@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/{chunk-OYW3I5M4.js → chunk-PCYPXLEX.js}

@@ -1,19 +1,19 @@
 import {
   installLive
-} from "./chunk-NBQ3KK6X.js";
+} from "./chunk-EA4VDI5D.js";
 import {
   installReduce
-} from "./chunk-4CIQDWRB.js";
+} from "./chunk-MRJDLXI3.js";
 import {
   installRelate
-} from "./chunk-TKVUE4JF.js";
+} from "./chunk-2ZFD2UJC.js";
 import {
   ScanBuilder
-} from "./chunk-JQYKPKG6.js";
+} from "./chunk-QGFEBNHO.js";
 import {
   Query,
   executePlan
-} from "./chunk-AL6ML4LA.js";
+} from "./chunk-ZVSKSUGI.js";
 
 // src/kernel/query/all.ts
 installRelate();
@@ -28,4 +28,4 @@ export {
   ScanBuilder2 as ScanBuilder,
   executePlan2 as executePlan
 };
-//# sourceMappingURL=chunk-OYW3I5M4.js.map
+//# sourceMappingURL=chunk-PCYPXLEX.js.map

package/dist/{chunk-2MG3SW7Q.js → chunk-PFCTSXHU.js}

@@ -1,6 +1,6 @@
 import {
   hasSealedBody
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 
 // src/with-shape/satellites/existence.ts
 function isEnvelopeLive(env) {
@@ -20,4 +20,4 @@ export {
   isBaseLive,
   liveBaseIdSet
 };
-//# sourceMappingURL=chunk-2MG3SW7Q.js.map
+//# sourceMappingURL=chunk-PFCTSXHU.js.map

package/dist/{chunk-FVH5QYY2.js → chunk-PGC35KXE.js}

@@ -1,6 +1,6 @@
 import {
   DuplicateBehaviorNameError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/guards/registry.ts
 var GuardRegistry = class {
@@ -141,4 +141,4 @@ var GuardRegistry = class {
 export {
   GuardRegistry
 };
-//# sourceMappingURL=chunk-FVH5QYY2.js.map
+//# sourceMappingURL=chunk-PGC35KXE.js.map

package/dist/{chunk-NCO25JZO.js → chunk-PT2YCQVK.js}

@@ -1,13 +1,13 @@
 import {
   matchDeclaredJoin
-} from "./chunk-4V3Q35WG.js";
+} from "./chunk-5UUJE4FP.js";
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-BUE7R3B5.js";
 import {
   DanglingReferenceError,
   JoinTooLargeError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/kernel/query/relate/join.ts
 var DEFAULT_JOIN_MAX_ROWS = 5e4;
@@ -270,4 +270,4 @@ export {
   bucketByRefKey,
   resetJoinWarnings
 };
-//# sourceMappingURL=chunk-NCO25JZO.js.map
+//# sourceMappingURL=chunk-PT2YCQVK.js.map

package/dist/{chunk-SYNY3VB5.js → chunk-PTJY5R3O.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/kernel/via/index.ts
 function isViaPrefixProbe(x) {
@@ -30,4 +30,4 @@ export {
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-SYNY3VB5.js.map
+//# sourceMappingURL=chunk-PTJY5R3O.js.map

package/dist/{chunk-QMWY2FDS.js → chunk-PUBI455O.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/capsule/plumbing/normalize.ts
 function normalizeForVerify(mode, value) {
@@ -154,4 +154,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-QMWY2FDS.js.map
+//# sourceMappingURL=chunk-PUBI455O.js.map

package/dist/{chunk-VMV5SBE4.js → chunk-QDHHHI5Q.js}

@@ -1,10 +1,10 @@
 import {
   ENCLAVE_SCHEME
-} from "./chunk-JWWYRR4Q.js";
+} from "./chunk-5XONHAFD.js";
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-DLD5LGDS.js";
+} from "./chunk-D5A3GCZ4.js";
 import {
   bytesToB64url,
   computeFieldHashes,
@@ -18,10 +18,10 @@ import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   AttestationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/attestation/issue.ts
 async function issueAttestationCore(ctx, args) {
@@ -62,4 +62,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-VMV5SBE4.js.map
+//# sourceMappingURL=chunk-QDHHHI5Q.js.map

