@noy-db/hub 0.7.0-pre.9 → 0.7.1-pre.0

package/dist/kernel/match-pairs.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Kernel-side matching primitives for composite `triggerBy` fan-out (#1249).
+ *
+ * Lives in the kernel (not `with-formula/derivations/`) so `collection.ts` can
+ * import it statically without dragging derivations code into the floor
+ * bundle — the module used to be dynamically imported from `collection.ts`
+ * while also being statically imported by `registry.ts`/`dispatch.ts`,
+ * which merged it into a chunk that `dist/index.js` ended up pulling in
+ * statically.
+ * @module
+ */
+/** Conjunction over one candidate record, same coercion as tupleFromWritten. */
+export declare function recordMatchesPairs(rec: Record<string, unknown>, pairs: ReadonlyArray<{
+    field: string;
+    value: string;
+}>): boolean;
+/** Scan/filter core for composite fan-out. `residualPairs` are the pairs NOT
+ *  already decided by `indexCandidates` (the id set from an equality index for
+ *  ONE pair, or null when no pair is indexed). When the index alone decides
+ *  membership (`indexCandidates` non-null and no residual pairs left), this
+ *  returns the index's answer verbatim with ZERO record reads — matching the
+ *  old single-field `_findMatchingIds`' `[...hit]` fast path exactly. */
+export declare function findMatchingIdsByPairs(residualPairs: ReadonlyArray<{
+    field: string;
+    value: string;
+}>, io: {
+    indexCandidates: ReadonlyArray<string> | null;
+    listIds: () => Promise<ReadonlyArray<string>>;
+    getRecord: (id: string) => Promise<Record<string, unknown> | null>;
+}): Promise<string[]>;

package/dist/kernel/memory-store.d.ts

@@ -1,17 +1,45 @@
 import type { NoydbStore } from './types.js';
+/** Options for {@link memoryStore}. */
+export interface MemoryStoreOptions {
+    /**
+     * Implement the OPTIONAL half of the store contract — `listVaults`,
+     * `ping`, `tx` — and declare `txAtomic`. Off by default: see the note on
+     * {@link memoryStore} for why the zero-config store must stay a bare core.
+     *
+     * Also switches the store clock to monotonic wall-clock milliseconds,
+     * which is what makes {@link MemoryStoreOptions.clockUncertaintyMs} an
+     * honest unit.
+     */
+    readonly full?: boolean;
+    /**
+     * Widen the interval `getStoreTime()` returns by ±this many milliseconds,
+     * to exercise the commit-wait path in deferred numbering. Default 0 (exact).
+     *
+     * Requires `full: true` — against the default's counter clock a millisecond
+     * epsilon is meaningless, so passing it alone is rejected rather than
+     * silently ignored.
+     */
+    readonly clockUncertaintyMs?: number;
+}
 /**
  * Built-in in-memory store — the kernel's zero-config default.
  *
  * Nested `Map`s: `vault → collection → id → envelope`. Non-persistent
- * (data is lost on process exit). A conformant 6-method {@link NoydbStore}
- * with CAS atomicity and a monotonic store clock — the kernel version of
- * `@noy-db/to-memory`'s core, so `createNoydb()` works with no store package.
+ * (data is lost on process exit). A conformant {@link NoydbStore} with CAS
+ * atomicity and a monotonic store clock, so `createNoydb()` works with no
+ * store package at all.
  *
  * Portable: imports only `types` + `errors` (no crypto primitive) — passes
  * the `stores-ciphertext-only` architecture guard.
  *
- * Implements the 6-method core only (no optional `listVaults`/`ping`/`tx`),
- * so `Noydb.listAccessibleVaults()` throws its documented capability error
- * rather than enumerating vaults under the default store.
+ * ## Why the default is a bare 6-method core
+ *
+ * Called with no options it implements the 6-method core ONLY, so
+ * `Noydb.listAccessibleVaults()` throws its documented capability error
+ * rather than enumerating vaults under a store the caller never chose. That
+ * omission is a decision, not a gap — do not "complete" it. `full: true` is
+ * how a caller opts into the optional half, and
+ * `__tests__/memory-store-full.test.ts` guards the default against exactly
+ * that well-meaning change.
  */
-export declare function memoryStore(): NoydbStore;
+export declare function memoryStore(options?: MemoryStoreOptions): NoydbStore;

