@noy-db/hub 0.7.0-pre.9 → 0.7.0

package/dist/pod/index.js

@@ -5,44 +5,48 @@ import {
   signRedirect,
   verifyRedirect,
   wrapPodStore
-} from "../chunk-7YVSWPZB.js";
-import "../chunk-6L5IMNJX.js";
-import "../chunk-J6FXVDKC.js";
+} from "../chunk-WEQEYLCS.js";
+import "../chunk-6GOE5PGN.js";
 import {
   deriveSchemaManifest,
   loadSchemaManifestEntry
-} from "../chunk-5W5CEHLA.js";
+} from "../chunk-VXGSWL6L.js";
 import {
   MANIFEST_COLLECTION,
   isManifestReservedCollection
 } from "../chunk-EPFF7LOX.js";
-import "../chunk-KQIDBIZL.js";
-import "../chunk-JY4U6CYV.js";
-import "../chunk-GM4IM7TC.js";
-import "../chunk-QJLOWGOU.js";
+import "../chunk-QIZPZMUI.js";
+import "../chunk-TUFM4UZP.js";
+import "../chunk-SMH6SRX7.js";
+import "../chunk-453F654R.js";
+import "../chunk-SPXXX5E4.js";
 import "../chunk-GYGLAVCX.js";
 import "../chunk-6LJY7X5A.js";
-import "../chunk-FLRLZ4XZ.js";
-import "../chunk-P2RJAVMR.js";
-import "../chunk-5NKHCJU5.js";
-import "../chunk-UTFY6W6X.js";
-import "../chunk-FKQCC4C5.js";
-import "../chunk-JUBWUJY5.js";
-import "../chunk-GHADG5QZ.js";
-import "../chunk-KHKKD62N.js";
-import "../chunk-VT4DTCK5.js";
+import "../chunk-Q7HZX3IF.js";
+import "../chunk-KJIMGIWO.js";
+import "../chunk-BZ3534YM.js";
+import "../chunk-NQKIUNW5.js";
+import "../chunk-4GVM6QZA.js";
+import "../chunk-VTFVLCUH.js";
+import "../chunk-RXLYKVTF.js";
+import "../chunk-ZVO4QVPD.js";
+import "../chunk-GPEQUXHL.js";
+import "../chunk-2C3AQB46.js";
+import "../chunk-TFMM5DBB.js";
+import "../chunk-RTBJ5IOO.js";
+import "../chunk-5VCRVKOZ.js";
+import "../chunk-VYYM3MEN.js";
+import "../chunk-REDOOY2Q.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-I5LSKXT6.js";
-import "../chunk-H5GVPOB4.js";
-import "../chunk-K432FT7T.js";
-import "../chunk-XJP66QEN.js";
-import "../chunk-FRIVOR5N.js";
-import "../chunk-FYT3DXPN.js";
+import "../chunk-2Y4IMKA6.js";
+import "../chunk-CARABLSQ.js";
+import "../chunk-U4FOQDY4.js";
+import "../chunk-SKGMN35F.js";
 import "../chunk-T7IR4N2S.js";
 import "../chunk-PEOZ34EM.js";
-import "../chunk-SWFIXQF5.js";
+import "../chunk-PT43Y56J.js";
 import "../chunk-GHVIKOHT.js";
-import "../chunk-Q2ZN5DWZ.js";
+import "../chunk-FAHMLERK.js";
 import "../chunk-SMY5X46Z.js";
 import "../chunk-DZFQVICS.js";
 import {
@@ -68,55 +72,56 @@ import {
   verifyPodHeader,
   verifyRecord,
   writePod
-} from "../chunk-RCONOOVF.js";
-import "../chunk-NMDMSHBF.js";
-import "../chunk-RPX2H2OL.js";
+} from "../chunk-5WDXHNSW.js";
+import "../chunk-EQEYOJBM.js";
+import "../chunk-BLN54W3L.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-IAHDSFFA.js";
+import "../chunk-UXWB3FPF.js";
 import "../chunk-AURFOK3D.js";
-import "../chunk-P7KJME6C.js";
-import "../chunk-LAI7ENPW.js";
-import "../chunk-AW4KTQA4.js";
-import "../chunk-IS5LFHV2.js";
-import "../chunk-HS3LEVT4.js";
-import "../chunk-ZB2K3FV7.js";
+import "../chunk-6YXCPL4T.js";
+import "../chunk-7MG2LHO5.js";
+import "../chunk-ZORTV6NH.js";
+import "../chunk-AO42KJO6.js";
+import "../chunk-BM5TWITZ.js";
+import "../chunk-KTFRCC5C.js";
 import "../chunk-I3ISCYT7.js";
-import "../chunk-NO272T7Q.js";
+import "../chunk-66TQOPFM.js";
+import "../chunk-V4PXLYWM.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-YMUFFJCO.js";
 import "../chunk-ATL3ZVXT.js";
 import "../chunk-NSITFOCJ.js";
 import "../chunk-PVEWA2DU.js";
-import "../chunk-JFSUYGNE.js";
-import "../chunk-TQGT5BZE.js";
-import "../chunk-DIVY2CJZ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-VTTDPGEK.js";
-import "../chunk-5UKIZIO3.js";
-import "../chunk-OHGCRKWA.js";
-import "../chunk-MV2OEK3K.js";
-import "../chunk-DZPMKY3J.js";
-import "../chunk-PV7XXAXK.js";
+import "../chunk-MVMXZYXT.js";
+import "../chunk-6I2RQCET.js";
+import "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-RRNRNANG.js";
+import "../chunk-2577DKXB.js";
+import "../chunk-G56KBWFY.js";
+import "../chunk-KG7TZKZG.js";
+import "../chunk-UGTBXF5U.js";
+import "../chunk-JBDFMYKQ.js";
 import "../chunk-VKQCVU2Z.js";
 import {
   generateULID,
   isULID
 } from "../chunk-4AOERLTV.js";
-import "../chunk-TAJZ7GXO.js";
-import "../chunk-OKCQNMO6.js";
+import "../chunk-X2DLENDQ.js";
+import "../chunk-L742JPKZ.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-IZTU6RKH.js";
+import "../chunk-BOET4NA4.js";
+import "../chunk-JMGDHKQF.js";
 import "../chunk-HK67PX4J.js";
-import "../chunk-HOIWW2LV.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-7V4TP3AF.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
-import "../chunk-N4CHCXDL.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
 import {
   BackupCorruptedError,
   BackupLedgerError,
@@ -130,8 +135,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   BackupCorruptedError,
   BackupLedgerError,

package/dist/{pod-handle-BLOI4IFY.js → pod-handle-Q736KYON.js}

@@ -1,15 +1,14 @@
-import "./chunk-DOPZWTMJ.js";
+import "./chunk-77K4PG6P.js";
 import {
   buildRecordEnvelope
-} from "./chunk-4RUFYGWG.js";
-import "./chunk-XGXVPCYW.js";
-import "./chunk-CWFH36SI.js";
-import "./chunk-KZTPL7NL.js";
+} from "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-USKHHOIV.js";
-import "./chunk-N4CHCXDL.js";
-import "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
 
