@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/{chunk-SYNY3VB5.js → chunk-NCTN2FW4.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/via/index.ts
 function isViaPrefixProbe(x) {
@@ -30,4 +30,4 @@ export {
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-SYNY3VB5.js.map
+//# sourceMappingURL=chunk-NCTN2FW4.js.map

package/dist/{chunk-4T3SE27M.js → chunk-ND6S2DKC.js}

@@ -6,7 +6,7 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -62,4 +62,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-4T3SE27M.js.map
+//# sourceMappingURL=chunk-ND6S2DKC.js.map

package/dist/{chunk-3XJQBBZD.js → chunk-NTVKHQ3L.js}

@@ -10,7 +10,7 @@ import {
   importTransferKey,
   recipientUnwrap,
   recipientWrap
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-party/team/managed-secret.ts
 var MemorySealer = class {
@@ -249,4 +249,4 @@ export {
   loadSealedSecret,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-3XJQBBZD.js.map
+//# sourceMappingURL=chunk-NTVKHQ3L.js.map

package/dist/{chunk-RHVMZSUU.js → chunk-NV4OESHC.js}

@@ -4,4 +4,4 @@ var NO_COVERAGE = { observer: () => void 0 };
 export {
   NO_COVERAGE
 };
-//# sourceMappingURL=chunk-RHVMZSUU.js.map
+//# sourceMappingURL=chunk-NV4OESHC.js.map

package/dist/chunk-NV4OESHC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/coverage-strategy.ts"],"sourcesContent":["/**\n * Read-coverage sensor contract (#1363, from the #1251 design).\n *\n * ⛔⛔ **THIS IS TELEMETRY. IT IS NOT A CONTROL.** Against an insider holding\n * the device and local keys, it prevents nothing — they hold the DEK, so the\n * plaintext is derivable whatever hub decides. What it does is make bulk\n * extraction **visible early, attributable and loud**. The real remediation is\n * key custody — tiers and per-collection DEKs — and any deployment that reads\n * this as a control has been made *less* safe by it, because it stops building\n * the key boundary that would actually bind.\n *\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`RecordCodec` can hold the {@link NO_COVERAGE}\n * floor default without a spine→service static import.\n *\n * ⛔ There is deliberately NO refusal path here, and none may be added. The\n * design ruled (#1251 §3) that set-completion ALERTING beats threshold\n * blocking: a refusal at a boundary is a threshold the reader can\n * binary-search, and a signal is not. Adding \"just an option\" to refuse\n * reintroduces exactly the objection the shape was chosen to dissolve.\n *\n * ⭐ PUBLISHED SEAM — ruled 2026-09-16 (core#38, recorded in the family's seam\n * registry). {@link CoverageEvent} is re-exported from `@noy-db/hub/coverage`\n * and shipped in 0.8.0's `.d.ts`; consumers already hold it. This module\n * previously ended `@internal`, which strips nothing (`stripInternal` is set\n * in no tsconfig here) and so described the opposite of what shipped. The tag\n * is gone rather than made true, because adding `stripInternal` now would\n * break every importer at 0.8.0.\n *\n * Consequences, additive-only from here:\n *   - a new sensor ADDS fields and never redefines `served` / `novel` /\n *     `coverage` / `window` — their horizons are mixed BY DESIGN (see each\n *     field), and redefining one per `source` is what makes a controller\n *     subscribe once and compute nonsense;\n *   - `source` stays `string` — an enum would make every new sensor a\n *     breaking change to hub — and its VALUES are allocated in the family\n *     registry as `<repo>/<sensor>`. A new sensor claims its value there\n *     before it ships.\n */\n\n/**\n * The one event every sensor in the #1251 design emits, whatever its\n * enforcement point — so a controller subscribes once. Emitted on the Noydb\n * event bus as `'coverage:threshold'`.\n */\nexport interface CoverageEvent {\n  /** Authenticated identity the reads are attributed to (`keyring.userId`). */\n  readonly principal: string\n  readonly vault: string\n  readonly collection: string\n  /** Records novel to this window (Bloom-estimated; under-reports, never over). */\n  readonly novel: number\n  /** Decrypts served to this principal for this collection, all time. */\n  readonly served: number\n  /** Distinct-ever-decrypted as a fraction of the declared corpus, 0..1 (HLL-estimated). */\n  readonly coverage: number\n  /** ISO-8601 start of the window the crossing was observed in. */\n  readonly window: string\n  /** Which sensor produced it. `'hub/coverage'` for this one. */\n  readonly source: string\n}\n\n/**\n * The decrypt observer: called once per record decrypt, with the record id.\n *\n * ⛔ The id is passed so the sketch can be UPDATED with it, and must never be\n * retained. See `with-audit/coverage/sketch.ts`.\n */\nexport type CoverageObserver = (id: string) => void\n\n/** The minimal emitter slice the sensor needs. Structural, to avoid an import. */\nexport interface CoverageEmitter {\n  emit(event: 'coverage:threshold', data: CoverageEvent): void\n}\n\n/** Field descriptors, read only for the `bulk` axis. Structural by design. */\nexport type CoverageFieldMeta = Readonly<Record<string, { readonly bulk?: 'sensitive' }>>\n\nexport interface CoverageStrategy {\n  /**\n   * Resolve the decrypt observer for one collection, or `undefined` when\n   * nothing should be accounted — which is the un-opted-in case, and also the\n   * opted-in case for a collection declaring no `bulk: 'sensitive'` field.\n   *\n   * `fieldMeta` is a THUNK because `fieldMeta` can be attached to a Collection\n   * after construction (`_applyFieldMeta`, first-wins), and this is called\n   * from the constructor.\n   *\n   * ⛔ `eager` is load-bearing, not informational — see the eager-hydration\n   * note in `with-audit/coverage/accounting.ts`. An eager collection decrypts\n   * its WHOLE corpus at hydration, so a decrypt-point sensor reads 100%\n   * coverage for anyone who opens the vault.\n   */\n  observer(\n    vault: string,\n    collection: string,\n    principal: string,\n    fieldMeta: () => CoverageFieldMeta | undefined,\n    emitter: CoverageEmitter,\n    eager: boolean,\n  ): CoverageObserver | undefined\n}\n\n/**\n * The un-opted-in floor: no observer, therefore no accounting, no allocation\n * per read, and no coverage code in the bundle. `Collection` calls\n * `observer()` once at construction and stores `undefined`; `RecordCodec`'s\n * hot path is a single `!== undefined` test.\n */\nexport const NO_COVERAGE: CoverageStrategy = { observer: () => undefined }\n"],"mappings":";AA6GO,IAAM,cAAgC,EAAE,UAAU,MAAM,OAAU;","names":[]}

package/dist/chunk-NXQEOC3X.js

@@ -0,0 +1,40 @@
+import {
+  dekKey
+} from "./chunk-2LBS62AC.js";
+import {
+  TierNotGrantedError
+} from "./chunk-IKPQ2GGB.js";
+
+// src/with-party/team/tiers.ts
+function effectiveClearance(dekSlots, collection) {
+  let max = 0;
+  const prefix = `${collection}#`;
+  for (const key of dekSlots) {
+    if (!key.startsWith(prefix)) continue;
+    const n = Number.parseInt(key.slice(prefix.length), 10);
+    if (Number.isFinite(n) && n > max) max = n;
+  }
+  return max;
+}
+function keyringClearance(dekSlots) {
+  const slots = [...dekSlots];
+  let max = 0;
+  for (const collection of new Set(slots.map((s) => s.split("#")[0]))) {
+    const c = effectiveClearance(slots, collection);
+    if (c > max) max = c;
+  }
+  return max;
+}
+function assertTierAccess(keyring, collection, tier) {
+  if (tier <= 0) return;
+  if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return;
+  if (!keyring.deks.has(dekKey(collection, tier))) {
+    throw new TierNotGrantedError(collection, tier);
+  }
+}
+
+export {
+  keyringClearance,
+  assertTierAccess
+};
+//# sourceMappingURL=chunk-NXQEOC3X.js.map