package/dist/{chunk-JQYKPKG6.js → chunk-QGFEBNHO.js}

@@ -1,16 +1,16 @@
 import {
   splitAroundJoins
-} from "./chunk-AL6ML4LA.js";
+} from "./chunk-ZVSKSUGI.js";
 import {
   evaluateClause,
   hasFnClause,
   normalizeMatches,
   normalizeSubqueryOperand
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-BUE7R3B5.js";
 import {
   FieldNotQueryableError,
   QueryExtensionMissingError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/kernel/query/scan-builder.ts
 var DEFAULT_SCAN_PAGE_SIZE = 100;
@@ -190,4 +190,4 @@ for (const [method, subpath] of SCAN_EXTENSION_METHODS) {
 export {
   ScanBuilder
 };
-//# sourceMappingURL=chunk-JQYKPKG6.js.map
+//# sourceMappingURL=chunk-QGFEBNHO.js.map

package/dist/{chunk-52MGURXO.js → chunk-QGSNJD3B.js}

@@ -1,6 +1,6 @@
 import {
   CargoNotEnabledError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -12,4 +12,4 @@ var NO_CARGO = {
 export {
   NO_CARGO
 };
-//# sourceMappingURL=chunk-52MGURXO.js.map
+//# sourceMappingURL=chunk-QGSNJD3B.js.map

package/dist/chunk-QJNAHPVT.js

@@ -0,0 +1,91 @@
+// src/with-shape/introspection/field-meta.ts
+var FieldMetaUnknownFieldError = class extends Error {
+  constructor(collection, key) {
+    super(`fieldMeta for collection "${collection}" references unknown field "${key}". Declare it in the schema/config or remove the fieldMeta entry.`);
+    this.collection = collection;
+    this.key = key;
+    this.name = "FieldMetaUnknownFieldError";
+  }
+  collection;
+  key;
+};
+function validateFieldMetaKeys(collection, fieldMeta, knownFields) {
+  for (const key of Object.keys(fieldMeta)) {
+    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key);
+  }
+}
+function humanizeFieldKey(key) {
+  return key.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function resolveFieldMeta(key, inputs) {
+  const { channel, zodMeta, inferred } = inputs;
+  const pick = (k) => channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k];
+  const description = pick("description");
+  const semanticType = pick("semanticType");
+  const unit = pick("unit");
+  const sensitivity = pick("sensitivity");
+  const bulk = pick("bulk");
+  const aggregate = pick("aggregate");
+  const aliases = pick("aliases");
+  const displayFor = pick("displayFor");
+  const widget = pick("widget");
+  const group = pick("group");
+  const order = pick("order");
+  return {
+    label: pick("label") ?? humanizeFieldKey(key),
+    ...description !== void 0 ? { description } : {},
+    ...semanticType !== void 0 ? { semanticType } : {},
+    ...unit !== void 0 ? { unit } : {},
+    ...sensitivity !== void 0 ? { sensitivity } : {},
+    ...bulk !== void 0 ? { bulk } : {},
+    ...aggregate !== void 0 ? { aggregate } : {},
+    ...aliases !== void 0 ? { aliases } : {},
+    ...displayFor !== void 0 ? { displayFor } : {},
+    ...widget !== void 0 ? { widget } : {},
+    ...group !== void 0 ? { group } : {},
+    ...order !== void 0 ? { order } : {}
+  };
+}
+function schemaFieldKeys(schema) {
+  let s = schema;
+  for (let depth = 0; depth < 10; depth++) {
+    if (s === null || typeof s !== "object") return void 0;
+    const shape = s.shape;
+    if (shape !== null && typeof shape === "object") {
+      const keys = Object.keys(shape);
+      return keys.length > 0 ? keys : void 0;
+    }
+    const def = s._def;
+    const effect = def?.effect?.type;
+    if (def?.schema !== void 0 && (effect === "refinement" || effect === "preprocess")) {
+      s = def.schema;
+      continue;
+    }
+    if (def?.out !== void 0) {
+      s = def.out;
+      continue;
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function validateFieldMetaAtRegistration(input) {
+  if (input.fieldMeta === void 0) return;
+  const validatorKeys = schemaFieldKeys(input.schema);
+  if (validatorKeys === void 0) return;
+  validateFieldMetaKeys(
+    input.collection,
+    input.fieldMeta,
+    /* @__PURE__ */ new Set([...validatorKeys, ...input.configKeys])
+  );
+}
+
+export {
+  FieldMetaUnknownFieldError,
+  validateFieldMetaKeys,
+  humanizeFieldKey,
+  resolveFieldMeta,
+  schemaFieldKeys,
+  validateFieldMetaAtRegistration
+};
+//# sourceMappingURL=chunk-QJNAHPVT.js.map