 // src/with-pod/pod-handle.ts
 async function buildPodHandle(adapter, name) {
@@ -26,7 +25,7 @@ async function buildPodHandle(adapter, name) {
     } catch {
     }
   }
-  const { generateULID } = await import("./ulid-VQW6ERQN.js");
+  const { generateULID } = await import("./ulid-4MKXG325.js");
   const handle = generateULID();
   const envelope = buildRecordEnvelope(
     { collection: "_meta", id: "handle", version: 1 },
@@ -38,4 +37,4 @@ async function buildPodHandle(adapter, name) {
 export {
   buildPodHandle
 };
-//# sourceMappingURL=pod-handle-BLOI4IFY.js.map
+//# sourceMappingURL=pod-handle-Q736KYON.js.map

package/dist/{pod-handle-BLOI4IFY.js.map → pod-handle-Q736KYON.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-pod/pod-handle.ts"],"sourcesContent":["/**\n * Vault bundle handle — the stable opaque ULID identifying a vault\n * across `.noydb` exports.\n *\n * Behaviour is byte-identical to the inline `Vault.getPodHandle`\n * method this function replaced. `Vault` keeps the public method as\n * a thin delegator.\n *\n * Internal — reached through `vault.getPodHandle()`.\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js'\nimport { buildRecordEnvelope } from '../kernel/enclave/index.js'\n\n/**\n * Return the stable opaque bundle handle for the given vault adapter,\n * generating and persisting a fresh ULID on first call.\n *\n * See {@link import('../kernel/vault.js').Vault.getPodHandle} for\n * the full rationale and storage-path documentation.\n */\nexport async function buildPodHandle(adapter: NoydbStore, name: string): Promise<string> {\n  const existing = await adapter.get(name, '_meta', 'handle')\n  if (existing) {\n    try {\n      const parsed = JSON.parse(existing._data) as unknown\n      if (parsed !== null && typeof parsed === 'object' && 'handle' in parsed) {\n        const handle = (parsed as { handle: unknown }).handle\n        if (typeof handle === 'string' && /^[0-9A-HJKMNP-TV-Z]{26}$/.test(handle)) {\n          return handle\n        }\n      }\n    } catch {\n      // Fall through to regenerate — corrupted handle envelope\n      // is treated as missing, not as an error. The new handle\n      // overwrites the bad one.\n    }\n  }\n  const { generateULID } = await import('./ulid.js')\n  const handle = generateULID()\n  const envelope: EncryptedEnvelope = buildRecordEnvelope(\n    { collection: '_meta', id: 'handle', version: 1 },\n    { iv: '', data: JSON.stringify({ handle }) },\n  )\n  await adapter.put(name, '_meta', 'handle', envelope)\n  return handle\n}\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAsB,eAAe,SAAqB,MAA+B;AACvF,QAAM,WAAW,MAAM,QAAQ,IAAI,MAAM,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,UAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,YAAY,QAAQ;AACvE,cAAMA,UAAU,OAA+B;AAC/C,YAAI,OAAOA,YAAW,YAAY,2BAA2B,KAAKA,OAAM,GAAG;AACzE,iBAAOA;AAAA,QACT;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAIR;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAW;AACjD,QAAM,SAAS,aAAa;AAC5B,QAAM,WAA8B;AAAA,IAClC,EAAE,YAAY,SAAS,IAAI,UAAU,SAAS,EAAE;AAAA,IAChD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE;AAAA,EAC7C;AACA,QAAM,QAAQ,IAAI,MAAM,SAAS,UAAU,QAAQ;AACnD,SAAO;AACT;","names":["handle"]}
+{"version":3,"sources":["../src/with-pod/pod-handle.ts"],"sourcesContent":["/**\n * Vault bundle handle — the stable opaque ULID identifying a vault\n * across `.noydb` exports.\n *\n * Behaviour is byte-identical to the inline `Vault.getPodHandle`\n * method this function replaced. `Vault` keeps the public method as\n * a thin delegator.\n *\n * Internal — reached through `vault.getPodHandle()`.\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js'\nimport { buildRecordEnvelope } from '../kernel/enclave/index.js'\n\n/**\n * Return the stable opaque bundle handle for the given vault adapter,\n * generating and persisting a fresh ULID on first call.\n *\n * See {@link import('../kernel/vault.js').Vault.getPodHandle} for\n * the full rationale and storage-path documentation.\n */\nexport async function buildPodHandle(adapter: NoydbStore, name: string): Promise<string> {\n  const existing = await adapter.get(name, '_meta', 'handle')\n  if (existing) {\n    try {\n      const parsed = JSON.parse(existing._data) as unknown\n      if (parsed !== null && typeof parsed === 'object' && 'handle' in parsed) {\n        const handle = (parsed as { handle: unknown }).handle\n        if (typeof handle === 'string' && /^[0-9A-HJKMNP-TV-Z]{26}$/.test(handle)) {\n          return handle\n        }\n      }\n    } catch {\n      // Fall through to regenerate — corrupted handle envelope\n      // is treated as missing, not as an error. The new handle\n      // overwrites the bad one.\n    }\n  }\n  const { generateULID } = await import('./ulid.js')\n  const handle = generateULID()\n  const envelope: EncryptedEnvelope = buildRecordEnvelope(\n    { collection: '_meta', id: 'handle', version: 1 },\n    { iv: '', data: JSON.stringify({ handle }) },\n  )\n  await adapter.put(name, '_meta', 'handle', envelope)\n  return handle\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,eAAsB,eAAe,SAAqB,MAA+B;AACvF,QAAM,WAAW,MAAM,QAAQ,IAAI,MAAM,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,UAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,YAAY,QAAQ;AACvE,cAAMA,UAAU,OAA+B;AAC/C,YAAI,OAAOA,YAAW,YAAY,2BAA2B,KAAKA,OAAM,GAAG;AACzE,iBAAOA;AAAA,QACT;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAIR;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAW;AACjD,QAAM,SAAS,aAAa;AAC5B,QAAM,WAA8B;AAAA,IAClC,EAAE,YAAY,SAAS,IAAI,UAAU,SAAS,EAAE;AAAA,IAChD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE;AAAA,EAC7C;AACA,QAAM,QAAQ,IAAI,MAAM,SAAS,UAAU,QAAQ;AACnD,SAAO;AACT;","names":["handle"]}

package/dist/policy/index.js

@@ -6,28 +6,27 @@ import {
   createNoydbPolicy,
   describeGate,
   mergePolicy
-} from "../chunk-JILOSL4O.js";
+} from "../chunk-SPYWXKJN.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
   loadVaultPolicy,
   saveVaultPolicy
-} from "../chunk-5UKIZIO3.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+} from "../chunk-2577DKXB.js";
+import "../chunk-77K4PG6P.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
-import "../chunk-N4CHCXDL.js";
+import "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
   RecoveryNotEnrolledError,
   RecoveryProfileNotImplementedError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   DEFAULT_FRESHNESS_MS,
   META_COLLECTION,