package/dist/chunk-NXQEOC3X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/tiers.ts"],"sourcesContent":["/**\n * Hierarchical access — tier-aware keyring helpers.\n *\n * The keyring's existing `deks: Map<string, CryptoKey>` is keyed by\n * collection name. extends the key space:\n *\n *   `'invoices'`      — tier-0 DEK (unchanged from v0.x)\n *   `'invoices#1'`    — tier-1 DEK\n *   `'invoices#2'`    — tier-2 DEK\n *\n * Tier 0 keeps the bare collection name so any keyring written\n * before tiers existed loads without migration. Tiers ≥ 1 use `#N`\n * suffixes that\n * would be invalid as user-supplied collection names (see\n * `ReservedCollectionNameError` — `#` is reserved).\n *\n * @module\n */\n\nimport type { UnlockedKeyring } from './keyring.js'\nimport { TierNotGrantedError } from '../../kernel/errors.js'\n\n/** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */\n// Moved to `kernel/tier-visibility.ts` (#1042): the kernel needs it to resolve\n// a pulled envelope's DEK, and `port-layering` forbids the spine importing a\n// `with-*` service. Re-exported so every existing importer is unchanged.\nimport { dekKey } from '../../kernel/tier-visibility.js'\nexport { dekKey }\n\n/**\n * The user's effective clearance for ONE collection: the maximum tier for which\n * their keyring holds a DEK. `0` when only the tier-0 DEK is held (or none —\n * the `getDEK` caller raises separately).\n *\n * Takes DEK SLOT NAMES rather than an `UnlockedKeyring` (core#58), because the\n * callers that need this are the ones BUILDING a `KeyringFile`, where the slot\n * names exist and an unlocked keyring may not. Not published from any entry, so\n * the signature is free to say what it means.\n *\n * ⚠️ `kernel/vault.ts`'s `elevate()` scan is NOT this predicate: that asks\n * whether ANY collection has a DEK at ONE tier (`#N` suffix match); this asks\n * the MAXIMUM tier for ONE collection (`name#` prefix match).\n */\nexport function effectiveClearance(dekSlots: Iterable<string>, collection: string): number {\n  let max = 0\n  const prefix = `${collection}#`\n  for (const key of dekSlots) {\n    if (!key.startsWith(prefix)) continue\n    const n = Number.parseInt(key.slice(prefix.length), 10)\n    if (Number.isFinite(n) && n > max) max = n\n  }\n  return max\n}\n\n/**\n * The whole keyring's clearance: the highest tier held for ANY collection.\n *\n * ## What this is, and the one thing it must never become (core#58)\n *\n * This is the value persisted as `KeyringFile.clearance`. It is **derived**,\n * not independent — a pure function of the DEK slot names written into the same\n * file — and that is deliberate on two counts:\n *\n *  1. `dek_slots` is already bound into the roster tag (#1115), so a clearance\n *     computed from it carries no authority the tag does not already cover. A\n *     store that forges one contradicts data it cannot forge.\n *  2. Being derived at every write is what stops it drifting. A value computed\n *     once at grant time and carried forward goes stale the moment a tier DEK\n *     is added or revoked.\n *\n * ⛔ **It is ADVISORY and must stay advisory.** The real check is whether the\n * DEK map carries a `collection#tier` entry — `assertTierAccess` is the gate,\n * and access in this system IS the key. Never branch a privilege decision on\n * this number: it would be a second, weaker representation of access sitting\n * beside the authoritative one, which is how the two come to disagree.\n */\nexport function keyringClearance(dekSlots: Iterable<string>): number {\n  const slots = [...dekSlots]\n  let max = 0\n  for (const collection of new Set(slots.map((s) => s.split('#')[0] as string))) {\n    const c = effectiveClearance(slots, collection)\n    if (c > max) max = c\n  }\n  return max\n}\n\n/**\n * Assert the caller is cleared for the requested tier. Owners and\n * admins always pass (they can mint any new tier DEK on demand);\n * other roles must already hold the tier DEK — via a prior grant or\n * an active delegation — otherwise this throws `TierNotGrantedError`.\n *\n * This gate runs BEFORE `getDEK()` on the mutation path so a\n * non-cleared operator never has the opportunity to silently\n * auto-create a tier DEK they shouldn't have.\n */\nexport function assertTierAccess(\n  keyring: UnlockedKeyring,\n  collection: string,\n  tier: number,\n): void {\n  if (tier <= 0) return\n  // FR-6: custodian operates every collection at every tier (admin-level\n  // operational authority), so it may mint a tier DEK on demand like admin.\n  if (keyring.role === 'owner' || keyring.role === 'admin' || keyring.role === 'custodian') return\n  if (!keyring.deks.has(dekKey(collection, tier))) {\n    throw new TierNotGrantedError(collection, tier)\n  }\n}\n"],"mappings":";;;;;;;;AA2CO,SAAS,mBAAmB,UAA4B,YAA4B;AACzF,MAAI,MAAM;AACV,QAAM,SAAS,GAAG,UAAU;AAC5B,aAAW,OAAO,UAAU;AAC1B,QAAI,CAAC,IAAI,WAAW,MAAM,EAAG;AAC7B,UAAM,IAAI,OAAO,SAAS,IAAI,MAAM,OAAO,MAAM,GAAG,EAAE;AACtD,QAAI,OAAO,SAAS,CAAC,KAAK,IAAI,IAAK,OAAM;AAAA,EAC3C;AACA,SAAO;AACT;AAwBO,SAAS,iBAAiB,UAAoC;AACnE,QAAM,QAAQ,CAAC,GAAG,QAAQ;AAC1B,MAAI,MAAM;AACV,aAAW,cAAc,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAW,CAAC,GAAG;AAC7E,UAAM,IAAI,mBAAmB,OAAO,UAAU;AAC9C,QAAI,IAAI,IAAK,OAAM;AAAA,EACrB;AACA,SAAO;AACT;AAYO,SAAS,iBACd,SACA,YACA,MACM;AACN,MAAI,QAAQ,EAAG;AAGf,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,SAAS,YAAa;AAC1F,MAAI,CAAC,QAAQ,KAAK,IAAI,OAAO,YAAY,IAAI,CAAC,GAAG;AAC/C,UAAM,IAAI,oBAAoB,YAAY,IAAI;AAAA,EAChD;AACF;","names":[]}

package/dist/{chunk-Q4UHJ5SN.js → chunk-O2VQ3K36.js}

@@ -1,7 +1,7 @@
 import {
   NoydbError,
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-shape/links/names.ts
 var LINK_COLLECTION_PREFIX = "_links_";
@@ -60,4 +60,4 @@ export {
   linkRowKey,
   LinkIntegrityError
 };
-//# sourceMappingURL=chunk-Q4UHJ5SN.js.map
+//# sourceMappingURL=chunk-O2VQ3K36.js.map

package/dist/{chunk-HW7CMKUG.js → chunk-OFD2HD6F.js}

@@ -24,4 +24,4 @@ export {
   DEFAULT_HEAD_BUCKETS,
   NO_VAULT_HEAD
 };
-//# sourceMappingURL=chunk-HW7CMKUG.js.map
+//# sourceMappingURL=chunk-OFD2HD6F.js.map

