@noy-db/hub 0.7.0-pre.9 → 0.7.0

package/dist/kernel/types.d.ts

@@ -3088,6 +3088,45 @@ export interface HistoryConfig {
      * confining tamper-evidence to the collections where it carries weight.
      * Independent of `enabled`, which gates per-record snapshots. Has no
      * effect when `withHistory()` is not active (there is no ledger).
+     *
+     * ## Cost — scope this deliberately (#1248)
+     *
+     * **The chain is the entire cost of history; per-record snapshots are
+     * free.** Measured on the primitive write path (one small collection, no
+     * guards / MVs / derivations, sequential `put()`, in-memory store,
+     * N = 3000):
+     *
+     * | config | µs/write | vs no history |
+     * |---|---|---|
+     * | no `withHistory()` | 137 | 1.00× |
+     * | `enabled: true, ledger: false` | 137 | **1.00×** |
+     * | `enabled: false, ledger: true` | 322 | 2.35× |
+     * | both (default) | 330 | **2.41×** |
+     *
+     * The cause is structural, not an inefficiency to tune away: an entry's
+     * `prevHash` depends on the current head, so appends are **inherently
+     * serialized** — one head read, one delta encryption and one CAS-put per
+     * record op. That serialization IS the tamper-evidence property.
+     *
+     * ⚠️ **The µs figures understate the felt cost on a real store.** They come
+     * from an in-memory store where the base op is ~137µs. On browser IndexedDB
+     * — or any store whose base op is milliseconds — the ledger adds a whole
+     * extra encrypted store write plus a hash to a path that was already
+     * ms-scale. **Treat the ~2.4× RATIO as the portable number and the
+     * microseconds as a floor**, not as the cost you will observe.
+     *
+     * ## What that means in practice
+     *
+     * A single human-paced write (someone saving a record) pays a difference
+     * nobody perceives. What pays visibly is a **one-click batch** — an
+     * "approve all", a CSV import, a period prefill — where tens to hundreds of
+     * writes land together and a 2.4× turns a multi-second action into a longer
+     * one. A write that fans out through derivations and materialized views
+     * pays once per resulting stored write, not once per user action.
+     *
+     * `HistoryConfig` is per-collection precisely so the chain can be confined
+     * to the collections where tamper-evidence carries weight, rather than
+     * being an all-or-nothing vault-wide toggle.
      */
     readonly ledger?: boolean;
 }

package/dist/lazy/index.js

@@ -1,10 +1,10 @@
 import {
   withLazy
-} from "../chunk-THNJ3IKU.js";
+} from "../chunk-ULUMAZ5S.js";
 import {
   IMPLICIT_LAZY
-} from "../chunk-NO272T7Q.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-66TQOPFM.js";
+import "../chunk-V4PXLYWM.js";
 export {
   IMPLICIT_LAZY,
   withLazy

package/dist/{ledger-ZAFULLAF.js → ledger-F33ZVMTK.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-OKCQNMO6.js";
+} from "./chunk-L742JPKZ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,17 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-JRWLUWDM.js";
-import "./chunk-DOPZWTMJ.js";
-import "./chunk-4RUFYGWG.js";
-import "./chunk-XGXVPCYW.js";
-import "./chunk-CWFH36SI.js";
-import "./chunk-KZTPL7NL.js";
+} from "./chunk-BOET4NA4.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-USKHHOIV.js";
-import "./chunk-N4CHCXDL.js";
-import "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -39,4 +38,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-ZAFULLAF.js.map
+//# sourceMappingURL=ledger-F33ZVMTK.js.map

package/dist/liberate-LCDPNAG2.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-CHJBLCOG.js";
+import "./chunk-BSFNRLK2.js";
+import "./chunk-L7CIOOBW.js";
+import "./chunk-4GVM6QZA.js";
+import "./chunk-5WDXHNSW.js";
+import "./chunk-EQEYOJBM.js";
+import "./chunk-G56KBWFY.js";
+import "./chunk-KG7TZKZG.js";
+import "./chunk-JMGDHKQF.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-LCDPNAG2.js.map