package/dist/port/to/index.d.ts

@@ -15,9 +15,49 @@
  * Named re-exports only (no `export *`) so the published surface is explicit and
  * tsup's per-entry bundling keeps class identity stable across subpaths.
  */
+import type { NoydbStore as NoydbStoreType } from '../../kernel/types.js';
 export type { NoydbStore, NoydbPodStore, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
 export { ConflictError, NetworkError, StoreCapabilityError, PodVersionConflictError, UnknownStoreKindError, DuplicateStoreKindError, } from '../../kernel/errors.js';
 export { isConflictError } from '../../kernel/errors.js';
 export type { StoreClass, StoreDescriptor, StoreBinding, StoreFactory, StoreLocator, AnyNoydbStore, } from './locator.js';
 export { createStoreLocator, isPodStore } from './locator.js';
 export { NOYDB_ENVELOPE_GENERATION } from '../../kernel/types.js';
+/**
+ * A store a RELAY may serve — the 6-method contract minus the two members a
+ * relay profile omits **by construction** (#1237).
+ *
+ * ## Why a type rather than a runtime allowlist
+ *
+ * `in-rest` types its `store` option as a full {@link NoydbStore} and gates
+ * dispatch with an `allow` set. That works, and for `in-rest` it is right — its
+ * job is to serve a whole store. But it means a relay profile's exclusions are
+ * enforced by *handing the handler an object that carries `saveAll`* and
+ * trusting a `Set` not to call it. **That converts structural absence into a
+ * runtime allowlist**, which is a downgrade of exactly the property a relay
+ * exists to have: a handler typed against this cannot compile a call to
+ * `saveAll`, so no mis-set `allow` can talk it into one.
+ *
+ * ## The two exclusions, and why each
+ *
+ * - **`saveAll`** — whole-vault replace. A relay that can be asked to overwrite
+ *   a vault wholesale is a rollback superweapon pointed at its own hosts.
+ * - **`listVaults`** — enumeration is an existence leak. Already optional on
+ *   `NoydbStore`, so omitting it here is a statement of profile rather than a
+ *   new restriction.
+ *
+ * ## Scope — deliberately narrow
+ *
+ * This is a TYPE. It changes nothing about the `NoydbStore` runtime contract,
+ * which stays the 6-method interface every backend implements; a full store
+ * satisfies this type structurally and needs no changes to be relayed. That
+ * boundary is load-bearing: the format-conformance kit's store-observation
+ * design (#1211) names a change to the `NoydbStore` contract as the single
+ * thing that would invalidate it, so a narrowing that stayed purely in the type
+ * layer was a precondition of this work rather than a convenience.
+ *
+ * It lives here, on the published `/to` seam, rather than inside the relay
+ * package because there is already a second consumer: `@doi-db/daemon`
+ * implements this profile natively and needs to name the same shape without
+ * depending on a relay server it does not run.
+ */
+export type NoydbRelayStore = Omit<NoydbStoreType, 'saveAll' | 'listVaults'>;

package/dist/portability/index.js

@@ -1,36 +1,35 @@
 import {
   NO_PORTABILITY
-} from "../chunk-UTFY6W6X.js";
+} from "../chunk-BZ3534YM.js";
 import {
   PortabilityNotEnabledError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 
 // src/with-audit/portability/active.ts
 function withPortability() {
   return {
     async exportAccessibleData(vault, opts) {
-      const { exportAccessibleData } = await import("../export-accessible-K4GJAU7U.js");
+      const { exportAccessibleData } = await import("../export-accessible-72EQNBMR.js");
       return exportAccessibleData(vault, opts);
     },
     async withdrawAccessibleData(vault, opts) {
-      const { withdrawAccessibleData } = await import("../withdraw-accessible-62VI4W7D.js");
+      const { withdrawAccessibleData } = await import("../withdraw-accessible-EL5GXZBS.js");
       return withdrawAccessibleData(vault, opts);
     },
     async requestWithdrawal(vault, opts) {
-      const { requestWithdrawal } = await import("../request-withdrawal-7IKUIAEB.js");
+      const { requestWithdrawal } = await import("../request-withdrawal-KFQHEZ25.js");
       return requestWithdrawal(vault, opts);
     },
     async listWithdrawalRequests(vault, opts) {
-      const { listWithdrawalRequests } = await import("../request-withdrawal-7IKUIAEB.js");
+      const { listWithdrawalRequests } = await import("../request-withdrawal-KFQHEZ25.js");
       return listWithdrawalRequests(vault, opts);
     },
     async approveWithdrawal(vault, requestId, opts) {
-      const { approveWithdrawal } = await import("../request-withdrawal-7IKUIAEB.js");
+      const { approveWithdrawal } = await import("../request-withdrawal-KFQHEZ25.js");
       return approveWithdrawal(vault, requestId, opts);
     },
     async rejectWithdrawal(vault, requestId, opts) {
-      const { rejectWithdrawal } = await import("../request-withdrawal-7IKUIAEB.js");
+      const { rejectWithdrawal } = await import("../request-withdrawal-KFQHEZ25.js");
       return rejectWithdrawal(vault, requestId, opts);
     }
   };

