@klum-db/lobby 0.2.0-pre.26 → 0.2.0-pre.27

package/dist/index.d.cts

@@ -1,8 +1,8 @@
-import { Vault, SealingKeyProvider, Noydb as Noydb$1 } from '@noy-db/hub';
+import { Vault, SealingKeyProvider, PublicEnvelope, Noydb as Noydb$1 } from '@noy-db/hub';
 export { CustodyApi, DeedMarker, GrantCustodianOptions, LiberateOptions, LiberateResult, createDeedOwner, isDeedVault, liberateVault, loadDeedMarker } from '@noy-db/hub';
 import { IndexDef, LiveAggregation, AggregateSpec, AggregateResult, LiveQuery, Vault as Vault$1, Collection, Operator, Noydb, Query, JoinStrategy, ChangeEvent } from '@noy-db/hub/kernel';
 export { CrossShardJoinError, DataResidencyError, ReservedVaultNameError, ShardProvisioningError, UnknownShardError, VaultTemplateNotFoundError } from '@noy-db/hub/kernel';
-import { DecryptedRecord, ExtractionPreview } from '@noy-db/hub/bundle';
+import { DecryptedRecord, ExtractionPreview, WriteNoydbBundleOptions } from '@noy-db/hub/bundle';
 import { AsXlsxSheetOptions } from '@noy-db/as-xlsx';
 export { MultiVaultDenormColumn, MultiVaultXlsxEntry, MultiVaultXlsxOptions } from '@noy-db/as-xlsx';
 
@@ -987,6 +987,107 @@ declare class UnitGraduationError extends Error {
     constructor(message: string);
 }
 
+/**
+ * Multi-compartment `.noydb` bundle (`NDBM`). A thin outer container
+ * that embeds N standard single-vault `.noydb` bundles plus an
+ * unencrypted, owner-curated **manifest**. The v1 single-vault format
+ * is untouched; each compartment is a complete v1 bundle, produced by
+ * `writeNoydbBundle` and read by `readNoydbBundle`.
+ *
+ * Layout: magic 'NDBM'(4) · version(1) · reserved(1) · manifestLen(4 BE)
+ *         · manifest JSON · concat(inner v1 bundles, in manifest order).
+ *
+ * @packageDocumentation
+ */
+
+/** Magic bytes 'NDBM' — NOYDB Multi-compartment bundle. */
+declare const NOYDB_MULTI_BUNDLE_MAGIC: Uint8Array<ArrayBuffer>;
+/** Fixed prefix: magic(4) + version(1) + reserved(1) + manifestLen(4). */
+declare const NOYDB_MULTI_BUNDLE_PREFIX_BYTES = 10;
+/** Current multi-bundle layout version. */
+declare const NOYDB_MULTI_BUNDLE_VERSION = 1;
+/** One compartment's entry in the pre-decrypt manifest. */
+interface CompartmentManifest {
+    /** The inner v1 bundle's stable ULID handle. */
+    readonly handle: string;
+    /** Owner-curated classification (e.g. 'shard', 'pool'). Opt-in. */
+    readonly roleTag?: string;
+    /** ISO export timestamp. Always set by the writer; absent for a v1 bundle read as a 1-entry manifest. */
+    readonly exportedAt?: string;
+    /** Compartment (vault) name. Opt-in disclosure. */
+    readonly name?: string;
+    /** Collection names + record counts. Opt-in disclosure. */
+    readonly collections?: readonly {
+        readonly name: string;
+        readonly count: number;
+    }[];
+    /** Inner bundle's owner-curated public envelope, surfaced. Opt-in. */
+    readonly publicEnvelope?: PublicEnvelope;
+    /** Byte length of the inner v1 bundle (drives framing). */
+    readonly innerBytes: number;
+    /** SHA-256 (lowercase hex) of the inner v1 bundle bytes — pre-decrypt integrity. */
+    readonly innerSha256: string;
+    /** Source vault's schema fence version at extract time (FR-8). Opt-in; absent on older bundles. */
+    readonly schemaVersion?: number;
+}
+/** The unencrypted manifest of a multi-compartment bundle. */
+interface MultiBundleManifest {
+    readonly multiFormatVersion: number;
+    /** Opaque ULID for the outer container. */
+    readonly handle: string;
+    readonly compartments: readonly CompartmentManifest[];
+}
+/** Assemble the `NDBM` container from a manifest + inner bundle bytes (in manifest order). */
+declare function encodeMultiBundle(manifest: MultiBundleManifest, inner: readonly Uint8Array[]): Uint8Array;
+/** Parse the `NDBM` container into its manifest + raw inner bundle byte slices. */
+declare function decodeMultiBundle(bytes: Uint8Array): {
+    manifest: MultiBundleManifest;
+    inner: Uint8Array[];
+};
+/** Per-compartment input to {@link writeMultiVaultBundle}. */
+interface MultiVaultCompartmentInput {
+    readonly vault: Vault$1;
+    /** Owner-curated classification surfaced in the manifest (e.g. 'shard', 'pool'). */
+    readonly roleTag?: string;
+    /** ISO timestamp for the manifest; defaults to now. */
+    readonly exportedAt?: string;
+    /** Opt-in pre-decrypt disclosure for this compartment. */
+    readonly disclose?: {
+        /** `true` → use `vault.name`; a string → that explicit name. */
+        readonly name?: boolean | string;
+        /** `true` → include collection names + record counts. */
+        readonly collections?: boolean;
+        /** `true` → surface the inner bundle's public envelope into the manifest. */
+        readonly publicEnvelope?: boolean;
+    };
+    /** Options forwarded to `writeNoydbBundle` for this compartment's inner bundle. */
+    readonly bundleOptions?: WriteNoydbBundleOptions;
+}
+/** Write N vaults into one `NDBM` multi-compartment bundle. */
+declare function writeMultiVaultBundle(compartments: readonly MultiVaultCompartmentInput[], opts?: {
+    readonly handle?: string;
+}): Promise<Uint8Array>;
+/**
+ * Read the pre-decrypt manifest of a bundle WITHOUT decrypting any
+ * compartment. Accepts a multi-compartment `NDBM` bundle (returns its
+ * N entries) OR a single v1 `NDB1` bundle (returns a 1-entry manifest,
+ * for uniform handling). Throws on anything else.