package/dist/kernel/types.d.ts

@@ -3088,6 +3088,45 @@ export interface HistoryConfig {
      * confining tamper-evidence to the collections where it carries weight.
      * Independent of `enabled`, which gates per-record snapshots. Has no
      * effect when `withHistory()` is not active (there is no ledger).
+     *
+     * ## Cost — scope this deliberately (#1248)
+     *
+     * **The chain is the entire cost of history; per-record snapshots are
+     * free.** Measured on the primitive write path (one small collection, no
+     * guards / MVs / derivations, sequential `put()`, in-memory store,
+     * N = 3000):
+     *
+     * | config | µs/write | vs no history |
+     * |---|---|---|
+     * | no `withHistory()` | 137 | 1.00× |
+     * | `enabled: true, ledger: false` | 137 | **1.00×** |
+     * | `enabled: false, ledger: true` | 322 | 2.35× |
+     * | both (default) | 330 | **2.41×** |
+     *
+     * The cause is structural, not an inefficiency to tune away: an entry's
+     * `prevHash` depends on the current head, so appends are **inherently
+     * serialized** — one head read, one delta encryption and one CAS-put per
+     * record op. That serialization IS the tamper-evidence property.
+     *
+     * ⚠️ **The µs figures understate the felt cost on a real store.** They come
+     * from an in-memory store where the base op is ~137µs. On browser IndexedDB
+     * — or any store whose base op is milliseconds — the ledger adds a whole
+     * extra encrypted store write plus a hash to a path that was already
+     * ms-scale. **Treat the ~2.4× RATIO as the portable number and the
+     * microseconds as a floor**, not as the cost you will observe.
+     *
+     * ## What that means in practice
+     *
+     * A single human-paced write (someone saving a record) pays a difference
+     * nobody perceives. What pays visibly is a **one-click batch** — an
+     * "approve all", a CSV import, a period prefill — where tens to hundreds of
+     * writes land together and a 2.4× turns a multi-second action into a longer
+     * one. A write that fans out through derivations and materialized views
+     * pays once per resulting stored write, not once per user action.
+     *
+     * `HistoryConfig` is per-collection precisely so the chain can be confined
+     * to the collections where tamper-evidence carries weight, rather than
+     * being an all-or-nothing vault-wide toggle.
      */
     readonly ledger?: boolean;
 }

package/dist/lazy/index.js

@@ -1,10 +1,10 @@
 import {
   withLazy
-} from "../chunk-THNJ3IKU.js";
+} from "../chunk-ULUMAZ5S.js";
 import {
   IMPLICIT_LAZY
-} from "../chunk-NO272T7Q.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-66TQOPFM.js";
+import "../chunk-V4PXLYWM.js";
 export {
   IMPLICIT_LAZY,
   withLazy

package/dist/{ledger-ZAFULLAF.js → ledger-EDXFFZQL.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-OKCQNMO6.js";
+} from "./chunk-V7ZRRCRJ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,17 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-JRWLUWDM.js";
-import "./chunk-DOPZWTMJ.js";
-import "./chunk-4RUFYGWG.js";
-import "./chunk-XGXVPCYW.js";
-import "./chunk-CWFH36SI.js";
-import "./chunk-KZTPL7NL.js";
+} from "./chunk-QPQUVOZ2.js";
+import "./chunk-4ZS56W5S.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BRLKZUBT.js";
+import "./chunk-BTDR2PXY.js";
+import "./chunk-CHQCZZWC.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-USKHHOIV.js";
-import "./chunk-N4CHCXDL.js";
-import "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+import "./chunk-HPVZCW43.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -39,4 +38,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-ZAFULLAF.js.map
+//# sourceMappingURL=ledger-EDXFFZQL.js.map