package/dist/{chunk-HW7CMKUG.js.map → chunk-OFD2HD6F.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-commit/vault-head/strategy.ts"],"sourcesContent":["/**\n * `withVaultHead()` — the opt-in detector for **omission** (#1044).\n *\n * ## What it is for, and what it deliberately is not\n *\n * #1041 made every envelope self-authenticating at its identity, and #1042\n * made the merge reject one that is not. What neither can catch is **absence**:\n * a store that serves a genuine, unmodified `v1` when `v7` exists, or serves\n * nothing at all. An authentic old envelope is indistinguishable from an\n * authentic current one without external knowledge of what *should* be there.\n *\n * The head is that external knowledge: an authenticated `{id → version}`\n * manifest the client writes and the store cannot forge. It is **not** a Merkle\n * chain over content — content integrity is already handled, so the head needs\n * only versions.\n *\n * ## Why it is opt-in when AAD is not\n *\n * AAD costs nothing to coordinate and closes *alteration*, so it is kernel. The\n * head costs a write per commit and needs anti-entropy; on a single-device\n * offline vault it defends against nothing. Making it kernel would tax every\n * user for a multi-writer property. ADR 0003, Decision 3.\n *\n * `SECURITY.md` states the split exactly: a store cannot alter, relocate,\n * re-tier, re-author or rewind a record; **without `withVaultHead()` it can\n * still withhold or omit.**\n *\n * ## Bucketed, and why that is not a compromise\n *\n * ADR 0003 left head granularity open and asked for it to be sized early.\n * Measured, at the documented 50K-record vault ceiling:\n *\n * | shape | write cost per commit | detection |\n * |---|---|---|\n * | one per-vault manifest | **1.1 MiB** | per-record |\n * | one per collection | the same problem, renamed | per-record |\n * | **bucketed, 256 buckets** | **~4.4 KiB** | per-record |\n *\n * Bucketing changes *only* write amplification. Each bucket still lists every\n * one of its records' versions, so detection stays per-record — which is why\n * this is not a trade-off between cost and strength. Verifying one pulled\n * record reads one bucket rather than a megabyte.\n *\n * ## Wired as a bus OBSERVER, not a call in `collection.ts`\n *\n * That is what `kernel-surface` means by \"register on the ServiceBus instead of\n * growing this file\", and it keeps the hot write path untouched for anyone who\n * has not opted in: nothing is registered at all, so `hasHandlers` stays false\n * and the dispatch never happens.\n *\n * Both `afterPut` AND `afterDelete`, because a delete is a version bump like\n * any other. A head that stopped tracking deleted records would let a store\n * resurrect one by withholding the tombstone — precisely the omission this\n * exists to catch.\n *\n * ⚠️ The registration must be UNCONDITIONAL on anything but `enabled`. Its first\n * draft sat inside `#registerForgetHooks()`, which returns early when no forget\n * subjects are declared, so the head silently recorded nothing unless the vault\n * happened to use an unrelated feature. The tests caught it only because they\n * asserted a COUNT rather than \"no error\" — a head that records nothing raises\n * no errors and sweeps perfectly clean.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\n\n/** Reserved collection the head's buckets live in. */\nexport const VAULT_HEAD_COLLECTION = '_head' as const\n\n/** Default bucket count — see the sizing table above. */\nexport const DEFAULT_HEAD_BUCKETS = 256\n\nexport interface WithVaultHeadOptions {\n  /**\n   * How many buckets the manifest is split across. Higher means smaller writes\n   * and more reads to sweep the whole vault; lower means the opposite.\n   * Changing it on an existing vault re-homes every entry, so treat it as a\n   * layout decision rather than a tuning knob.\n   */\n  readonly buckets?: number\n}\n\n/** One record's expected state, as the client last committed it. */\nexport interface HeadEntry {\n  readonly collection: string\n  readonly id: string\n  readonly version: number\n}\n\nexport interface VaultHeadStrategy {\n  /**\n   * Is the head actually keeping a manifest?\n   *\n   * An explicit flag rather than an identity check against the stub: the kernel\n   * decides whether to register the write-path observer at all, and\n   * `port-layering` forbids it importing `NO_VAULT_HEAD` to compare. Without\n   * this, every write in a vault that never opted in would still pay a cache\n   * lookup and a no-op call.\n   */\n  readonly enabled: boolean\n\n  /** Bucket a record id lands in — pure, so callers can pre-group a batch. */\n  bucketFor(collection: string, id: string): string\n\n  /**\n   * Record `entry` as the client's expectation for that record.\n   *\n   * Called on every committed write, INSIDE the same logical operation, so\n   * there is no window where the record exists and the head does not know it.\n   */\n  note(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    entry: HeadEntry,\n  ): Promise<void>\n\n  /**\n   * What the client expects for `collection/id`, or `null` if the head has\n   * never seen it.\n   */\n  expected(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n    id: string,\n  ): Promise<number | null>\n\n  /**\n   * Every record the head knows about in `collection` — the set a sweep\n   * compares against what the store actually serves, which is how DELETION\n   * SUPPRESSION is caught. A withheld record is absent from the store but\n   * present here.\n   */\n  knownIn(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n  ): Promise<ReadonlyMap<string, number>>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the vault-head capability. Pass \\`vaultHeadStrategy: withVaultHead()\\` ` +\n    'from \"@noy-db/hub/vault-head\" to createNoydb().',\n  )\n}\n\n/**\n * The un-opted-in stub. `note` is a NO-OP rather than a throw: the write path\n * calls it unconditionally, and a vault without the head must simply not keep\n * one. The READ side throws, because asking what the head expects when there is\n * no head is a caller error, not a silent \"nothing to report\" — the latter\n * would look exactly like a clean sweep.\n */\nexport const NO_VAULT_HEAD: VaultHeadStrategy = {\n  enabled: false,\n  bucketFor: () => '',\n  async note() {},\n  async expected() { throw notEnabled('vault.verifyHead()') },\n  async knownIn() { throw notEnabled('vault.verifyHead()') },\n}\n\nexport type { EncryptedEnvelope }\n"],"mappings":";AAoEO,IAAM,wBAAwB;AAG9B,IAAM,uBAAuB;AAyEpC,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAEP;AACF;AASO,IAAM,gBAAmC;AAAA,EAC9C,SAAS;AAAA,EACT,WAAW,MAAM;AAAA,EACjB,MAAM,OAAO;AAAA,EAAC;AAAA,EACd,MAAM,WAAW;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAAA,EAC1D,MAAM,UAAU;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAC3D;","names":[]}
+{"version":3,"sources":["../src/with-commit/vault-head/strategy.ts"],"sourcesContent":["/**\n * `withVaultHead()` — the opt-in detector for **omission** (#1044).\n *\n * ## What it is for, and what it deliberately is not\n *\n * #1041 made every envelope self-authenticating at its identity, and #1042\n * made the merge reject one that is not. What neither can catch is **absence**:\n * a store that serves a genuine, unmodified `v1` when `v7` exists, or serves\n * nothing at all. An authentic old envelope is indistinguishable from an\n * authentic current one without external knowledge of what *should* be there.\n *\n * The head is that external knowledge: an authenticated `{id → version}`\n * manifest the client writes and the store cannot forge. It is **not** a Merkle\n * chain over content — content integrity is already handled, so the head needs\n * only versions.\n *\n * ## Why it is opt-in when AAD is not\n *\n * AAD costs nothing to coordinate and closes *alteration*, so it is kernel. The\n * head costs a write per commit and needs anti-entropy; on a single-device\n * offline vault it defends against nothing. Making it kernel would tax every\n * user for a multi-writer property. ADR 0003, Decision 3.\n *\n * `SECURITY.md` states the split exactly: a store cannot alter, relocate,\n * re-tier, re-author or rewind a record; **without `withVaultHead()` it can\n * still withhold or omit.**\n *\n * ## Bucketed, and why that is not a compromise\n *\n * ADR 0003 left head granularity open and asked for it to be sized early.\n * Measured, at the documented 50K-record vault ceiling:\n *\n * | shape | write cost per commit | detection |\n * |---|---|---|\n * | one per-vault manifest | **1.1 MiB** | per-record |\n * | one per collection | the same problem, renamed | per-record |\n * | **bucketed, 256 buckets** | **~4.4 KiB** | per-record |\n *\n * Bucketing changes *only* write amplification. Each bucket still lists every\n * one of its records' versions, so detection stays per-record — which is why\n * this is not a trade-off between cost and strength. Verifying one pulled\n * record reads one bucket rather than a megabyte.\n *\n * ## Wired as a bus OBSERVER, not a call in `collection.ts`\n *\n * That is what `kernel-surface` means by \"register on the ServiceBus instead of\n * growing this file\", and it keeps the hot write path untouched for anyone who\n * has not opted in: nothing is registered at all, so `hasHandlers` stays false\n * and the dispatch never happens.\n *\n * Both `afterPut` AND `afterDelete`, because a delete is a version bump like\n * any other. A head that stopped tracking deleted records would let a store\n * resurrect one by withholding the tombstone — precisely the omission this\n * exists to catch.\n *\n * ⚠️ The registration must be UNCONDITIONAL on anything but `enabled`. Its first\n * draft sat inside `#registerForgetHooks()`, which returns early when no forget\n * subjects are declared, so the head silently recorded nothing unless the vault\n * happened to use an unrelated feature. The tests caught it only because they\n * asserted a COUNT rather than \"no error\" — a head that records nothing raises\n * no errors and sweeps perfectly clean.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\n\n/** Reserved collection the head's buckets live in. */\nexport const VAULT_HEAD_COLLECTION = '_head' as const\n\n/** Default bucket count — see the sizing table above. */\nexport const DEFAULT_HEAD_BUCKETS = 256\n\nexport interface WithVaultHeadOptions {\n  /**\n   * How many buckets the manifest is split across. Higher means smaller writes\n   * and more reads to sweep the whole vault; lower means the opposite.\n   * Changing it on an existing vault re-homes every entry, so treat it as a\n   * layout decision rather than a tuning knob.\n   */\n  readonly buckets?: number\n}\n\n/** One record's expected state, as the client last committed it. */\nexport interface HeadEntry {\n  readonly collection: string\n  readonly id: string\n  readonly version: number\n}\n\nexport interface VaultHeadStrategy {\n  /**\n   * Is the head actually keeping a manifest?\n   *\n   * An explicit flag rather than an identity check against the stub: the kernel\n   * decides whether to register the write-path observer at all, and\n   * `port-layering` forbids it importing `NO_VAULT_HEAD` to compare. Without\n   * this, every write in a vault that never opted in would still pay a cache\n   * lookup and a no-op call.\n   */\n  readonly enabled: boolean\n\n  /** Bucket a record id lands in — pure, so callers can pre-group a batch. */\n  bucketFor(collection: string, id: string): string\n\n  /**\n   * Record `entry` as the client's expectation for that record.\n   *\n   * Called on every committed write, INSIDE the same logical operation, so\n   * there is no window where the record exists and the head does not know it.\n   */\n  note(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    entry: HeadEntry,\n  ): Promise<void>\n\n  /**\n   * What the client expects for `collection/id`, or `null` if the head has\n   * never seen it.\n   */\n  expected(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n    id: string,\n  ): Promise<number | null>\n\n  /**\n   * Every record the head knows about in `collection` — the set a sweep\n   * compares against what the store actually serves, which is how DELETION\n   * SUPPRESSION is caught. A withheld record is absent from the store but\n   * present here.\n   */\n  knownIn(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n  ): Promise<ReadonlyMap<string, number>>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the vault-head capability. Pass \\`vaultHeadStrategy: withVaultHead()\\` ` +\n    'from \"@noy-db/hub/vault-head\" to createNoydb().',\n  )\n}\n\n/**\n * The un-opted-in stub. `note` is a NO-OP rather than a throw: the write path\n * calls it unconditionally, and a vault without the head must simply not keep\n * one. The READ side throws, because asking what the head expects when there is\n * no head is a caller error, not a silent \"nothing to report\" — the latter\n * would look exactly like a clean sweep.\n */\nexport const NO_VAULT_HEAD: VaultHeadStrategy = {\n  enabled: false,\n  bucketFor: () => '',\n  async note() {},\n  async expected() { throw notEnabled('vault.verifyHead()') },\n  async knownIn() { throw notEnabled('vault.verifyHead()') },\n}\n\n/**\n * `EncryptedEnvelope` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/debug, @noy-db/hub/tiers, @noy-db/hub/to, @noy-db/hub/vault-head. Flagged as unused because\n * nothing inside hub imports it from this module; a consumer does. Do not narrow\n * or delete without a seam change (#55).\n *\n * @public\n */\nexport type { EncryptedEnvelope }\n"],"mappings":";AAoEO,IAAM,wBAAwB;AAG9B,IAAM,uBAAuB;AAyEpC,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAEP;AACF;AASO,IAAM,gBAAmC;AAAA,EAC9C,SAAS;AAAA,EACT,WAAW,MAAM;AAAA,EACjB,MAAM,OAAO;AAAA,EAAC;AAAA,EACd,MAAM,WAAW;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAAA,EAC1D,MAAM,UAAU;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAC3D;","names":[]}