+ */
+declare function readNoydbBundleManifest(bytes: Uint8Array): Promise<CompartmentManifest[]>;
+/**
+ * Extract one compartment's inner v1 `.noydb` bundle bytes, ready to
+ * pass to `readNoydbBundle`. `selector` is a compartment `handle` or a
+ * zero-based index. For a single v1 bundle, the bundle itself is the
+ * only compartment.
+ *
+ * Does NOT verify the manifest `innerSha256` — it returns the raw
+ * slice. Integrity is enforced downstream: `readNoydbBundle` verifies
+ * the inner bundle's own `bodySha256`. Callers wanting an early,
+ * pre-decrypt check can hash the returned bytes against the
+ * compartment's `innerSha256`.
+ */
+declare function readMultiVaultBundleCompartment(bytes: Uint8Array, selector: string | number): Uint8Array;
+
 /**
  * @klum-db/lobby interchange — migrate-then-merge (FR-8). Upgrade an incoming
  * compartment to the receiver's schema version IN STAGING, then merge.
@@ -1312,4 +1413,4 @@ declare class Lobby {
 }
 declare function createLobby(noydb: Noydb$1): Lobby;
 
-export { type CapturedBlueprint, type CompartmentMeta, CrossVaultAggregation, type CrossVaultClosurePlan, CrossVaultDanglingRefError, type CrossVaultDerivationContext, type CrossVaultDerivationSpec, CrossVaultGroupedAggregation, type GroupedRow as CrossVaultGroupedRow, type CrossVaultLiveAggregation, type CrossVaultLiveQuery, type CrossVaultPreview, type CrossVaultRef, type CrossVaultSeed, type DecryptedMergeOptions, type DeploymentEvent, DockedUnit, type ExportMultiVaultXlsxOptions, type ExtractCrossVaultOptions, type ExtractCrossVaultResult, type FanoutQueryOptions, type FanoutResult, type FieldAuthorityInputs, type FieldAuthorityPolicy, FieldAuthorityPolicyMissingError, type FieldAuthorityRule, FieldLevelDeferredError, type FleetMigrationResult, type GraduateOptions, type GraduationReport, InMemoryUnitDriver, type LiveQueryOptions, Lobby, type MergeCompartmentOptions, type MergeConflict, type MergeReport, type MergeStrategy, type MigrateThenMergeOptions, type MigrateThenMergeReport, type MigrationStatusRow, type MigrationStep, MigrationTransformRequiredError, MinVersionError, type RefreshInsightsResult, type SchemaManifestRow, ShardedCollection, ShardedGroupedQuery, ShardedQuery, type ShardingConfig, type SkippedVault, StateManagementVault, SurfaceCadenceScheduler, type SurfaceConflictPolicy, type SurfaceDefinition, type SurfaceDirection, SurfaceNotFoundError, type SurfaceRow, SurfaceStateError, type SurfaceStatus, type UnitDriver, UnitGraduationError, VaultGroup, type VaultGroupOptions, type VaultRegistryRow, type VaultTemplate, agreeSurface, applySurface, createLobby, describeCrossVaultExtraction, exportSurface, extractCrossVaultPartition, isSurfaceDue, listDueSurfaces, markSynced, mergeCompartment, mergeDecryptedRecords, migrateThenMerge, proposeSurface, resolveFieldAuthority, resolveRecordByFieldAuthority, walkCrossVaultClosure };