package/dist/liberate-V35QUHJP.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-2N5ML6HT.js";
+import "./chunk-3BVH633C.js";
+import "./chunk-JVIBCBC7.js";
+import "./chunk-4GVM6QZA.js";
+import "./chunk-BVN6KXL2.js";
+import "./chunk-EQEYOJBM.js";
+import "./chunk-3V4KWFX7.js";
+import "./chunk-XKWGNJ26.js";
+import "./chunk-JMGDHKQF.js";
+import "./chunk-4ZS56W5S.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BRLKZUBT.js";
+import "./chunk-BTDR2PXY.js";
+import "./chunk-CHQCZZWC.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HPVZCW43.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-V35QUHJP.js.map

package/dist/link-set-2TTM3IZC.js

@@ -0,0 +1,30 @@
+import {
+  LinkEndpointError,
+  LinkSet
+} from "./chunk-OTQZ7ZWU.js";
+import {
+  LINK_COLLECTION_PREFIX,
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-QIZPZMUI.js";
+import "./chunk-4ZS56W5S.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BRLKZUBT.js";
+import "./chunk-BTDR2PXY.js";
+import "./chunk-CHQCZZWC.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HPVZCW43.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  LINK_COLLECTION_PREFIX,
+  LinkEndpointError,
+  LinkIntegrityError,
+  LinkSet,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+};
+//# sourceMappingURL=link-set-2TTM3IZC.js.map

package/dist/{managed-secret-7OH7HKXV.js → managed-secret-NCWEMPUQ.js}

@@ -9,17 +9,16 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-JUBWUJY5.js";
-import "./chunk-DOPZWTMJ.js";
-import "./chunk-4RUFYGWG.js";
-import "./chunk-XGXVPCYW.js";
-import "./chunk-CWFH36SI.js";
-import "./chunk-KZTPL7NL.js";
+} from "./chunk-4GVM6QZA.js";
+import "./chunk-4ZS56W5S.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BRLKZUBT.js";
+import "./chunk-BTDR2PXY.js";
+import "./chunk-CHQCZZWC.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-USKHHOIV.js";
-import "./chunk-N4CHCXDL.js";
-import "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+import "./chunk-HPVZCW43.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,
@@ -32,4 +31,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-7OH7HKXV.js.map
+//# sourceMappingURL=managed-secret-NCWEMPUQ.js.map

package/dist/materialized-views/index.js

@@ -1,49 +1,49 @@
 import {
   withMaterializedView
-} from "../chunk-UL7TLJ54.js";
+} from "../chunk-HJUWN7JN.js";
 import {
   MaterializedViewExecutor
-} from "../chunk-3SWP2FYA.js";
+} from "../chunk-KKEESNPE.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
   canonicalizeQueryPlan,
   computeQueryHash,
   summarizeQueryPlan
-} from "../chunk-75WNTBZL.js";
+} from "../chunk-PPTHY5QO.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-MENI33ZV.js";
-import "../chunk-U3RMWOXY.js";
-import "../chunk-FRIVOR5N.js";
+} from "../chunk-ZHKOPKE3.js";
+import "../chunk-VXANTWBJ.js";
+import "../chunk-3BZZJJMQ.js";
+import "../chunk-R7BX2NB3.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-AW4KTQA4.js";
-import "../chunk-4U52PMEL.js";
+import "../chunk-ZORTV6NH.js";
+import "../chunk-ZN4FD4PE.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import "../chunk-NSITFOCJ.js";
-import "../chunk-TQGT5BZE.js";
-import "../chunk-DIVY2CJZ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-Q2MPFCQ7.js";
+import "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-QPQUVOZ2.js";
+import "../chunk-4ZS56W5S.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BRLKZUBT.js";
+import "../chunk-BTDR2PXY.js";
+import "../chunk-CHQCZZWC.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
-import "../chunk-N4CHCXDL.js";
+import "../chunk-HPVZCW43.js";
+import "../chunk-7MG7SJT7.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError,
   MaterializedViewTooLargeError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   MaterializedViewConfigError,
   MaterializedViewCycleError,