package/dist/chunk-QJNAHPVT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/introspection/field-meta.ts"],"sourcesContent":["/**\n * Consumer-neutral, data-relatable field descriptors — the canonical,\n * validator-agnostic authoring channel. Merged by `collection.describe()`.\n *\n * Descriptive, never prescriptive: label/semanticType/unit/sensitivity/\n * aggregate/aliases/displayFor only. Layout, styling, and active-locale\n * selection stay app-side.\n *\n * @module\n */\n\n/** Known semantic types; the union is open — unknown strings pass through. */\nexport type SemanticType =\n  | 'date' | 'datetime' | 'email' | 'url' | 'currency' | 'percent'\n  | 'country' | 'vat' | 'iban' | 'entity'\n  | (string & {})\n\nexport interface FieldMeta {\n  /** Human label for any displayable field. Required. */\n  label: string\n  description?: string\n  semanticType?: SemanticType\n  /** Display unit, e.g. '€', '%', 'kg'. */\n  unit?: string\n  /** Data classification driving redaction/inspector masking. */\n  sensitivity?: 'public' | 'pii' | 'secret'\n  /**\n   * Sensitivity that is a property of the READ SHAPE, not the value (#1251).\n   *\n   * ⚠️ Declaring this prevents nothing. Against an insider holding the device\n   * and local keys it is TELEMETRY: it lets an opt-in sensor make bulk\n   * extraction visible early, attributable and loud. The real remediation is\n   * key custody — tiers and per-collection DEKs — not this label.\n   *\n   * Reads as: *this field's collection is a corpus whose COVERAGE is a\n   * protected quantity.* Deliberately ORTHOGONAL to {@link FieldMeta.sensitivity}:\n   * a company tax id stays `'public'` (it is public by law) and is still\n   * `bulk: 'sensitive'`, because the book of business is the set, not the value.\n   *\n   * The kernel does NOTHING with it beyond carrying it through introspection\n   * (`describe()` / `dumpSchema()`), so a sensor can discover which\n   * collections to account for. Zero runtime cost when unused.\n   */\n  bulk?: 'sensitive'\n  /** Default aggregation for this field. */\n  aggregate?: 'sum' | 'count' | 'distinct' | 'none'\n  /** Canonical search synonyms (data vocabulary, not UI). */\n  aliases?: readonly string[]\n  /** Entity pairing: the field holding the human label for this id (buyerId → buyerName). */\n  displayFor?: string\n  /**\n   * Override the widget hint derived from semanticType/type.\n   * e.g. 'textarea', 'date', 'money', 'select', 'checkbox', 'number', 'text'.\n   * When absent, the widget is derived automatically by buildDescription.\n   */\n  widget?: string\n  /**\n   * Card/section grouping hint for detail & form layouts (e.g. 'Identity',\n   * 'Amounts'). Purely descriptive metadata — consumers group; describe()\n   * keeps emitting fields alphabetically.\n   */\n  group?: string\n  /** Relative ordering hint within (and across) groups. Lower renders first. */\n  order?: number\n}\n\nexport class FieldMetaUnknownFieldError extends Error {\n  constructor(public readonly collection: string, public readonly key: string) {\n    super(`fieldMeta for collection \"${collection}\" references unknown field \"${key}\". `\n      + `Declare it in the schema/config or remove the fieldMeta entry.