAO,KAAK,GAAG;AAAA,MACjB,WAAW,gBAAgB,GAAG,GAAG;AAC/B,eAAO,KAAK,GAAG;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,iBAAW,CAAC;AACZ,aAAO,KAAK,IAAI;AAAA,IAClB,WAAW,QAAQ;AACjB,aAAO,OAAO,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAC5C,WAAO,MAAM,IAAI;AAAA,EACnB,OAAO;AACL,WAAO,OAAO,MAAM;AAAA,EACtB;AACF;;;AC9FO,SAAS,WAAyB;AAKvC,QAAM,SAAS,WAAW;AAC1B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBACE,MACwB;AACxB,aAAO,OAAO,kBAAwB;AAAA,QACpC,SAAS,KAAK;AAAA,QACd,iBAAiB,KAAK;AAAA,QACtB,eAAe,KAAK;AAAA,QACpB,SAAS,KAAK;AAAA,QACd,mBAAmB,KAAK;AAAA,QACxB,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,SAAS,KAAK;AAAA,QACd,yBAAyB,KAAK;AAAA,QAC9B,SAAS,KAAK;AAAA,QACd,mBAAmB,KAAK;AAAA;AAAA,QACxB,SAAS,KAAK;AAAA;AAAA,QACd,iBAAiB,KAAK;AAAA;AAAA,QACtB,yBAAyB,KAAK;AAAA;AAAA,MAChC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/i18n/densify.ts","../../src/via/i18n/active.ts"],"sourcesContent":["/**\n * `densifyOnWrite` — eager-fill empty i18n slots from each field's\n * substitute chain at write time, recording provenance in the internal\n * `_i18nFilled` marker (decision A: dense map + prior-read).\n *\n * Pure functions over plain records; all DB wiring lives in collection.ts.\n * Only single-leaf i18n fields are supported (array-wildcard paths are\n * skipped, mirroring auto-translate).\n */\nimport { getAtPath, resolveI18nText } from './core.js'\nimport type { I18nTextDescriptor } from './core.js'\n\nconst MARKER = '_i18nFilled'\n\ntype Leaf = Record<string, string>\n\n/** Locales recorded as densify-filled on the prior record for `field`. */\nfunction priorFilled(prior: Record<string, unknown> | undefined, field: string): Set<string> {\n  if (!prior) return new Set()\n  const marker = prior[MARKER] as Record<string, string[]> | undefined\n  return new Set(marker?.[field] ?? [])\n}\n\n/** The single leaf map for `field`, or undefined for absent / array-wildcard / non-object. */\nfunction singleLeaf(record: Record<string, unknown>, field: string): Leaf | undefined {\n  const leaves = getAtPath(record, field)\n  if (leaves.length !== 1) return undefined\n  const leaf = leaves[0]\n  if (!leaf || typeof leaf !== 'object' || Array.isArray(leaf)) return undefined\n  return leaf as Leaf\n}\n\n/**\n * Per field, the locales that are UNCHANGED round-tripped densify fills — i.e.\n * marked filled on the prior record AND identical in the incoming record.\n * These are exempt from write-time script enforcement (they are derived copies,\n * not authored text). Slots the user changed are NOT exempt (validated as authored).\n */\nexport function computeExemptFills(\n  prior: Record<string, unknown> | undefined,\n  incoming: Record<string, unknown>,\n  fields: Record<string, I18nTextDescriptor>,\n): Map<string, Set<string>> {\n  const out = new Map<string, Set<string>>()\n  if (!prior) return out\n  for (const field of Object.keys(fields)) {\n    const filled = priorFilled(prior, field)\n    if (filled.size === 0) continue\n    const priorLeaf = singleLeaf(prior, field)\n    const incLeaf = singleLeaf(incoming, field)\n    if (!priorLeaf || !incLeaf) continue\n    const exempt = new Set<string>()\n    for (const loc of filled) {\n      if (incLeaf[loc] !== undefined && incLeaf[loc] !== '' && incLeaf[loc] === priorLeaf[loc]) {\n        exempt.add(loc)\n      }\n    }\n    if (exempt.size > 0) out.set(field, exempt)\n  }\n  return out\n}\n\n/**\n * Mutate `record` in place: fill empty declared-language slots for each\n * densify-enabled field from the field's substitute chain, recompute unchanged\n * prior fills, clear marks for slots that became authored, and write the\n * resulting `_i18nFilled` marker (removed when empty).