npm - @noy-db/hub - Versions diffs - 0.10.0-pre.0 → 0.10.0-pre.2 - Mend

@noy-db/hub 0.10.0-pre.0 → 0.10.0-pre.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (492) hide show

package/dist/chunk-OIBFIWVJ.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/with-party/team/managed-secret.ts"],"sourcesContent":["/**\n * Managed-secret mode — rubber-hose-resistant vaults.\n *\n * A vault mode where the secret is machine-generated and never\n * exposed to the user, sealed under a developer-provided\n * {@link NoydbSealer} (macOS Keychain, Windows Credential\n * Manager, libsecret, AWS KMS, …). The user has no secret to give\n * up to coercion — they can't reveal what they don't know.\n *\n * ## Components in this file\n *\n * - {@link NoydbSealer} — the interface concrete providers\n * implement. Provider implementations live OUTSIDE hub (per-\n * platform packages).\n * - {@link MemorySealer} — in-memory test provider; uses\n * a deterministic per-instance \"key\" so two providers with\n * different ids cannot unseal each other's outputs.\n * - {@link RecipientHint} — public material a sender uses to seal\n * plaintext for a specific recipient; published by\n * {@link RecipientSealer.publishRecipientHint} and transported\n * out-of-band to the sender before bundle writes.\n * - {@link RecipientSealer} — interface for asymmetric/granted\n * providers that support recipient-target sealing (RSA-OAEP,\n * cloud-KMS asymmetric, etc.); distinct from self-only\n * {@link NoydbSealer} (macOS Keychain, WebAuthn-PRF).\n * - {@link MemoryRecipientSealer} — in-process reference\n * implementation of both `RecipientSealer` and\n * `NoydbSealer` using real WebCrypto RSA-OAEP + AES-GCM;\n * safe for tests and same-process sender/recipient scenarios.\n * - {@link loadSealedSecret} / {@link saveSealedSecret} —\n * plaintext envelope storage at `_meta/sealed-secret`.\n * Mirrors the `_meta/handle` and `_meta/public-envelope` AES-\n * GCM-bypassed patterns. The sealing layer (provider's job)\n * is the security boundary; hub doesn't have a key to encrypt\n * with at this layer — that's the whole point of the design.\n * - {@link resolveManagedSecret} — orchestrates the \"generate +\n * seal + persist on first open; unseal on reopen\" flow.\n * Returns the plaintext secret string that the rest of the\n * `createNoydb` keyring path consumes.\n *\n * Deferred to follow-ups:\n * - Block `rotate-secret` policy gate under managed mode.\n * - Mandatory strong-recovery enforcement.\n * - Recovery flow under managed mode (generates fresh sealed phrase).\n *\n * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode\n *\n * @module\n */\n\nimport {\n buildRecordEnvelope,\n importTransferKey,\n encryptBytes,\n decryptBytes,\n bufferToBase64,\n base64ToBuffer,\n generateRecipientKeyPair,\n exportRecipientPublicKeySpki,\n importRecipientPublicKeySpki,\n recipientWrap,\n recipientUnwrap,\n type EnclaveKeyPair,\n} from '../../capsule/index.js'\nimport type { NoydbStore, RecipientSealer } from '../../kernel/types.js'\n\n/**\n * The contract concrete providers (per-platform key stores) implement\n * to seal and unseal a hub-generated random secret. The plaintext\n * secret NEVER leaves hub-controlled memory in unsealed form —\n * the provider receives the bytes, returns opaque sealed bytes, and\n * later reverses the operation. Hub treats the sealed bytes as\n * fully opaque.\n *\n * Implementations live OUTSIDE `@noy-db/hub` (separate packages\n * per the issue's \"Concrete providers (live outside hub)\" note):\n *\n * | Platform | Package (TBD) | Backing |\n * |---|---|---|\n * | macOS | `@noy-db/seal-macos-keychain` | Security.framework |\n * | Windows | `@noy-db/seal-wincred` | Credential Manager |\n * | Linux | `@noy-db/seal-libsecret` | libsecret / secret-service |\n * | Cloud / server | `@noy-db/seal-aws-kms` | AWS KMS Decrypt |\n */\nexport interface NoydbSealer {\n /**\n * Non-sensitive identifier disclosed in the persisted envelope.\n * Surfaced to consumers via `loadSealedSecret().providerId` so\n * a vault opened with the wrong provider class can detect the\n * mismatch and surface a clear error. NOT secret — fine to log.\n *\n * Suggested format: `<family>:<scope>` — e.g. `macos-keychain:com.acme.app`,\n * `aws-kms:arn:aws:kms:us-east-1:123:key/abc`. The hub never\n * parses this; it's purely audit metadata.\n */\n readonly id: string\n\n /**\n * Seal raw secret bytes. Output bytes are opaque to hub.\n *\n * `ctx` is ADDITIVE and OPTIONAL (family#157): hub passes it where the bytes\n * belong to one vault, so a provider can scope its key material — a KMS\n * encryption context, a per-vault keychain account, a key-id suffix. An\n * existing provider that ignores the second argument keeps working unchanged.\n *\n * ⛔ A provider MUST stay functional when `ctx` is ABSENT, and must not treat\n * absence as an error. Hub omits it deliberately where sealed bytes have to\n * TRAVEL — see {@link SealContext}.\n */\n seal(secret: Uint8Array, ctx?: SealContext): Promise<Uint8Array>\n\n /**\n * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or\n * any other failure — hub treats a thrown error as \"this provider\n * cannot unlock this vault\" and surfaces it to the caller.\n *\n * ⚠️ Hub passes the SAME `ctx` it sealed under at every paired call site, so a\n * provider that binds key material to `ctx.vault` can unseal its own output.\n * It is not passed where it was not available at seal time.\n */\n unseal(sealed: Uint8Array, ctx?: SealContext): Promise<Uint8Array>\n}\n\n/**\n * What hub knows about the bytes it is asking a {@link NoydbSealer} to seal\n * (family#157). Deliberately one field — anything a provider needs beyond the\n * vault name belongs in its own construction, not in a per-call argument.\n *\n * ⛔ **Hub does NOT pass this on every call, and the exception is load-bearing.**\n * A pod's auto-unlock credentials (`with-pod/pod.ts`) are sealed WITHOUT a\n * context, because a pod is a PORTABLE bundle: `ReadPodOptions` carries no\n * vault, and the pod may be read into a differently-named vault or merely\n * inspected with no vault at all. A provider that bound those bytes to a vault\n * name would produce a credential only the originating vault could open, which\n * defeats the entire point of the format.\n *\n * ⭐ So the rule for a provider author is the asymmetry itself: `ctx` present\n * means \"these bytes stay in this vault\" and `ctx` absent means \"these bytes\n * are meant to travel\". Scoping to `ctx.vault` when it IS given is safe for\n * exactly that reason.\n */\nexport interface SealContext {\n /** The vault whose secret is being sealed or unsealed. */\n readonly vault: string\n}\n\n/**\n * In-memory test provider. NOT secure — uses a deterministic\n * per-instance \"key\" (16-byte SHA-256 of `id`) XOR'd over the\n * secret plus a 4-byte provider-id fingerprint prefix. The XOR is\n * sufficient to make different `id` values produce mutually-unsealable\n * outputs (the contract tests for that), but offers ZERO real\n * confidentiality — never use outside tests.\n *\n * Replace with a real platform provider in production.\n */\nexport class MemorySealer implements NoydbSealer {\n readonly id: string\n private readonly fingerprint: Uint8Array\n private readonly keyBytes: Uint8Array\n\n constructor(opts: { id: string }) {\n this.id = opts.id\n // Deterministic 4-byte fingerprint of the provider id, prepended\n // to every sealed output so we can detect \"wrong provider\" at\n // unseal time without leaking anything sensitive about either\n // provider's actual key material.\n const encoded = new TextEncoder().encode(opts.id)\n let h = 0\n for (let i = 0; i < encoded.length; i++) {\n h = (h * 31 + encoded[i]!) >>> 0\n }\n this.fingerprint = new Uint8Array([\n (h >>> 24) & 0xff, (h >>> 16) & 0xff, (h >>> 8) & 0xff, h & 0xff,\n ])\n // Deterministic 16-byte \"key\" derived from the id by repeating\n // the fingerprint with offsets. Good enough for the XOR-stream\n // test cipher; never confuse this with real key derivation.\n this.keyBytes = new Uint8Array(16)\n for (let i = 0; i < 16; i++) {\n this.keyBytes[i] = this.fingerprint[i % 4]! ^ (i * 17)\n }\n }\n\n /**\n * Deterministic 4-byte integrity tag over the ciphertext, keyed by the\n * same derived bytes. NOT a MAC and not forgery-resistant — a real\n * provider authenticates with its backend. It exists because the contract\n * says `unseal` MUST throw on tamper, and a double that silently returns\n * corrupted bytes is not modelling the contract it stands in for. Without\n * it, every managed-mode test ran against a provider that could not fail\n * the way a real one must (found by @noy-db/ports/at).