`)\n    this.name = 'FieldMetaUnknownFieldError'\n  }\n}\n\n/** Reject fieldMeta keys that are not known fields (typo guard), fail-loud. */\nexport function validateFieldMetaKeys(\n  collection: string,\n  fieldMeta: Record<string, FieldMeta>,\n  knownFields: ReadonlySet<string>,\n): void {\n  for (const key of Object.keys(fieldMeta)) {\n    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key)\n  }\n}\n\nexport interface MergeInputs {\n  channel?: FieldMeta\n  zodMeta?: Partial<FieldMeta>\n  inferred?: Partial<FieldMeta>\n}\nexport interface ResolvedMeta extends Partial<FieldMeta> { label: string }\n\n/** camelCase / snake_case → Title Case words. */\nexport function humanizeFieldKey(key: string): string {\n  return key\n    .replace(/[_-]+/g, ' ')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .trim()\n    .split(/\\s+/)\n    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n    .join(' ')\n}\n\n/** Merge one field's metadata: channel > zodMeta > inferred; label always present. */\nexport function resolveFieldMeta(key: string, inputs: MergeInputs): ResolvedMeta {\n  const { channel, zodMeta, inferred } = inputs\n  const pick = <K extends keyof FieldMeta>(k: K): FieldMeta[K] | undefined =>\n    channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k]\n  const description = pick('description')\n  const semanticType = pick('semanticType')\n  const unit = pick('unit')\n  const sensitivity = pick('sensitivity')\n  const bulk = pick('bulk')\n  const aggregate = pick('aggregate')\n  const aliases = pick('aliases')\n  const displayFor = pick('displayFor')\n  const widget = pick('widget')\n  const group = pick('group')\n  const order = pick('order')\n  return {\n    label: pick('label') ?? humanizeFieldKey(key),\n    ...(description !== undefined ? { description } : {}),\n    ...(semanticType !== undefined ? { semanticType } : {}),\n    ...(unit !== undefined ? { unit } : {}),\n    ...(sensitivity !== undefined ? { sensitivity } : {}),\n    ...(bulk !== undefined ? { bulk } : {}),\n    ...(aggregate !== undefined ? { aggregate } : {}),\n    ...(aliases !== undefined ? { aliases } : {}),\n    ...(displayFor !== undefined ? { displayFor } : {}),\n    ...(widget !== undefined ? { widget } : {}),\n    ...(group !== undefined ? { group } : {}),\n    ...(order !== undefined ? { order } : {}),\n  }\n}\n\n/**\n * Field KEYS from a configured validator, synchronously — the complement to\n * {@link deriveZodFields}, which derives field TYPES and must be async.\n *\n * The distinction is the whole point (#1253). `describe()`'s sync path passed\n * `zodFields: undefined`, so `fieldMeta` key-validation could never run there\n * and a typo'd key became a PHANTOM FIELD carrying its declared `sensitivity`\n * while the real field went undescribed — an inventory wrong in both\n * directions, silently, on the surface `sensitivity` exists to serve.\n *\n * That was read as unavoidable (\"the sync path cannot know the schema's\n * fields\"), which is true of types and false of keys: a Zod object exposes\n * `.shape` directly, on both v3 and v4, with no JSON-Schema derivation and no\n * `zod-to-json-schema` peer. The latter matters — on Zod 3 that peer is\n * required for the async path, so the sync path is the only one some\n * consumers can reach.\n *\n * A duck-typed probe, not a Zod dependency: an unrecognised validator returns\n * `undefined` and the caller stays silent rather than guessing, so a validator\n * hub cannot read never produces a false \"unknown field\" error.\n *\n * Wrappers (reported by the pilot on #1249's guard, and it equally affected\n * #1253's): a wrapped object's `.shape` is undefined, so \"has a schema\" and\n * \"hub can enumerate its fields\" silently diverged for exactly the schemas\n * most worth guarding — validated ones.