package/dist/portability/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/portability/active.ts"],"sourcesContent":["/**\n * Enable the portability capability.\n * Pass to `createNoydb({ portabilityStrategy: withPortability() })` to make a\n * vault's `user.exportMyAccessibleData` / `user.unilateralWithdrawal` /\n * `user.requestWithdrawal` / `user.listWithdrawalRequests` /\n * `user.approveWithdrawal` / `user.rejectWithdrawal` methods live. The\n * export/withdraw/request engines are dynamically imported here, so they stay\n * reachable only via opt-in.\n */\nimport type { PortabilityStrategy } from './strategy.js'\n\nexport function withPortability(): PortabilityStrategy {\n  return {\n    async exportAccessibleData(vault, opts) {\n      const { exportAccessibleData } = await import('./export-accessible.js')\n      return exportAccessibleData(vault, opts)\n    },\n    async withdrawAccessibleData(vault, opts) {\n      const { withdrawAccessibleData } = await import('./withdraw-accessible.js')\n      return withdrawAccessibleData(vault, opts)\n    },\n    async requestWithdrawal(vault, opts) {\n      const { requestWithdrawal } = await import('./request-withdrawal.js')\n      return requestWithdrawal(vault, opts)\n    },\n    async listWithdrawalRequests(vault, opts) {\n      const { listWithdrawalRequests } = await import('./request-withdrawal.js')\n      return listWithdrawalRequests(vault, opts)\n    },\n    async approveWithdrawal(vault, requestId, opts) {\n      const { approveWithdrawal } = await import('./request-withdrawal.js')\n      return approveWithdrawal(vault, requestId, opts)\n    },\n    async rejectWithdrawal(vault, requestId, opts) {\n      const { rejectWithdrawal } = await import('./request-withdrawal.js')\n      return rejectWithdrawal(vault, requestId, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,qBAAqB,OAAO,MAAM;AACtC,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,kCAAwB;AACtE,aAAO,qBAAqB,OAAO,IAAI;AAAA,IACzC;AAAA,IACA,MAAM,uBAAuB,OAAO,MAAM;AACxC,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,oCAA0B;AAC1E,aAAO,uBAAuB,OAAO,IAAI;AAAA,IAC3C;AAAA,IACA,MAAM,kBAAkB,OAAO,MAAM;AACnC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,mCAAyB;AACpE,aAAO,kBAAkB,OAAO,IAAI;AAAA,IACtC;AAAA,IACA,MAAM,uBAAuB,OAAO,MAAM;AACxC,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,mCAAyB;AACzE,aAAO,uBAAuB,OAAO,IAAI;AAAA,IAC3C;AAAA,IACA,MAAM,kBAAkB,OAAO,WAAW,MAAM;AAC9C,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,mCAAyB;AACpE,aAAO,kBAAkB,OAAO,WAAW,IAAI;AAAA,IACjD;AAAA,IACA,MAAM,iBAAiB,OAAO,WAAW,MAAM;AAC7C,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mCAAyB;AACnE,aAAO,iBAAiB,OAAO,WAAW,IAAI;AAAA,IAChD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/portability/active.ts"],"sourcesContent":["/**\n * Enable the portability capability.\n * Pass to `createNoydb({ portabilityStrategy: withPortability() })` to make a\n * vault's `user.exportMyAccessibleData` / `user.unilateralWithdrawal` /\n * `user.requestWithdrawal` / `user.listWithdrawalRequests` /\n * `user.approveWithdrawal` / `user.rejectWithdrawal` methods live. The\n * export/withdraw/request engines are dynamically imported here, so they stay\n * reachable only via opt-in.\n */\nimport type { PortabilityStrategy } from './strategy.js'\n\nexport function withPortability(): PortabilityStrategy {\n  return {\n    async exportAccessibleData(vault, opts) {\n      const { exportAccessibleData } = await import('./export-accessible.js')\n      return exportAccessibleData(vault, opts)\n    },\n    async withdrawAccessibleData(vault, opts) {\n      const { withdrawAccessibleData } = await import('./withdraw-accessible.js')\n      return withdrawAccessibleData(vault, opts)\n    },\n    async requestWithdrawal(vault, opts) {\n      const { requestWithdrawal } = await import('./request-withdrawal.js')\n      return requestWithdrawal(vault, opts)\n    },\n    async listWithdrawalRequests(vault, opts) {\n      const { listWithdrawalRequests } = await import('./request-withdrawal.js')\n      return listWithdrawalRequests(vault, opts)\n    },\n    async approveWithdrawal(vault, requestId, opts) {\n      const { approveWithdrawal } = await import('./request-withdrawal.js')\n      return approveWithdrawal(vault, requestId, opts)\n    },\n    async rejectWithdrawal(vault, requestId, opts) {\n      const { rejectWithdrawal } = await import('./request-withdrawal.js')\n      return rejectWithdrawal(vault, requestId, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,qBAAqB,OAAO,MAAM;AACtC,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,kCAAwB;AACtE,aAAO,qBAAqB,OAAO,IAAI;AAAA,IACzC;AAAA,IACA,MAAM,uBAAuB,OAAO,MAAM;AACxC,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,oCAA0B;AAC1E,aAAO,uBAAuB,OAAO,IAAI;AAAA,IAC3C;AAAA,IACA,MAAM,kBAAkB,OAAO,MAAM;AACnC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,mCAAyB;AACpE,aAAO,kBAAkB,OAAO,IAAI;AAAA,IACtC;AAAA,IACA,MAAM,uBAAuB,OAAO,MAAM;AACxC,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,mCAAyB;AACzE,aAAO,uBAAuB,OAAO,IAAI;AAAA,IAC3C;AAAA,IACA,MAAM,kBAAkB,OAAO,WAAW,MAAM;AAC9C,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,mCAAyB;AACpE,aAAO,kBAAkB,OAAO,WAAW,IAAI;AAAA,IACjD;AAAA,IACA,MAAM,iBAAiB,OAAO,WAAW,MAAM;AAC7C,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mCAAyB;AACnE,aAAO,iBAAiB,OAAO,WAAW,IAAI;AAAA,IAChD;AAAA,EACF;AACF;","names":[]}

package/dist/{post-register-R33EKJQR.js → post-register-LNE2FE2A.js}

@@ -1,10 +1,9 @@
 import {
   hashFields
-} from "./chunk-JY4U6CYV.js";
+} from "./chunk-TUFM4UZP.js";
 import {
   SatelliteConfigError
-} from "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-shape/satellites/marker.ts
 async function ensureSatelliteMarker(store, vaultName, spec, dek) {
@@ -14,7 +13,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     joined: spec.joined,
     epoch: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const { loadPersistedSchema } = await import("./storage-J2QHNJCB.js");
+  const { loadPersistedSchema } = await import("./storage-FLR73HHF.js");
   const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek);
   const prior = persisted?.satellite;
   if (prior) {
@@ -25,7 +24,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     }
     return;
   }
-  const { persistSatelliteMarker } = await import("./register-AYBQNTM3.js");
+  const { persistSatelliteMarker } = await import("./register-I2DZXGAR.js");
   await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next });
 }
 
@@ -39,7 +38,7 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
   }
   if (baseSchema !== void 0) {
     try {
-      const { derivePersistedSchema } = await import("./derive-AAIXSQIE.js");
+      const { derivePersistedSchema } = await import("./derive-6O5SWQKN.js");
       const envelope = await derivePersistedSchema(baseSchema);
       const properties = envelope.jsonSchema?.["properties"];
       const baseFields = Object.keys(properties ?? {});
@@ -57,4 +56,4 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
 export {
   postRegister
 };
-//# sourceMappingURL=post-register-R33EKJQR.js.map
+//# sourceMappingURL=post-register-LNE2FE2A.js.map

