@noy-db/hub 0.7.0 → 0.8.0-pre.0

package/dist/{chunk-ANATMFIO.js → chunk-QWFHIOD2.js}

@@ -1,16 +1,16 @@
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 import {
   encrypt
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 import {
   ConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-audit/attestation/signer.ts
 import { generateDocSigningKeyPair } from "@noy-db/attestation";
@@ -55,4 +55,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-ANATMFIO.js.map
+//# sourceMappingURL=chunk-QWFHIOD2.js.map

package/dist/{chunk-X2DLENDQ.js → chunk-QWGU66MP.js}

@@ -1,12 +1,12 @@
 import {
   isRewrappedUnder,
   rewrapEnvelope
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope,
   isTombstone,
   isTombstoneShape
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 
 // src/with-commit/history/history.ts
 var HISTORY_COLLECTION = "_history";
@@ -187,4 +187,4 @@ export {
   rewrapHistory,
   NO_HISTORY
 };
-//# sourceMappingURL=chunk-X2DLENDQ.js.map
+//# sourceMappingURL=chunk-QWGU66MP.js.map

package/dist/chunk-RHVMZSUU.js

@@ -0,0 +1,7 @@
+// src/port/with/coverage-strategy.ts
+var NO_COVERAGE = { observer: () => void 0 };
+
+export {
+  NO_COVERAGE
+};
+//# sourceMappingURL=chunk-RHVMZSUU.js.map

package/dist/chunk-RHVMZSUU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/coverage-strategy.ts"],"sourcesContent":["/**\n * Read-coverage sensor contract (#1363, from the #1251 design).\n *\n * ⛔⛔ **THIS IS TELEMETRY. IT IS NOT A CONTROL.** Against an insider holding\n * the device and local keys, it prevents nothing — they hold the DEK, so the\n * plaintext is derivable whatever hub decides. What it does is make bulk\n * extraction **visible early, attributable and loud**. The real remediation is\n * key custody — tiers and per-collection DEKs — and any deployment that reads\n * this as a control has been made *less* safe by it, because it stops building\n * the key boundary that would actually bind.\n *\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`RecordCodec` can hold the {@link NO_COVERAGE}\n * floor default without a spine→service static import.\n *\n * ⛔ There is deliberately NO refusal path here, and none may be added. The\n * design ruled (#1251 §3) that set-completion ALERTING beats threshold\n * blocking: a refusal at a boundary is a threshold the reader can\n * binary-search, and a signal is not. Adding \"just an option\" to refuse\n * reintroduces exactly the objection the shape was chosen to dissolve.\n *\n * @internal\n */\n\n/**\n * The one event every sensor in the #1251 design emits, whatever its\n * enforcement point — so a controller subscribes once. Emitted on the Noydb\n * event bus as `'coverage:threshold'`.\n */\nexport interface CoverageEvent {\n  /** Authenticated identity the reads are attributed to (`keyring.userId`). */\n  readonly principal: string\n  readonly vault: string\n  readonly collection: string\n  /** Records novel to this window (Bloom-estimated; under-reports, never over). */\n  readonly novel: number\n  /** Decrypts served to this principal for this collection, all time. */\n  readonly served: number\n  /** Distinct-ever-decrypted as a fraction of the declared corpus, 0..1 (HLL-estimated). */\n  readonly coverage: number\n  /** ISO-8601 start of the window the crossing was observed in. */\n  readonly window: string\n  /** Which sensor produced it. `'hub/coverage'` for this one. */\n  readonly source: string\n}\n\n/**\n * The decrypt observer: called once per record decrypt, with the record id.\n *\n * ⛔ The id is passed so the sketch can be UPDATED with it, and must never be\n * retained. See `with-audit/coverage/sketch.ts`.\n */\nexport type CoverageObserver = (id: string) => void\n\n/** The minimal emitter slice the sensor needs. Structural, to avoid an import. */\nexport interface CoverageEmitter {\n  emit(event: 'coverage:threshold', data: CoverageEvent): void\n}\n\n/** Field descriptors, read only for the `bulk` axis. Structural by design. */\nexport type CoverageFieldMeta = Readonly<Record<string, { readonly bulk?: 'sensitive' }>>\n\nexport interface CoverageStrategy {\n  /**\n   * Resolve the decrypt observer for one collection, or `undefined` when\n   * nothing should be accounted — which is the un-opted-in case, and also the\n   * opted-in case for a collection declaring no `bulk: 'sensitive'` field.\n   *\n   * `fieldMeta` is a THUNK because `fieldMeta` can be attached to a Collection\n   * after construction (`_applyFieldMeta`, first-wins), and this is called\n   * from the constructor.\n   *\n   * ⛔ `eager` is load-bearing, not informational — see the eager-hydration\n   * note in `with-audit/coverage/accounting.ts`. An eager collection decrypts\n   * its WHOLE corpus at hydration, so a decrypt-point sensor reads 100%\n   * coverage for anyone who opens the vault.\n   */\n  observer(\n    vault: string,\n    collection: string,\n    principal: string,\n    fieldMeta: () => CoverageFieldMeta | undefined,\n    emitter: CoverageEmitter,\n    eager: boolean,\n  ): CoverageObserver | undefined\n}\n\n/**\n * The un-opted-in floor: no observer, therefore no accounting, no allocation\n * per read, and no coverage code in the bundle. `Collection` calls\n * `observer()` once at construction and stores `undefined`; `RecordCodec`'s\n * hot path is a single `!== undefined` test.\n */\nexport const NO_COVERAGE: CoverageStrategy = { observer: () => undefined }\n"],"mappings":";AA6FO,IAAM,cAAgC,EAAE,UAAU,MAAM,OAAU;","names":[]}