\n */\n private tag(cipher: Uint8Array): Uint8Array {\n let a = 0x9e3779b9\n for (let i = 0; i < cipher.length; i++) {\n a = ((a ^ (cipher[i]! ^ this.keyBytes[i % 16]!)) * 0x01000193) >>> 0\n }\n return new Uint8Array([(a >>> 24) & 0xff, (a >>> 16) & 0xff, (a >>> 8) & 0xff, a & 0xff])\n }\n\n async seal(secret: Uint8Array): Promise<Uint8Array> {\n const cipher = new Uint8Array(secret.length)\n for (let i = 0; i < secret.length; i++) {\n cipher[i] = secret[i]! ^ this.keyBytes[i % 16]!\n }\n const out = new Uint8Array(8 + secret.length)\n out.set(this.fingerprint, 0)\n out.set(this.tag(cipher), 4)\n out.set(cipher, 8)\n return out\n }\n\n async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n if (sealed.length < 8) {\n throw new Error('MemorySealer: sealed input too short')\n }\n for (let i = 0; i < 4; i++) {\n if (sealed[i] !== this.fingerprint[i]) {\n throw new Error(\n `MemorySealer(\"${this.id}\"): provider-id mismatch on unseal `\n + '(sealed bytes were produced by a different provider)',\n )\n }\n }\n const cipher = sealed.subarray(8)\n const expected = this.tag(cipher)\n for (let i = 0; i < 4; i++) {\n if (sealed[4 + i] !== expected[i]) {\n throw new Error(\n `MemorySealer(\"${this.id}\"): integrity check failed on unseal `\n + '(the sealed bytes were modified after sealing)',\n )\n }\n }\n const out = new Uint8Array(cipher.length)\n for (let i = 0; i < cipher.length; i++) {\n out[i] = cipher[i]! ^ this.keyBytes[i % 16]!\n }\n return out\n }\n}\n\n/**\n * Public material a sender uses to seal-for-this-recipient. Published by\n * a recipient's RecipientSealer; transported to the sender out-of-band\n * (email, S3, in-app message). The sender obtains the hint, supplies it\n * to writePod's sealedCredentials.perUser[userId].hint, and the\n * hub seals each user's credential against it. Per foundation §11.4.\n */\nexport type RecipientHint = {\n readonly v: 1\n /** Recipient's provider id; matches the SealedAutoUnlockEntry.pid they'll unseal under. */\n readonly pid: string\n /** Algorithm the sender uses to produce the seal. Slice 1 ships RSA-OAEP-SHA256 only. */\n readonly alg: 'rsa-oaep-sha256'\n /** Public material — alg-specific. For 'rsa-oaep-sha256': { publicKeyPem: string }. */\n readonly material: Readonly<Record<string, unknown>>\n}\n\n// Hoisted to kernel/types.ts (C3 — enclave self-containment: sealing.ts\n// consumes this as a spine-owned contract type). Re-exported here so existing\n// importers of this module are unaffected.\nexport type { RecipientSealer } from '../../kernel/types.js'\n\n/**\n * Shared RSA-OAEP-SHA256 + AES-GCM seal in the canonical recipient-target\n * TLV wire format. Mints a fresh 32-byte CEK, AES-GCM-encrypts `plaintext`\n * under it, RSA-OAEP-SHA256-wraps the CEK to `publicKeyPem`, and packs:\n *\n * byte 0 : version (0x01)\n * bytes 1..256 : RSA-OAEP-wrapped CEK (fixed 256 bytes at RSA-2048)\n * bytes 257..268: AES-GCM IV (12 bytes)\n * bytes 269.. : AES-GCM ciphertext ‖ 16-byte tag\n *\n * This is the single source of truth for the wire format — both\n * {@link MemoryRecipientSealer} and external sealers (e.g. `@noy-db/at-aws-kms`'s\n * asymmetric-KMS recipient sealer) call it so a blob sealed by one unseals\n * by the other. WebCrypto RSA-OAEP/SHA-256 here is wire-compatible with\n * AWS KMS `RSAES_OAEP_SHA_256` (both RSAES-OAEP, SHA-256 hash, MGF1-SHA256,\n * empty label).\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport async function sealRsaOaepTlv(plaintext: Uint8Array, publicKeyPem: string): Promise<Uint8Array> {\n // Parse PEM → SPKI bytes.\n const b64 = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----/, '').replace(/-----END PUBLIC KEY-----/, '').replace(/\\s+/g, '')\n const recipientPub = await importRecipientPublicKeySpki(base64ToBytes(b64))\n // Mint fresh CEK, AES-GCM encrypt plaintext.\n const cekBytes = crypto.getRandomValues(new Uint8Array(32))\n const cek = await importTransferKey(cekBytes)\n const { iv: ivB64, data } = await encryptBytes(plaintext, cek)\n const iv = base64ToBuffer(ivB64)\n const ct = base64ToBuffer(data)\n // RSA-OAEP-wrap the CEK bytes.\n const wrapped = await recipientWrap(recipientPub, cekBytes)\n cekBytes.fill(0)\n if (wrapped.length !== 256) {\n throw new Error(`sealRsaOaepTlv: expected 256-byte RSA-OAEP wrap, got ${wrapped.length}`)\n }\n // TLV layout.\n const out = new Uint8Array(1 + 256 + 12 + ct.length)\n out[0] = 0x01\n out.set(wrapped, 1)\n out.set(iv, 1 + 256)\n out.set(ct, 1 + 256 + 12)\n return out\n}\n\n/**\n * Parse a {@link sealRsaOaepTlv} blob into its three segments without\n * decrypting. The `wrapped` CEK is RSA-OAEP-SHA256 ciphertext over a\n * 32-byte CEK — the unwrap step is pluggable: {@link MemoryRecipientSealer}\n * decrypts it with a local RSA private key; `@noy-db/at-aws-kms` hands it to\n * KMS `Decrypt`. After unwrapping, pass the CEK + `iv` + `ct` to\n * {@link aesGcmOpen}.\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport function parseRsaOaepTlv(bytes: Uint8Array): { wrapped: Uint8Array; iv: Uint8Array; ct: Uint8Array } {\n if (bytes.length < 1 + 256 + 12 + 16) {\n throw new Error('parseRsaOaepTlv: sealed input too short')\n }\n if (bytes[0] !== 0x01) {\n throw new Error(`parseRsaOaepTlv: unknown TLV version ${bytes[0]}`)\n }\n return {\n wrapped: bytes.subarray(1, 1 + 256),\n iv: bytes.subarray(1 + 256, 1 + 256 + 12),\n ct: bytes.subarray(1 + 256 + 12),\n }\n}\n\n/**\n * AES-GCM-decrypt the `ct` segment of a {@link parseRsaOaepTlv} result under\n * the unwrapped 32-byte CEK and its `iv`. Throws on a bad tag (tamper) — the\n * same authenticated-decryption guarantee the TLV relies on.\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport async function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array): Promise<Uint8Array> {\n const cek = await importTransferKey(cekBytes)\n return decryptBytes(bufferToBase64(iv), bufferToBase64(ct), cek)\n}\n\n/**\n * Reference implementation of `RecipientSealer` + `NoydbSealer`.\n * Uses WebCrypto RSA-OAEP-SHA256 (2048-bit) to wrap a fresh 32-byte\n * AES-GCM CEK, AES-GCM-encrypts plaintext under it, and packs the\n * result into a self-describing TLV:\n *\n * byte 0 : version (0x01)\n * bytes 1..256 : RSA-OAEP-wrapped CEK (fixed 256 bytes at RSA-2048)\n * bytes 257..268: AES-GCM IV (12 bytes)\n * bytes 269.. : AES-GCM ciphertext ‖ 16-byte tag\n *\n * Implements BOTH interfaces. `seal(plaintext)` (self-target) is just\n * `sealForRecipient(plaintext, this own hint)` — same TLV. Convenient\n * for tests where one provider plays both ends. Real cloud providers\n * (`at-aws-kms`, etc.) will pick their own internal layouts; the only\n * contract is round-trip identity.\n *\n * SAFE for production within its scope — the cryptography is real\n * (RSA-OAEP + AES-GCM via WebCrypto), but the keypair lives in-process\n * and is regenerated on every construction. Not suitable as a managed\n * keychain; use it for tests and for shipping bundles where the\n * recipient instance lives in the same process as the sender (rare).\n */\nexport class MemoryRecipientSealer implements NoydbSealer, RecipientSealer {\n readonly id: string\n private readonly keypair: Promise<EnclaveKeyPair>\n\n constructor(opts: { id: string }) {\n this.id = opts.id\n this.keypair = generateRecipientKeyPair()\n }\n\n async publishRecipientHint(): Promise<RecipientHint> {\n const spki = await exportRecipientPublicKeySpki(await this.keypair)\n const pem = '-----BEGIN PUBLIC KEY-----\\n'\n + bytesToBase64(spki).match(/.{1,64}/g)!.join('\\n')\n + '\\n-----END PUBLIC KEY-----\\n'\n return { v: 1, pid: this.id, alg: 'rsa-oaep-sha256', material: { publicKeyPem: pem } }\n }\n\n async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n if (hint.v !== 1) {\n throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n }\n if (hint.alg !== 'rsa-oaep-sha256') {\n throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n }\n const pem = hint.material['publicKeyPem']\n if (typeof pem !== 'string') {\n throw new Error('MemoryRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n }\n return sealRsaOaepTlv(plaintext, pem)\n }\n\n async seal(plaintext: Uint8Array): Promise<Uint8Array> {\n const hint = await this.publishRecipientHint()\n return this.sealForRecipient(plaintext, hint)\n }\n\n async unseal(bytes: Uint8Array): Promise<Uint8Array> {\n const { wrapped, iv, ct } = parseRsaOaepTlv(bytes)\n // Local RSA-OAEP-SHA256 unwrap of the CEK — the pluggable step external\n // sealers replace with KMS Decrypt.