package/dist/{chunk-2GHDLTPE.js → chunk-OGKMRIIJ.js}

@@ -1,6 +1,6 @@
 import {
   linkI18nVia
-} from "./chunk-OKSTSITU.js";
+} from "./chunk-PR7ILCIH.js";
 
 // src/via/i18n/dictionary.ts
 function dictKey(name, keysOrMap, opts) {
@@ -71,4 +71,4 @@ export {
   dictKey,
   staticDict
 };
-//# sourceMappingURL=chunk-2GHDLTPE.js.map
+//# sourceMappingURL=chunk-OGKMRIIJ.js.map

package/dist/{chunk-N7EVQD5S.js → chunk-ONZ3B5EW.js}

@@ -7,17 +7,17 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-6QVKPHBF.js";
+} from "./chunk-QHG7GQKM.js";
 import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   LedgerContentionError,
   isConflictError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-commit/history/ledger/patch.ts
 function computePatch(prev, next) {
@@ -695,4 +695,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-N7EVQD5S.js.map
+//# sourceMappingURL=chunk-ONZ3B5EW.js.map

package/dist/{chunk-VKI2EB3N.js → chunk-OOPSMQX5.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-FMPVN6DT.js"));
+var loadMVExecutor = lazy(() => import("./executor-6PQ7WAGV.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-VKI2EB3N.js.map
+//# sourceMappingURL=chunk-OOPSMQX5.js.map

package/dist/{chunk-VMV5SBE4.js → chunk-OYEBSWLE.js}

@@ -1,10 +1,10 @@
 import {
   ENCLAVE_SCHEME
-} from "./chunk-JWWYRR4Q.js";
+} from "./chunk-B6EWMGFX.js";
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-DLD5LGDS.js";
+} from "./chunk-ZUTUNVFD.js";
 import {
   bytesToB64url,
   computeFieldHashes,
@@ -18,10 +18,10 @@ import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   AttestationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-audit/attestation/issue.ts
 async function issueAttestationCore(ctx, args) {
@@ -62,4 +62,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-VMV5SBE4.js.map
+//# sourceMappingURL=chunk-OYEBSWLE.js.map

package/dist/{chunk-JDEYF3PJ.js → chunk-P6FATPXQ.js}

@@ -5,7 +5,7 @@ import {
   hmacSha256Hex,
   openEnvelopeJson,
   sha256Hex
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-audit/forget/strategy.ts
 var NO_FORGET = { subjects: {} };
@@ -145,4 +145,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-JDEYF3PJ.js.map
+//# sourceMappingURL=chunk-P6FATPXQ.js.map