package/dist/{chunk-BSFNRLK2.js → chunk-S57HTZ6X.js}

@@ -1,16 +1,16 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-L7CIOOBW.js";
+} from "./chunk-WNJ4AVGE.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 import {
   sha256Hex
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 import {
   ReadOnlyError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -117,4 +117,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-BSFNRLK2.js.map
+//# sourceMappingURL=chunk-S57HTZ6X.js.map

package/dist/{chunk-SZJ3DLZA.js → chunk-SEE332EV.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-7MG7SJT7.js";
+} from "./chunk-ODVPTDPK.js";
 
 // src/kernel/enclave/record-envelope.ts
 function buildRecordEnvelope(identity, body) {
@@ -63,4 +63,4 @@ export {
   isDeleteMarker,
   buildDeleteMarker
 };
-//# sourceMappingURL=chunk-SZJ3DLZA.js.map
+//# sourceMappingURL=chunk-SEE332EV.js.map

package/dist/{chunk-YYP7WSEB.js → chunk-SI3V7D4G.js}

@@ -2,7 +2,7 @@ import {
   IllegalTransitionError,
   RecordLockedError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-audit/guards/with-guard.ts
 function withGuard(strategy) {
@@ -124,4 +124,4 @@ export {
   immutableGuard,
   transitionGuard
 };
-//# sourceMappingURL=chunk-YYP7WSEB.js.map
+//# sourceMappingURL=chunk-SI3V7D4G.js.map

package/dist/{chunk-UGTBXF5U.js → chunk-SOIQ4MM4.js}

@@ -1,9 +1,9 @@
 import {
   dekKey
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-JCN44NCY.js";
 import {
   TierNotGrantedError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-party/team/tiers.ts
 function assertTierAccess(keyring, collection, tier) {
@@ -17,4 +17,4 @@ function assertTierAccess(keyring, collection, tier) {
 export {
   assertTierAccess
 };
-//# sourceMappingURL=chunk-UGTBXF5U.js.map
+//# sourceMappingURL=chunk-SOIQ4MM4.js.map