+export { type CapturedBlueprint, type CompartmentManifest, type CompartmentMeta, CrossVaultAggregation, type CrossVaultClosurePlan, CrossVaultDanglingRefError, type CrossVaultDerivationContext, type CrossVaultDerivationSpec, CrossVaultGroupedAggregation, type GroupedRow as CrossVaultGroupedRow, type CrossVaultLiveAggregation, type CrossVaultLiveQuery, type CrossVaultPreview, type CrossVaultRef, type CrossVaultSeed, type DecryptedMergeOptions, type DeploymentEvent, DockedUnit, type ExportMultiVaultXlsxOptions, type ExtractCrossVaultOptions, type ExtractCrossVaultResult, type FanoutQueryOptions, type FanoutResult, type FieldAuthorityInputs, type FieldAuthorityPolicy, FieldAuthorityPolicyMissingError, type FieldAuthorityRule, FieldLevelDeferredError, type FleetMigrationResult, type GraduateOptions, type GraduationReport, InMemoryUnitDriver, type LiveQueryOptions, Lobby, type MergeCompartmentOptions, type MergeConflict, type MergeReport, type MergeStrategy, type MigrateThenMergeOptions, type MigrateThenMergeReport, type MigrationStatusRow, type MigrationStep, MigrationTransformRequiredError, MinVersionError, type MultiBundleManifest, type MultiVaultCompartmentInput, NOYDB_MULTI_BUNDLE_MAGIC, NOYDB_MULTI_BUNDLE_PREFIX_BYTES, NOYDB_MULTI_BUNDLE_VERSION, type RefreshInsightsResult, type SchemaManifestRow, ShardedCollection, ShardedGroupedQuery, ShardedQuery, type ShardingConfig, type SkippedVault, StateManagementVault, SurfaceCadenceScheduler, type SurfaceConflictPolicy, type SurfaceDefinition, type SurfaceDirection, SurfaceNotFoundError, type SurfaceRow, SurfaceStateError, type SurfaceStatus, type UnitDriver, UnitGraduationError, VaultGroup, type VaultGroupOptions, type VaultRegistryRow, type VaultTemplate, agreeSurface, applySurface, createLobby, decodeMultiBundle, describeCrossVaultExtraction, encodeMultiBundle, exportSurface, extractCrossVaultPartition, isSurfaceDue, listDueSurfaces, markSynced, mergeCompartment, mergeDecryptedRecords, migrateThenMerge, proposeSurface, readMultiVaultBundleCompartment, readNoydbBundleManifest, resolveFieldAuthority, resolveRecordByFieldAuthority, walkCrossVaultClosure, writeMultiVaultBundle };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { Vault, SealingKeyProvider, Noydb as Noydb$1 } from '@noy-db/hub';
+import { Vault, SealingKeyProvider, PublicEnvelope, Noydb as Noydb$1 } from '@noy-db/hub';
 export { CustodyApi, DeedMarker, GrantCustodianOptions, LiberateOptions, LiberateResult, createDeedOwner, isDeedVault, liberateVault, loadDeedMarker } from '@noy-db/hub';
 import { IndexDef, LiveAggregation, AggregateSpec, AggregateResult, LiveQuery, Vault as Vault$1, Collection, Operator, Noydb, Query, JoinStrategy, ChangeEvent } from '@noy-db/hub/kernel';
 export { CrossShardJoinError, DataResidencyError, ReservedVaultNameError, ShardProvisioningError, UnknownShardError, VaultTemplateNotFoundError } from '@noy-db/hub/kernel';
-import { DecryptedRecord, ExtractionPreview } from '@noy-db/hub/bundle';
+import { DecryptedRecord, ExtractionPreview, WriteNoydbBundleOptions } from '@noy-db/hub/bundle';
 import { AsXlsxSheetOptions } from '@noy-db/as-xlsx';
 export { MultiVaultDenormColumn, MultiVaultXlsxEntry, MultiVaultXlsxOptions } from '@noy-db/as-xlsx';
 
@@ -987,6 +987,107 @@ declare class UnitGraduationError extends Error {
     constructor(message: string);
 }
 
+/**
+ * Multi-compartment `.noydb` bundle (`NDBM`). A thin outer container
+ * that embeds N standard single-vault `.noydb` bundles plus an
+ * unencrypted, owner-curated **manifest**. The v1 single-vault format
+ * is untouched; each compartment is a complete v1 bundle, produced by
+ * `writeNoydbBundle` and read by `readNoydbBundle`.
+ *
+ * Layout: magic 'NDBM'(4) · version(1) · reserved(1) · manifestLen(4 BE)
+ *         · manifest JSON · concat(inner v1 bundles, in manifest order).