\n *\n * `prior` is read-only — it is never mutated.\n *\n * Provenance uses value-equality (decision A): a slot counts as an unchanged\n * fill when it was prior-marked AND its value still equals the prior value. A\n * consequence is that re-authoring a value byte-identical to the existing fill\n * keeps it classified as a fill (the visible value is unchanged either way; the\n * slot stays script-exempt and will auto-refresh if its source later changes).\n * This is inherent to value-equality provenance, not a bug.\n */\nexport function densify(\n  record: Record<string, unknown>,\n  prior: Record<string, unknown> | undefined,\n  fields: Record<string, I18nTextDescriptor>,\n): void {\n  let marker = record[MARKER] as Record<string, string[]> | undefined\n\n  for (const [field, descriptor] of Object.entries(fields)) {\n    const leaf = singleLeaf(record, field)\n    if (!leaf) continue\n    const { languages, substitute, smartSubstitute } = descriptor.options\n    const filledSet = priorFilled(prior, field)\n    const priorLeaf = singleLeaf(prior ?? {}, field)\n    const isUnchangedFill = (loc: string): boolean =>\n      filledSet.has(loc) && priorLeaf?.[loc] !== undefined && leaf[loc] === priorLeaf[loc]\n\n    // Authored source = present, non-empty, NOT an unchanged prior fill.\n    const authored: Leaf = {}\n    for (const [loc, val] of Object.entries(leaf)) {\n      if (typeof val === 'string' && val !== '' && !isUnchangedFill(loc)) authored[loc] = val\n    }\n\n    const filled: string[] = []\n    for (const loc of languages) {\n      if (authored[loc] !== undefined) continue // real value present → not a fill\n      const sub = resolveI18nText(authored, loc, undefined, field, {\n        policy: 'substitute',\n        substitute: substitute ?? ['any'],\n        ...(smartSubstitute ? { smartSubstitute } : {}),\n      })\n      if (typeof sub === 'string' && sub !== '') {\n        leaf[loc] = sub\n        filled.push(loc)\n      } else if (isUnchangedFill(loc)) {\n        delete leaf[loc] // stale fill with no source left → drop it\n      }\n    }\n\n    if (filled.length > 0) {\n      marker ??= {}\n      marker[field] = filled\n    } else if (marker) {\n      delete marker[field]\n    }\n  }\n\n  if (marker && Object.keys(marker).length > 0) {\n    record[MARKER] = marker\n  } else {\n    delete record[MARKER]\n  }\n}\n","/**\n * Active i18n strategy — `withI18n()` returns the real implementation\n * that wires multi-locale resolution, i18nText validation, and the\n * `DictionaryHandle` for `dictKey` fields into the core read/write\n * paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withI18n } from '@noy-db/hub/i18n'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   i18nStrategy: withI18n(),\n * })\n * ```\n *\n * The factory delegates to the existing `core.ts` and `dictionary.ts`\n * modules. Splitting the import chain through this file is what lets\n * tsup tree-shake the `~854 LOC` of dictionary + locale resolution\n * out of the default bundle when no `withI18n()` import is present.