\n *\n * ONE RULE UNWRAPS ALL OF THEM: FOLLOW THE OUTPUT SIDE. These keys describe\n * the PARSED record, so the only question a wrapper raises is whether it\n * changes the parsed shape.\n *\n *   Zod 3 `ZodEffects`  — `.refine()`/`.superRefine()` (`effect.type` is\n *     `'refinement'`) and `z.preprocess()` (`'preprocess'`) both parse WITH\n *     the inner schema, so the output is the inner object: follow\n *     `_def.schema`. `.transform()` REPLACES the output, so the inner keys\n *     would be a lie: stay `undefined`, deliberately.\n *   Zod 4 `ZodPipe`     — `z.preprocess()` is `pipe(transform -> object)` and\n *     `.transform()` is `pipe(object -> transform)`. Following `_def.out`\n *     resolves both correctly with no effect-kind test: preprocess reaches the\n *     object, transform reaches a `ZodTransform` that has no shape and no\n *     inner schema, so the loop returns `undefined` on its own.\n *\n * `preprocess` was the pilot's second finding (#1262): the first fix followed\n * refinements only, which left four of their registered collections unguarded\n * — including the one carrying their only `fieldMeta` PII declaration, i.e.\n * precisely the collection #1253 was written for. It is one string away from\n * `transform` and means the opposite thing, so a test pins the two apart.\n *\n * A duck-typed probe throughout: an unrecognised validator returns `undefined`\n * and the caller stays silent rather than guessing. Bounded depth, so a cyclic\n * duck cannot hang us.\n */\nexport function schemaFieldKeys(schema: unknown): readonly string[] | undefined {\n  let s: unknown = schema\n  for (let depth = 0; depth < 10; depth++) {\n    if (s === null || typeof s !== 'object') return undefined\n    const shape: unknown = (s as { shape?: unknown }).shape\n    if (shape !== null && typeof shape === 'object') {\n      const keys = Object.keys(shape as Record<string, unknown>)\n      return keys.length > 0 ? keys : undefined\n    }\n    const def = (s as {\n      _def?: { effect?: { type?: unknown }; schema?: unknown; out?: unknown }\n    })._def\n    // Zod 3 ZodEffects: refinement and preprocess parse WITH the inner schema,\n    // so the output shape is the inner object's. `transform` replaces it.\n    const effect = def?.effect?.type\n    if (def?.schema !== undefined && (effect === 'refinement' || effect === 'preprocess')) {\n      s = def.schema\n      continue\n    }\n    // Zod 4 ZodPipe: the output side IS the parsed shape. `z.preprocess` puts\n    // the object there; `.transform()` puts a shapeless ZodTransform there,\n    // which falls out of the loop as `undefined` on the next pass.\n    if (def?.out !== undefined) {\n      s = def.out\n      continue\n    }\n    return undefined\n  }\n  return undefined\n}\n\n/**\n * Registration-time `fieldMeta` key check (#1253 follow-up, the \"refuse as early\n * as the information allows\" pass).\n *\n * The same validation `buildDescription` runs, hoisted to collection\n * construction so a typo is refused when it is DECLARED rather than when\n * someone happens to call `describe()`. A collection nobody describes was\n * previously never checked at all — and `fieldMeta` is what carries\n * `sensitivity`, so the un-checked case was the one with a data-classification\n * inventory hanging off it.