package/dist/link-set-FKNWAYKS.js

@@ -0,0 +1,30 @@
+import {
+  LinkEndpointError,
+  LinkSet
+} from "./chunk-6GMZ7HEE.js";
+import {
+  LINK_COLLECTION_PREFIX,
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-QIZPZMUI.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  LINK_COLLECTION_PREFIX,
+  LinkEndpointError,
+  LinkIntegrityError,
+  LinkSet,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+};
+//# sourceMappingURL=link-set-FKNWAYKS.js.map

package/dist/{managed-secret-7OH7HKXV.js → managed-secret-PQYKSR6T.js}

@@ -9,17 +9,16 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-JUBWUJY5.js";
-import "./chunk-DOPZWTMJ.js";
-import "./chunk-4RUFYGWG.js";
-import "./chunk-XGXVPCYW.js";
-import "./chunk-CWFH36SI.js";
-import "./chunk-KZTPL7NL.js";
+} from "./chunk-4GVM6QZA.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-USKHHOIV.js";
-import "./chunk-N4CHCXDL.js";
-import "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,
@@ -32,4 +31,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-7OH7HKXV.js.map
+//# sourceMappingURL=managed-secret-PQYKSR6T.js.map

package/dist/materialized-views/index.js

@@ -1,49 +1,49 @@
 import {
   withMaterializedView
-} from "../chunk-UL7TLJ54.js";
+} from "../chunk-6X6SEMEE.js";
 import {
   MaterializedViewExecutor
-} from "../chunk-3SWP2FYA.js";
+} from "../chunk-NA2NIJZI.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
   canonicalizeQueryPlan,
   computeQueryHash,
   summarizeQueryPlan
-} from "../chunk-75WNTBZL.js";
+} from "../chunk-QIBVIOXO.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-MENI33ZV.js";
-import "../chunk-U3RMWOXY.js";
-import "../chunk-FRIVOR5N.js";
+} from "../chunk-FMZY5Q6L.js";
+import "../chunk-VXANTWBJ.js";
+import "../chunk-CARABLSQ.js";
+import "../chunk-U4FOQDY4.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-AW4KTQA4.js";
-import "../chunk-4U52PMEL.js";
+import "../chunk-ZORTV6NH.js";
+import "../chunk-ZN4FD4PE.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import "../chunk-NSITFOCJ.js";
-import "../chunk-TQGT5BZE.js";
-import "../chunk-DIVY2CJZ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-6I2RQCET.js";
+import "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-BOET4NA4.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
-import "../chunk-N4CHCXDL.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError,
   MaterializedViewTooLargeError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   MaterializedViewConfigError,
   MaterializedViewCycleError,

package/dist/{migrate-cek-QHZ75E6E.js → migrate-cek-5ENH64AA.js}

@@ -1,7 +1,6 @@
 import {
   SatelliteConfigError
-} from "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-shape/satellites/migrate-cek.ts
 async function migrateSatelliteCek(name, coll) {
@@ -16,4 +15,4 @@ async function migrateSatelliteCek(name, coll) {
 export {
   migrateSatelliteCek
 };
-//# sourceMappingURL=migrate-cek-QHZ75E6E.js.map
+//# sourceMappingURL=migrate-cek-5ENH64AA.js.map