+ *
+ * @packageDocumentation
+ */
+
+/** Magic bytes 'NDBM' — NOYDB Multi-compartment bundle. */
+declare const NOYDB_MULTI_BUNDLE_MAGIC: Uint8Array<ArrayBuffer>;
+/** Fixed prefix: magic(4) + version(1) + reserved(1) + manifestLen(4). */
+declare const NOYDB_MULTI_BUNDLE_PREFIX_BYTES = 10;
+/** Current multi-bundle layout version. */
+declare const NOYDB_MULTI_BUNDLE_VERSION = 1;
+/** One compartment's entry in the pre-decrypt manifest. */
+interface CompartmentManifest {
+    /** The inner v1 bundle's stable ULID handle. */
+    readonly handle: string;
+    /** Owner-curated classification (e.g. 'shard', 'pool'). Opt-in. */
+    readonly roleTag?: string;
+    /** ISO export timestamp. Always set by the writer; absent for a v1 bundle read as a 1-entry manifest. */
+    readonly exportedAt?: string;
+    /** Compartment (vault) name. Opt-in disclosure. */
+    readonly name?: string;
+    /** Collection names + record counts. Opt-in disclosure. */
+    readonly collections?: readonly {
+        readonly name: string;
+        readonly count: number;
+    }[];
+    /** Inner bundle's owner-curated public envelope, surfaced. Opt-in. */
+    readonly publicEnvelope?: PublicEnvelope;
+    /** Byte length of the inner v1 bundle (drives framing). */
+    readonly innerBytes: number;
+    /** SHA-256 (lowercase hex) of the inner v1 bundle bytes — pre-decrypt integrity. */
+    readonly innerSha256: string;
+    /** Source vault's schema fence version at extract time (FR-8). Opt-in; absent on older bundles. */
+    readonly schemaVersion?: number;
+}
+/** The unencrypted manifest of a multi-compartment bundle. */
+interface MultiBundleManifest {
+    readonly multiFormatVersion: number;
+    /** Opaque ULID for the outer container. */
+    readonly handle: string;
+    readonly compartments: readonly CompartmentManifest[];
+}
+/** Assemble the `NDBM` container from a manifest + inner bundle bytes (in manifest order). */
+declare function encodeMultiBundle(manifest: MultiBundleManifest, inner: readonly Uint8Array[]): Uint8Array;
+/** Parse the `NDBM` container into its manifest + raw inner bundle byte slices. */
+declare function decodeMultiBundle(bytes: Uint8Array): {
+    manifest: MultiBundleManifest;
+    inner: Uint8Array[];
+};
+/** Per-compartment input to {@link writeMultiVaultBundle}. */
+interface MultiVaultCompartmentInput {
+    readonly vault: Vault$1;
+    /** Owner-curated classification surfaced in the manifest (e.g. 'shard', 'pool'). */
+    readonly roleTag?: string;
+    /** ISO timestamp for the manifest; defaults to now. */
+    readonly exportedAt?: string;
+    /** Opt-in pre-decrypt disclosure for this compartment. */
+    readonly disclose?: {
+        /** `true` → use `vault.name`; a string → that explicit name. */
+        readonly name?: boolean | string;
+        /** `true` → include collection names + record counts. */
+        readonly collections?: boolean;
+        /** `true` → surface the inner bundle's public envelope into the manifest. */
+        readonly publicEnvelope?: boolean;
+    };
+    /** Options forwarded to `writeNoydbBundle` for this compartment's inner bundle. */
+    readonly bundleOptions?: WriteNoydbBundleOptions;
+}
+/** Write N vaults into one `NDBM` multi-compartment bundle. */
+declare function writeMultiVaultBundle(compartments: readonly MultiVaultCompartmentInput[], opts?: {
+    readonly handle?: string;
+}): Promise<Uint8Array>;
+/**
+ * Read the pre-decrypt manifest of a bundle WITHOUT decrypting any
+ * compartment. Accepts a multi-compartment `NDBM` bundle (returns its
+ * N entries) OR a single v1 `NDB1` bundle (returns a 1-entry manifest,
+ * for uniform handling). Throws on anything else.
+ */
+declare function readNoydbBundleManifest(bytes: Uint8Array): Promise<CompartmentManifest[]>;
+/**
+ * Extract one compartment's inner v1 `.noydb` bundle bytes, ready to
+ * pass to `readNoydbBundle`. `selector` is a compartment `handle` or a
+ * zero-based index. For a single v1 bundle, the bundle itself is the
+ * only compartment.
+ *
+ * Does NOT verify the manifest `innerSha256` — it returns the raw
+ * slice. Integrity is enforced downstream: `readNoydbBundle` verifies
+ * the inner bundle's own `bodySha256`. Callers wanting an early,
+ * pre-decrypt check can hash the returned bytes against the
+ * compartment's `innerSha256`.
+ */
+declare function readMultiVaultBundleCompartment(bytes: Uint8Array, selector: string | number): Uint8Array;
+
 /**
  * @klum-db/lobby interchange — migrate-then-merge (FR-8). Upgrade an incoming
  * compartment to the receiver's schema version IN STAGING, then merge.