package/dist/{post-register-R33EKJQR.js.map → post-register-LNE2FE2A.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/satellites/marker.ts","../src/with-shape/satellites/post-register.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { SatelliteConfigError } from '../../kernel/errors.js'\nimport { hashFields } from './validate.js'\nimport type { PairingMarker, SatelliteSpec } from './types.js'\n\n/**\n * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.\n * First declaration writes { base, fieldsHash, joined }; later declarations\n * must match exactly or are refused (R-S9). Lazy imports keep the satellite\n * spine tree-shakeable (config-drift.ts pattern).\n */\nexport async function ensureSatelliteMarker(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec, dek: EnclaveKey,\n): Promise<void> {\n  // #597: `epoch` only matters the first time this marker is ever persisted —\n  // when a `prior` marker already exists below we return without ever using\n  // it, so re-declaring a LIVE collection never mints (or compares) a new\n  // epoch; the persisted one is carried forward untouched. Stamped here as a\n  // timestamp (mirrors `derivedAt` in persisted-schemas/register.ts) rather\n  // than a counter, since there's nothing to count from yet.\n  const next: PairingMarker = {\n    base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined,\n    epoch: new Date().toISOString(),\n  }\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek)\n  const prior = persisted?.satellite\n  if (prior) {\n    if (prior.base !== next.base || prior.fieldsHash !== next.fieldsHash || (prior.joined ?? null) !== (next.joined ?? null)) {\n      throw new SatelliteConfigError(\n        `R-S9: satellite \"${spec.satellite}\" re-declared divergently from its persisted pairing marker ` +\n        `(persisted base=\"${prior.base}\" fieldsHash=${prior.fieldsHash}; declared base=\"${next.base}\" fieldsHash=${next.fieldsHash}). ` +\n        `Evolve the marker deliberately, don't redeclare.`,\n      )\n    }\n    return\n  }\n  const { persistSatelliteMarker } = await import('../persisted-schemas/register.js')\n  await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next })\n}\n","import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { SatelliteSpec } from './types.js'\nimport type { SatelliteRegistry } from './registry.js'\nimport { ensureSatelliteMarker } from './marker.js'\n\n/** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */\nexport async function postRegister(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec,\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n  baseSchema: unknown, registry: SatelliteRegistry,\n): Promise<void> {\n  try {\n    await ensureSatelliteMarker(store, vaultName, spec, await getDEK(spec.satellite))\n  } catch (err) {\n    registry.poison(spec.satellite, (err as Error).message); return\n  }\n  if (baseSchema !== undefined) {\n    try {\n      const { derivePersistedSchema } = await import('../persisted-schemas/derive.js')\n      const envelope = await derivePersistedSchema(baseSchema)\n      const properties = (envelope.jsonSchema as Record<string, unknown> | null)?.['properties'] as Record<string, unknown> | undefined\n      const baseFields: string[] = Object.keys(properties ?? {})\n      const overlap = spec.fields.filter(f => baseFields.includes(f))\n      if (overlap.length > 0) {\n        registry.poison(spec.satellite,\n          `R-S1: satellite \"${spec.satellite}\" fields overlap the base schema: ${overlap.join(', ')} — routing must be unambiguous.`)\n      }\n    } catch { /* non-derivable validator → cross-check unavailable, by design (spec R-S5) */ }\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,eAAsB,sBACpB,OAAmB,WAAmB,MAAqB,KAC5C;AAOf,QAAM,OAAsB;AAAA,IAC1B,MAAM,KAAK;AAAA,IAAM,YAAY,WAAW,KAAK,MAAM;AAAA,IAAG,QAAQ,KAAK;AAAA,IACnE,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,KAAK,WAAW,GAAG;AACjF,QAAM,QAAQ,WAAW;AACzB,MAAI,OAAO;AACT,QAAI,MAAM,SAAS,KAAK,QAAQ,MAAM,eAAe,KAAK,eAAe,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACxH,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,SAAS,gFACd,MAAM,IAAI,gBAAgB,MAAM,UAAU,oBAAoB,KAAK,IAAI,gBAAgB,KAAK,UAAU;AAAA,MAE5H;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,wBAAkC;AAClF,QAAM,uBAAuB,EAAE,OAAO,OAAO,WAAW,gBAAgB,KAAK,WAAW,KAAK,QAAQ,KAAK,CAAC;AAC7G;;;ACjCA,eAAsB,aACpB,OAAmB,WAAmB,MACtC,QACA,YAAqB,UACN;AACf,MAAI;AACF,UAAM,sBAAsB,OAAO,WAAW,MAAM,MAAM,OAAO,KAAK,SAAS,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,aAAS,OAAO,KAAK,WAAY,IAAc,OAAO;AAAG;AAAA,EAC3D;AACA,MAAI,eAAe,QAAW;AAC5B,QAAI;AACF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,sBAAgC;AAC/E,YAAM,WAAW,MAAM,sBAAsB,UAAU;AACvD,YAAM,aAAc,SAAS,aAAgD,YAAY;AACzF,YAAM,aAAuB,OAAO,KAAK,cAAc,CAAC,CAAC;AACzD,YAAM,UAAU,KAAK,OAAO,OAAO,OAAK,WAAW,SAAS,CAAC,CAAC;AAC9D,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS;AAAA,UAAO,KAAK;AAAA,UACnB,oBAAoB,KAAK,SAAS,qCAAqC,QAAQ,KAAK,IAAI,CAAC;AAAA,QAAiC;AAAA,MAC9H;AAAA,IACF,QAAQ;AAAA,IAAiF;AAAA,EAC3F;AACF;","names":[]}
+{"version":3,"sources":["../src/with-shape/satellites/marker.ts","../src/with-shape/satellites/post-register.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { SatelliteConfigError } from '../../kernel/errors.js'\nimport { hashFields } from './validate.js'\nimport type { PairingMarker, SatelliteSpec } from './types.js'\n\n/**\n * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.\n * First declaration writes { base, fieldsHash, joined }; later declarations\n * must match exactly or are refused (R-S9). Lazy imports keep the satellite\n * spine tree-shakeable (config-drift.ts pattern).\n */\nexport async function ensureSatelliteMarker(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec, dek: EnclaveKey,\n): Promise<void> {\n  // #597: `epoch` only matters the first time this marker is ever persisted —\n  // when a `prior` marker already exists below we return without ever using\n  // it, so re-declaring a LIVE collection never mints (or compares) a new\n  // epoch; the persisted one is carried forward untouched. Stamped here as a\n  // timestamp (mirrors `derivedAt` in persisted-schemas/register.ts) rather\n  // than a counter, since there's nothing to count from yet.\n  const next: PairingMarker = {\n    base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined,\n    epoch: new Date().toISOString(),\n  }\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek)\n  const prior = persisted?.satellite\n  if (prior) {\n    if (prior.base !== next.base || prior.fieldsHash !== next.fieldsHash || (prior.joined ?? null) !== (next.joined ?? null)) {\n      throw new SatelliteConfigError(\n        `R-S9: satellite \"${spec.satellite}\" re-declared divergently from its persisted pairing marker ` +\n        `(persisted base=\"${prior.base}\" fieldsHash=${prior.fieldsHash}; declared base=\"${next.base}\" fieldsHash=${next.fieldsHash}). ` +\n        `Evolve the marker deliberately, don't redeclare.`,\n      )\n    }\n    return\n  }\n  const { persistSatelliteMarker } = await import('../persisted-schemas/register.js')\n  await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next })\n}\n","import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { SatelliteSpec } from './types.js'\nimport type { SatelliteRegistry } from './registry.js'\nimport { ensureSatelliteMarker } from './marker.js'\n\n/** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */\nexport async function postRegister(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec,\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n  baseSchema: unknown, registry: SatelliteRegistry,\n): Promise<void> {\n  try {\n    await ensureSatelliteMarker(store, vaultName, spec, await getDEK(spec.satellite))\n  } catch (err) {\n    registry.poison(spec.satellite, (err as Error).message); return\n  }\n  if (baseSchema !== undefined) {\n    try {\n      const { derivePersistedSchema } = await import('../persisted-schemas/derive.js')\n      const envelope = await derivePersistedSchema(baseSchema)\n      const properties = (envelope.jsonSchema as Record<string, unknown> | null)?.['properties'] as Record<string, unknown> | undefined\n      const baseFields: string[] = Object.keys(properties ?? {})\n      const overlap = spec.fields.filter(f => baseFields.includes(f))\n      if (overlap.length > 0) {\n        registry.poison(spec.satellite,\n          `R-S1: satellite \"${spec.satellite}\" fields overlap the base schema: ${overlap.join(', ')} — routing must be unambiguous.`)\n      }\n    } catch { /* non-derivable validator → cross-check unavailable, by design (spec R-S5) */ }\n  }\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,sBACpB,OAAmB,WAAmB,MAAqB,KAC5C;AAOf,QAAM,OAAsB;AAAA,IAC1B,MAAM,KAAK;AAAA,IAAM,YAAY,WAAW,KAAK,MAAM;AAAA,IAAG,QAAQ,KAAK;AAAA,IACnE,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,KAAK,WAAW,GAAG;AACjF,QAAM,QAAQ,WAAW;AACzB,MAAI,OAAO;AACT,QAAI,MAAM,SAAS,KAAK,QAAQ,MAAM,eAAe,KAAK,eAAe,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACxH,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,SAAS,gFACd,MAAM,IAAI,gBAAgB,MAAM,UAAU,oBAAoB,KAAK,IAAI,gBAAgB,KAAK,UAAU;AAAA,MAE5H;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,wBAAkC;AAClF,QAAM,uBAAuB,EAAE,OAAO,OAAO,WAAW,gBAAgB,KAAK,WAAW,KAAK,QAAQ,KAAK,CAAC;AAC7G;;;ACjCA,eAAsB,aACpB,OAAmB,WAAmB,MACtC,QACA,YAAqB,UACN;AACf,MAAI;AACF,UAAM,sBAAsB,OAAO,WAAW,MAAM,MAAM,OAAO,KAAK,SAAS,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,aAAS,OAAO,KAAK,WAAY,IAAc,OAAO;AAAG;AAAA,EAC3D;AACA,MAAI,eAAe,QAAW;AAC5B,QAAI;AACF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,sBAAgC;AAC/E,YAAM,WAAW,MAAM,sBAAsB,UAAU;AACvD,YAAM,aAAc,SAAS,aAAgD,YAAY;AACzF,YAAM,aAAuB,OAAO,KAAK,cAAc,CAAC,CAAC;AACzD,YAAM,UAAU,KAAK,OAAO,OAAO,OAAK,WAAW,SAAS,CAAC,CAAC;AAC9D,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS;AAAA,UAAO,KAAK;AAAA,UACnB,oBAAoB,KAAK,SAAS,qCAAqC,QAAQ,KAAK,IAAI,CAAC;AAAA,QAAiC;AAAA,MAC9H;AAAA,IACF,QAAQ;AAAA,IAAiF;AAAA,EAC3F;AACF;","names":[]}