package/dist/{migrate-cek-QHZ75E6E.js → migrate-cek-5ENH64AA.js}

@@ -1,7 +1,6 @@
 import {
   SatelliteConfigError
-} from "./chunk-SW4TOSJL.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-shape/satellites/migrate-cek.ts
 async function migrateSatelliteCek(name, coll) {
@@ -16,4 +15,4 @@ async function migrateSatelliteCek(name, coll) {
 export {
   migrateSatelliteCek
 };
-//# sourceMappingURL=migrate-cek-QHZ75E6E.js.map
+//# sourceMappingURL=migrate-cek-5ENH64AA.js.map

package/dist/{migrate-cek-QHZ75E6E.js.map → migrate-cek-5ENH64AA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/satellites/migrate-cek.ts"],"sourcesContent":["/**\n * Satellite per-record-CEK migration (#599) — the R-S7 retro-coverage\n * unblock.\n *\n * R-S7 (`declare.ts:89-91`) correctly refuses declaring/redeclaring a\n * satellite of a forget-covered base without `perRecordKeys: true` — but\n * `perRecordKeys` is construction-only (`kernel/collection.ts:402`), so an\n * app that shipped a satellite BEFORE its base gained forget coverage has\n * no way past the refusal: the existing records must be re-encrypted under\n * fresh per-record CEKs before the satellite can reopen in\n * `perRecordKeys: true` mode, and the only re-encrypt primitive\n * (`Collection._applyCutoverTransform`) needs the collection already\n * constructed in that mode — chicken-and-egg.\n *\n * The break: `Vault.migrateSatellitePerRecordKeys` (`kernel/vault.ts`)\n * opens the satellite collection via `vault.collection(name, {\n * perRecordKeys: true })` WITHOUT `satelliteOf` — that never enters\n * `declareSatellite`, so R-S7's gate (which only fires on the `satelliteOf`\n * declaration path) never runs for the migration pass. R-S7 stays fully\n * enforced for every NORMAL `satelliteOf` declaration; this module and its\n * call-site never touch `declare.ts`.\n *\n * `migrateSatelliteCek` then reuses `_applyCutoverTransform` verbatim (an\n * identity transform — no field/shape change, only the encryption wrapper\n * changes) rather than duplicating its mint-or-reuse-CEK logic\n * (`resolveRecordCek`/`resolveStableCek`, `collection.ts:2537-2545`): a\n * record with no `_cek` yet gets a freshly minted per-record CEK; a record\n * that already carries `_cek` (already migrated, e.g. a prior interrupted\n * run) reuses its existing CEK unchanged. That mint-or-reuse discrimination\n * is what makes re-running this after a mid-migration failure safe for\n * free — no separate resumability marker needed, no double-mint, no\n * plaintext write, no shared-DEK write.\n *\n * **Mode-assertion guard (review Important 1):** `perRecordKeys` is\n * construction-only and the vault's collection cache is first-wins with no\n * mismatch guard. If `coll`'s name was already opened THIS SESSION without\n * `perRecordKeys` (e.g. an incidental bare `vault.collection(name)` call\n * before the migration ran), `vault.collection(name, { perRecordKeys: true\n * })` cache-HITS that instance instead of constructing a fresh one — the\n * returned handle is silently NOT in per-record-CEK mode. Without a check,\n * `_applyCutoverTransform` would then pass `cek: undefined` for every\n * record (`this.perRecordCek` false) and RE-ENCRYPT EVERY RECORD UNDER THE\n * SHARED COLLECTION DEK while still reporting `{ migrated: N }` as success\n * — a security migration that silently mints nothing. `migrateSatelliteCek`\n * reads the opened handle's own `getConfig()` (the same accessor\n * `dumpSchema()` uses) to confirm `perRecordKeys` is genuinely `true`\n * before walking, and throws `SatelliteConfigError` instead of proceeding\n * if not.\n *\n * **No-quiesce precondition (review Important 2):** `_applyCutoverTransform`\n * is documented as fence-phase-only (`collection.ts:2517-2522`) — the\n * generic schema-cutover caller (`Vault.runSchemaCutover` →\n * `SchemaFenceController`) always runs it under the vault-wide schema fence,\n * which blocks concurrent writes. This migration does NOT fence: it calls\n * `_applyCutoverTransform` directly, with no fence and CAS-less\n * (`adapter.put` with no `expectedVersion`) writes. A concurrent write to\n * the same satellite collection racing the walk's `await`s can be\n * clobbered by (or clobber) a migration write. Callers MUST run this before\n * the collection serves traffic — e.g. at v2 boot, before declaring the\n * pair, before any client can write — or otherwise ensure the vault is\n * quiescent for this collection for the duration of the call.