@@ -1312,4 +1413,4 @@ declare class Lobby {
 }
 declare function createLobby(noydb: Noydb$1): Lobby;
 
-export { type CapturedBlueprint, type CompartmentMeta, CrossVaultAggregation, type CrossVaultClosurePlan, CrossVaultDanglingRefError, type CrossVaultDerivationContext, type CrossVaultDerivationSpec, CrossVaultGroupedAggregation, type GroupedRow as CrossVaultGroupedRow, type CrossVaultLiveAggregation, type CrossVaultLiveQuery, type CrossVaultPreview, type CrossVaultRef, type CrossVaultSeed, type DecryptedMergeOptions, type DeploymentEvent, DockedUnit, type ExportMultiVaultXlsxOptions, type ExtractCrossVaultOptions, type ExtractCrossVaultResult, type FanoutQueryOptions, type FanoutResult, type FieldAuthorityInputs, type FieldAuthorityPolicy, FieldAuthorityPolicyMissingError, type FieldAuthorityRule, FieldLevelDeferredError, type FleetMigrationResult, type GraduateOptions, type GraduationReport, InMemoryUnitDriver, type LiveQueryOptions, Lobby, type MergeCompartmentOptions, type MergeConflict, type MergeReport, type MergeStrategy, type MigrateThenMergeOptions, type MigrateThenMergeReport, type MigrationStatusRow, type MigrationStep, MigrationTransformRequiredError, MinVersionError, type RefreshInsightsResult, type SchemaManifestRow, ShardedCollection, ShardedGroupedQuery, ShardedQuery, type ShardingConfig, type SkippedVault, StateManagementVault, SurfaceCadenceScheduler, type SurfaceConflictPolicy, type SurfaceDefinition, type SurfaceDirection, SurfaceNotFoundError, type SurfaceRow, SurfaceStateError, type SurfaceStatus, type UnitDriver, UnitGraduationError, VaultGroup, type VaultGroupOptions, type VaultRegistryRow, type VaultTemplate, agreeSurface, applySurface, createLobby, describeCrossVaultExtraction, exportSurface, extractCrossVaultPartition, isSurfaceDue, listDueSurfaces, markSynced, mergeCompartment, mergeDecryptedRecords, migrateThenMerge, proposeSurface, resolveFieldAuthority, resolveRecordByFieldAuthority, walkCrossVaultClosure };
+export { type CapturedBlueprint, type CompartmentManifest, type CompartmentMeta, CrossVaultAggregation, type CrossVaultClosurePlan, CrossVaultDanglingRefError, type CrossVaultDerivationContext, type CrossVaultDerivationSpec, CrossVaultGroupedAggregation, type GroupedRow as CrossVaultGroupedRow, type CrossVaultLiveAggregation, type CrossVaultLiveQuery, type CrossVaultPreview, type CrossVaultRef, type CrossVaultSeed, type DecryptedMergeOptions, type DeploymentEvent, DockedUnit, type ExportMultiVaultXlsxOptions, type ExtractCrossVaultOptions, type ExtractCrossVaultResult, type FanoutQueryOptions, type FanoutResult, type FieldAuthorityInputs, type FieldAuthorityPolicy, FieldAuthorityPolicyMissingError, type FieldAuthorityRule, FieldLevelDeferredError, type FleetMigrationResult, type GraduateOptions, type GraduationReport, InMemoryUnitDriver, type LiveQueryOptions, Lobby, type MergeCompartmentOptions, type MergeConflict, type MergeReport, type MergeStrategy, type MigrateThenMergeOptions, type MigrateThenMergeReport, type MigrationStatusRow, type MigrationStep, MigrationTransformRequiredError, MinVersionError, type MultiBundleManifest, type MultiVaultCompartmentInput, NOYDB_MULTI_BUNDLE_MAGIC, NOYDB_MULTI_BUNDLE_PREFIX_BYTES, NOYDB_MULTI_BUNDLE_VERSION, type RefreshInsightsResult, type SchemaManifestRow, ShardedCollection, ShardedGroupedQuery, ShardedQuery, type ShardingConfig, type SkippedVault, StateManagementVault, SurfaceCadenceScheduler, type SurfaceConflictPolicy, type SurfaceDefinition, type SurfaceDirection, SurfaceNotFoundError, type SurfaceRow, SurfaceStateError, type SurfaceStatus, type UnitDriver, UnitGraduationError, VaultGroup, type VaultGroupOptions, type VaultRegistryRow, type VaultTemplate, agreeSurface, applySurface, createLobby, decodeMultiBundle, describeCrossVaultExtraction, encodeMultiBundle, exportSurface, extractCrossVaultPartition, isSurfaceDue, listDueSurfaces, markSynced, mergeCompartment, mergeDecryptedRecords, migrateThenMerge, proposeSurface, readMultiVaultBundleCompartment, readNoydbBundleManifest, resolveFieldAuthority, resolveRecordByFieldAuthority, walkCrossVaultClosure, writeMultiVaultBundle };

package/dist/index.js

@@ -8,6 +8,188 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/bundle/uint32.ts
+function readUint32BE(bytes, offset) {
+  return (bytes[offset] << 24 | bytes[offset + 1] << 16 | bytes[offset + 2] << 8 | bytes[offset + 3]) >>> 0;
+}
+function writeUint32BE(bytes, offset, value) {
+  bytes[offset] = value >>> 24 & 255;
+  bytes[offset + 1] = value >>> 16 & 255;