package/dist/{migrate-cek-QHZ75E6E.js.map → migrate-cek-5ENH64AA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/satellites/migrate-cek.ts"],"sourcesContent":["/**\n * Satellite per-record-CEK migration (#599) — the R-S7 retro-coverage\n * unblock.\n *\n * R-S7 (`declare.ts:89-91`) correctly refuses declaring/redeclaring a\n * satellite of a forget-covered base without `perRecordKeys: true` — but\n * `perRecordKeys` is construction-only (`kernel/collection.ts:402`), so an\n * app that shipped a satellite BEFORE its base gained forget coverage has\n * no way past the refusal: the existing records must be re-encrypted under\n * fresh per-record CEKs before the satellite can reopen in\n * `perRecordKeys: true` mode, and the only re-encrypt primitive\n * (`Collection._applyCutoverTransform`) needs the collection already\n * constructed in that mode — chicken-and-egg.\n *\n * The break: `Vault.migrateSatellitePerRecordKeys` (`kernel/vault.ts`)\n * opens the satellite collection via `vault.collection(name, {\n * perRecordKeys: true })` WITHOUT `satelliteOf` — that never enters\n * `declareSatellite`, so R-S7's gate (which only fires on the `satelliteOf`\n * declaration path) never runs for the migration pass. R-S7 stays fully\n * enforced for every NORMAL `satelliteOf` declaration; this module and its\n * call-site never touch `declare.ts`.\n *\n * `migrateSatelliteCek` then reuses `_applyCutoverTransform` verbatim (an\n * identity transform — no field/shape change, only the encryption wrapper\n * changes) rather than duplicating its mint-or-reuse-CEK logic\n * (`resolveRecordCek`/`resolveStableCek`, `collection.ts:2537-2545`): a\n * record with no `_cek` yet gets a freshly minted per-record CEK; a record\n * that already carries `_cek` (already migrated, e.g. a prior interrupted\n * run) reuses its existing CEK unchanged. That mint-or-reuse discrimination\n * is what makes re-running this after a mid-migration failure safe for\n * free — no separate resumability marker needed, no double-mint, no\n * plaintext write, no shared-DEK write.\n *\n * **Mode-assertion guard (review Important 1):** `perRecordKeys` is\n * construction-only and the vault's collection cache is first-wins with no\n * mismatch guard. If `coll`'s name was already opened THIS SESSION without\n * `perRecordKeys` (e.g. an incidental bare `vault.collection(name)` call\n * before the migration ran), `vault.collection(name, { perRecordKeys: true\n * })` cache-HITS that instance instead of constructing a fresh one — the\n * returned handle is silently NOT in per-record-CEK mode. Without a check,\n * `_applyCutoverTransform` would then pass `cek: undefined` for every\n * record (`this.perRecordCek` false) and RE-ENCRYPT EVERY RECORD UNDER THE\n * SHARED COLLECTION DEK while still reporting `{ migrated: N }` as success\n * — a security migration that silently mints nothing. `migrateSatelliteCek`\n * reads the opened handle's own `getConfig()` (the same accessor\n * `dumpSchema()` uses) to confirm `perRecordKeys` is genuinely `true`\n * before walking, and throws `SatelliteConfigError` instead of proceeding\n * if not.\n *\n * **No-quiesce precondition (review Important 2):** `_applyCutoverTransform`\n * is documented as fence-phase-only (`collection.ts:2517-2522`) — the\n * generic schema-cutover caller (`Vault.runSchemaCutover` →\n * `SchemaFenceController`) always runs it under the vault-wide schema fence,\n * which blocks concurrent writes. This migration does NOT fence: it calls\n * `_applyCutoverTransform` directly, with no fence and CAS-less\n * (`adapter.put` with no `expectedVersion`) writes. A concurrent write to\n * the same satellite collection racing the walk's `await`s can be\n * clobbered by (or clobber) a migration write. Callers MUST run this before\n * the collection serves traffic — e.g. at v2 boot, before declaring the\n * pair, before any client can write — or otherwise ensure the vault is\n * quiescent for this collection for the duration of the call.