\n */\nimport { SatelliteConfigError } from '../../kernel/errors.js'\n\n/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */\nexport interface SatelliteCekMigrationTarget {\n  /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */\n  getConfig(): { readonly perRecordKeys?: boolean } | undefined\n  _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>\n}\n\nexport interface SatelliteCekMigrationResult {\n  /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */\n  readonly migrated: number\n}\n\n/**\n * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be\n * a collection handle already opened with `perRecordKeys: true` — see the\n * file header for how the caller gets one past R-S7. Throws\n * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in\n * per-record-CEK mode — see the file header's mode-assertion note.\n * Idempotent/resumable: safe to call again after a partial failure. NOT\n * fenced against concurrent writers — see the file header's no-quiesce\n * precondition; run this before the collection serves traffic.\n *\n * @param name The satellite collection's name — used only for the error\n *   message below; identical to what the caller passed to `vault.collection()`.\n */\nexport async function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult> {\n  if (coll.getConfig()?.perRecordKeys !== true) {\n    throw new SatelliteConfigError(\n      `migrateSatellitePerRecordKeys: collection \"${name}\" was already opened this session without ` +\n      `perRecordKeys (construction-only); migrate before its first open, or restart the session.`,\n    )\n  }\n  // Ledger reason (review Minor): the walk below reuses _applyCutoverTransform's\n  // hardcoded 'schema:coordinated-cutover' ledger reason — it has no reason/label\n  // param, and this migration is not itself a schema cutover. Not threaded through\n  // (would touch collection.ts's own ceilinged surface for a cosmetic label);\n  // flagged here so the audit trail's shared reason string is documented, not silent.\n  const migrated = await coll._applyCutoverTransform((doc) => doc)\n  return { migrated }\n}\n"],"mappings":";;;;;;AAyFA,eAAsB,oBAAoB,MAAc,MAAyE;AAC/H,MAAI,KAAK,UAAU,GAAG,kBAAkB,MAAM;AAC5C,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI;AAAA,IAEpD;AAAA,EACF;AAMA,QAAM,WAAW,MAAM,KAAK,uBAAuB,CAAC,QAAQ,GAAG;AAC/D,SAAO,EAAE,SAAS;AACpB;","names":[]}
+{"version":3,"sources":["../src/with-shape/satellites/migrate-cek.ts"],"sourcesContent":["/**\n * Satellite per-record-CEK migration (#599) — the R-S7 retro-coverage\n * unblock.\n *\n * R-S7 (`declare.ts:89-91`) correctly refuses declaring/redeclaring a\n * satellite of a forget-covered base without `perRecordKeys: true` — but\n * `perRecordKeys` is construction-only (`kernel/collection.ts:402`), so an\n * app that shipped a satellite BEFORE its base gained forget coverage has\n * no way past the refusal: the existing records must be re-encrypted under\n * fresh per-record CEKs before the satellite can reopen in\n * `perRecordKeys: true` mode, and the only re-encrypt primitive\n * (`Collection._applyCutoverTransform`) needs the collection already\n * constructed in that mode — chicken-and-egg.\n *\n * The break: `Vault.migrateSatellitePerRecordKeys` (`kernel/vault.ts`)\n * opens the satellite collection via `vault.collection(name, {\n * perRecordKeys: true })` WITHOUT `satelliteOf` — that never enters\n * `declareSatellite`, so R-S7's gate (which only fires on the `satelliteOf`\n * declaration path) never runs for the migration pass. R-S7 stays fully\n * enforced for every NORMAL `satelliteOf` declaration; this module and its\n * call-site never touch `declare.ts`.\n *\n * `migrateSatelliteCek` then reuses `_applyCutoverTransform` verbatim (an\n * identity transform — no field/shape change, only the encryption wrapper\n * changes) rather than duplicating its mint-or-reuse-CEK logic\n * (`resolveRecordCek`/`resolveStableCek`, `collection.ts:2537-2545`): a\n * record with no `_cek` yet gets a freshly minted per-record CEK; a record\n * that already carries `_cek` (already migrated, e.g. a prior interrupted\n * run) reuses its existing CEK unchanged. That mint-or-reuse discrimination\n * is what makes re-running this after a mid-migration failure safe for\n * free — no separate resumability marker needed, no double-mint, no\n * plaintext write, no shared-DEK write.