+  bytes[offset + 2] = value >>> 8 & 255;
+  bytes[offset + 3] = value & 255;
+}
+var init_uint32 = __esm({
+  "src/bundle/uint32.ts"() {
+    "use strict";
+  }
+});
+
+// src/bundle/multi-bundle.ts
+import { sha256Hex, generateULID } from "@noy-db/hub/kernel";
+import {
+  writeNoydbBundle,
+  readNoydbBundleHeader
+} from "@noy-db/hub/bundle";
+import {
+  readNoydbBundlePublicEnvelope,
+  hasNoydbBundleMagic
+} from "@noy-db/hub";
+function encodeMultiBundle(manifest, inner) {
+  validateManifest(manifest);
+  if (manifest.compartments.length !== inner.length) {
+    throw new Error(`multi-bundle: manifest has ${manifest.compartments.length} compartments but ${inner.length} inner bundles were provided.`);
+  }
+  for (let i = 0; i < inner.length; i++) {
+    if (manifest.compartments[i].innerBytes !== inner[i].length) {
+      throw new Error(`multi-bundle: compartment ${i} declares innerBytes ${manifest.compartments[i].innerBytes} but ${inner[i].length} bytes were provided.`);
+    }
+  }
+  const manifestBytes = new TextEncoder().encode(JSON.stringify(manifest));
+  const bodyLen = inner.reduce((n, b) => n + b.length, 0);
+  const out = new Uint8Array(NOYDB_MULTI_BUNDLE_PREFIX_BYTES + manifestBytes.length + bodyLen);
+  out.set(NOYDB_MULTI_BUNDLE_MAGIC, 0);
+  out[4] = NOYDB_MULTI_BUNDLE_VERSION;
+  out[5] = 0;
+  writeUint32BE(out, 6, manifestBytes.length);
+  out.set(manifestBytes, NOYDB_MULTI_BUNDLE_PREFIX_BYTES);
+  let off = NOYDB_MULTI_BUNDLE_PREFIX_BYTES + manifestBytes.length;
+  for (const b of inner) {
+    out.set(b, off);
+    off += b.length;
+  }
+  return out;
+}
+function hasMultiMagic(bytes) {
+  if (bytes.length < NOYDB_MULTI_BUNDLE_MAGIC.length) return false;
+  for (let i = 0; i < NOYDB_MULTI_BUNDLE_MAGIC.length; i++) if (bytes[i] !== NOYDB_MULTI_BUNDLE_MAGIC[i]) return false;
+  return true;
+}
+function validateManifest(parsed) {
+  if (parsed === null || typeof parsed !== "object") throw new Error("multi-bundle manifest must be a JSON object.");
+  const m = parsed;
+  if (m["multiFormatVersion"] !== NOYDB_MULTI_BUNDLE_VERSION) throw new Error(`multi-bundle manifest.multiFormatVersion must be ${NOYDB_MULTI_BUNDLE_VERSION}, got ${String(m["multiFormatVersion"])}.`);
+  if (typeof m["handle"] !== "string" || m["handle"].length === 0) throw new Error("multi-bundle manifest.handle must be a non-empty string.");
+  if (!Array.isArray(m["compartments"])) throw new Error("multi-bundle manifest.compartments must be an array.");
+  const seenHandles = /* @__PURE__ */ new Set();
+  for (const c of m["compartments"]) {
+    if (c === null || typeof c !== "object") throw new Error("multi-bundle compartment must be an object.");
+    const e = c;
+    if (typeof e["handle"] !== "string" || e["handle"].length === 0) throw new Error("multi-bundle compartment.handle must be a non-empty string.");
+    if (seenHandles.has(e["handle"])) {
+      throw new Error(`multi-bundle manifest has a duplicate compartment handle "${e["handle"]}".`);
+    }
+    seenHandles.add(e["handle"]);
+    if (typeof e["innerBytes"] !== "number" || !Number.isInteger(e["innerBytes"]) || e["innerBytes"] < 0) throw new Error("multi-bundle compartment.innerBytes must be a non-negative integer.");
+    if (typeof e["innerSha256"] !== "string" || !/^[0-9a-f]{64}$/.test(e["innerSha256"])) throw new Error("multi-bundle compartment.innerSha256 must be 64-char lowercase hex.");
+  }
+}
+function decodeMultiBundle(bytes) {
+  if (!hasMultiMagic(bytes)) throw new Error("not a NOYDB multi-bundle: missing NDBM magic.");
+  if (bytes.length < NOYDB_MULTI_BUNDLE_PREFIX_BYTES) throw new Error("multi-bundle truncated: shorter than the fixed prefix.");
+  if (bytes[4] !== NOYDB_MULTI_BUNDLE_VERSION) throw new Error(`unsupported multi-bundle version ${String(bytes[4])}.`);
+  const manifestLen = readUint32BE(bytes, 6);
+  const manifestEnd = NOYDB_MULTI_BUNDLE_PREFIX_BYTES + manifestLen;
+  if (manifestEnd > bytes.length) throw new Error("multi-bundle truncated: manifest length overruns the buffer.");
+  const manifestJson = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(NOYDB_MULTI_BUNDLE_PREFIX_BYTES, manifestEnd));
+  let parsed;
+  try {
+    parsed = JSON.parse(manifestJson);
+  } catch (err) {
+    throw new Error(`multi-bundle manifest is not valid JSON: ${err.message}`);
+  }
+  validateManifest(parsed);
+  const inner = [];
+  let off = manifestEnd;
+  for (const c of parsed.compartments) {
+    const end = off + c.innerBytes;
+    if (end > bytes.length) throw new Error(`multi-bundle truncated: compartment "${c.handle}" innerBytes overruns the buffer.`);