package/dist/chunk-P6FATPXQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/forget/strategy.ts","../src/with-audit/forget/subject-index.ts"],"sourcesContent":["/**\n * `withForget` — declaration surface for GDPR right-to-erasure via\n * per-record CEK crypto-shred.\n *\n * This file holds only the *declaration* shape and the disabled sentinel.\n * The actual erasure machinery lives in:\n *   - `subject-index.ts` — the encrypted `_subject_index` reserved collection\n *   - `vault.ts` `forget()` — the per-record tombstone + ledger flow\n *   - `collection.ts` `_writeTombstone` — the envelope rewrite\n *\n * A `ForgetStrategy` declares which collections carry erasable subject data\n * and the (dotted-path) field on each record that names the data subject.\n * Declaring a collection here ALSO forces `perRecordKeys: true` for it (a\n * shred can only erase a record whose body is keyed off a per-record CEK),\n * so adopters opt into the CEK foundation transitively.\n *\n * @module\n */\nimport type { LedgerEntry } from '../../with-commit/history/ledger/entry.js'\n\n/**\n * User-supplied declaration passed to {@link withForget}. Maps a\n * collection name to the record field (dotted path supported, e.g.\n * `'billing.buyerId'`) that identifies the data subject for erasure.\n *\n * ```ts\n * withForget({ subjects: { invoices: 'buyerId', contacts: 'id' } })\n * ```\n */\nexport interface SubjectDeclaration {\n  readonly subjects: Record<string, string>\n  /**\n   * #633 — opt-in: gate the vault-level `_sealed_cek` and blob purges on\n   * per-collection via declarations instead of running them unconditionally\n   * for every forgotten ref. Default `false`/absent = today's unconditional\n   * behavior (byte-identical). See `purge-scope.ts` for the partition logic\n   * and the `scopedPurgeResidue` skip-reporting this enables.\n   *\n   * **Footgun:** a bare `sensitive: [...]` collection — no `classifiedFields`\n   * (no classified via binder compiled in) — counts as UNDECLARED for the\n   * sealed-CEK arm. Under `scopedPurge: true`, its `_sealed_cek` host-delivery\n   * envelopes are SKIPPED, not purged (reported via `scopedPurgeResidue`,\n   * reason `'skipped-undeclared-sealed-cek'`) even if that collection called\n   * `sealRecordToHost()` — the sealed CEK stays recoverable by that granted\n   * host until purged. Add a `classifiedFields` binding to close the gap, or\n   * leave `scopedPurge` off/false for the unconditional (always-purged) default.\n   * The declaration signal is session-local: a declared collection never opened\n   * (with its config) before `forget()` in this session counts as UNDECLARED —\n   * open it first, or its entries are skipped-and-reported.\n   */\n  readonly scopedPurge?: boolean\n}\n\n/**\n * Resolved forget strategy threaded through Noydb → every Vault. Carries\n * the same `subjects` map the user declared. `NO_FORGET` (empty map) is the\n * off-by-default sentinel; `vault.forget()` throws\n * `ForgetStrategyNotConfiguredError` when the map is empty.\n */\nexport interface ForgetStrategy {\n  /** Collection → subject-field (dotted path). Empty under `NO_FORGET`. */\n  readonly subjects: Readonly<Record<string, string>>\n  /** #633 — see {@link SubjectDeclaration.scopedPurge}. */\n  readonly scopedPurge?: boolean\n}\n\n/**\n * Disabled sentinel — no collections declare a subject field. `vault.forget()`\n * refuses with `ForgetStrategyNotConfiguredError`; no write hooks register; no\n * collection is forced into `perRecordKeys`. Non-adopters pay nothing.\n */\nexport const NO_FORGET: ForgetStrategy = { subjects: {} }\n\n// The `withForget` factory lives in `active.ts` (canonical\n// strategy.ts/active.ts/index.ts split); this file holds only the\n// declaration shape + disabled sentinel.\n\n/**\n * The outcome of a `vault.forget(subjectId)` call.\n *\n * `unmigratedRecords` lists `collection:id` pairs that were tombstoned but\n * whose body had NOT been migrated to a per-record CEK at shred time (legacy\n * body still under the shared collection DEK). Those records are tombstoned\n * (live envelope + history stripped) but their pre-shred ciphertext, if it\n * leaked into a backup before migration, remains decryptable under the\n * collection DEK — so erasure-completeness is NOT guaranteed for them. Run\n * the per-record-CEK migration pass, then re-forget, to close the gap.\n *\n * Blob attachments: a shredded record's **erasable** blobs (on a\n * `perRecordKeys` collection) are crypto-shredded inline — `blobsShredded`\n * counts those taken to refCount 0 (BlobObject deleted → chunks permanently\n * undecryptable), `blobsRetainedShared` counts those still referenced by\n * another record (shared content legitimately persists for its other owner).\n * `blobResidueCollections` now lists only collections with blobs that could\n * NOT be crypto-shredded: **legacy** blobs (no per-blob `_cek`, chunks under\n * the shared `_blob` DEK — migrate them), or a session without the blob\n * service loaded. An all-erasable subject yields an empty residue list.\n */\nexport interface ForgetResult {\n  /** The subject id passed to `forget()`. Echoed for caller convenience. */\n  readonly subject: string\n  /** Count of live records rewritten to a tombstone. */\n  readonly recordsShredded: number\n  /** Count of `_history` envelopes tombstoned across all shredded records. */\n  readonly historyVersionsShredded: number\n  /** Distinct collections that had at least one record shredded. */\n  readonly collections: readonly string[]\n  /** `collection:id` pairs shredded while still un-migrated (see type docs). */\n  readonly unmigratedRecords: readonly string[]\n  /** Count of erasable blobs crypto-shredded (refCount → 0, BlobObject deleted). */\n  readonly blobsShredded: number\n  /** Count of erasable blobs retained because still referenced elsewhere (shared). */\n  readonly blobsRetainedShared: number\n  /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */\n  readonly blobResidueCollections: readonly string[]\n  /**\n   * #28 — the same residue as {@link blobResidueCollections}, at `collection:id`\n   * grain: which RECORDS held blob content that could not be crypto-shredded.\n   *\n   * ⭐ Prefer this one. `blobResidueCollections` answers \"some blobs in\n   * `invoices` did not shred\"; a specific erasure request asks \"which of THIS\n   * subject's records are affected\", and only a record-grained answer can say.\n   *\n   * ⚠️ \"Could not be shredded\" does NOT mean the bytes are still in the live\n   * store — `forget()` deletes legacy chunks, it just cannot crypto-shred them.\n   * See {@link blobResidueETags} for what the exposure actually is.\n   *\n   * ⚠️ `blobResidueCollections` is kept, unchanged, because it is published —\n   * widening it in place would silently change what every existing reader sees,\n   * with no type error (`string[]` either way). Both are populated from the\n   * same sites; this is the finer of the two.\n   *\n   * Reported by pilot-1, who noticed that this result type carries residue at\n   * `collection:id` (`unmigratedRecords`) and `collection:id:field`\n   * (`indexResidue`, `sealedResidue`) elsewhere, so the coarse one read as a\n   * defect rather than a design choice. It was: the record id was in scope on\n   * the line that recorded only the collection.\n   */\n  readonly blobResidueRecords: readonly string[]\n  /**\n   * #28 — the eTags of blob content this erasure could not CRYPTO-SHRED.\n   *\n   * ⛔ READ THE MEANING CAREFULLY; it is not what the name suggests on first\n   * reading, and the obvious reading is wrong in a way that matters.\n   *\n   * On a LEGACY blob (no per-blob `_cek`) `forget()` still DELETES the chunks\n   * and the index row — it passes `reclaimLegacy: true`. What it cannot do is\n   * make them cryptographically unreadable, because there is no per-blob key to\n   * destroy; the bytes were removed rather than shredded. So:\n   *\n   * - the live store IS clean — do not expect these chunks to still be there;\n   * - but any pre-existing BACKUP, replica or snapshot taken before the erasure\n   *   remains decryptable under the retained collection DEK, and that is the\n   *   exposure this field is telling you about.\n   *\n   * ⚠️ THIS CANNOT BE RECONCILED AGAINST `compact({ reclaimLegacyBlobs })`.\n   * That sweep reclaims refCount-0 legacy index rows that still EXIST; these no\n   * longer do. An intersection of the two sets is empty by construction and\n   * means nothing — measured, not assumed (2026-09-14). The reclaim path\n   * belongs to ordinary `collection.delete()`, which passes\n   * `reclaimLegacy: false` and genuinely defers.\n   *\n   * ⭐ What to DO with a non-empty value: treat the subject's data as erased\n   * from the live vault but potentially present in backups, and handle it under\n   * whatever backup-retention policy you operate. Migrating the collection to\n   * per-record keys before the erasure (`blob(id).migrate()`) is what makes a\n   * future erasure a true crypto-shred.\n   *\n   * ⛔ DO NOT PERSIST THESE. An eTag is a CONTENT HASH, so a stored erasure\n   * receipt listing them lets anyone holding a candidate file confirm the vault\n   * once held it — a residual disclosure created by the very artefact meant to\n   * prove the data is gone. `ledgerEntry` records residue COUNTS, never values,\n   * for exactly this reason.\n   *\n   * ⚠️ Narrower than {@link blobResidueRecords}: this is the eTag half only. A\n   * record whose SLOT ROW was undecodable appears there and not here, because\n   * there is no content identity to name. {@link erasureCompleteness} counts\n   * both.\n   */\n  readonly blobResidueETags: readonly string[]\n  /**\n   * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted\n   * across the shredded records. These live under the retained\n   * collection DEK, so crypto-shred alone would leave the indexed field VALUES\n   * readable — `forget()` must delete them.\n   */\n  readonly indexPostingsPurged: number\n  /**\n   * `collection:id:field` entries whose persisted `_idx` side-car could NOT be\n   * deleted — index residue that still leaks the indexed value under the\n   * retained collection DEK. Non-empty means erasure is INCOMPLETE: retry, or\n   * purge the side-car out of band.