\n const cekBytes = await recipientUnwrap(await this.keypair, wrapped)\n const pt = await aesGcmOpen(cekBytes, iv, ct)\n cekBytes.fill(0)\n return pt\n }\n}\n\n// ─── Persisted envelope ────────────────────────────────────────────────\n\n/** Reserved id for the managed-secret envelope under `_meta`. */\nexport const SEALED_SECRET_RECORD_ID = 'sealed-secret' as const\n\n/** Plaintext payload stored inside the `_meta/sealed-secret` envelope. */\nexport interface SealedSecret {\n readonly _noydb_sealed: 1\n readonly providerId: string\n /** Sealed bytes. Base64-encoded on the wire; decoded on load. */\n readonly sealed: Uint8Array\n}\n\n/**\n * Wire-format envelope persisted at `_meta/sealed-secret` for\n * managed-mode vaults. The provider produces raw sealed bytes via\n * {@link NoydbSealer.seal}; this wrapper carries the dispatch\n * metadata hub needs to pick the right provider on the unseal path.\n *\n * Stability boundary: once shipped, the wire format only grows by\n * adding optional fields. See the at-* sealing dimension foundation\n * doc, §11.9.1.\n *\n * v1 shape (this release): `{ v: 1, _noydb_sealed: 1, pid, payload }`.\n *\n * Legacy shape (earlier releases): `{ _noydb_sealed: 1, providerId, sealed }`\n * — accepted on read for backwards compatibility; never produced on\n * write going forward.\n */\nexport interface SealedEnvelope {\n /** Envelope schema version. v1 is the current shape. */\n readonly v: 1\n /** Magic marker for forensics + legacy-shape detection. */\n readonly _noydb_sealed: 1\n /** Matches the producing provider's `.id`. Dispatch key on unseal. */\n readonly pid: string\n /** Sealed bytes from the provider, base64-encoded on the wire. */\n readonly payload: string\n}\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n let binary = ''\n for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!)\n return btoa(binary)\n}\n\nfunction base64ToBytes(b64: string): Uint8Array {\n const binary = atob(b64)\n const out = new Uint8Array(binary.length)\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i)\n return out\n}\n\n/**\n * Parse a `_meta/sealed-secret` `_data` JSON string into the\n * in-memory {@link SealedSecret} representation. Accepts both:\n *\n * 1. v1 wire format `{ v: 1, _noydb_sealed: 1, pid, payload }` —\n * the current shape.\n * 2. Legacy wire format `{ _noydb_sealed: 1, providerId, sealed }` —\n * read-only; never written\n * going forward.\n *\n * Returns `undefined` for any input that doesn't match either shape,\n * so callers can fall back to \"no managed-mode envelope present.\"\n *\n * @internal — exported only for the migration safety-net test suite.\n */\nexport function parseSealedEnvelope(raw: unknown): SealedSecret | undefined {\n if (typeof raw !== 'object' || raw === null) return undefined\n const r = raw as Record<string, unknown>\n if (r._noydb_sealed !== 1) return undefined\n\n // v1 shape — preferred.\n if (\n r.v === 1\n && typeof r.pid === 'string'\n && typeof r.payload === 'string'\n ) {\n return {\n _noydb_sealed: 1,\n providerId: r.pid,\n sealed: base64ToBytes(r.payload),\n }\n }\n\n // Legacy shape — earlier releases. Accept on read for compat.\n if (\n typeof r.providerId === 'string'\n && typeof r.sealed === 'string'\n ) {\n return {\n _noydb_sealed: 1,\n providerId: r.providerId,\n sealed: base64ToBytes(r.sealed),\n }\n }\n\n return undefined\n}\n\nexport async function saveSealedSecret(\n store: NoydbStore,\n vault: string,\n payload: { readonly providerId: string; readonly sealed: Uint8Array },\n): Promise<void> {\n const persisted: SealedEnvelope = {\n v: 1,\n _noydb_sealed: 1,\n pid: payload.providerId,\n payload: bytesToBase64(payload.sealed),\n }\n const prior = await store.get(vault, '_meta', SEALED_SECRET_RECORD_ID)\n const env = buildRecordEnvelope(\n { collection: '_meta', id: SEALED_SECRET_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n // AES-GCM bypassed — the sealing layer is the security boundary.\n { iv: '', data: JSON.stringify(persisted) },\n )\n await store.put(vault, '_meta', SEALED_SECRET_RECORD_ID, env)\n}\n\nexport async function loadSealedSecret(\n store: NoydbStore,\n vault: string,\n): Promise<SealedSecret | undefined> {\n const envelope = await store.get(vault, '_meta', SEALED_SECRET_RECORD_ID)\n if (!envelope) return undefined\n try {\n return parseSealedEnvelope(JSON.parse(envelope._data ?? ''))\n } catch {\n return undefined\n }\n}\n\n// ─── createNoydb orchestration ─────────────────────────────────────────\n\n/**\n * Resolve the effective plaintext secret string for a managed-mode\n * vault. Two paths:\n *\n * 1. **First open (no envelope persisted):** generate a 256-bit random\n * via `crypto.getRandomValues`, base64-encode for use as a\n * secret string, seal the underlying bytes under the\n * provider, persist `_meta/sealed-secret`, return the\n * base64 string.\n *\n * 2. **Reopen (envelope exists):** read + unseal + decode → return.\n * A different provider whose `seal` output disagrees on the\n * stored bytes throws here, surfaced as a clear error.\n *\n * The returned string is the same shape that `secret:` would take in\n * standard mode — the rest of the keyring path consumes it\n * unchanged.\n *\n * @internal — called from `createNoydb` / `getKeyringInternal`.\n */\nexport async function resolveManagedSecret(\n store: NoydbStore,\n vault: string,\n provider: NoydbSealer,\n): Promise<string> {\n const existing = await loadSealedSecret(store, vault)\n if (existing) {\n if (existing.providerId !== provider.id) {\n throw new Error(\n `Managed-mode vault \"${vault}\" was sealed under provider id `\n + `\"${existing.providerId}\" but the current NoydbSealer is `\n + `\"${provider.id}\". Pass the same provider that originally enrolled `\n + 'the vault, or treat this as a fresh enrollment and clear '\n + '`_meta/sealed-secret` first.',\n )\n }\n const plaintext = await provider.unseal(existing.sealed, { vault })\n return bytesToBase64(plaintext)\n }\n\n // First open: mint a 256-bit random, seal, persist.\n const random = new Uint8Array(32)\n globalThis.crypto.getRandomValues(random)\n const sealed = await provider.seal(random, { vault })\n await saveSealedSecret(store, vault, { providerId: provider.id, sealed })\n return bytesToBase64(random)\n}\n"],"mappings":";;;;;;;;;;;;;;;AA4JO,IAAM,eAAN,MAA0C;AAAA,EACtC;AAAA,EACQ;AAAA,EACA;AAAA,EAEjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AAKf,UAAM,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAChD,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAK,IAAI,KAAK,QAAQ,CAAC,MAAQ;AAAA,IACjC;AACA,SAAK,cAAc,IAAI,WAAW;AAAA,MAC/B,MAAM,KAAM;AAAA,MAAO,MAAM,KAAM;AAAA,MAAO,MAAM,IAAK;AAAA,MAAM,IAAI;AAAA,IAC9D,CAAC;AAID,SAAK,WAAW,IAAI,WAAW,EAAE;AACjC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,WAAK,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAM,IAAI;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,IAAI,QAAgC;AAC1C,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,WAAM,KAAK,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE,MAAO,aAAgB;AAAA,IACrE;AACA,WAAO,IAAI,WAAW,CAAE,MAAM,KAAM,KAAO,MAAM,KAAM,KAAO,MAAM,IAAK,KAAM,IAAI,GAAI,CAAC;AAAA,EAC1F;AAAA,EAEA,MAAM,KAAK,QAAyC;AAClD,UAAM,SAAS,IAAI,WAAW,OAAO,MAAM;AAC3C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,aAAO,CAAC,IAAI,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE;AAAA,IAC/C;AACA,UAAM,MAAM,IAAI,WAAW,IAAI,OAAO,MAAM;AAC5C,QAAI,IAAI,KAAK,aAAa,CAAC;AAC3B,QAAI,IAAI,KAAK,IAAI,MAAM,GAAG,CAAC;AAC3B,QAAI,IAAI,QAAQ,CAAC;AACjB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,QAAyC;AACpD,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,iBAAiB,KAAK,EAAE;AAAA,QAE1B;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,OAAO,SAAS,CAAC;AAChC,UAAM,WAAW,KAAK,IAAI,MAAM;AAChC,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAI,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG;AACjC,cAAM,IAAI;AAAA,UACR,iBAAiB,KAAK,EAAE;AAAA,QAE1B;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAI,CAAC,IAAI,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AACF;AA2CA,eAAsB,eAAe,WAAuB,cAA2C;AAErG,QAAM,MAAM,aAAa,QAAQ,8BAA8B,EAAE,EAAE,QAAQ,4BAA4B,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAC7H,QAAM,eAAe,MAAM,6BAA6B,cAAc,GAAG,CAAC;AAE1E,QAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC1D,QAAM,MAAM,MAAM,kBAAkB,QAAQ;AAC5C,QAAM,EAAE,IAAI,OAAO,KAAK,IAAI,MAAM,aAAa,WAAW,GAAG;AAC7D,QAAM,KAAK,eAAe,KAAK;AAC/B,QAAM,KAAK,eAAe,IAAI;AAE9B,QAAM,UAAU,MAAM,cAAc,cAAc,QAAQ;AAC1D,WAAS,KAAK,CAAC;AACf,MAAI,QAAQ,WAAW,KAAK;AAC1B,UAAM,IAAI,MAAM,wDAAwD,QAAQ,MAAM,EAAE;AAAA,EAC1F;AAEA,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM,KAAK,GAAG,MAAM;AACnD,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,SAAS,CAAC;AAClB,MAAI,IAAI,IAAI,IAAI,GAAG;AACnB,MAAI,IAAI,IAAI,IAAI,MAAM,EAAE;AACxB,SAAO;AACT;AAYO,SAAS,gBAAgB,OAA4E;AAC1G,MAAI,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI;AACpC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,MAAI,MAAM,CAAC,MAAM,GAAM;AACrB,UAAM,IAAI,MAAM,wCAAwC,MAAM,CAAC,CAAC,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS,GAAG,IAAI,GAAG;AAAA,IAClC,IAAI,MAAM,SAAS,IAAI,KAAK,IAAI,MAAM,EAAE;AAAA,IACxC,IAAI,MAAM,SAAS,IAAI,MAAM,EAAE;AAAA,EACjC;AACF;AASA,eAAsB,WAAW,UAAsB,IAAgB,IAAqC;AAC1G,QAAM,MAAM,MAAM,kBAAkB,QAAQ;AAC5C,SAAO,aAAa,eAAe,EAAE,GAAG,eAAe,EAAE,GAAG,GAAG;AACjE;AAyBO,IAAM,wBAAN,MAAoE;AAAA,EAChE;AAAA,EACQ;AAAA,EAEjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,UAAU,yBAAyB;AAAA,EAC1C;AAAA,EAEA,MAAM,uBAA+C;AACnD,UAAM,OAAO,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAClE,UAAM,MAAM,iCACR,cAAc,IAAI,EAAE,MAAM,UAAU,EAAG,KAAK,IAAI,IAChD;AACJ,WAAO,EAAE,GAAG,GAAG,KAAK,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,cAAc,IAAI,EAAE;AAAA,EACvF;AAAA,EAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,QAAI,KAAK,MAAM,GAAG;AAChB,YAAM,IAAI,MAAM,8DAA8D,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,IAC7G;AACA,QAAI,KAAK,QAAQ,mBAAmB;AAClC,YAAM,IAAI,MAAM,iEAAiE,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,IACnI;AACA,UAAM,MAAM,KAAK,SAAS,cAAc;AACxC,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI,MAAM,4FAA4F;AAAA,IAC9G;AACA,WAAO,eAAe,WAAW,GAAG;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,WAA4C;AACrD,UAAM,OAAO,MAAM,KAAK,qBAAqB;AAC7C,WAAO,KAAK,iBAAiB,WAAW,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,OAAO,OAAwC;AACnD,UAAM,EAAE,SAAS,IAAI,GAAG,IAAI,gBAAgB,KAAK;AAGjD,UAAM,WAAW,MAAM,gBAAgB,MAAM,KAAK,SAAS,OAAO;AAClE,UAAM,KAAK,MAAM,WAAW,UAAU,IAAI,EAAE;AAC5C,aAAS,KAAK,CAAC;AACf,WAAO;AAAA,EACT;AACF;AAKO,IAAM,0BAA0B;AAqCvC,SAAS,cAAc,OAA2B;AAChD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAC9E,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,cAAc,KAAyB;AAC9C,QAAM,SAAS,KAAK,GAAG;AACvB,QAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,SAAO;AACT;AAiBO,SAAS,oBAAoB,KAAwC;AAC1E,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,MAAI,EAAE,kBAAkB,EAAG,QAAO;AAGlC,MACE,EAAE,MAAM,KACL,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,YAAY,UACxB;AACA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,YAAY,EAAE;AAAA,MACd,QAAQ,cAAc,EAAE,OAAO;AAAA,IACjC;AAAA,EACF;AAGA,MACE,OAAO,EAAE,eAAe,YACrB,OAAO,EAAE,WAAW,UACvB;AACA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,YAAY,EAAE;AAAA,MACd,QAAQ,cAAc,EAAE,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,iBACpB,OACA,OACA,SACe;AACf,QAAM,YAA4B;AAAA,IAChC,GAAG;AAAA,IACH,eAAe;AAAA,IACf,KAAK,QAAQ;AAAA,IACb,SAAS,cAAc,QAAQ,MAAM;AAAA,EACvC;AACA,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,uBAAuB;AACrE,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,yBAAyB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAElF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,yBAAyB,GAAG;AAC9D;AAEA,eAAsB,iBACpB,OACA,OACmC;AACnC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,uBAAuB;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,WAAO,oBAAoB,KAAK,MAAM,SAAS,SAAS,EAAE,CAAC;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAwBA,eAAsB,qBACpB,OACA,OACA,UACiB;AACjB,QAAM,WAAW,MAAM,iBAAiB,OAAO,KAAK;AACpD,MAAI,UAAU;AACZ,QAAI,SAAS,eAAe,SAAS,IAAI;AACvC,YAAM,IAAI;AAAA,QACR,uBAAuB,KAAK,mCACtB,SAAS,UAAU,qCACnB,SAAS,EAAE;AAAA,MAGnB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,SAAS,OAAO,SAAS,QAAQ,EAAE,MAAM,CAAC;AAClE,WAAO,cAAc,SAAS;AAAA,EAChC;AAGA,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,aAAW,OAAO,gBAAgB,MAAM;AACxC,QAAM,SAAS,MAAM,SAAS,KAAK,QAAQ,EAAE,MAAM,CAAC;AACpD,QAAM,iBAAiB,OAAO,OAAO,EAAE,YAAY,SAAS,IAAI,OAAO,CAAC;AACxE,SAAO,cAAc,MAAM;AAC7B;","names":[]}

package/dist/{chunk-PWAMX5KU.js → chunk-OOLF5FU2.js} RENAMED Viewed

@@ -1,6 +1,6 @@
 import {
   QuiesceTimeoutError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/port/by/types.ts
 function isQuorum(writers, generation, excludeWriterId) {
@@ -51,4 +51,4 @@ export {
   isQuorum,
   runDrainBarrier
 };
-//# sourceMappingURL=chunk-PWAMX5KU.js.map
+//# sourceMappingURL=chunk-OOLF5FU2.js.map

package/dist/{chunk-WQUIJPN4.js → chunk-OQA7UF2Q.js} RENAMED Viewed

@@ -1,9 +1,9 @@
 import {
   buildRecordEnvelope
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   ValidationError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-party/directory/cover/custom.ts
 var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
@@ -230,4 +230,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-WQUIJPN4.js.map
+//# sourceMappingURL=chunk-OQA7UF2Q.js.map

package/dist/{chunk-7JRLCP2J.js → chunk-ORJPICJI.js} RENAMED Viewed

@@ -4,7 +4,7 @@ import {
   formatScaledInt,
   parseToScaledInt,
   rescaleScaledInt
-} from "./chunk-3EXQXOQ2.js";
+} from "./chunk-VHKAW5OI.js";
 // src/via/money/arith.ts
 function parseAmount(label, amount, scale, rounding) {
@@ -120,4 +120,4 @@ export {
   isMoneyString,
   moneyNumber
 };
-//# sourceMappingURL=chunk-7JRLCP2J.js.map
+//# sourceMappingURL=chunk-ORJPICJI.js.map

package/dist/{chunk-IF2M43G4.js → chunk-PBRD75JF.js} RENAMED Viewed

@@ -3,7 +3,7 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -41,4 +41,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-IF2M43G4.js.map
+//# sourceMappingURL=chunk-PBRD75JF.js.map

package/dist/{chunk-RKBCUP5D.js → chunk-PDCBL23X.js} RENAMED Viewed

@@ -7,28 +7,28 @@ import {
   deriveSchemaManifest,
   loadSchemaManifestEntry,
   saveSchemaManifest
-} from "./chunk-T5EXREMW.js";
+} from "./chunk-N25Z6PR4.js";
 import {
   MANIFEST_COLLECTION
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence,
   saveFence
-} from "./chunk-TLIFNRU5.js";
+} from "./chunk-63LZLRWG.js";
 import {
   derivePersistedSchema
-} from "./chunk-UORWAG7K.js";
+} from "./chunk-FY4FFNKK.js";
 import {
   loadPersistedSchemaEntry,
   savePersistedSchema
-} from "./chunk-IF2M43G4.js";
+} from "./chunk-PBRD75JF.js";
 import {
   envelopePayloadHash
-} from "./chunk-QHG7GQKM.js";
+} from "./chunk-5JNEDW7I.js";
 import {
   ManifestConflictError,
   isConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-shape/persisted-schemas/field-ids.ts
 var BASE32URL_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
@@ -76,7 +76,7 @@ function resolveFieldIds(freshJsonSchema, priorFieldIds, renamed) {
 // src/with-shape/manifest/writer.ts
 async function writeSchemaManifest(store, vault, manifest, expectedVersion, getDEK) {
   try {
-    await saveSchemaManifest(store, vault, manifest, expectedVersion, getDEK);
+    return await saveSchemaManifest(store, vault, manifest, expectedVersion, getDEK);
   } catch (err) {
     if (isConflictError(err)) {
       throw new ManifestConflictError(err.version, expectedVersion);
@@ -98,13 +98,18 @@ async function syncSchemaManifest(store, vault, deps) {
       return;
     }
     const expectedVersion = existing?.version ?? 0;
-    try {
-      await writeSchemaManifest(store, vault, derived, expectedVersion, deps.getDEK);
-    } catch (err) {
-      if (err instanceof ManifestConflictError) continue;
-      throw err;
-    }
-    await auditManifestWrite(store, vault, deps, derived, expectedVersion);
+    const written = await withManifestLock(store, vault, async () => {
+      let envelope;
+      try {
+        envelope = await writeSchemaManifest(store, vault, derived, expectedVersion, deps.getDEK);
+      } catch (err) {
+        if (err instanceof ManifestConflictError) return false;
+        throw err;
+      }
+      await auditManifestWrite(deps, derived, expectedVersion, envelope);
+      return true;
+    });
+    if (!written) continue;
     const recheck = await deriveSchemaManifest(store, vault, deps.lookupDEK);
     if (recheck.undecodableCollections.length > 0) return;
     if (recheck.manifest.generation === derived.generation && recheck.manifest.aggregateHash === derived.aggregateHash) {
@@ -115,10 +120,27 @@ async function syncSchemaManifest(store, vault, deps) {
     `[noy-db] schema-manifest sync did not converge after ${MAX_SYNC_ATTEMPTS} attempts; the persisted manifest may be stale until the next schema write or open()'s re-derive.`
   );
 }
-async function auditManifestWrite(store, vault, deps, derived, expectedVersion) {
+var manifestLocks = /* @__PURE__ */ new WeakMap();
+async function withManifestLock(store, vault, fn) {