\n */\nimport { SatelliteConfigError } from '../../kernel/errors.js'\n\n/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */\nexport interface SatelliteCekMigrationTarget {\n  /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */\n  getConfig(): { readonly perRecordKeys?: boolean } | undefined\n  _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>\n}\n\nexport interface SatelliteCekMigrationResult {\n  /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */\n  readonly migrated: number\n}\n\n/**\n * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be\n * a collection handle already opened with `perRecordKeys: true` — see the\n * file header for how the caller gets one past R-S7. Throws\n * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in\n * per-record-CEK mode — see the file header's mode-assertion note.\n * Idempotent/resumable: safe to call again after a partial failure. NOT\n * fenced against concurrent writers — see the file header's no-quiesce\n * precondition; run this before the collection serves traffic.\n *\n * @param name The satellite collection's name — used only for the error\n *   message below; identical to what the caller passed to `vault.collection()`.\n */\nexport async function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult> {\n  if (coll.getConfig()?.perRecordKeys !== true) {\n    throw new SatelliteConfigError(\n      `migrateSatellitePerRecordKeys: collection \"${name}\" was already opened this session without ` +\n      `perRecordKeys (construction-only); migrate before its first open, or restart the session.`,\n    )\n  }\n  // Ledger reason (review Minor): the walk below reuses _applyCutoverTransform's\n  // hardcoded 'schema:coordinated-cutover' ledger reason — it has no reason/label\n  // param, and this migration is not itself a schema cutover. Not threaded through\n  // (would touch collection.ts's own ceilinged surface for a cosmetic label);\n  // flagged here so the audit trail's shared reason string is documented, not silent.\n  const migrated = await coll._applyCutoverTransform((doc) => doc)\n  return { migrated }\n}\n"],"mappings":";;;;;;AAyFA,eAAsB,oBAAoB,MAAc,MAAyE;AAC/H,MAAI,KAAK,UAAU,GAAG,kBAAkB,MAAM;AAC5C,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI;AAAA,IAEpD;AAAA,EACF;AAMA,QAAM,WAAW,MAAM,KAAK,uBAAuB,CAAC,QAAQ,GAAG;AAC/D,SAAO,EAAE,SAAS;AACpB;","names":[]}
+{"version":3,"sources":["../src/with-shape/satellites/migrate-cek.ts"],"sourcesContent":["/**\n * Satellite per-record-CEK migration (#599) — the R-S7 retro-coverage\n * unblock.\n *\n * R-S7 (`declare.ts:89-91`) correctly refuses declaring/redeclaring a\n * satellite of a forget-covered base without `perRecordKeys: true` — but\n * `perRecordKeys` is construction-only (`kernel/collection.ts:402`), so an\n * app that shipped a satellite BEFORE its base gained forget coverage has\n * no way past the refusal: the existing records must be re-encrypted under\n * fresh per-record CEKs before the satellite can reopen in\n * `perRecordKeys: true` mode, and the only re-encrypt primitive\n * (`Collection._applyCutoverTransform`) needs the collection already\n * constructed in that mode — chicken-and-egg.\n *\n * The break: `Vault.migrateSatellitePerRecordKeys` (`kernel/vault.ts`)\n * opens the satellite collection via `vault.collection(name, {\n * perRecordKeys: true })` WITHOUT `satelliteOf` — that never enters\n * `declareSatellite`, so R-S7's gate (which only fires on the `satelliteOf`\n * declaration path) never runs for the migration pass. R-S7 stays fully\n * enforced for every NORMAL `satelliteOf` declaration; this module and its\n * call-site never touch `declare.ts`.\n *\n * `migrateSatelliteCek` then reuses `_applyCutoverTransform` verbatim (an\n * identity transform — no field/shape change, only the encryption wrapper\n * changes) rather than duplicating its mint-or-reuse-CEK logic\n * (`resolveRecordCek`/`resolveStableCek`, `collection.ts:2537-2545`): a\n * record with no `_cek` yet gets a freshly minted per-record CEK; a record\n * that already carries `_cek` (already migrated, e.g. a prior interrupted\n * run) reuses its existing CEK unchanged. That mint-or-reuse discrimination\n * is what makes re-running this after a mid-migration failure safe for\n * free — no separate resumability marker needed, no double-mint, no\n * plaintext write, no shared-DEK write.