\n *\n * @public\n */\n\nimport type { I18nStrategy, BuildDictionaryHandleOptions } from './strategy.js'\nimport { applyI18nLocale, validateI18nTextValue } from './core.js'\nimport { enforceScript } from './script.js'\nimport { computeExemptFills, densify } from './densify.js'\nimport type { DictionaryHandle } from './dictionary.js'\nimport { withLookup } from '../lookup/active.js'\n\nexport function withI18n(): I18nStrategy {\n  // #650 Task 1: the handle-construction logic moved to\n  // via/lookup/active.ts (LookupHandle, renamed from\n  // DictionaryHandle, new home). buildDictionaryHandle below is now a\n  // thin field-name translator over buildLookupHandle — same handle.\n  const lookup = withLookup()\n  return {\n    applyI18nLocale,\n    validateI18nTextValue,\n    enforceScript,\n    computeExemptFills,\n    densify,\n    buildDictionaryHandle<Keys extends string = string>(\n      opts: BuildDictionaryHandleOptions<Keys>,\n    ): DictionaryHandle<Keys> {\n      return lookup.buildLookupHandle<Keys>({\n        adapter: opts.adapter,\n        compartmentName: opts.compartmentName,\n        dimensionName: opts.dictionaryName,\n        keyring: opts.keyring,\n        reservedEnvelopes: opts.reservedEnvelopes,\n        encrypted: opts.encrypted,\n        ledger: opts.ledger,\n        options: opts.options,\n        findAndUpdateReferences: opts.findAndUpdateReferences,\n        emitter: opts.emitter,\n        buildDeleteMarker: opts.buildDeleteMarker, // #647 fix wave 1\n        onDirty: opts.onDirty, // #650 Task 4\n        onRecordMutated: opts.onRecordMutated, // #650 Task 4\n        checkReferencesOnDelete: opts.checkReferencesOnDelete, // #650 Task 5\n      })\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAM,SAAS;AAKf,SAAS,YAAY,OAA4C,OAA4B;AAC3F,MAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,QAAM,SAAS,MAAM,MAAM;AAC3B,SAAO,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC;AACtC;AAGA,SAAS,WAAW,QAAiC,OAAiC;AACpF,QAAM,SAAS,UAAU,QAAQ,KAAK;AACtC,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,OAAO,OAAO,CAAC;AACrB,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,SAAO;AACT;AAQO,SAAS,mBACd,OACA,UACA,QAC0B;AAC1B,QAAM,MAAM,oBAAI,IAAyB;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AACvC,UAAM,SAAS,YAAY,OAAO,KAAK;AACvC,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,YAAY,WAAW,OAAO,KAAK;AACzC,UAAM,UAAU,WAAW,UAAU,KAAK;AAC1C,QAAI,CAAC,aAAa,CAAC,QAAS;AAC5B,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,QAAQ;AACxB,UAAI,QAAQ,GAAG,MAAM,UAAa,QAAQ,GAAG,MAAM,MAAM,QAAQ,GAAG,MAAM,UAAU,GAAG,GAAG;AACxF,eAAO,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,OAAO,OAAO,EAAG,KAAI,IAAI,OAAO,MAAM;AAAA,EAC5C;AACA,SAAO;AACT;AAiBO,SAAS,QACd,QACA,OACA,QACM;AACN,MAAI,SAAS,OAAO,MAAM;AAE1B,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxD,UAAM,OAAO,WAAW,QAAQ,KAAK;AACrC,QAAI,CAAC,KAAM;AACX,UAAM,EAAE,WAAW,YAAY,gBAAgB,IAAI,WAAW;AAC9D,UAAM,YAAY,YAAY,OAAO,KAAK;AAC1C,UAAM,YAAY,WAAW,SAAS,CAAC,GAAG,KAAK;AAC/C,UAAM,kBAAkB,CAAC,QACvB,UAAU,IAAI,GAAG,KAAK,YAAY,GAAG,MAAM,UAAa,KAAK,GAAG,MAAM,UAAU,GAAG;AAGrF,UAAM,WAAiB,CAAC;AACxB,eAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC7C,UAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,CAAC,gBAAgB,GAAG,EAAG,UAAS,GAAG,IAAI;AAAA,IACtF;AAEA,UAAM,SAAmB,CAAC;AAC1B,eAAW,OAAO,WAAW;AAC3B,UAAI,SAAS,GAAG,MAAM,OAAW;AACjC,YAAM,MAAM,gBAAgB,UAAU,KAAK,QAAW,OAAO;AAAA,QAC3D,QAAQ;AAAA,QACR,YAAY,cAAc,CAAC,KAAK;AAAA,QAChC,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAC/C,CAAC;AACD,UAAI,OAAO,QAAQ,YAAY,QAAQ,IAAI;AACzC,aAAK,GAAG,IAAI;AACZ,eAAO,KAAK,GAAG;AAAA,MACjB,WAAW,gBAAgB,GAAG,GAAG;AAC/B,eAAO,KAAK,GAAG;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,iBAAW,CAAC;AACZ,aAAO,KAAK,IAAI;AAAA,IAClB,WAAW,QAAQ;AACjB,aAAO,OAAO,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAC5C,WAAO,MAAM,IAAI;AAAA,EACnB,