\n   */\n  readonly indexResidue: readonly string[]\n  /**\n   * Count of `_sealed[field]` slots dropped from the live store across the\n   * shredded records. For slots written under `sensitive` +\n   * `perRecordKeys` (the current path), the key derives off the per-record CEK,\n   * so tombstoning the record — which drops `_cek` and `_sealed` — also\n   * crypto-shreds the value. A legacy slot (written before per-record CEKs) keys\n   * off the collection DEK instead, so dropping it removes it from the live store but a\n   * pre-forget backup remains recoverable by a DEK holder (same caveat `_data`\n   * carries); migrate by re-`put`ting before forgetting for full crypto-shred.\n   */\n  readonly sealedFieldsShredded: number\n  /** Count of `_sealed_cek` host-delivery envelopes deleted (#H-1). A record sealed to an\n   * at-* host via sealRecordToHost persists its raw CEK there; forget() must destroy them. */\n  readonly sealedCekEnvelopesPurged: number\n  /** `collection:id` whose `_sealed_cek` purge failed (residue — the host-recoverable CEK may survive). */\n  readonly sealedCekResidue: readonly string[]\n  /** `collection:id:field` sealed slots that were DEK-derived (legacy, written before per-record CEKs) and thus NOT crypto-shredded\n   * by dropping `_cek` — the collection DEK is retained, so synced/backup copies stay decryptable (#M-1). */\n  readonly sealedResidue: readonly string[]\n  /** Count of `_ledger_deltas` rows hard-deleted across the shredded records (#734) — the\n   * erasure twin of #729's elevate-side purge. Entry metadata (that the record was mutated,\n   * at which version/timestamp/actor) is retained; only the plaintext delta content is removed. */\n  readonly ledgerDeltasPurged: number\n  /** `collection:id` refs whose `_ledger_deltas` purge failed — plaintext delta residue still\n   * readable under the retained ledger DEK. Non-empty means erasure is INCOMPLETE. */\n  readonly ledgerDeltaResidue: readonly string[]\n  /** The single `op:'forget'` ledger entry appended for this erasure. */\n  readonly ledgerEntry: LedgerEntry\n  /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased\n   *  because their source subject was forgotten. Overlay outputs are intentionally out of\n   *  scope here — an overlay is always sourced from an MV, never directly from a subject\n   *  collection, so the personal-data-bearing MV rows it reads are already erased above. */\n  readonly derivedRecordsErased: number\n  /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */\n  readonly derivedAggregatesRecomputed: number\n  /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen\n   *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */\n  readonly derivedResidueFrozen: readonly string[]\n  /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */\n  readonly lookupReferencesCascaded: number\n  /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */\n  readonly lookupReferencesNullified: number\n  /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,\n   *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.\n   *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */\n  readonly lookupReferencesResidue: readonly string[]\n  /** #633 — scoped-purge skip notices (opt-in `scopedPurge`, see {@link SubjectDeclaration}).\n   *  Always empty under the unconditional default. Non-empty means a `_sealed_cek` entry or a\n   *  blob scan was skipped for an undeclared collection — reported, never a silent skip. */\n  readonly scopedPurgeResidue: readonly ScopedPurgeResidueNotice[]\n  /** #776/#782/#785 — `collection:id` MV-output rows that survived erasure invalidation (eager\n   *  tombstone leg AND lazy/manual `invalidateMVAtRest`) despite belonging to the forgotten\n   *  subject, because the `_materializedFrom` ownership stamp could NOT be decoded (undecodable\n   *  under the collection's default DEK — e.g. elevated above tier 0 on a tiered output\n   *  collection; ownership unconfirmed — could be a plain user record on a same-collection\n   *  partition MV). Never erased, but surfaced here rather than silently skipped (the #724\n   *  posture). Non-empty means the row may still hold the forgotten/pre-elevation contribution,\n   *  decryptable by tier-holders. */\n  readonly derivedResidueUndecodable: readonly string[]\n  /** #782/#785 — `collection:id` MV-output rows that DID decode and stamp-match via\n   *  `_materializedFrom`, but whose erasure was declined by the #718 tier-elevation gate\n   *  (`_internalDelete` returned false). Ownership CONFIRMED here — a real silent survival,\n   *  not a stamp-mismatch skip — surfaced rather than dropped. Non-empty means a live,\n   *  tier-holder-decryptable copy of the forgotten contribution was deliberately retained. */\n  readonly derivedResidueDeclined: readonly string[]\n}\n\n/** #633 — the two `scopedPurgeResidue` skip reasons. Single source of truth: `purge-scope.ts`\n *  (the port-internal partition helpers) imports this rather than redeclaring it. */\nexport type ScopedPurgeResidueReason = 'skipped-undeclared-sealed-cek' | 'skipped-undeclared-blob-scan'\n\n/** #633 — one `ForgetResult.scopedPurgeResidue` entry: an undeclared collection's sealed-CEK\n *  entries left unpurged, or its blob scan skipped entirely, under `scopedPurge`. `count` is the\n *  number of `_sealed_cek` entries left in place (sealed-cek reason) or the number of refs whose\n *  blob scan was skipped (blob-scan reason) — aggregated per collection across the whole call. */\nexport interface ScopedPurgeResidueNotice {\n  readonly reason: ScopedPurgeResidueReason\n  readonly collection: string\n  readonly count: number\n}\n","/**\n * The encrypted subject index.\n *\n * GDPR crypto-shred needs to answer \"which records belong to data subject\n * X?\" portably (the index must travel with the vault/bundle) WITHOUT leaking\n * subject-equivalence to the store. The rejected alternative — an unencrypted\n * subject tag in envelope metadata — would let anyone with store access see\n * which records share a subject. Instead we keep a reserved `_subject_index`\n * collection, encrypted under its OWN DEK (`getDEK('_subject_index')`):\n *\n *   - record id  = `HMAC-SHA256(indexDEK, subjectId)` (M-2). A bare\n *     `sha256Hex(subjectId)` would be offline-computable: an attacker with\n *     store access and a candidate list (emails / customer ids are low-entropy)\n *     could dictionary the hash to confirm \"subject X is present here.\" Keying\n *     the id with the vault-only index DEK removes that capability — without the\n *     DEK the id cannot be derived. (Legacy entries written before M-2 used the\n *     bare sha256 id; the read/remove paths dual-look-up both forms.)\n *   - record body = AES-GCM(JSON `{ r: [{ collection, id }], p }`) under the\n *     index DEK, where `p` pads the plaintext to a bucketed length so the\n *     ciphertext `_data` length does not leak the approximate record count.\n *     Legacy bodies were a bare `[{ collection, id }]` array; reads accept both.\n *\n * ## Concurrency (RISK #3 — known v1 limitation)\n *\n * `addSubjectRef` / `removeSubjectRef` are read-modify-write with no CAS. The\n * design assumes a SINGLE WRITER (the noy-db single-process write model). Two\n * concurrent writers racing on the SAME subject can lose an entry (last-write\n * wins on the ref list). This is documented, not fixed in v1:\n * `rebuildSubjectIndex` performs a full scan to recover a correct index from\n * the canonical records, so a lost ref is recoverable. A CAS-backed index is\n * deferred to a later slice.\n *\n * @module\n */\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, hmacSha256Hex, sha256Hex, type EnclaveKey } from '../../capsule/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\n\n/** Reserved collection holding the encrypted subject → records index. */\nexport const SUBJECT_INDEX_COLLECTION = '_subject_index'\n\n/**\n * Bucket (bytes) the encrypted ref-list plaintext is padded up to, so the\n * ciphertext `_data` length leaks only `count` rounded up to a bucket — not the\n * exact record count. 256 keeps small subjects (the common case) indistinguishable.\n */\nconst REF_LIST_BUCKET = 256\n\n/** A single record reference held in a subject's index entry. */\nexport interface SubjectRef {\n  readonly collection: string\n  readonly id: string\n}\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** SHA-256 hex of a UTF-8 string. The LEGACY (pre-M-2) subject-index key. */\nasync function sha256HexString(input: string): Promise<string> {\n  return sha256Hex(new TextEncoder().encode(input))\n}\n\n/**\n * The subject-index record id(s) to consult for a subject, most-current first.\n *\n * - Encrypted vault: the PRIMARY id is `HMAC-SHA256(indexDEK, subjectId)` (M-2)\n *   — not offline-computable. The LEGACY `sha256Hex(subjectId)` id is also\n *   returned so reads/removes still find entries written before M-2 (dual-lookup).\n * - Plaintext/debug vault: no DEK to key with, so the only id is the legacy\n *   sha256 form (unchanged behaviour — plaintext mode is not zero-knowledge anyway).\n */\nasync function subjectKeys(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string[]> {\n  const legacy = await sha256HexString(subjectId)\n  if (!encrypted) return [legacy]\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const keyed = await hmacSha256Hex(dek, new TextEncoder().encode(subjectId))\n  return keyed === legacy ? [keyed] : [keyed, legacy]\n}\n\n/** The id new writes land under (keyed when encrypted, else legacy sha256). */\nasync function primarySubjectKey(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string> {\n  return (await subjectKeys(getDEK, encrypted, subjectId))[0]!\n}\n\n/** Parse a stored ref-list body: new padded `{ r, p }` wrapper OR legacy bare array. */\nfunction parseRefs(json: string): SubjectRef[] {\n  const parsed = JSON.parse(json) as SubjectRef[] | { r: SubjectRef[] }\n  return Array.isArray(parsed) ? parsed : parsed.r\n}\n\n/** Serialize + pad the ref list to a bucket boundary (encrypted vaults only). */\nfunction serializeRefs(refs: SubjectRef[]): string {\n  const base = JSON.stringify({ r: refs, p: '' })\n  const pad = Math.ceil(base.length / REF_LIST_BUCKET) * REF_LIST_BUCKET - base.length\n  return JSON.stringify({ r: refs, p: ' '.repeat(pad) })\n}\n\n/** Read + decrypt the ref list at a SINGLE index key. Returns `[]` when absent. */\nasync function readRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n): Promise<SubjectRef[]> {\n  const env = await adapter.get(vault, SUBJECT_INDEX_COLLECTION, key)\n  if (!env || !env._data) return []\n  if (!encrypted) return parseRefs(env._data)\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const json = await openEnvelopeJson({ collection: SUBJECT_INDEX_COLLECTION, id: key }, env, dek)\n  return parseRefs(json)\n}\n\n/** Encrypt + write a ref list for a subject under its derived key. */\nasync function writeRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n  refs: SubjectRef[],\n): Promise<void> {\n  const identity = { collection: SUBJECT_INDEX_COLLECTION, id: key, version: 1 }\n  let env: EncryptedEnvelope\n  if (!encrypted) {\n    // Plaintext/debug vault: keep the bare-array form (no padding needed).