+  let byVault = manifestLocks.get(store);
+  if (!byVault) {
+    byVault = /* @__PURE__ */ new Map();
+    manifestLocks.set(store, byVault);
+  }
+  const run = (byVault.get(vault) ?? Promise.resolve()).then(fn);
+  const tail = run.then(() => {
+  }, () => {
+  });
+  byVault.set(vault, tail);
+  try {
+    return await run;
+  } finally {
+    if (byVault.get(vault) === tail) byVault.delete(vault);
+  }
+}
+async function auditManifestWrite(deps, derived, expectedVersion, envelope) {
   const ledger = deps.getLedgerOrNull?.();
   if (!ledger) return;
-  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID);
   await ledger.append({
     op: "migration",
     collection: MANIFEST_COLLECTION,
@@ -257,4 +279,4 @@ export {
   persistClassifiedMarker,
   persistSatelliteMarker
 };
-//# sourceMappingURL=chunk-RKBCUP5D.js.map
+//# sourceMappingURL=chunk-PDCBL23X.js.map

package/dist/chunk-PDCBL23X.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/with-shape/persisted-schemas/field-ids.ts","../src/with-shape/manifest/writer.ts","../src/with-shape/manifest/sync.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Stable field-identifier minting (#946).\n *\n * A field's `id` is opaque and permanent — minted once, from randomness\n * only, with no timestamp and no name-derivation. A name-derived id would\n * change when the field is renamed, defeating the whole point (identity\n * must survive a rename). See `PersistedSchemaEnvelope.fieldIds`.\n *\n * @module\n */\n\nconst BASE32URL_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567'\n\n/** Unpadded RFC 4648 §7 base32url encoding of an arbitrary byte string. */\nfunction encodeBase32Url(bytes: Uint8Array): string {\n let bits = 0\n let value = 0\n let out = ''\n for (const byte of bytes) {\n value = (value << 8) | byte\n bits += 8\n while (bits >= 5) {\n out += BASE32URL_ALPHABET[(value >>> (bits - 5)) & 31]\n bits -= 5\n }\n }\n if (bits > 0) {\n out += BASE32URL_ALPHABET[(value << (5 - bits)) & 31]\n }\n return out\n}\n\n/**\n * Mint a fresh opaque field id: 12 random bytes (96 bits) from\n * `crypto.getRandomValues`, encoded as a 20-character base32url token.\n * Not exported — Task 2/3 (#946) may need to export this later; keep it\n * module-internal until an external consumer exists.\n */\nfunction mintFieldId(): string {\n const bytes = new Uint8Array(12)\n crypto.getRandomValues(bytes)\n return encodeBase32Url(bytes)\n}\n\n/** Top-level property names of a Draft 2020-12 object JSON Schema, or `[]` when not an object schema. */\nfunction topLevelFieldNames(jsonSchema: object | null): readonly string[] {\n if (jsonSchema === null) return []\n const props = (jsonSchema as { properties?: unknown }).properties\n if (props === null || typeof props !== 'object') return []\n return Object.keys(props as Record<string, unknown>)\n}\n\n/**\n * Resolve the `fieldIds` map for a freshly-derived schema against the\n * previously-stored envelope's map (if any). Existing ids are preserved by\n * name — a field keeps its id across re-derivation as long as its name is\n * unchanged; a genuinely new field name mints a fresh id. Returns\n * `undefined` when the fresh schema has no derivable top-level field set\n * (e.g. a stub envelope, or a non-object root schema).\n *\n * `renamed` (#946 Task 2) — unambiguous rename pairs from\n * `computeSchemaDelta`'s `SchemaDelta.renamed`. When the fresh name is a\n * rename target (`to`), the id is looked up under its OLD name (`from`)\n * instead of the fresh name itself — the whole point of a stable field id\n * is that it survives exactly this case; without it, a rename would mint a\n * fresh id for the new name and silently drop the old one.\n */\nexport function resolveFieldIds(\n freshJsonSchema: object | null,\n priorFieldIds: Record<string, string> | undefined,\n renamed?: readonly { readonly from: string; readonly to: string }[],\n): Record<string, string> | undefined {\n const names = topLevelFieldNames(freshJsonSchema)\n if (names.length === 0) return undefined\n const priorNameFor = new Map<string, string>()\n if (renamed) for (const { from, to } of renamed) priorNameFor.set(to, from)\n const out: Record<string, string> = {}\n for (const name of names) {\n const priorName = priorNameFor.get(name) ?? name\n out[name] = priorFieldIds?.[priorName] ?? mintFieldId()\n }\n return out\n}\n","/**\n * Strict-CAS schema-manifest writer (#941, AC #1).\n *\n * Every other reserved-collection writer in the hub (`persisted-schemas`'s\n * `savePersistedSchema` callers, the classified/satellite marker writers)\n * retries on a CAS conflict: re-read, re-apply, try again. The schema\n * manifest deliberately does NOT — two concurrent *direct* edits to the\n * manifest must be refused and surfaced, never silently merged or\n * retry-resolved, because a manifest write encodes a specific point-in-time\n * claim about the pod's schema generation/content-hash set. A caller that\n * lost the race must re-derive against the fresh state and decide what to\n * do, not have its stale write quietly re-applied on top of someone else's.\n *\n * Ledger audit: this writer does not have a `LedgerStore` handle at this\n * seam (mirroring `persisted-schemas`, whose `_schemas/<collection>` writes\n * are likewise not ledger-audited today). Wiring `LedgerStore.append({ op:\n * 'migration', ... })` around a manifest write belongs at the call site\n * where a ledger handle is already in scope (the open/write integration —\n * #941 Task 3/4), not here.\n *\n * @module\n */\n\nimport { isConflictError, ManifestConflictError } from '../../kernel/errors.js'\nimport { saveSchemaManifest, type GetManifestDEK } from './storage.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { SchemaManifest } from './types.js'\n\n/**\n * Write the schema manifest as a strict CAS: `expectedVersion` must match\n * the stored envelope's `_v` (0 when no manifest exists yet). On a\n * conflict, throws {@link ManifestConflictError} — this function never\n * retries.\n */\nexport async function writeSchemaManifest(\n store: NoydbStore,\n vault: string,\n manifest: SchemaManifest,\n expectedVersion: number,\n getDEK: GetManifestDEK,\n /** family#197 — the envelope actually written, for the ledger append to hash. */\n): Promise<EncryptedEnvelope> {\n try {\n return await saveSchemaManifest(store, vault, manifest, expectedVersion, getDEK)\n } catch (err) {\n if (isConflictError(err)) {\n throw new ManifestConflictError(err.version, expectedVersion)\n }\n throw err\n }\n}\n","/**\n * Keep the persisted `_manifest/schema` record in sync with the\n * per-collection `_schemas/<collection>` source of truth (#941 Task 3).\n *\n * Called from `persisted-schemas/register.ts`'s `persistSchemaIfNeeded`\n * right after a `_schemas/<collection>` write succeeds.\n *\n * ## Reconciling strict-CAS-refuse with the derived nature of the manifest\n *\n * `writer.ts`'s `writeSchemaManifest` is deliberately strict-CAS: a\n * concurrent *direct* edit to the manifest is refused, never retried (AC\n * #1). But this call site is not a direct edit — it is a re-derivation\n * from the source of truth, triggered as a side effect of a `_schemas`\n * write that has ALREADY succeeded. When N collections are declared\n * together (one `openVault()` call registering several `persistJsonSchema:\n * true` collections), their `persistSchemaIfNeeded` calls run CONCURRENTLY\n * — each one's own `_schemas/<collection>` write lands independently, and\n * each then calls this function. A single derive-then-write with no\n * feedback loop is NOT enough here: a call whose `deriveSchemaManifest`\n * snapshot ran before a sibling's `_schemas` write landed would persist a\n * manifest that's missing that sibling forever (nothing re-triggers it) —\n * this was a REAL bug (not a test-isolation artifact — reproduced with 0\n * shared state, purely from concurrent `_schemas` writes racing the derive\n * snapshot; see #941 flake fix commit). `syncSchemaManifest` therefore\n * loops (bounded by {@link MAX_SYNC_ATTEMPTS}):\n *\n * 1. Derive fresh, compare to what's persisted. Already converged → done.\n * 2. Write via strict-CAS. `ManifestConflictError` (another writer moved\n * the manifest first) → loop: re-derive against the NEW state and\n * retry, exactly like a normal optimistic-CAS retry.\n * 3. On a successful write, derive ONE more time. If a sibling's\n * `_schemas` write landed while we were deriving/writing, the state\n * has already moved past what we just wrote — loop again to catch it\n * up. If the re-derive matches what we wrote, we're the last writer\n * and the manifest is provably converged: return.