+    inner.push(bytes.subarray(off, end));
+    off = end;
+  }
+  if (off !== bytes.length) {
+    throw new Error(`multi-bundle: ${bytes.length - off} trailing byte(s) after the last compartment \u2014 buffer may be corrupt.`);
+  }
+  return { manifest: parsed, inner };
+}
+async function writeMultiVaultBundle(compartments, opts = {}) {
+  if (compartments.length === 0) throw new Error("writeMultiVaultBundle: at least one compartment is required.");
+  const inner = [];
+  const entries = [];
+  for (const c of compartments) {
+    const innerBytes = await writeNoydbBundle(c.vault, c.bundleOptions ?? {});
+    const header = readNoydbBundleHeader(innerBytes);
+    const entry = {
+      handle: header.handle,
+      exportedAt: c.exportedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      innerBytes: innerBytes.length,
+      innerSha256: await sha256Hex(innerBytes)
+    };
+    if (c.roleTag !== void 0) entry.roleTag = c.roleTag;
+    if (c.disclose?.name !== void 0 && c.disclose.name !== false) {
+      entry.name = c.disclose.name === true ? c.vault.name : c.disclose.name;
+    }
+    if (c.disclose?.collections === true) {
+      const names = await c.vault.collections();
+      entry.collections = await Promise.all(
+        names.map(async (n) => ({ name: n, count: await c.vault.collection(n).count() }))
+      );
+    }
+    if (c.disclose?.publicEnvelope === true) {
+      const env = readNoydbBundlePublicEnvelope(innerBytes);
+      if (env !== void 0) entry.publicEnvelope = env;
+    }
+    const fence = await c.vault.schemaFenceState();
+    entry.schemaVersion = fence.currentSchemaVersion;
+    inner.push(innerBytes);
+    entries.push(entry);
+  }
+  const manifest = {
+    multiFormatVersion: NOYDB_MULTI_BUNDLE_VERSION,
+    handle: opts.handle ?? generateULID(),
+    compartments: entries
+  };
+  return encodeMultiBundle(manifest, inner);
+}
+async function readNoydbBundleManifest(bytes) {
+  if (hasMultiMagic(bytes)) return [...decodeMultiBundle(bytes).manifest.compartments];
+  if (hasNoydbBundleMagic(bytes)) {
+    const header = readNoydbBundleHeader(bytes);
+    const env = readNoydbBundlePublicEnvelope(bytes);
+    const entry = {
+      handle: header.handle,
+      innerBytes: bytes.length,
+      innerSha256: await sha256Hex(bytes)
+    };
+    if (env !== void 0) entry.publicEnvelope = env;
+    return [entry];
+  }
+  throw new Error("readNoydbBundleManifest: not a NOYDB bundle (no NDB1 or NDBM magic).");
+}
+function readMultiVaultBundleCompartment(bytes, selector) {
+  if (typeof selector === "number" && !Number.isInteger(selector)) {
+    throw new Error(`readMultiVaultBundleCompartment: numeric selector must be an integer, got ${selector}.`);
+  }
+  if (hasNoydbBundleMagic(bytes) && !hasMultiMagic(bytes)) {
+    const header = readNoydbBundleHeader(bytes);
+    if (selector === 0 || selector === header.handle) return bytes;
+    throw new Error(`readMultiVaultBundleCompartment: single v1 bundle has only compartment "${header.handle}".`);
+  }
+  const { manifest, inner } = decodeMultiBundle(bytes);
+  const idx = typeof selector === "number" ? selector : manifest.compartments.findIndex((c) => c.handle === selector);
+  if (idx < 0 || idx >= inner.length) throw new Error(`readMultiVaultBundleCompartment: no compartment ${typeof selector === "number" ? `at index ${selector}` : `"${selector}"`}.`);
+  return inner[idx];
+}
+var NOYDB_MULTI_BUNDLE_MAGIC, NOYDB_MULTI_BUNDLE_PREFIX_BYTES, NOYDB_MULTI_BUNDLE_VERSION;
+var init_multi_bundle = __esm({
+  "src/bundle/multi-bundle.ts"() {
+    "use strict";
+    init_uint32();
+    NOYDB_MULTI_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 77]);
+    NOYDB_MULTI_BUNDLE_PREFIX_BYTES = 10;
+    NOYDB_MULTI_BUNDLE_VERSION = 1;
+  }
+});
+
 // src/interchange/extract-cross-vault.ts
 var extract_cross_vault_exports = {};
 __export(extract_cross_vault_exports, {
@@ -19,13 +201,10 @@ __export(extract_cross_vault_exports, {
 import {
   walkClosure,
   extractPartition,
-  encodeMultiBundle,
-  readNoydbBundleHeader,
-  NOYDB_MULTI_BUNDLE_VERSION,
-  generateULID,
+  readNoydbBundleHeader as readNoydbBundleHeader2,
   describeExtraction
 } from "@noy-db/hub/bundle";
-import { sha256Hex } from "@noy-db/hub/kernel";
+import { sha256Hex as sha256Hex2, generateULID as generateULID2 } from "@noy-db/hub/kernel";
 function asIdArray(v) {
   if (v === null || v === void 0) return [];