\n *\n * **Mode-assertion guard (review Important 1):** `perRecordKeys` is\n * construction-only and the vault's collection cache is first-wins with no\n * mismatch guard. If `coll`'s name was already opened THIS SESSION without\n * `perRecordKeys` (e.g. an incidental bare `vault.collection(name)` call\n * before the migration ran), `vault.collection(name, { perRecordKeys: true\n * })` cache-HITS that instance instead of constructing a fresh one — the\n * returned handle is silently NOT in per-record-CEK mode. Without a check,\n * `_applyCutoverTransform` would then pass `cek: undefined` for every\n * record (`this.perRecordCek` false) and RE-ENCRYPT EVERY RECORD UNDER THE\n * SHARED COLLECTION DEK while still reporting `{ migrated: N }` as success\n * — a security migration that silently mints nothing. `migrateSatelliteCek`\n * reads the opened handle's own `getConfig()` (the same accessor\n * `dumpSchema()` uses) to confirm `perRecordKeys` is genuinely `true`\n * before walking, and throws `SatelliteConfigError` instead of proceeding\n * if not.\n *\n * **No-quiesce precondition (review Important 2):** `_applyCutoverTransform`\n * is documented as fence-phase-only (`collection.ts:2517-2522`) — the\n * generic schema-cutover caller (`Vault.runSchemaCutover` →\n * `SchemaFenceController`) always runs it under the vault-wide schema fence,\n * which blocks concurrent writes. This migration does NOT fence: it calls\n * `_applyCutoverTransform` directly, with no fence and CAS-less\n * (`adapter.put` with no `expectedVersion`) writes. A concurrent write to\n * the same satellite collection racing the walk's `await`s can be\n * clobbered by (or clobber) a migration write. Callers MUST run this before\n * the collection serves traffic — e.g. at v2 boot, before declaring the\n * pair, before any client can write — or otherwise ensure the vault is\n * quiescent for this collection for the duration of the call.\n */\nimport { SatelliteConfigError } from '../../kernel/errors.js'\n\n/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */\nexport interface SatelliteCekMigrationTarget {\n  /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */\n  getConfig(): { readonly perRecordKeys?: boolean } | undefined\n  _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>\n}\n\nexport interface SatelliteCekMigrationResult {\n  /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */\n  readonly migrated: number\n}\n\n/**\n * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be\n * a collection handle already opened with `perRecordKeys: true` — see the\n * file header for how the caller gets one past R-S7. Throws\n * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in\n * per-record-CEK mode — see the file header's mode-assertion note.\n * Idempotent/resumable: safe to call again after a partial failure. NOT\n * fenced against concurrent writers — see the file header's no-quiesce\n * precondition; run this before the collection serves traffic.\n *\n * @param name The satellite collection's name — used only for the error\n *   message below; identical to what the caller passed to `vault.collection()`.\n */\nexport async function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult> {\n  if (coll.getConfig()?.perRecordKeys !== true) {\n    throw new SatelliteConfigError(\n      `migrateSatellitePerRecordKeys: collection \"${name}\" was already opened this session without ` +\n      `perRecordKeys (construction-only); migrate before its first open, or restart the session.`,\n    )\n  }\n  // Ledger reason (review Minor): the walk below reuses _applyCutoverTransform's\n  // hardcoded 'schema:coordinated-cutover' ledger reason — it has no reason/label\n  // param, and this migration is not itself a schema cutover. Not threaded through\n  // (would touch collection.ts's own ceilinged surface for a cosmetic label);\n  // flagged here so the audit trail's shared reason string is documented, not silent.\n  const migrated = await coll._applyCutoverTransform((doc) => doc)\n  return { migrated }\n}\n"],"mappings":";;;;;AAyFA,eAAsB,oBAAoB,MAAc,MAAyE;AAC/H,MAAI,KAAK,UAAU,GAAG,kBAAkB,MAAM;AAC5C,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI;AAAA,IAEpD;AAAA,EACF;AAMA,QAAM,WAAW,MAAM,KAAK,uBAAuB,CAAC,QAAQ,GAAG;AAC/D,SAAO,EAAE,SAAS;AACpB;","names":[]}