\n *\n * Deliberately NOT a replacement for the check inside `buildDescription`. There\n * are three tiers of knowability, not two:\n *\n *   always      — a name declared in the config itself (see the virtual-field\n *                 refusal in the derivation registry: \"declared and never\n *                 stored\" needs no schema at all)\n *   at reg.     — a validator whose `.shape` is readable synchronously: THIS\n *   at describe — a validator whose fields only exist after async JSON-Schema\n *                 derivation (Zod 3 + `zod-to-json-schema`)\n *\n * The third tier is why `buildDescription` keeps its own call. Hoisting alone\n * would move the check earlier for some collections and REMOVE it for others.\n *\n * Silent when the field set cannot be enumerated, exactly as the describe-time\n * check is: a TS-generic collection names real fields that appear in no runtime\n * config, and rejecting those teaches people to stop declaring `fieldMeta`.\n */\nexport function validateFieldMetaAtRegistration(input: {\n  readonly collection: string\n  readonly schema?: unknown\n  readonly fieldMeta?: Record<string, unknown> | undefined\n  readonly configKeys: readonly string[]\n}): void {\n  if (input.fieldMeta === undefined) return\n  const validatorKeys = schemaFieldKeys(input.schema)\n  if (validatorKeys === undefined) return\n  validateFieldMetaKeys(\n    input.collection,\n    input.fieldMeta as Parameters<typeof validateFieldMetaKeys>[1],\n    new Set<string>([...validatorKeys, ...input.configKeys]),\n  )\n}\n"],"mappings":";AAkEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,KAAa;AAC3E,UAAM,6BAA6B,UAAU,+BAA+B,GAAG,mEACX;AAF1C;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAGO,SAAS,sBACd,YACA,WACA,aACM;AACN,aAAW,OAAO,OAAO,KAAK,SAAS,GAAG;AACxC,QAAI,CAAC,YAAY,IAAI,GAAG,EAAG,OAAM,IAAI,2BAA2B,YAAY,GAAG;AAAA,EACjF;AACF;AAUO,SAAS,iBAAiB,KAAqB;AACpD,SAAO,IACJ,QAAQ,UAAU,GAAG,EACrB,QAAQ,sBAAsB,OAAO,EACrC,KAAK,EACL,MAAM,KAAK,EACX,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,GAAG;AACb;AAGO,SAAS,iBAAiB,KAAa,QAAmC;AAC/E,QAAM,EAAE,SAAS,SAAS,SAAS,IAAI;AACvC,QAAM,OAAO,CAA4B,MACvC,UAAU,CAAC,KAAK,UAAU,CAAC,KAAK,WAAW,CAAC;AAC9C,QAAM,cAAc,KAAK,aAAa;AACtC,QAAM,eAAe,KAAK,cAAc;AACxC,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,cAAc,KAAK,aAAa;AACtC,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,YAAY,KAAK,WAAW;AAClC,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,KAAK,YAAY;AACpC,QAAM,SAAS,KAAK,QAAQ;AAC5B,QAAM,QAAQ,KAAK,OAAO;AAC1B,QAAM,QAAQ,KAAK,OAAO;AAC1B,SAAO;AAAA,IACL,OAAO,KAAK,OAAO,KAAK,iBAAiB,GAAG;AAAA,IAC5C,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,IACrD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IAC/C,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,IACjD,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,IACvC,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACF;AAqDO,SAAS,gBAAgB,QAAgD;AAC9E,MAAI,IAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,QAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,UAAM,QAAkB,EAA0B;AAClD,QAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,YAAM,OAAO,OAAO,KAAK,KAAgC;AACzD,aAAO,KAAK,SAAS,IAAI,OAAO;AAAA,IAClC;AACA,UAAM,MAAO,EAEV;AAGH,UAAM,SAAS,KAAK,QAAQ;AAC5B,QAAI,KAAK,WAAW,WAAc,WAAW,gBAAgB,WAAW,eAAe;AACrF,UAAI,IAAI;AACR;AAAA,IACF;AAIA,QAAI,KAAK,QAAQ,QAAW;AAC1B,UAAI,IAAI;AACR;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AA8BO,SAAS,gCAAgC,OAKvC;AACP,MAAI,MAAM,cAAc,OAAW;AACnC,QAAM,gBAAgB,gBAAgB,MAAM,MAAM;AAClD,MAAI,kBAAkB,OAAW;AACjC;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,oBAAI,IAAY,CAAC,GAAG,eAAe,GAAG,MAAM,UAAU,CAAC;AAAA,EACzD;AACF;","names":[]}