\n *\n * **Mode-assertion guard (review Important 1):** `perRecordKeys` is\n * construction-only and the vault's collection cache is first-wins with no\n * mismatch guard. If `coll`'s name was already opened THIS SESSION without\n * `perRecordKeys` (e.g. an incidental bare `vault.collection(name)` call\n * before the migration ran), `vault.collection(name, { perRecordKeys: true\n * })` cache-HITS that instance instead of constructing a fresh one — the\n * returned handle is silently NOT in per-record-CEK mode. Without a check,\n * `_applyCutoverTransform` would then pass `cek: undefined` for every\n * record (`this.perRecordCek` false) and RE-ENCRYPT EVERY RECORD UNDER THE\n * SHARED COLLECTION DEK while still reporting `{ migrated: N }` as success\n * — a security migration that silently mints nothing. `migrateSatelliteCek`\n * reads the opened handle's own `getConfig()` (the same accessor\n * `dumpSchema()` uses) to confirm `perRecordKeys` is genuinely `true`\n * before walking, and throws `SatelliteConfigError` instead of proceeding\n * if not.\n *\n * **No-quiesce precondition (review Important 2):** `_applyCutoverTransform`\n * is documented as fence-phase-only (`collection.ts:2517-2522`) — the\n * generic schema-cutover caller (`Vault.runSchemaCutover` →\n * `SchemaFenceController`) always runs it under the vault-wide schema fence,\n * which blocks concurrent writes. This migration does NOT fence: it calls\n * `_applyCutoverTransform` directly, with no fence and CAS-less\n * (`adapter.put` with no `expectedVersion`) writes. A concurrent write to\n * the same satellite collection racing the walk's `await`s can be\n * clobbered by (or clobber) a migration write. Callers MUST run this before\n * the collection serves traffic — e.g. at v2 boot, before declaring the\n * pair, before any client can write — or otherwise ensure the vault is\n * quiescent for this collection for the duration of the call.\n */\nimport { SatelliteConfigError } from '../../kernel/errors.js'\n\n/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */\nexport interface SatelliteCekMigrationTarget {\n  /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */\n  getConfig(): { readonly perRecordKeys?: boolean } | undefined\n  _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>\n}\n\nexport interface SatelliteCekMigrationResult {\n  /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */\n  readonly migrated: number\n}\n\n/**\n * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be\n * a collection handle already opened with `perRecordKeys: true` — see the\n * file header for how the caller gets one past R-S7. Throws\n * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in\n * per-record-CEK mode — see the file header's mode-assertion note.\n * Idempotent/resumable: safe to call again after a partial failure. NOT\n * fenced against concurrent writers — see the file header's no-quiesce\n * precondition; run this before the collection serves traffic.\n *\n * @param name The satellite collection's name — used only for the error\n *   message below; identical to what the caller passed to `vault.collection()`.\n */\nexport async function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult> {\n  if (coll.getConfig()?.perRecordKeys !== true) {\n    throw new SatelliteConfigError(\n      `migrateSatellitePerRecordKeys: collection \"${name}\" was already opened this session without ` +\n      `perRecordKeys (construction-only); migrate before its first open, or restart the session.`,\n    )\n  }\n  // Ledger reason (review Minor): the walk below reuses _applyCutoverTransform's\n  // hardcoded 'schema:coordinated-cutover' ledger reason — it has no reason/label\n  // param, and this migration is not itself a schema cutover. Not threaded through\n  // (would touch collection.ts's own ceilinged surface for a cosmetic label);\n  // flagged here so the audit trail's shared reason string is documented, not silent.\n  const migrated = await coll._applyCutoverTransform((doc) => doc)\n  return { migrated }\n}\n"],"mappings":";;;;;AAyFA,eAAsB,oBAAoB,MAAc,MAAyE;AAC/H,MAAI,KAAK,UAAU,GAAG,kBAAkB,MAAM;AAC5C,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI;AAAA,IAEpD;AAAA,EACF;AAMA,QAAM,WAAW,MAAM,KAAK,uBAAuB,CAAC,QAAQ,GAAG;AAC/D,SAAO,EAAE,SAAS;AACpB;","names":[]}