package/dist/money/index.js

@@ -4,7 +4,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "../chunk-DNMTN46H.js";
+} from "../chunk-GY4WYNNG.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -13,11 +13,10 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "../chunk-U3RMWOXY.js";
+} from "../chunk-VXANTWBJ.js";
 import "../chunk-NSITFOCJ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-7O3Y4PPD.js";
 export {
   MoneyCurrencyError,
   MoneyPrecisionError,

package/dist/noydb-62MX4QUG.js

@@ -0,0 +1,90 @@
+import {
+  Noydb,
+  createNoydb
+} from "./chunk-ZYIYHJ5R.js";
+import "./chunk-EPFF7LOX.js";
+import "./chunk-QIZPZMUI.js";
+import "./chunk-TUFM4UZP.js";
+import "./chunk-SMH6SRX7.js";
+import "./chunk-453F654R.js";
+import "./chunk-UP4BECPY.js";
+import "./chunk-GYGLAVCX.js";
+import "./chunk-6LJY7X5A.js";
+import "./chunk-Q7HZX3IF.js";
+import "./chunk-M4YPHYEH.js";
+import "./chunk-BZ3534YM.js";
+import "./chunk-NQKIUNW5.js";
+import "./chunk-4GVM6QZA.js";
+import "./chunk-VTFVLCUH.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-GPNTB4Y7.js";
+import "./chunk-UHHPLO3I.js";
+import "./chunk-CUQPWYRX.js";
+import "./chunk-TFMM5DBB.js";
+import "./chunk-RTBJ5IOO.js";
+import "./chunk-5VCRVKOZ.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-ACAQ2DSG.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-SGZAIJCV.js";
+import "./chunk-3BZZJJMQ.js";
+import "./chunk-R7BX2NB3.js";
+import "./chunk-SKGMN35F.js";
+import "./chunk-T7IR4N2S.js";
+import "./chunk-PEOZ34EM.js";
+import "./chunk-2ENE6445.js";
+import "./chunk-GHVIKOHT.js";
+import "./chunk-FAHMLERK.js";
+import "./chunk-SMY5X46Z.js";
+import "./chunk-DZFQVICS.js";
+import "./chunk-BLN54W3L.js";
+import "./chunk-5D2ALSM5.js";
+import "./chunk-LH5A3ZPG.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-6YXCPL4T.js";
+import "./chunk-7MG2LHO5.js";
+import "./chunk-ZORTV6NH.js";
+import "./chunk-7APJ6CO6.js";
+import "./chunk-HIWCKBEY.js";
+import "./chunk-KTFRCC5C.js";
+import "./chunk-I3ISCYT7.js";
+import "./chunk-66TQOPFM.js";
+import "./chunk-V4PXLYWM.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-YMUFFJCO.js";
+import "./chunk-ATL3ZVXT.js";
+import "./chunk-NSITFOCJ.js";
+import "./chunk-PVEWA2DU.js";
+import "./chunk-MVMXZYXT.js";
+import "./chunk-Q2MPFCQ7.js";