package/dist/{purge-scope-FGNNLWHD.js → purge-scope-4HEFPDOW.js}

@@ -1,5 +1,3 @@
-import "./chunk-PZ5AY32C.js";
-
 // src/with-audit/forget/purge-scope.ts
 function partitionSealedCekKeys(keys, prefix, scopedPurge, declared) {
   const matches = keys.filter((key) => key.startsWith(prefix));
@@ -21,4 +19,4 @@ export {
   residueNoticesFromMap,
   shouldSkipBlobScan
 };
-//# sourceMappingURL=purge-scope-FGNNLWHD.js.map
+//# sourceMappingURL=purge-scope-4HEFPDOW.js.map

package/dist/{purge-scope-FGNNLWHD.js.map → purge-scope-4HEFPDOW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-audit/forget/purge-scope.ts"],"sourcesContent":["/**\n * #633 — scoped-purge partitioning for the opt-in `scopedPurge` forget-strategy\n * knob (`strategy.ts`'s `SubjectDeclaration.scopedPurge`). Pure helpers only —\n * no store I/O, no `Vault`/`Collection` imports — kept out of `kernel/vault.ts`\n * (exact zero-slack `kernel-surface` ceiling) and free of any circular-import\n * risk with the kernel spine.\n *\n * The two `forget()` purge sites (`_sealed_cek` listing, blob shred) stay\n * UNCONDITIONAL by default (byte-identical to pre-#633 behavior); when\n * `scopedPurge` is `true`, each site calls into this module to decide what to\n * purge vs. what to leave in place + report as residue, keyed off a\n * per-collection declaration signal the caller (vault.ts) resolves itself:\n *   - sealed-CEK arm: `coll._via?.hasAtRestHooks === true` — the classified\n *     via binding's at-rest hooks (the \"richer\" declaration; a bare\n *     `sensitive` collection with NO classified binder does not count — it can\n *     still call `sealRecordToHost()` ad hoc, which is exactly the\n *     under-approximation #633 calls out).\n *   - blob arm: `this.blobFieldsRegistry.has(ref.collection)` — a collection\n *     can call `.blob(id)` regardless of this declaration (same\n *     under-approximation), which is why the default stays unconditional.\n *\n * @module\n */\nimport type { ScopedPurgeResidueReason } from './strategy.js'\n\n/**\n * Partitions an already-fetched vault-wide `_sealed_cek` key listing into\n * keys to purge vs. a skipped count, for ONE ref's `<collection>/<id>/`\n * prefix. No new store call — `keys` is the SAME listing the unconditional\n * path already fetched. Default parity: when `scopedPurge` is false, or\n * `declared` is true, every matching key is returned for purge and\n * `skippedCount` is 0 — byte-identical to the unconditional behavior.\n */\nexport function partitionSealedCekKeys(\n  keys: readonly string[],\n  prefix: string,\n  scopedPurge: boolean,\n  declared: boolean,\n): { readonly toPurge: readonly string[]; readonly skippedCount: number } {\n  const matches = keys.filter((key) => key.startsWith(prefix))\n  if (!scopedPurge || declared) return { toPurge: matches, skippedCount: 0 }\n  return { toPurge: [], skippedCount: matches.length }\n}\n\n/**\n * True when the blob arm should skip `ref.collection` entirely — no\n * `.blob(id).shredAllForRecord()` call AND no `_blob_slots_<collection>`\n * residue-detection `list()` call either (the perf win: scoped mode never\n * pays for a per-collection scan on a collection that never declared\n * `blobFields`).\n */\nexport function shouldSkipBlobScan(scopedPurge: boolean, declared: boolean): boolean {\n  return scopedPurge && !declared\n}\n\n/** Adds `count` (if positive) to `collection`'s running total in `map` — the\n *  per-collection residue accumulator both purge sites share. */\nexport function bumpResidueCount(map: Map<string, number>, collection: string, count: number): void {\n  if (count > 0) map.set(collection, (map.get(collection) ?? 0) + count)\n}\n\n/** Flattens an accumulated per-collection count map into `ForgetResult.scopedPurgeResidue` notices\n *  tagged with `reason`. Empty map → empty array (the unconditional-default case). */\nexport function residueNoticesFromMap(\n  map: ReadonlyMap<string, number>,\n  reason: ScopedPurgeResidueReason,\n): { readonly reason: ScopedPurgeResidueReason; readonly collection: string; readonly count: number }[] {\n  return [...map].map(([collection, count]) => ({ reason, collection, count }))\n}\n"],"mappings":";;;AAiCO,SAAS,uBACd,MACA,QACA,aACA,UACwE;AACxE,QAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,CAAC;AAC3D,MAAI,CAAC,eAAe,SAAU,QAAO,EAAE,SAAS,SAAS,cAAc,EAAE;AACzE,SAAO,EAAE,SAAS,CAAC,GAAG,cAAc,QAAQ,OAAO;AACrD;AASO,SAAS,mBAAmB,aAAsB,UAA4B;AACnF,SAAO,eAAe,CAAC;AACzB;AAIO,SAAS,iBAAiB,KAA0B,YAAoB,OAAqB;AAClG,MAAI,QAAQ,EAAG,KAAI,IAAI,aAAa,IAAI,IAAI,UAAU,KAAK,KAAK,KAAK;AACvE;AAIO,SAAS,sBACd,KACA,QACsG;AACtG,SAAO,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,QAAQ,YAAY,MAAM,EAAE;AAC9E;","names":[]}