package/dist/money/index.js

@@ -4,7 +4,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "../chunk-DNMTN46H.js";
+} from "../chunk-GY4WYNNG.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -13,11 +13,10 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "../chunk-U3RMWOXY.js";
+} from "../chunk-VXANTWBJ.js";
 import "../chunk-NSITFOCJ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-7O3Y4PPD.js";
 export {
   MoneyCurrencyError,
   MoneyPrecisionError,

package/dist/noydb-DUXZPKSN.js

@@ -0,0 +1,90 @@
+import {
+  Noydb,
+  createNoydb
+} from "./chunk-6GOE5PGN.js";
+import "./chunk-EPFF7LOX.js";
+import "./chunk-QIZPZMUI.js";
+import "./chunk-TUFM4UZP.js";
+import "./chunk-SMH6SRX7.js";
+import "./chunk-453F654R.js";
+import "./chunk-SPXXX5E4.js";
+import "./chunk-GYGLAVCX.js";
+import "./chunk-6LJY7X5A.js";
+import "./chunk-Q7HZX3IF.js";
+import "./chunk-KJIMGIWO.js";
+import "./chunk-BZ3534YM.js";
+import "./chunk-NQKIUNW5.js";
+import "./chunk-4GVM6QZA.js";
+import "./chunk-VTFVLCUH.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-ZVO4QVPD.js";
+import "./chunk-GPEQUXHL.js";
+import "./chunk-2C3AQB46.js";
+import "./chunk-TFMM5DBB.js";
+import "./chunk-RTBJ5IOO.js";
+import "./chunk-5VCRVKOZ.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-REDOOY2Q.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-2Y4IMKA6.js";
+import "./chunk-CARABLSQ.js";
+import "./chunk-U4FOQDY4.js";
+import "./chunk-SKGMN35F.js";
+import "./chunk-T7IR4N2S.js";
+import "./chunk-PEOZ34EM.js";
+import "./chunk-PT43Y56J.js";
+import "./chunk-GHVIKOHT.js";
+import "./chunk-FAHMLERK.js";
+import "./chunk-SMY5X46Z.js";
+import "./chunk-DZFQVICS.js";
+import "./chunk-BLN54W3L.js";
+import "./chunk-5D2ALSM5.js";
+import "./chunk-UXWB3FPF.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-6YXCPL4T.js";
+import "./chunk-7MG2LHO5.js";
+import "./chunk-ZORTV6NH.js";
+import "./chunk-AO42KJO6.js";
+import "./chunk-BM5TWITZ.js";
+import "./chunk-KTFRCC5C.js";
+import "./chunk-I3ISCYT7.js";
+import "./chunk-66TQOPFM.js";
+import "./chunk-V4PXLYWM.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-YMUFFJCO.js";
+import "./chunk-ATL3ZVXT.js";
+import "./chunk-NSITFOCJ.js";
+import "./chunk-PVEWA2DU.js";
+import "./chunk-MVMXZYXT.js";
+import "./chunk-6I2RQCET.js";
+import "./chunk-TRGTKX5E.js";
+import "./chunk-UXVWEX5L.js";
+import "./chunk-RRNRNANG.js";
+import "./chunk-2577DKXB.js";
+import "./chunk-G56KBWFY.js";
+import "./chunk-KG7TZKZG.js";
+import "./chunk-UGTBXF5U.js";
+import "./chunk-JBDFMYKQ.js";
+import "./chunk-VKQCVU2Z.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-X2DLENDQ.js";
+import "./chunk-L742JPKZ.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-BOET4NA4.js";
+import "./chunk-JMGDHKQF.js";
+import "./chunk-HK67PX4J.js";
+import "./chunk-7V4TP3AF.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  Noydb,
+  createNoydb
+};
+//# sourceMappingURL=noydb-DUXZPKSN.js.map

package/dist/overlay-views/index.js

@@ -1,19 +1,18 @@
 import {
   withOverlayedView
-} from "../chunk-XKA6UH5V.js";
+} from "../chunk-SFAWCTEM.js";
 import {
   OverlayedViewRegistry
-} from "../chunk-MTTPHBIE.js";
+} from "../chunk-Q2PU57HC.js";
 import {
   OverlayedCollection
-} from "../chunk-FYT3DXPN.js";
+} from "../chunk-SKGMN35F.js";
 import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayIdMismatchError,
   OverlayNameCollisionError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,

package/dist/periods/index.js

@@ -11,7 +11,7 @@ import {
   samePartition,
   validatePeriodName,
   withPeriods
-} from "../chunk-SWFIXQF5.js";
+} from "../chunk-PT43Y56J.js";
 import "../chunk-GHVIKOHT.js";
 import {
   PERIODS_COLLECTION,
@@ -20,20 +20,19 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "../chunk-Q2ZN5DWZ.js";
-import "../chunk-OKCQNMO6.js";
+} from "../chunk-FAHMLERK.js";
+import "../chunk-L742JPKZ.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOET4NA4.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
-import "../chunk-N4CHCXDL.js";
-import "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
+import "../chunk-7O3Y4PPD.js";
 export {
   NO_PERIODS,
   PERIODS_COLLECTION,