\n *\n * This guarantees that whichever collection's `_schemas` write is the LAST\n * to land (in real wall-clock order — there is always exactly one, even\n * though no single caller knows which) ends up running a sync whose own\n * derive sees every sibling's write already committed, and whose\n * recheck-after-write confirms nothing moved further — so it converges the\n * manifest deterministically, regardless of interleaving. If attempts are\n * exhausted under pathological contention, the loop gives up — with a\n * `console.warn` (see cap-exhaustion note below), not silently — leaving\n * the last successful write in place; the manifest is a derivable cache\n * (not a correctness invariant), so a next schema write or `open()`'s\n * re-derive still converges it, matching how `persistSchemaIfNeeded`\n * already treats its own write failures.\n * Any error OTHER than `ManifestConflictError` (store failure, DEK\n * resolution failure, etc.) is NOT swallowed — it propagates to the\n * caller immediately, matching how `persistSchemaIfNeeded` already treats\n * its own write failures as a visible (not silently discarded) fingerprint\n * failure.\n *\n * ## CRITICAL fix (#941 review): a scoped principal must never write a\n * partial manifest\n *\n * `deriveSchemaManifest` returns `undecodableCollections` for any\n * `_schemas/<collection>` entry this principal's `lookupDEK` couldn't\n * resolve — e.g. a member `grant()`-scoped to one collection can decrypt\n * `_manifest` itself (system-prefixed DEKs propagate to every role) but\n * NOT a sibling data collection's `_schemas/<sibling>` entry. Before this\n * fix, `deriveSchemaManifest` silently treated \"can't decrypt\" the same as\n * \"no derivable content\" and omitted the sibling — so a scoped member's\n * OWN schema declare would derive a manifest missing every collection they\n * can't see, load the real (complete) persisted manifest as a valid CAS\n * token, observe a hash mismatch, and OVERWRITE it — permanently dropping\n * the siblings, silently, ledger-audited as a legitimate migration. The\n * converging recheck loop above made this WORSE, not better: re-deriving\n * from the same restricted view just re-confirms the same partial result\n * and declares it \"stable.\"\n *\n * Fix: if `undecodableCollections` is non-empty, `syncSchemaManifest`\n * `SKIP`s entirely — no read-compare, no write, no audit, no loop. It does\n * NOT try to merge-preserve the undecodable entries from what's currently\n * persisted: an `aggregateHash` computed over entries this principal can't\n * verify would be a hash asserting something it never actually checked,\n * which is worse than not writing at all. This is safe because:\n *\n * - The source of truth, `_schemas/<their-collection>`, was ALREADY\n * updated by their declare — nothing about their own change is lost.\n * - The pod-wide `_manifest` cache simply isn't rewritten by a principal\n * who'd corrupt it by omission — it stays whatever a full-visibility\n * principal (owner/admin/custodian) last wrote.\n * - `open()` re-derives from `_schemas` directly (not from the cached\n * manifest) for whoever opens it, so a stale cache is never load-bearing.\n * - The NEXT full-visibility principal's declare (or any subsequent sync\n * by someone with complete access) naturally refreshes the cache,\n * including the scoped member's own just-landed change.\n *\n * ## Ledger audit (AC #5)\n *\n * Schema-generation transitions are not ledger-audited anywhere else today\n * (neither the `_schemas/<collection>` write in `register.ts` nor the fence\n * bump in `schema-update/fence-controller.ts#runCutover`). This is the\n * first ledger-audited signal for a schema change: every manifest write\n * that actually happens (i.e. every time the derived manifest differs from\n * what's stored) appends an `op: 'migration'` entry via the optional\n * `getLedgerOrNull` callback — `null`/absent when the history strategy\n * isn't opted in, matching every other optional-ledger call site\n * (`vault._getLedgerOrNull()?.append(...)`, see `liberate.ts`,\n * `with-audit/periods/vault-facade.ts`). No audit fires on the no-op path\n * (derived manifest unchanged), on a swallowed conflict (the winning\n * writer's own sync already audits its write), or on the scoped-principal\n * SKIP path above (nothing was written).\n *\n * @module\n */\n\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport { envelopePayloadHash } from '../../with-commit/history/ledger/hash.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { ManifestConflictError } from '../../kernel/errors.js'\nimport { deriveSchemaManifest, type LookupDEK } from './derive.js'\nimport { loadSchemaManifestEntry, type GetManifestDEK } from './storage.js'\nimport { writeSchemaManifest } from './writer.js'\nimport { MANIFEST_COLLECTION } from './reserved-collections.js'\nimport { MANIFEST_SCHEMA_RECORD_ID, type SchemaManifest } from './types.js'\n\nexport interface ManifestSyncDeps {\n /** Resolver for `_manifest`'s OWN DEK — mints if absent (this principal's declare is about to write it). */\n readonly getDEK: GetManifestDEK\n /**\n * NON-MINTING lookup for every OTHER (sibling data) collection's DEK,\n * used by `deriveSchemaManifest` to build the index — see `derive.ts`'s\n * `LookupDEK` doc for why minting here would be actively harmful.\n */\n readonly lookupDEK: LookupDEK\n /** Optional ledger handle — absent when the history strategy isn't opted in (no-op audit). */\n readonly getLedgerOrNull?: () => LedgerStore | null\n}\n\n/**\n * Bound on the derive→write→recheck loop (see module doc). Headroom above\n * what any realistic `openVault()` batch (a handful of collections) needs —\n * a 40-way concurrent-declare stress repro converged within single digits.\n */\nconst MAX_SYNC_ATTEMPTS = 16\n\n/**\n * Re-derive the schema manifest and write it if it changed, looping until\n * the write is provably stable against concurrent sibling `_schemas`\n * writes (see module doc). SKIPS entirely (no write, no audit) when this\n * principal's view is incomplete (`undecodableCollections` non-empty) —\n * see the module doc's CRITICAL fix section. Swallows a\n * {@link ManifestConflictError} by retrying against the fresher state; any\n * other error propagates. Ledger-audits (`op: 'migration'`) once per\n * successful write.\n */\nexport async function syncSchemaManifest(\n store: NoydbStore,\n vault: string,\n deps: ManifestSyncDeps,\n): Promise<void> {\n for (let attempt = 0; attempt < MAX_SYNC_ATTEMPTS; attempt++) {\n const { manifest: derived, undecodableCollections } = await deriveSchemaManifest(store, vault, deps.lookupDEK)\n if (undecodableCollections.length > 0) {\n // Scoped principal — see module doc's CRITICAL fix. Never write a\n // manifest we know is missing collections we couldn't decrypt.\n return\n }\n\n const existing = await loadSchemaManifestEntry(store, vault, deps.getDEK)\n\n if (\n existing &&\n existing.manifest.generation === derived.generation &&\n existing.manifest.aggregateHash === derived.aggregateHash\n ) {\n return // already converged — no write, no audit\n }\n\n const expectedVersion = existing?.version ?? 0\n // family#197 — ONE critical section per vault: the manifest write and its\n // ledger append cannot be split. The append records `payloadHash` for\n // `version: expectedVersion + 1`, and `verifyBackupIntegrity` recomputes\n // the LATEST entry's hash against the CURRENT envelope — so if a sibling\n // sync commits the next version in between, the entry claims our version\n // with someone else's hash, or lands after theirs carrying a stale one.\n // Either way restore reports tampering on data nobody tampered with.\n const written = await withManifestLock(store, vault, async () => {\n let envelope: EncryptedEnvelope\n try {\n envelope = await writeSchemaManifest(store, vault, derived, expectedVersion, deps.getDEK)\n } catch (err) {\n if (err instanceof ManifestConflictError) return false // another writer moved it first — re-derive + retry\n throw err\n }\n // ⛔ The envelope WE wrote, never a re-read. A re-read is the defect's\n // other half and the lock alone does NOT close it: a second PROCESS is\n // held off the write by CAS, but nothing stops its newer envelope being\n // what a re-read hashes. Passing the envelope REMOVES the window rather\n // than narrowing it. Covered by the lying-store case in\n // `__tests__/manifest/sync-ledger-hash.test.ts`, which is the only one of\n // the four that can tell the two implementations apart.