   if (Array.isArray(v)) return v.filter((x) => typeof x === "string" || typeof x === "number").map(String);
@@ -142,13 +321,13 @@ async function extractCrossVaultPartition(openVault, opts) {
       carryLedger: opts.carryLedger ?? false,
       ...opts.compression !== void 0 ? { compression: opts.compression } : {}
     });
-    const header = readNoydbBundleHeader(bundleBytes);
+    const header = readNoydbBundleHeader2(bundleBytes);
     const meta = opts.compartmentMeta?.[vaultName];
     const entry = {
       handle: header.handle,
       exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
       innerBytes: bundleBytes.length,
-      innerSha256: await sha256Hex(bundleBytes)
+      innerSha256: await sha256Hex2(bundleBytes)
     };
     if (meta?.roleTag !== void 0) entry.roleTag = meta.roleTag;
     if (meta?.disclose?.name !== void 0 && meta.disclose.name !== false) {
@@ -167,7 +346,7 @@ async function extractCrossVaultPartition(openVault, opts) {
   }
   const manifest = {
     multiFormatVersion: NOYDB_MULTI_BUNDLE_VERSION,
-    handle: generateULID(),
+    handle: generateULID2(),
     compartments
   };
   return { bundle: encodeMultiBundle(manifest, inner), transferKeys, sealIds };
@@ -189,6 +368,7 @@ var CrossVaultDanglingRefError;
 var init_extract_cross_vault = __esm({
   "src/interchange/extract-cross-vault.ts"() {
     "use strict";
+    init_multi_bundle();
     CrossVaultDanglingRefError = class extends Error {
       constructor(dangling) {
         super(
@@ -544,12 +724,12 @@ __export(surface_exports, {
   markSynced: () => markSynced,
   proposeSurface: () => proposeSurface
 });
-import { generateULID as generateULID2 } from "@noy-db/hub/kernel";
+import { generateULID as generateULID3 } from "@noy-db/hub/kernel";
 import { extractPartition as extractPartition2 } from "@noy-db/hub/bundle";
 async function proposeSurface(smv, def, proposedBy, now) {
   const row = {
     ...def,
-    id: def.id ?? generateULID2(),
+    id: def.id ?? generateULID3(),
     status: "proposed",
     proposedBy,
     createdAt: now
@@ -666,7 +846,7 @@ var init_surface = __esm({
 });
 
 // src/federation/schema-manifest.ts
-import { sha256Hex as sha256Hex2 } from "@noy-db/hub/kernel";
+import { sha256Hex as sha256Hex3 } from "@noy-db/hub/kernel";
 function captureBlueprint(configure) {
   const recorded = [];
   const collectionStub = new Proxy(
@@ -717,7 +897,7 @@ function canonical(value) {
   return `{${keys.map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`).join(",")}}`;
 }
 async function fingerprintBlueprint(bp) {
-  return sha256Hex2(new TextEncoder().encode(canonical(bp)));
+  return sha256Hex3(new TextEncoder().encode(canonical(bp)));
 }
 var init_schema_manifest = __esm({
   "src/federation/schema-manifest.ts"() {
@@ -739,7 +919,7 @@ __export(state_vault_exports, {
   STATE_VAULT_NAME: () => STATE_VAULT_NAME,
   StateManagementVault: () => StateManagementVault
 });
-import { generateULID as generateULID3 } from "@noy-db/hub/kernel";
+import { generateULID as generateULID4 } from "@noy-db/hub/kernel";
 var REGISTRY, MANIFEST, EVENTS, MIGRATION_STATUS, SURFACES, StateManagementVault;
 var init_state_vault = __esm({
   "src/federation/state-vault.ts"() {
@@ -835,7 +1015,7 @@ var init_state_vault = __esm({
        */
       async appendEvent(event) {
         const ts = event.ts ?? Date.now();
-        const id = generateULID3();
+        const id = generateULID4();
         await this.#events.put(id, { ...event, id, ts });
       }
       /**
@@ -1809,6 +1989,7 @@ var DockedUnit = class {
 };
 
 // src/index.ts
+init_multi_bundle();
 init_extract_cross_vault();
 init_merge_compartment();
 import {
@@ -2023,6 +2204,9 @@ export {
   Lobby,
   MigrationTransformRequiredError,
   MinVersionError,
+  NOYDB_MULTI_BUNDLE_MAGIC,
+  NOYDB_MULTI_BUNDLE_PREFIX_BYTES,
+  NOYDB_MULTI_BUNDLE_VERSION,
   ReservedVaultNameError3 as ReservedVaultNameError,
   ShardProvisioningError2 as ShardProvisioningError,
   SurfaceCadenceScheduler,
@@ -2035,7 +2219,9 @@ export {
   applySurface,
   createDeedOwner2 as createDeedOwner,
   createLobby,
+  decodeMultiBundle,
   describeCrossVaultExtraction,
+  encodeMultiBundle,
   exportSurface,
   extractCrossVaultPartition,
   isDeedVault,
@@ -2048,8 +2234,11 @@ export {
   mergeDecryptedRecords,
   migrateThenMerge,
   proposeSurface,
+  readMultiVaultBundleCompartment,
+  readNoydbBundleManifest,
   resolveFieldAuthority,
   resolveRecordByFieldAuthority,
-  walkCrossVaultClosure
+  walkCrossVaultClosure,
+  writeMultiVaultBundle
 };
 //# sourceMappingURL=index.js.map