+import "./chunk-TRGTKX5E.js";
+import "./chunk-UXVWEX5L.js";
+import "./chunk-WQBG4SZS.js";
+import "./chunk-2577DKXB.js";
+import "./chunk-3V4KWFX7.js";
+import "./chunk-XKWGNJ26.js";
+import "./chunk-UGTBXF5U.js";
+import "./chunk-JBDFMYKQ.js";
+import "./chunk-VKQCVU2Z.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-AYX7AINO.js";
+import "./chunk-V7ZRRCRJ.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-QPQUVOZ2.js";
+import "./chunk-JMGDHKQF.js";
+import "./chunk-HK67PX4J.js";
+import "./chunk-RF6D3Y5E.js";
+import "./chunk-4ZS56W5S.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BRLKZUBT.js";
+import "./chunk-BTDR2PXY.js";
+import "./chunk-CHQCZZWC.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HPVZCW43.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  Noydb,
+  createNoydb
+};
+//# sourceMappingURL=noydb-62MX4QUG.js.map

package/dist/overlay-views/index.js

@@ -1,19 +1,18 @@
 import {
   withOverlayedView
-} from "../chunk-XKA6UH5V.js";
+} from "../chunk-SFAWCTEM.js";
 import {
   OverlayedViewRegistry
-} from "../chunk-MTTPHBIE.js";
+} from "../chunk-Q2PU57HC.js";
 import {
   OverlayedCollection
-} from "../chunk-FYT3DXPN.js";
+} from "../chunk-SKGMN35F.js";
 import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayIdMismatchError,
   OverlayNameCollisionError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,

package/dist/periods/index.js

@@ -11,7 +11,7 @@ import {
   samePartition,
   validatePeriodName,
   withPeriods
-} from "../chunk-SWFIXQF5.js";
+} from "../chunk-2ENE6445.js";
 import "../chunk-GHVIKOHT.js";
 import {
   PERIODS_COLLECTION,
@@ -20,20 +20,19 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "../chunk-Q2ZN5DWZ.js";
-import "../chunk-OKCQNMO6.js";
+} from "../chunk-FAHMLERK.js";
+import "../chunk-V7ZRRCRJ.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-QPQUVOZ2.js";
+import "../chunk-4ZS56W5S.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BRLKZUBT.js";
+import "../chunk-BTDR2PXY.js";
+import "../chunk-CHQCZZWC.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
-import "../chunk-N4CHCXDL.js";
-import "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+import "../chunk-HPVZCW43.js";
+import "../chunk-7MG7SJT7.js";
+import "../chunk-7O3Y4PPD.js";
 export {
   NO_PERIODS,
   PERIODS_COLLECTION,