package/dist/chunk-SUZKW6UR.js

@@ -0,0 +1,25 @@
+// src/kernel/query/distinct-key.ts
+function stringifyBucketKey(value) {
+  if (value === null || value === void 0) return NULLISH_BUCKET_KEY;
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (value instanceof Date) return value.toISOString();
+  return OBJECT_BUCKET_KEY;
+}
+var NULLISH_BUCKET_KEY = "\0NULL\0";
+var OBJECT_BUCKET_KEY = "\0OBJECT\0";
+function isProbeableBucketKey(value) {
+  const key = stringifyBucketKey(value);
+  return key !== NULLISH_BUCKET_KEY && key !== OBJECT_BUCKET_KEY;
+}
+function distinctKeyOf(field, storedValue, via) {
+  if (storedValue === null || storedValue === void 0) return void 0;
+  return via?.canonicalizeIndexKey(field, storedValue) ?? stringifyBucketKey(storedValue);
+}
+
+export {
+  stringifyBucketKey,
+  isProbeableBucketKey,
+  distinctKeyOf
+};
+//# sourceMappingURL=chunk-SUZKW6UR.js.map

package/dist/chunk-SUZKW6UR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/distinct-key.ts"],"sourcesContent":["/**\n * ⚠️ #1458 — this file is SHARED, not Reduce's.\n *\n * It moved into `query/reduce/` with `distinct()` and moved straight back: the\n * eager index layer (`with-lookup/indexing/eager-indexes.ts`) canonicalises its\n * bucket keys through `stringifyBucketKey` / `isProbeableBucketKey`, so\n * `@noy-db/hub/query` reaches it at runtime through the index fast path and the\n * query-tiers closure check said so. Two callers with different lifetimes —\n * `distinctKeyOf` for Reduce, the bucket-key pair for Find's indexes — and the\n * canonicalisation must be ONE definition or a probe and a bucket disagree.\n */\n\n/**\n * The ONE definition of \"are these two field values the same value?\" (#1347).\n *\n * `distinct()`, `countDistinct()` and the eager hash index all have to answer\n * that question, and they have to answer it IDENTICALLY — an index-backed\n * `distinct()` reads bucket keys, a scanned one recomputes them, and the two\n * are only allowed to be different code paths because they are not different\n * definitions. So `stringifyBucketKey` lives here and `eager-indexes.ts`\n * imports it rather than keeping a private twin; a change to one is a change\n * to both by construction.\n *\n * ⚠️ THE KEY IS COMPUTED FROM THE **STORED** VALUE, never the decoded one.\n * That is what makes a Via-covered field behave: money stores a scaled\n * integer, and a legacy row written before the field was declared can hold a\n * non-canonical spelling of it (`'0100'` where a canonical write produces\n * `'100'`). Both denote 1.00, and `ViaPipeline.canonicalizeIndexKey` folds\n * them onto one key. Dedup on the raw string reports two values; dedup on the\n * FORMATTED string is worse still, because it makes distinctness depend on a\n * locale the query layer does not have.\n */\n\n/**\n * Stringify a value into a stable bucket key.\n *\n * `null`/`undefined` produce a sentinel that records will never match (so we\n * never index nullish values — `where('x', '==', null)` falls back to a\n * linear scan). Numbers, booleans, strings, and Date objects are coerced via\n * `String()`. Objects produce a sentinel that no real record will match —\n * querying with object values is a code smell.\n */\nexport function stringifyBucketKey(value: unknown): string {\n  if (value === null || value === undefined) return NULLISH_BUCKET_KEY\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (value instanceof Date) return value.toISOString()\n  return OBJECT_BUCKET_KEY\n}\n\n/** The key a nullish value maps to. Nullish values are never INSERTED, so this bucket is always empty. */\nconst NULLISH_BUCKET_KEY = '\\0NULL\\0'\n/** The key EVERY non-Date object maps to — one shared bucket, not a per-object identity. */\nconst OBJECT_BUCKET_KEY = '\\0OBJECT\\0'\n\n/**\n * Is this OPERAND one a hash bucket can answer for? (#1402)\n *\n * ⛔ Two of {@link stringifyBucketKey}'s outputs are not addresses, and a\n * probe that treats them as one returns wrong rows SILENTLY — the #1402\n * failure mode, and measured on `main` for ordinary non-Via fields:\n *\n *  - `'\\0OBJECT\\0'` is a COLLISION BUCKET, not a sentinel. Every non-Date\n *    object-valued record in the collection sits in it, so\n *    `where('obj', '==', { k: 1 })` matched `[a, b]` from the index against\n *    `[]` from the scan (the scan compares by reference and matches\n *    neither). The doc above says *\"objects produce a sentinel that no real\n *    record will match\"*; that was true of the OPERAND and false of the\n *    stored values, which is exactly the half that decides the answer.