+{"version":3,"sources":["../src/with-audit/forget/purge-scope.ts"],"sourcesContent":["/**\n * #633 — scoped-purge partitioning for the opt-in `scopedPurge` forget-strategy\n * knob (`strategy.ts`'s `SubjectDeclaration.scopedPurge`). Pure helpers only —\n * no store I/O, no `Vault`/`Collection` imports — kept out of `kernel/vault.ts`\n * (exact zero-slack `kernel-surface` ceiling) and free of any circular-import\n * risk with the kernel spine.\n *\n * The two `forget()` purge sites (`_sealed_cek` listing, blob shred) stay\n * UNCONDITIONAL by default (byte-identical to pre-#633 behavior); when\n * `scopedPurge` is `true`, each site calls into this module to decide what to\n * purge vs. what to leave in place + report as residue, keyed off a\n * per-collection declaration signal the caller (vault.ts) resolves itself:\n *   - sealed-CEK arm: `coll._via?.hasAtRestHooks === true` — the classified\n *     via binding's at-rest hooks (the \"richer\" declaration; a bare\n *     `sensitive` collection with NO classified binder does not count — it can\n *     still call `sealRecordToHost()` ad hoc, which is exactly the\n *     under-approximation #633 calls out).\n *   - blob arm: `this.blobFieldsRegistry.has(ref.collection)` — a collection\n *     can call `.blob(id)` regardless of this declaration (same\n *     under-approximation), which is why the default stays unconditional.\n *\n * @module\n */\nimport type { ScopedPurgeResidueReason } from './strategy.js'\n\n/**\n * Partitions an already-fetched vault-wide `_sealed_cek` key listing into\n * keys to purge vs. a skipped count, for ONE ref's `<collection>/<id>/`\n * prefix. No new store call — `keys` is the SAME listing the unconditional\n * path already fetched. Default parity: when `scopedPurge` is false, or\n * `declared` is true, every matching key is returned for purge and\n * `skippedCount` is 0 — byte-identical to the unconditional behavior.\n */\nexport function partitionSealedCekKeys(\n  keys: readonly string[],\n  prefix: string,\n  scopedPurge: boolean,\n  declared: boolean,\n): { readonly toPurge: readonly string[]; readonly skippedCount: number } {\n  const matches = keys.filter((key) => key.startsWith(prefix))\n  if (!scopedPurge || declared) return { toPurge: matches, skippedCount: 0 }\n  return { toPurge: [], skippedCount: matches.length }\n}\n\n/**\n * True when the blob arm should skip `ref.collection` entirely — no\n * `.blob(id).shredAllForRecord()` call AND no `_blob_slots_<collection>`\n * residue-detection `list()` call either (the perf win: scoped mode never\n * pays for a per-collection scan on a collection that never declared\n * `blobFields`).\n */\nexport function shouldSkipBlobScan(scopedPurge: boolean, declared: boolean): boolean {\n  return scopedPurge && !declared\n}\n\n/** Adds `count` (if positive) to `collection`'s running total in `map` — the\n *  per-collection residue accumulator both purge sites share. */\nexport function bumpResidueCount(map: Map<string, number>, collection: string, count: number): void {\n  if (count > 0) map.set(collection, (map.get(collection) ?? 0) + count)\n}\n\n/** Flattens an accumulated per-collection count map into `ForgetResult.scopedPurgeResidue` notices\n *  tagged with `reason`. Empty map → empty array (the unconditional-default case). */\nexport function residueNoticesFromMap(\n  map: ReadonlyMap<string, number>,\n  reason: ScopedPurgeResidueReason,\n): { readonly reason: ScopedPurgeResidueReason; readonly collection: string; readonly count: number }[] {\n  return [...map].map(([collection, count]) => ({ reason, collection, count }))\n}\n"],"mappings":";AAiCO,SAAS,uBACd,MACA,QACA,aACA,UACwE;AACxE,QAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,CAAC;AAC3D,MAAI,CAAC,eAAe,SAAU,QAAO,EAAE,SAAS,SAAS,cAAc,EAAE;AACzE,SAAO,EAAE,SAAS,CAAC,GAAG,cAAc,QAAQ,OAAO;AACrD;AASO,SAAS,mBAAmB,aAAsB,UAA4B;AACnF,SAAO,eAAe,CAAC;AACzB;AAIO,SAAS,iBAAiB,KAA0B,YAAoB,OAAqB;AAClG,MAAI,QAAQ,EAAG,KAAI,IAAI,aAAa,IAAI,IAAI,UAAU,KAAK,KAAK,KAAK;AACvE;AAIO,SAAS,sBACd,KACA,QACsG;AACtG,SAAO,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,QAAQ,YAAY,MAAM,EAAE;AAC9E;","names":[]}

package/dist/query/index.js

@@ -4,12 +4,12 @@ import {
   ScanBuilder,
   buildLiveQuery,
   executePlan
-} from "../chunk-LAI7ENPW.js";
+} from "../chunk-7MG2LHO5.js";
 import {
   DEFAULT_JOIN_MAX_ROWS,
   applyJoins,
   resetJoinWarnings
-} from "../chunk-AW4KTQA4.js";
+} from "../chunk-ZORTV6NH.js";
 import {
   CollectionIndexes
 } from "../chunk-I3ISCYT7.js";
@@ -29,8 +29,7 @@ import {
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   CollectionIndexes,
   CrossJoinSourceUnknownError,

package/dist/{read-only-facade-CHCKSEPD.js → read-only-facade-BIGO37U3.js}

@@ -1,8 +1,7 @@
 import {
   ReadOnlyVaultFacade
 } from "./chunk-JK733I5V.js";
-import "./chunk-PZ5AY32C.js";
 export {
   ReadOnlyVaultFacade
 };
-//# sourceMappingURL=read-only-facade-CHCKSEPD.js.map
+//# sourceMappingURL=read-only-facade-BIGO37U3.js.map

package/dist/reduce/index.js

@@ -9,7 +9,7 @@ import {
   groupAndReduce,
   reduceRecords,
   resetGroupByWarnings
-} from "../chunk-4U52PMEL.js";
+} from "../chunk-ZN4FD4PE.js";
 import "../chunk-XZHEOSQ2.js";
 import {
   NO_REDUCE
@@ -26,10 +26,9 @@ import {
   sum
 } from "../chunk-ATL3ZVXT.js";
 import "../chunk-NSITFOCJ.js";
-import "../chunk-DIVY2CJZ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-7O3Y4PPD.js";
 