\n await auditManifestWrite(deps, derived, expectedVersion, envelope)\n return true\n })\n if (!written) continue\n\n // A sibling's `_schemas` write can land while WE were deriving/writing\n // (#941 flake fix — see module doc). Re-derive once more: if the truth\n // has already moved past what we just wrote, loop again to catch it up\n // instead of leaving a permanently-partial manifest. (A principal with\n // full visibility at the top of this iteration cannot lose that\n // visibility mid-call — the keyring doesn't change during one sync —\n // so this recheck is never itself subject to the undecodable-skip; the\n // `for` loop's own guard covers it defensively regardless.)\n const recheck = await deriveSchemaManifest(store, vault, deps.lookupDEK)\n if (recheck.undecodableCollections.length > 0) return // defensive — see comment above\n if (recheck.manifest.generation === derived.generation && recheck.manifest.aggregateHash === derived.aggregateHash) {\n return // stable — we were the last writer\n }\n }\n // Attempts exhausted under pathological contention — see module doc:\n // the manifest is a derivable cache, not a correctness invariant, so a\n // later schema write or open()'s re-derive still converges it. Warn\n // rather than fail silently — a silent give-up on a completeness\n // invariant is exactly what hid the original concurrent-declare race.\n console.warn(\n `[noy-db] schema-manifest sync did not converge after ${MAX_SYNC_ATTEMPTS} attempts; ` +\n 'the persisted manifest may be stale until the next schema write or open()\\'s re-derive.',\n )\n}\n\n/**\n * family#197 — serialize a manifest write with its ledger append, per\n * (store, vault).\n *\n * ⚠️ IN-PROCESS ONLY, and that is a real limit rather than an oversight. It\n * orders every vault handle sharing this store object in this process. A second\n * PROCESS is held off the write by strict CAS, but CAS does not order the two\n * appends — so cross-process interleaving can still leave the latest ledger\n * entry describing a version that is no longer current. Passing the written\n * envelope removes the wrong-hash half outright; the ordering half cannot be\n * fixed from inside one process, and is reported rather than papered over.\n */\nconst manifestLocks = new WeakMap<NoydbStore, Map<string, Promise<void>>>()\n\nasync function withManifestLock<T>(store: NoydbStore, vault: string, fn: () => Promise<T>): Promise<T> {\n let byVault = manifestLocks.get(store)\n if (!byVault) {\n byVault = new Map()\n manifestLocks.set(store, byVault)\n }\n const run = (byVault.get(vault) ?? Promise.resolve()).then(fn)\n // ⚠️ The chain TAIL must never reject: a rejected tail propagates into every\n // later waiter, failing a sync that did nothing wrong.\n const tail = run.then(() => {}, () => {})\n byVault.set(vault, tail)\n try {\n return await run\n } finally {\n if (byVault.get(vault) === tail) byVault.delete(vault)\n }\n}\n\nasync function auditManifestWrite(\n deps: ManifestSyncDeps,\n derived: SchemaManifest,\n expectedVersion: number,\n /** family#197 — the envelope just written, NOT a re-read of the record. */\n envelope: EncryptedEnvelope,\n): Promise<void> {\n const ledger = deps.getLedgerOrNull?.()\n if (!ledger) return\n // `_manifest/schema` has a real, individually-addressable envelope (unlike\n // a `lifecycle` entry's empty collection/id) — `verifyBackupIntegrity`'s\n // data cross-check (`with-pod/backup.ts`) treats any non-amendment,\n // non-lifecycle entry's `collection`/`id` as \"the latest write to this\n // record\" and recomputes+compares its ciphertext hash, so `payloadHash`\n // must be the real `envelopePayloadHash` of the just-written envelope\n // (ciphertext domain), NOT `derived.aggregateHash` (plaintext domain) —\n // using the wrong domain here trips a false-positive tamper failure on\n // restore.\n await ledger.append({\n op: 'migration',\n collection: MANIFEST_COLLECTION,\n id: MANIFEST_SCHEMA_RECORD_ID,\n version: expectedVersion + 1,\n actor: '',\n payloadHash: await envelopePayloadHash(envelope),\n reason: `schema-manifest-sync:generation=${derived.generation}`,\n })\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n * - Zod validators: skip when the new hash equals the stored hash.\n * - Non-Zod (stub envelopes have hash=null): skip when the stored\n * envelope's `kind` matches the freshly-detected kind (since there's\n * no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { resolveFieldIds } from './field-ids.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { loadFence, saveFence } from '../schema-update/fence.js'\nimport { isConflictError } from '../../kernel/errors.js'\nimport { syncSchemaManifest, type ManifestSyncDeps } from '../manifest/sync.js'\nimport type { SchemaUpdateStrategy, UpdateDecision, SchemaDelta } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n /** True when a fresh envelope was written to storage. */\n readonly written: boolean\n /** True when an existing envelope matched and the write was skipped. */\n readonly skipped: boolean\n /** The envelope that was either written or matched. */\n readonly envelope: PersistedSchemaEnvelope\n /** The update-strategy decision, present when strategies ran. */\n readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n readonly store: NoydbStore\n readonly vault: string\n readonly collectionName: string\n readonly validator: unknown\n readonly dek: EnclaveKey\n readonly strategies?: readonly SchemaUpdateStrategy[]\n /** #941 Task 3: re-derive + sync the `_manifest/schema` INDEX after a write. Omitted → no sync (e.g. tests that don't care). */\n readonly manifestSync?: ManifestSyncDeps\n}): Promise<PersistSchemaResult> {\n const fresh = await derivePersistedSchema(opts.validator)\n\n // The `_schemas/<collection>` record is shared with the classified-marker\n // writer, so a plain load→save loses whichever writer put first (#583). Read\n // the version at load time and CAS on it; on conflict re-read (picking up the\n // other writer's field), re-evaluate, and retry.\n for (let attempt = 0; ; attempt++) {\n const { version, payload: stored } = await loadPersistedSchemaEntry(\n opts.store, opts.vault, opts.collectionName, opts.dek,\n )\n\n if (stored && isEquivalent(stored, fresh)) {\n return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n }\n\n // Changed (or first registration). Compute the delta whenever we have a\n // comparable JSON-Schema baseline — independent of whether strategies\n // were registered (#946: the rename pairing it carries feeds the\n // fieldIds id-carry below even on a bare re-declare with no\n // `schemaUpdate` strategies configured). Strategies only run when\n // registered.\n let decision: UpdateDecision = { action: 'allow' }\n const strategies = opts.strategies ?? []\n let delta: SchemaDelta | undefined\n if (\n stored &&\n stored.kind === fresh.kind &&\n isPlainObject(stored.jsonSchema) &&\n isPlainObject(fresh.jsonSchema)\n ) {\n delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n if (strategies.length > 0) {\n decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n }\n }\n\n if (decision.action !== 'allow') {\n // reject (or cutover): do NOT overwrite the baseline — the\n // old schema stays the source of truth until the change is resolved.\n return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n }\n\n // Preserve a previously-persisted classified marker (C-A / R10) and\n // satellite pairing marker (R-S9) — the schema derivation knows nothing\n // about them, so a naive overwrite here would drop the config-drift\n // guards' cross-session signals.\n let toSave: PersistedSchemaEnvelope = fresh\n if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n\n // #946: mint/preserve stable per-field ids (by name, carrying a\n // detected rename's id from its old name — see `delta.renamed`) and\n // stamp the vault-wide schema-fence generation this write happened at —\n // binds \"generation N\" to this envelope's content hash\n // (schemaFenceState() + loadPersistedSchema agree).\n const fieldIds = resolveFieldIds(fresh.jsonSchema, stored?.fieldIds, delta?.renamed)\n if (fieldIds !== undefined) toSave = { ...toSave, fieldIds }\n const fence = await loadFence(opts.store, opts.vault)\n toSave = { ...toSave, generation: fence.currentSchemaVersion }\n\n try {\n await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n if (toSave.hash !== null) {\n // This is the FIRST non-barrier writer to `_meta/schema-fence` —\n // previously only SchemaFenceController.