\n    env = buildRecordEnvelope(identity, { iv: '', data: JSON.stringify(refs) })\n  } else {\n    const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n    const { iv, data } = await encrypt(serializeRefs(refs), dek, buildRecordAad(identity))\n    env = buildRecordEnvelope(identity, { iv, data })\n  }\n  await adapter.put(vault, SUBJECT_INDEX_COLLECTION, key, env)\n}\n\n/**\n * Add a `{ collection, id }` ref to a subject's index entry (idempotent —\n * a duplicate ref is not appended). Read-modify-write; see the concurrency\n * note in the module docstring.\n */\nexport async function addSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n  const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n  if (refs.some((r) => r.collection === ref.collection && r.id === ref.id)) return\n  refs.push(ref)\n  await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n}\n\n/**\n * Remove a `{ collection, id }` ref from a subject's index entry. When the\n * last ref is removed the (now empty) entry is deleted so the store holds no\n * residual key for an erased subject.\n */\nexport async function removeSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  // Dual-lookup: drop the ref from BOTH the keyed (M-2) and the legacy sha256\n  // entry, so a pre-M-2 subject is still fully erased.\n  for (const key of await subjectKeys(getDEK, encrypted, subjectId)) {\n    const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n    const next = refs.filter((r) => !(r.collection === ref.collection && r.id === ref.id))\n    if (next.length === refs.length) continue\n    if (next.length === 0) {\n      await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, key)\n    } else {\n      await writeRefs(adapter, vault, getDEK, encrypted, key, next)\n    }\n  }\n}\n\n/**\n * Look up every record ref for a subject. Returns `[]` when none exist. Unions\n * the keyed (M-2) and legacy sha256 entries (dual-lookup), deduplicated, so a\n * subject indexed before M-2 is still fully found.\n */\nexport async function lookupSubject(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n): Promise<SubjectRef[]> {\n  const keys = await subjectKeys(getDEK, encrypted, subjectId)\n  const seen = new Set<string>()\n  const out: SubjectRef[] = []\n  for (const key of keys) {\n    for (const ref of await readRefs(adapter, vault, getDEK, encrypted, key)) {\n      const dedup = `${ref.collection}\\u0000${ref.id}`\n      if (seen.has(dedup)) continue\n      seen.add(dedup)\n      out.push(ref)\n    }\n  }\n  return out\n}\n\n/**\n * Rebuild the entire subject index from the canonical records (the recovery\n * path for the documented read-modify-write race). Scans each declared\n * collection, reads `record[subjectField]` (dotted path), and rewrites the\n * index from scratch. Tombstoned (already-shredded) records contribute no\n * ref — their body is gone, so they cannot be re-indexed.\n *\n * `decodeRecord` decrypts an envelope to a plain object (or returns null for\n * a tombstone / unreadable record); supplied by the caller so this module\n * stays free of Collection internals.\n */\nexport async function rebuildSubjectIndex(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjects: Readonly<Record<string, string>>,\n  decodeRecord: (collection: string, id: string, env: EncryptedEnvelope) => Promise<Record<string, unknown> | null>,\n): Promise<number> {\n  // Drop every existing index entry first so removed refs don't linger.\n  const existing = await adapter.list(vault, SUBJECT_INDEX_COLLECTION)\n  for (const k of existing) {\n    await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, k)\n  }\n\n  // subjectId → refs, accumulated across all declared collections.\n  const bySubject = new Map<string, SubjectRef[]>()\n  for (const [collection, field] of Object.entries(subjects)) {\n    const ids = await adapter.list(vault, collection)\n    for (const id of ids) {\n      if (id.startsWith('_')) continue\n      const env = await adapter.get(vault, collection, id)\n      if (!env || !env._data) continue // missing or tombstone\n      const record = await decodeRecord(collection, id, env)\n      if (record === null) continue\n      const subjectValue = readDottedPath(record, field)\n      if (subjectValue === undefined || subjectValue === null) continue\n      const subjectId = coerceSubjectId(subjectValue)\n      const list = bySubject.get(subjectId) ?? []\n      list.push({ collection, id })\n      bySubject.set(subjectId, list)\n    }\n  }\n\n  let entries = 0\n  for (const [subjectId, refs] of bySubject) {\n    const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n    await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n    entries++\n  }\n  return entries\n}\n\n/**\n * Coerce a read subject-field value to a stable string id. Primitives use\n * their natural string form; objects/arrays are JSON-stringified so structural\n * subjects still get a deterministic key (avoids the `[object Object]` trap).\n */\nexport function coerceSubjectId(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {\n    return String(value)\n  }\n  return JSON.stringify(value)\n}\n\n/** Read a (possibly dotted) field path from a plain record. */\nexport function readDottedPath(record: Record<string, unknown>, field: string): unknown {\n  if (!field.includes('.')) return record[field]\n  let cursor: unknown = record\n  for (const segment of field.split('.')) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n"],"mappings":";;;;;;;;;;AAuEO,IAAM,YAA4B,EAAE,UAAU,CAAC,EAAE;;;ACjCjD,IAAM,2BAA2B;AAOxC,IAAM,kBAAkB;AAWxB,eAAe,gBAAgB,OAAgC;AAC7D,SAAO,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAClD;AAWA,eAAe,YAAY,QAAgB,WAAoB,WAAsC;AACnG,QAAM,SAAS,MAAM,gBAAgB,SAAS;AAC9C,MAAI,CAAC,UAAW,QAAO,CAAC,MAAM;AAC9B,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAC1E,SAAO,UAAU,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,MAAM;AACpD;AAGA,eAAe,kBAAkB,QAAgB,WAAoB,WAAoC;AACvG,UAAQ,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG,CAAC;AAC5D;AAGA,SAAS,UAAU,MAA4B;AAC7C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,SAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO;AACjD;AAGA,SAAS,cAAc,MAA4B;AACjD,QAAM,OAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC;AAC9C,QAAM,MAAM,KAAK,KAAK,KAAK,SAAS,eAAe,IAAI,kBAAkB,KAAK;AAC9E,SAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,IAAI,OAAO,GAAG,EAAE,CAAC;AACvD;AAGA,eAAe,SACb,SACA,OACA,QACA,WACA,KACuB;AACvB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,0BAA0B,GAAG;AAClE,MAAI,CAAC,OAAO,CAAC,IAAI,MAAO,QAAO,CAAC;AAChC,MAAI,CAAC,UAAW,QAAO,UAAU,IAAI,KAAK;AAC1C,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,0BAA0B,IAAI,IAAI,GAAG,KAAK,GAAG;AAC/F,SAAO,UAAU,IAAI;AACvB;AAGA,eAAe,UACb,SACA,OACA,QACA,WACA,KACA,MACe;AACf,QAAM,WAAW,EAAE,YAAY,0BAA0B,IAAI,KAAK,SAAS,EAAE;AAC7E,MAAI;AACJ,MAAI,CAAC,WAAW;AAEd,UAAM,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,EAC5E,OAAO;AACL,UAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,cAAc,IAAI,GAAG,KAAK,eAAe,QAAQ,CAAC;AACrF,UAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EAClD;AACA,QAAM,QAAQ,IAAI,OAAO,0BAA0B,KAAK,GAAG;AAC7D;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACA,KACe;AACf,QAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,QAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,MAAI,KAAK,KAAK,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,EAAE,EAAG;AAC1E,OAAK,KAAK,GAAG;AACb,QAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC9D;AAOA,eAAsB,iBACpB,SACA,OACA,QACA,WACA,WACA,KACe;AAGf,aAAW,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG;AACjE,UAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,UAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,GAAG;AACrF,QAAI,KAAK,WAAW,KAAK,OAAQ;AACjC,QAAI,KAAK,WAAW,GAAG;AACrB,YAAM,QAAQ,OAAO,OAAO,0BAA0B,GAAG;AAAA,IAC3D,OAAO;AACL,YAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAAA,IAC9D;AAAA,EACF;AACF;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACuB;AACvB,QAAM,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS;AAC3D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAoB,CAAC;AAC3B,aAAW,OAAO,MAAM;AACtB,eAAW,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG,GAAG;AACxE,YAAM,QAAQ,GAAG,IAAI,UAAU,KAAS,IAAI,EAAE;AAC9C,UAAI,KAAK,IAAI,KAAK,EAAG;AACrB,WAAK,IAAI,KAAK;AACd,UAAI,KAAK,GAAG;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAaA,eAAsB,oBACpB,SACA,OACA,QACA,WACA,UACA,cACiB;AAEjB,QAAM,WAAW,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AACnE,aAAW,KAAK,UAAU;AACxB,UAAM,QAAQ,OAAO,OAAO,0BAA0B,CAAC;AAAA,EACzD;AAGA,QAAM,YAAY,oBAAI,IAA0B;AAChD,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,eAAW,MAAM,KAAK;AACpB,UAAI,GAAG,WAAW,GAAG,EAAG;AACxB,YAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,YAAY,EAAE;AACnD,UAAI,CAAC,OAAO,CAAC,IAAI,MAAO;AACxB,YAAM,SAAS,MAAM,aAAa,YAAY,IAAI,GAAG;AACrD,UAAI,WAAW,KAAM;AACrB,YAAM,eAAe,eAAe,QAAQ,KAAK;AACjD,UAAI,iBAAiB,UAAa,iBAAiB,KAAM;AACzD,YAAM,YAAY,gBAAgB,YAAY;AAC9C,YAAM,OAAO,UAAU,IAAI,SAAS,KAAK,CAAC;AAC1C,WAAK,KAAK,EAAE,YAAY,GAAG,CAAC;AAC5B,gBAAU,IAAI,WAAW,IAAI;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,UAAU;AACd,aAAW,CAAC,WAAW,IAAI,KAAK,WAAW;AACzC,UAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,UAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC5D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,eAAe,QAAiC,OAAwB;AACtF,MAAI,CAAC,MAAM,SAAS,GAAG,EAAG,QAAO,OAAO,KAAK;AAC7C,MAAI,SAAkB;AACtB,aAAW,WAAW,MAAM,MAAM,GAAG,GAAG;AACtC,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-VVOLDVIR.js → chunk-PLTIJDQN.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-VVOLDVIR.js.map
+//# sourceMappingURL=chunk-PLTIJDQN.js.map