\n *  - `'\\0NULL\\0'` is an empty bucket, because nullish values are never\n *    inserted. Probing it returns `EMPTY_SET`, which reads as \"no matches\"\n *    rather than \"I cannot answer\" — so `where('tag', '==', undefined)`\n *    returned `[]` from the index against the records that genuinely have\n *    no `tag` from the scan. The doc above already claims this case *\"falls\n *    back to a linear scan\"*; it did not.\n *\n * Both are fixed at the PROBE, never at the bucketing: a caller that gets\n * `false` here must return `null` (= \"no index answer, scan it\"), not an\n * empty set. Bucketing is untouched, so no stored data or persisted sidecar\n * moves.\n *\n * ⚠️ EAGER MODE ONLY, deliberately. `PersistedCollectionIndex` (lazy) has\n * no scan to fall back TO — refusing there converts wrong rows into an\n * `IndexRequiredError`, which is a behaviour decision of its own and is\n * left open rather than smuggled in here.\n */\nexport function isProbeableBucketKey(value: unknown): boolean {\n  const key = stringifyBucketKey(value)\n  return key !== NULLISH_BUCKET_KEY && key !== OBJECT_BUCKET_KEY\n}\n\n/**\n * The narrow slice of `ViaPipeline` a distinct key needs. Declared\n * structurally so this module — kernel spine — does not have to reach into a\n * `with-*` service, and so a caller holding only a money binder can satisfy it.\n */\nexport interface BucketKeyCanonicalizer {\n  canonicalizeIndexKey(field: string, rawValue: unknown): string | undefined\n}\n\n/**\n * The distinct key for one stored field value, or `undefined` when the value\n * is NULLISH and therefore not a distinct value at all.\n *\n * ⭐ NULLISH IS EXCLUDED, DELIBERATELY. Three reasons, and the first is the\n * one that decides it: the hash index does not hold nullish values, so an\n * index-backed `distinct()` *cannot* report them, and a scan that did would\n * make the two paths disagree — a correctness bug that only appears on the\n * collections large enough to have an index. Second, it matches\n * `COUNT(DISTINCT x)` and Dexie's `uniqueKeys()`, so nobody is surprised.\n * Third, a caller who wants the nullish bucket can ask for it directly with\n * `.where(field, '==', null)`, which is cheap and says what it means.\n * (`groupBy()` goes the OTHER way and buckets nullish — that is not an\n * inconsistency: a group key is a partition of the rows, a distinct value is\n * a member of the field's value set.)\n */\nexport function distinctKeyOf(\n  field: string,\n  storedValue: unknown,\n  via?: BucketKeyCanonicalizer,\n): string | undefined {\n  if (storedValue === null || storedValue === undefined) return undefined\n  return via?.canonicalizeIndexKey(field, storedValue) ?? stringifyBucketKey(storedValue)\n}\n"],"mappings":";AA0CO,SAAS,mBAAmB,OAAwB;AACzD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO;AACT;AAGA,IAAM,qBAAqB;AAE3B,IAAM,oBAAoB;AAiCnB,SAAS,qBAAqB,OAAyB;AAC5D,QAAM,MAAM,mBAAmB,KAAK;AACpC,SAAO,QAAQ,sBAAsB,QAAQ;AAC/C;AA2BO,SAAS,cACd,OACA,aACA,KACoB;AACpB,MAAI,gBAAgB,QAAQ,gBAAgB,OAAW,QAAO;AAC9D,SAAO,KAAK,qBAAqB,OAAO,WAAW,KAAK,mBAAmB,WAAW;AACxF;","names":[]}

package/dist/{chunk-VXGSWL6L.js → chunk-SYVZW77S.js}

@@ -3,22 +3,22 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-453F654R.js";
+} from "./chunk-L7DOS3TE.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-2Y4IMKA6.js";
+} from "./chunk-3H5KLDZN.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-BOET4NA4.js";
+} from "./chunk-CKNGS5MH.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildSealedRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -86,4 +86,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-VXGSWL6L.js.map
+//# sourceMappingURL=chunk-SYVZW77S.js.map