 // src/with-lookup/reduce/active.ts
 function withReduce() {

package/dist/reduce/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-lookup/reduce/active.ts"],"sourcesContent":["/**\n * Active aggregate strategy factory. Calling `withReduce()` returns\n * an `ReduceStrategy` whose methods construct real `Reduction` /\n * `GroupedQuery` instances and run the streaming reducer protocol.\n *\n * This module is only reachable through the `@noy-db/hub/reduce`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { Reduction, reduceRecords } from './reduction.js'\nimport type { ReduceSpec, ReduceResult } from './reduction.js'\nimport { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { ReduceStrategy } from './strategy.js'\n\n/**\n * Build the default aggregate strategy. Pass into\n * `createNoydb({ reduceStrategy: withReduce() })` to light up\n * `.aggregate()` and `.groupBy()` on `Query` and `ScanBuilder`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withReduce, sum, count } from '@noy-db/hub/reduce'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   reduceStrategy: withReduce(),\n * })\n *\n * const totals = invoices.query()\n *   .where('status', '==', 'paid')\n *   .groupBy('clientId')\n *   .aggregate({ amount: sum('amount'), n: count() })\n *   .run()\n * ```\n */\nexport function withReduce(): ReduceStrategy {\n  return {\n    aggregate(executeRecords, spec, upstreams) {\n      return new Reduction(executeRecords, spec as unknown as ReduceSpec, upstreams) as unknown as Reduction<ReduceResult<typeof spec>>\n    },\n    groupBy(executeRecords, field, upstreams, dictLabelResolver, via) {\n      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver, via)\n    },\n    groupByN(executeRecords, fields, upstreams, via) {\n      return new GroupedQueryN(executeRecords, fields, upstreams, undefined, via)\n    },\n    async scanAggregate(iter, spec) {\n      const collected: unknown[] = []\n      for await (const record of iter) collected.push(record)\n      return reduceRecords(collected, spec as unknown as ReduceSpec) as unknown as ReduceResult<typeof spec>\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,UAAU,gBAAgB,MAAM,WAAW;AACzC,aAAO,IAAI,UAAU,gBAAgB,MAA+B,SAAS;AAAA,IAC/E;AAAA,IACA,QAAQ,gBAAgB,OAAO,WAAW,mBAAmB,KAAK;AAChE,aAAO,IAAI,aAAa,gBAAgB,OAAO,WAAW,mBAAmB,GAAG;AAAA,IAClF;AAAA,IACA,SAAS,gBAAgB,QAAQ,WAAW,KAAK;AAC/C,aAAO,IAAI,cAAc,gBAAgB,QAAQ,WAAW,QAAW,GAAG;AAAA,IAC5E;AAAA,IACA,MAAM,cAAc,MAAM,MAAM;AAC9B,YAAM,YAAuB,CAAC;AAC9B,uBAAiB,UAAU,KAAM,WAAU,KAAK,MAAM;AACtD,aAAO,cAAc,WAAW,IAA6B;AAAA,IAC/D;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-lookup/reduce/active.ts"],"sourcesContent":["/**\n * Active aggregate strategy factory. Calling `withReduce()` returns\n * an `ReduceStrategy` whose methods construct real `Reduction` /\n * `GroupedQuery` instances and run the streaming reducer protocol.\n *\n * This module is only reachable through the `@noy-db/hub/reduce`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { Reduction, reduceRecords } from './reduction.js'\nimport type { ReduceSpec, ReduceResult } from './reduction.js'\nimport { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { ReduceStrategy } from './strategy.js'\n\n/**\n * Build the default aggregate strategy. Pass into\n * `createNoydb({ reduceStrategy: withReduce() })` to light up\n * `.aggregate()` and `.groupBy()` on `Query` and `ScanBuilder`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withReduce, sum, count } from '@noy-db/hub/reduce'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   reduceStrategy: withReduce(),\n * })\n *\n * const totals = invoices.query()\n *   .where('status', '==', 'paid')\n *   .groupBy('clientId')\n *   .aggregate({ amount: sum('amount'), n: count() })\n *   .run()\n * ```\n */\nexport function withReduce(): ReduceStrategy {\n  return {\n    aggregate(executeRecords, spec, upstreams) {\n      return new Reduction(executeRecords, spec as unknown as ReduceSpec, upstreams) as unknown as Reduction<ReduceResult<typeof spec>>\n    },\n    groupBy(executeRecords, field, upstreams, dictLabelResolver, via) {\n      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver, via)\n    },\n    groupByN(executeRecords, fields, upstreams, via) {\n      return new GroupedQueryN(executeRecords, fields, upstreams, undefined, via)\n    },\n    async scanAggregate(iter, spec) {\n      const collected: unknown[] = []\n      for await (const record of iter) collected.push(record)\n      return reduceRecords(collected, spec as unknown as ReduceSpec) as unknown as ReduceResult<typeof spec>\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,UAAU,gBAAgB,MAAM,WAAW;AACzC,aAAO,IAAI,UAAU,gBAAgB,MAA+B,SAAS;AAAA,IAC/E;AAAA,IACA,QAAQ,gBAAgB,OAAO,WAAW,mBAAmB,KAAK;AAChE,aAAO,IAAI,aAAa,gBAAgB,OAAO,WAAW,mBAAmB,GAAG;AAAA,IAClF;AAAA,IACA,SAAS,gBAAgB,QAAQ,WAAW,KAAK;AAC/C,aAAO,IAAI,cAAc,gBAAgB,QAAQ,WAAW,QAAW,GAAG;AAAA,IAC5E;AAAA,IACA,MAAM,cAAc,MAAM,MAAM;AAC9B,YAAM,YAAuB,CAAC;AAC9B,uBAAiB,UAAU,KAAM,WAAU,KAAK,MAAM;AACtD,aAAO,cAAc,WAAW,IAA6B;AAAA,IAC/D;AAAA,EACF;AACF;","names":[]}

package/dist/register-I2DZXGAR.js

@@ -0,0 +1,31 @@
+import {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+} from "./chunk-K6LHRFBL.js";
+import "./chunk-ZVF37PKE.js";
+import "./chunk-VXGSWL6L.js";
+import "./chunk-EPFF7LOX.js";
+import "./chunk-453F654R.js";
+import "./chunk-REDOOY2Q.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-2Y4IMKA6.js";
+import "./chunk-GHVIKOHT.js";
+import "./chunk-L742JPKZ.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-BOET4NA4.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+};
+//# sourceMappingURL=register-I2DZXGAR.js.map

package/dist/registry-23WF3TGH.js

@@ -0,0 +1,8 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-Q2PU57HC.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-23WF3TGH.js.map

package/dist/registry-4AYVUNXK.js

@@ -0,0 +1,8 @@
+import {
+  GuardRegistry
+} from "./chunk-DGOZ4UZD.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  GuardRegistry
+};
+//# sourceMappingURL=registry-4AYVUNXK.js.map

package/dist/registry-VSSQPIGF.js

@@ -0,0 +1,18 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-QIBVIOXO.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-VSSQPIGF.js.map