package/dist/{chunk-OKSTSITU.js → chunk-PR7ILCIH.js}

@@ -1,13 +1,13 @@
 import {
   installViaBinder
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-NCTN2FW4.js";
 import {
   LocaleNotSpecifiedError,
   MissingTranslationError,
   ScriptViolationError,
   TranslatorNotConfiguredError,
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/port/with/i18n-strategy.ts
 function notEnabled(op) {
@@ -641,4 +641,4 @@ export {
   presentI18nForJoin,
   stripI18nFilled
 };
-//# sourceMappingURL=chunk-OKSTSITU.js.map
+//# sourceMappingURL=chunk-PR7ILCIH.js.map

package/dist/{chunk-7R2Q7CPL.js → chunk-QE3TLZ6Z.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-MXOQ5JCG.js";
+} from "./chunk-MRCR7ZMC.js";
 import {
   deriveSchemaManifest
-} from "./chunk-TEHHROZL.js";
+} from "./chunk-T5EXREMW.js";
 import {
   loadFence
-} from "./chunk-VAORSCSU.js";
+} from "./chunk-TLIFNRU5.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-KZXDLBY6.js";
+} from "./chunk-XPW7T2GN.js";
 import {
   loadKeyring
-} from "./chunk-XSPFDUDG.js";
+} from "./chunk-V7AKGAXY.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -26,7 +26,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-7R2Q7CPL.js.map
+//# sourceMappingURL=chunk-QE3TLZ6Z.js.map

package/dist/{chunk-G2MVBDFP.js → chunk-QFW4MYGN.js}

@@ -1,11 +1,11 @@
 import {
   assertTierAccess
-} from "./chunk-7XMHMVTS.js";
+} from "./chunk-NXQEOC3X.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-FLPCETP6.js";
+} from "./chunk-2LBS62AC.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -24,7 +24,7 @@ import {
   unwrapCek,
   wrapCek,
   writeEnvelopeBody
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
@@ -36,7 +36,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -1292,17 +1292,21 @@ var BlobSet = class _BlobSet {
   async unmarkedShred(tier) {
     const shredded = [];
     const retainedShared = [];
+    const residueETags = [];
     const collected = await this.collectShredHolds(tier);
     const residue = [...collected.residue, `${this.collection}:${this.recordId}:_blob_intent`];
     for (const hold of collected.holds) {
       const outcome = await this.releaseRef(hold.eTag, hold.n, true, tier);
       if (outcome === "shredded") shredded.push(hold.eTag);
       else if (outcome === "retainedShared") retainedShared.push(hold.eTag);
-      else residue.push(hold.eTag);
+      else {
+        residue.push(hold.eTag);
+        residueETags.push(hold.eTag);
+      }
     }
     if (collected.slotsPresent) await this.store.delete(this.vault, this.slotsCollection, this.recordId);
     for (const key of collected.versionKeysToDelete) await this.store.delete(this.vault, this.versionsCollection, key);
-    return { shredded, retainedShared, residue };
+    return { shredded, retainedShared, residue, residueETags };
   }
   /**
    * Collect this record's CURRENT blob holds (slot map + published
@@ -1383,15 +1387,20 @@ var BlobSet = class _BlobSet {
     const shredded = [];
     const retainedShared = [];
     const residue = [...collected.residue];
+    const residueETags = [];
     let allApplied = true;
     for (const hold of intent.holds ?? []) {
       try {
         const outcome = await this.releaseRef(hold.eTag, hold.n, true, tier, intent.opId, hold.chunkCount);
         if (outcome === "shredded") shredded.push(hold.eTag);
         else if (outcome === "retainedShared") retainedShared.push(hold.eTag);
-        else residue.push(hold.eTag);
+        else {
+          residue.push(hold.eTag);
+          residueETags.push(hold.eTag);
+        }
       } catch {
         residue.push(hold.eTag);
+        residueETags.push(hold.eTag);
         allApplied = false;
       }
     }
@@ -1400,7 +1409,7 @@ var BlobSet = class _BlobSet {
       for (const key of collected.versionKeysToDelete) await this.store.delete(this.vault, this.versionsCollection, key);
       await deleteIntent(this.store, this.vault, this.collection, this.recordId);
     }
-    return { shredded, retainedShared, residue };
+    return { shredded, retainedShared, residue, residueETags };
   }
   /**
    * Resume gate (#753/#746 spec §7 C6): every refCount/slot mutator calls
@@ -2612,6 +2621,27 @@ var BlobSet = class _BlobSet {
    * and "its attachments are released" are one operation. Ungated: the record
    * delete itself already passed the gate bus. Ref-counted like any release —
    * content another record still holds survives.
+   *
+   * ⛔ RELEASE IS NOT ERASURE, AND THE API CANNOT TELL YOU WHICH YOU GOT
+   * (noy-db/core#28). Releasing the slot is unconditional; when the BYTES
+   * leave the store depends on the collection's key mode:
+   *
+   * - `perRecordKeys: true` — crypto-shredded on the spot at refCount 0.
+   * - legacy (shared DEK) — chunks RETAINED under the collection DEK until
+   *   `vault.compact({ reclaimLegacyBlobs: true })` runs (#1453).
+   *
+   * Both give the caller the same `null` from `blob(id).get(slot)`, and the
+   * record, the slot list and the store listing all agree it is gone — so
+   * every signal a consumer has says "erased" while the ciphertext is still
+   * on disk, recoverable by anyone holding the DEK. pilot-1 measured exactly
+   * this (chunks 2 → 2 on delete) and reasonably read the deferral as a
+   * broken cascade.
+   *
+   * ⭐ So: if a delete is meant to ERASE — a subject-access request, a
+   * retention policy — either put the blobs on a `perRecordKeys` collection
+   * or run the reclaim pass, and assert on `compact()`'s
+   * `unreferencedLegacyBlobs.reclaimed`, never on the null read. The seam is
+   * pinned in `__tests__/1451-delete-releases-blobs.test.ts`.
    */
   async releaseAll() {
     const { slots } = await this.loadSlots();
@@ -3163,4 +3193,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-G2MVBDFP.js.map
+//# sourceMappingURL=chunk-QFW4MYGN.js.map