OAAO;AACL,WAAO,OAAO,MAAM;AAAA,EACtB;AACF;;;AC9FO,SAAS,WAAyB;AAKvC,QAAM,SAAS,WAAW;AAC1B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBACE,MACwB;AACxB,aAAO,OAAO,kBAAwB;AAAA,QACpC,SAAS,KAAK;AAAA,QACd,iBAAiB,KAAK;AAAA,QACtB,eAAe,KAAK;AAAA,QACpB,SAAS,KAAK;AAAA,QACd,mBAAmB,KAAK;AAAA,QACxB,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,SAAS,KAAK;AAAA,QACd,yBAAyB,KAAK;AAAA,QAC9B,SAAS,KAAK;AAAA,QACd,mBAAmB,KAAK;AAAA;AAAA,QACxB,SAAS,KAAK;AAAA;AAAA,QACd,iBAAiB,KAAK;AAAA;AAAA,QACtB,yBAAyB,KAAK;AAAA;AAAA,MAChC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.ts

@@ -24,8 +24,12 @@
  * import { createNoydb } from '@noy-db/hub'
  * import { toFile } from '@noy-db/to-file'
  *
- * const db = await createNoydb({ store: toFile({ dir: './data' }) })
- * const acme = await db.openVault('acme', { secret: 'hunter2' })
+ * const db = await createNoydb({
+ *   store: toFile({ dir: './data' }),
+ *   user: 'alice',
+ *   secret: 'correct horse battery staple',
+ * })
+ * const acme = await db.openVault('acme')
  * const invoices = acme.collection<Invoice>('invoices')
  *
  * await invoices.put('inv-001', { amount: 1200, client: 'Acme Corp' })
@@ -221,6 +225,18 @@ export { loadPaperRecoveryEntries, savePaperRecoveryEntries, burnPaperRecoveryEn
 export type { PaperRecoveryEntry } from './with-party/team/recovery.js';
 export { mintWrappedDeksBlob, unwrapDeksFromBlob } from './with-party/team/wrapped-deks.js';
 export { assertRosterAuthenticated } from './with-party/team/roster-tag.js';
+/**
+ * #1097 — the caller-side roster-epoch floor check.
+ *
+ * Exported HERE and not only from `/team`, because the comparison is the one
+ * part of the mechanism that application code performs: hub stamps and binds
+ * the epoch, but the expectation arrives by a second channel hub does not
+ * carry, so only the caller can supply it. A check the consumer cannot import
+ * is not a check — `0.7.0-pre.9` shipped this function in `dist/**` and
+ * exported it from no entry point at all, which is #1224's class one step
+ * worse: that one was reachable from the wrong seam, this one from none.
+ */
+export { assertRosterEpochCurrent, nextRosterEpoch } from './with-party/team/roster-epoch.js';
 export type { WrappedDeksBlob } from './with-party/team/wrapped-deks.js';
 export type { NoydbSealer, RecipientHint, RecipientSealer } from './with-party/team/managed-secret.js';
 export type { NoydbShamir } from './with-party/team/noydb-shamir.js';
@@ -258,8 +274,8 @@ export type { ImmutableGuardConfig } from './with-audit/guards/index.js';
 export { transitionGuard } from './with-audit/guards/index.js';
 export type { TransitionGuardConfig } from './with-audit/guards/index.js';
 export type { GuardSpec, GuardStrategy, GuardContext, GuardChange, } from './with-audit/guards/index.js';
-export { withDerivation } from './with-formula/derivations/index.js';
-export { withRollup } from './with-formula/derivations/index.js';
+export { withDerivation } from './with-formula/derivations/with-derivation.js';
+export { withRollup } from './with-formula/derivations/with-rollup.js';
 export type { WithRollupOptions } from './with-formula/derivations/index.js';
 export type { DerivationSpec, DerivationStrategy, DerivedFromMeta, OutputSpec, RecordOutputSpec, ArrayOutputSpec, } from './with-formula/derivations/index.js';
 export { DerivationCycleError, DerivationDepthError, DerivationOutputUnknownError, DerivationOutputShapeError, DerivationCapExceededError, DuplicateBehaviorNameError, } from './kernel/errors.js';