package/dist/{chunk-VVOLDVIR.js → chunk-QSHATAXJ.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-VVOLDVIR.js.map
+//# sourceMappingURL=chunk-QSHATAXJ.js.map

package/dist/{chunk-G2MVBDFP.js → chunk-QXJXG7DN.js}

@@ -1,11 +1,11 @@
 import {
   assertTierAccess
-} from "./chunk-7XMHMVTS.js";
+} from "./chunk-UHFGK6YA.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-FLPCETP6.js";
+} from "./chunk-RIZTZJX6.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -24,7 +24,7 @@ import {
   unwrapCek,
   wrapCek,
   writeEnvelopeBody
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
@@ -36,7 +36,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -1292,17 +1292,21 @@ var BlobSet = class _BlobSet {
   async unmarkedShred(tier) {
     const shredded = [];
     const retainedShared = [];
+    const residueETags = [];
     const collected = await this.collectShredHolds(tier);
     const residue = [...collected.residue, `${this.collection}:${this.recordId}:_blob_intent`];
     for (const hold of collected.holds) {
       const outcome = await this.releaseRef(hold.eTag, hold.n, true, tier);
       if (outcome === "shredded") shredded.push(hold.eTag);
       else if (outcome === "retainedShared") retainedShared.push(hold.eTag);
-      else residue.push(hold.eTag);
+      else {
+        residue.push(hold.eTag);
+        residueETags.push(hold.eTag);
+      }
     }
     if (collected.slotsPresent) await this.store.delete(this.vault, this.slotsCollection, this.recordId);
     for (const key of collected.versionKeysToDelete) await this.store.delete(this.vault, this.versionsCollection, key);
-    return { shredded, retainedShared, residue };
+    return { shredded, retainedShared, residue, residueETags };
   }
   /**
    * Collect this record's CURRENT blob holds (slot map + published
@@ -1383,15 +1387,20 @@ var BlobSet = class _BlobSet {
     const shredded = [];
     const retainedShared = [];
     const residue = [...collected.residue];
+    const residueETags = [];
     let allApplied = true;
     for (const hold of intent.holds ?? []) {
       try {
         const outcome = await this.releaseRef(hold.eTag, hold.n, true, tier, intent.opId, hold.chunkCount);
         if (outcome === "shredded") shredded.push(hold.eTag);
         else if (outcome === "retainedShared") retainedShared.push(hold.eTag);
-        else residue.push(hold.eTag);
+        else {
+          residue.push(hold.eTag);
+          residueETags.push(hold.eTag);
+        }
       } catch {
         residue.push(hold.eTag);
+        residueETags.push(hold.eTag);
         allApplied = false;
       }
     }
@@ -1400,7 +1409,7 @@ var BlobSet = class _BlobSet {
       for (const key of collected.versionKeysToDelete) await this.store.delete(this.vault, this.versionsCollection, key);
       await deleteIntent(this.store, this.vault, this.collection, this.recordId);
     }
-    return { shredded, retainedShared, residue };
+    return { shredded, retainedShared, residue, residueETags };
   }
   /**
    * Resume gate (#753/#746 spec §7 C6): every refCount/slot mutator calls
@@ -2612,6 +2621,27 @@ var BlobSet = class _BlobSet {
    * and "its attachments are released" are one operation. Ungated: the record
    * delete itself already passed the gate bus. Ref-counted like any release —
    * content another record still holds survives.
+   *
+   * ⛔ RELEASE IS NOT ERASURE, AND THE API CANNOT TELL YOU WHICH YOU GOT
+   * (noy-db/core#28). Releasing the slot is unconditional; when the BYTES
+   * leave the store depends on the collection's key mode:
+   *
+   * - `perRecordKeys: true` — crypto-shredded on the spot at refCount 0.
+   * - legacy (shared DEK) — chunks RETAINED under the collection DEK until
+   *   `vault.compact({ reclaimLegacyBlobs: true })` runs (#1453).
+   *
+   * Both give the caller the same `null` from `blob(id).get(slot)`, and the
+   * record, the slot list and the store listing all agree it is gone — so
+   * every signal a consumer has says "erased" while the ciphertext is still
+   * on disk, recoverable by anyone holding the DEK. pilot-1 measured exactly
+   * this (chunks 2 → 2 on delete) and reasonably read the deferral as a
+   * broken cascade.
+   *
+   * ⭐ So: if a delete is meant to ERASE — a subject-access request, a
+   * retention policy — either put the blobs on a `perRecordKeys` collection
+   * or run the reclaim pass, and assert on `compact()`'s
+   * `unreferencedLegacyBlobs.reclaimed`, never on the null read. The seam is
+   * pinned in `__tests__/1451-delete-releases-blobs.test.ts`.
    */
   async releaseAll() {
     const { slots } = await this.loadSlots();
@@ -3163,4 +3193,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-G2MVBDFP.js.map
+//# sourceMappingURL=chunk-QXJXG7DN.js.map