#setState wrote it, and only\n // sequentially, under the drain barrier. There is no CAS on the fence\n // doc (out of scope to add here), so re-read it immediately before\n // writing rather than reusing the `fence` snapshot captured above\n // (before the potentially-slow `savePersistedSchema` call): spreading\n // a stale snapshot here would roll back `currentSchemaVersion`/\n // `fenceState` if a concurrent cutover (on a different collection)\n // advanced the fence in between — corrupting the vault-wide gate the\n // whole barrier + MigrationRequiredError check depends on. Re-reading\n // narrows (does not eliminate) that window to just this one overlay.\n const freshFence = await loadFence(opts.store, opts.vault)\n await saveFence(opts.store, opts.vault, { ...freshFence, schemaHash: toSave.hash })\n }\n // #941 Task 3: keep the `_manifest/schema` INDEX in sync with the\n // `_schemas/<collection>` write that just landed. Opt-in via\n // `opts.manifestSync` (threaded from vault.ts, which is the only\n // caller with a general-purpose `getDEK` resolver + ledger handle).\n if (opts.manifestSync) {\n await syncSchemaManifest(opts.store, opts.vault, opts.manifestSync)\n }\n return { written: true, skipped: false, envelope: toSave, decision }\n } catch (err) {\n if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n throw err\n }\n }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n readonly store: NoydbStore\n readonly vault: string\n readonly collectionName: string\n readonly dek: EnclaveKey\n readonly marker: ClassifiedMarker\n}): Promise<void> {\n // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n // CAS on the loaded version so a concurrent schema (re)registration can't\n // silently drop the marker (and vice-versa) — see #583.\n for (let attempt = 0; ; attempt++) {\n const { version, payload: stored } = await loadPersistedSchemaEntry(\n opts.store, opts.vault, opts.collectionName, opts.dek,\n )\n if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n const payload: PersistedSchemaEnvelope =\n stored !== undefined\n ? { ...stored, classified: opts.marker }\n : {\n _noydb_schema: 1,\n kind: 'Unknown',\n jsonSchema: null,\n hash: null,\n derivedAt: new Date().toISOString(),\n classified: opts.marker,\n }\n try {\n await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n return\n } catch (err) {\n if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n throw err\n }\n }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n readonly store: NoydbStore\n readonly vault: string\n readonly collectionName: string\n readonly dek: EnclaveKey\n readonly marker: PairingMarker\n}): Promise<void> {\n // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n // CAS on the loaded version so a concurrent schema (re)registration can't\n // silently drop the marker (and vice-versa) — see #583.\n for (let attempt = 0; ; attempt++) {\n const { version, payload: stored } = await loadPersistedSchemaEntry(\n opts.store, opts.vault, opts.collectionName, opts.dek,\n )\n if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n const payload: PersistedSchemaEnvelope =\n stored !== undefined\n ? { ...stored, satellite: opts.marker }\n : {\n _noydb_schema: 1,\n kind: 'Unknown',\n jsonSchema: null,\n hash: null,\n derivedAt: new Date().toISOString(),\n satellite: opts.marker,\n }\n try {\n await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n return\n } catch (err) {\n if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n throw err\n }\n }\n}\n\n// #597: both equality checks below deliberately do NOT compare `epoch`. A\n// live collection re-opening itself computes a fresh epoch candidate on\n// every declare (marker.ts / config-drift.ts) that must still be treated as\n// \"the same marker\" so the no-op fast path fires and the already-persisted\n// epoch is left untouched — that's what makes epoch stable across re-opens.\n// Comparing epoch here would break that fast path today, with no\n// corresponding benefit: there is no delete-collection API yet, so a\n// mismatched epoch can't (yet) mean \"this name was reused for a genuinely\n// new collection.\" Wiring an epoch-mismatch REJECTION is a deferred\n// follow-up for whenever collection deletion ships.\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n if (a.length !== b.length) return false\n const s = new Set(a)\n return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n if (a.kind !== b.kind) return false\n // Zod path: real hashes — compare directly.\n if (a.hash && b.hash) return a.hash === b.hash\n // Stub path: both have hash=null. Kind equality is the only signal we have.\n if (a.hash === null && b.hash === null) return true\n // Mixed (one has a hash, the other doesn't) — treat as changed.\n return false\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,IAAM,qBAAqB;AAG3B,SAAS,gBAAgB,OAA2B;AAClD,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO;AACxB,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,aAAO,mBAAoB,UAAW,OAAO,IAAM,EAAE;AACrD,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,WAAO,mBAAoB,SAAU,IAAI,OAAS,EAAE;AAAA,EACtD;AACA,SAAO;AACT;AAQA,SAAS,cAAsB;AAC7B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAGA,SAAS,mBAAmB,YAA8C;AACxE,MAAI,eAAe,KAAM,QAAO,CAAC;AACjC,QAAM,QAAS,WAAwC;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO,CAAC;AACzD,SAAO,OAAO,KAAK,KAAgC;AACrD;AAiBO,SAAS,gBACd,iBACA,eACA,SACoC;AACpC,QAAM,QAAQ,mBAAmB,eAAe;AAChD,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,eAAe,oBAAI,IAAoB;AAC7C,MAAI,QAAS,YAAW,EAAE,MAAM,GAAG,KAAK,QAAS,cAAa,IAAI,IAAI,IAAI;AAC1E,QAAM,MAA8B,CAAC;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,aAAa,IAAI,IAAI,KAAK;AAC5C,QAAI,IAAI,IAAI,gBAAgB,SAAS,KAAK,YAAY;AAAA,EACxD;AACA,SAAO;AACT;;;AChDA,eAAsB,oBACpB,OACA,OACA,UACA,iBACA,QAE4B;AAC5B,MAAI;AACF,WAAO,MAAM,mBAAmB,OAAO,OAAO,UAAU,iBAAiB,MAAM;AAAA,EACjF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,IAAI,sBAAsB,IAAI,SAAS,eAAe;AAAA,IAC9D;AACA,UAAM;AAAA,EACR;AACF;;;ACuFA,IAAM,oBAAoB;AAY1B,eAAsB,mBACpB,OACA,OACA,MACe;AACf,WAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,UAAM,EAAE,UAAU,SAAS,uBAAuB,IAAI,MAAM,qBAAqB,OAAO,OAAO,KAAK,SAAS;AAC7G,QAAI,uBAAuB,SAAS,GAAG;AAGrC;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,wBAAwB,OAAO,OAAO,KAAK,MAAM;AAExE,QACE,YACA,SAAS,SAAS,eAAe,QAAQ,cACzC,SAAS,SAAS,kBAAkB,QAAQ,eAC5C;AACA;AAAA,IACF;AAEA,UAAM,kBAAkB,UAAU,WAAW;AAQ7C,UAAM,UAAU,MAAM,iBAAiB,OAAO,OAAO,YAAY;AAC/D,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,oBAAoB,OAAO,OAAO,SAAS,iBAAiB,KAAK,MAAM;AAAA,MAC1F,SAAS,KAAK;AACZ,YAAI,eAAe,sBAAuB,QAAO;AACjD,cAAM;AAAA,MACR;AAQA,YAAM,mBAAmB,MAAM,SAAS,iBAAiB,QAAQ;AACjE,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,QAAS;AAUd,UAAM,UAAU,MAAM,qBAAqB,OAAO,OAAO,KAAK,SAAS;AACvE,QAAI,QAAQ,uBAAuB,SAAS,EAAG;AAC/C,QAAI,QAAQ,SAAS,eAAe,QAAQ,cAAc,QAAQ,SAAS,kBAAkB,QAAQ,eAAe;AAClH;AAAA,IACF;AAAA,EACF;AAMA,UAAQ;AAAA,IACN,wDAAwD,iBAAiB;AAAA,EAE3E;AACF;AAcA,IAAM,gBAAgB,oBAAI,QAAgD;AAE1E,eAAe,iBAAoB,OAAmB,OAAe,IAAkC;AACrG,MAAI,UAAU,cAAc,IAAI,KAAK;AACrC,MAAI,CAAC,SAAS;AACZ,cAAU,oBAAI,IAAI;AAClB,kBAAc,IAAI,OAAO,OAAO;AAAA,EAClC;AACA,QAAM,OAAO,QAAQ,IAAI,KAAK,KAAK,QAAQ,QAAQ,GAAG,KAAK,EAAE;AAG7D,QAAM,OAAO,IAAI,KAAK,MAAM;AAAA,EAAC,GAAG,MAAM;AAAA,EAAC,CAAC;AACxC,UAAQ,IAAI,OAAO,IAAI;AACvB,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,QAAI,QAAQ,IAAI,KAAK,MAAM,KAAM,SAAQ,OAAO,KAAK;AAAA,EACvD;AACF;AAEA,eAAe,mBACb,MACA,SACA,iBAEA,UACe;AACf,QAAM,SAAS,KAAK,kBAAkB;AACtC,MAAI,CAAC,OAAQ;AAUb,QAAM,OAAO,OAAO;AAAA,IAClB,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,IAAI;AAAA,IACJ,SAAS,kBAAkB;AAAA,IAC3B,OAAO;AAAA,IACP,aAAa,MAAM,oBAAoB,QAAQ;AAAA,IAC/C,QAAQ,mCAAmC,QAAQ,UAAU;AAAA,EAC/D,CAAC;AACH;;;ACvPA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MASX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAQA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QAAI;AACJ,QACE,UACA,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,cAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACnF,UAAI,WAAW,SAAS,GAAG;AACzB,mBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,MAC5F;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AAOvF,UAAM,WAAW,gBAAgB,MAAM,YAAY,QAAQ,UAAU,OAAO,OAAO;AACnF,QAAI,aAAa,OAAW,UAAS,EAAE,GAAG,QAAQ,SAAS;AAC3D,UAAM,QAAQ,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK;AACpD,aAAS,EAAE,GAAG,QAAQ,YAAY,MAAM,qBAAqB;AAE7D,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,UAAI,OAAO,SAAS,MAAM;AAYxB,cAAM,aAAa,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK;AACzD,cAAM,UAAU,KAAK,OAAO,KAAK,OAAO,EAAE,GAAG,YAAY,YAAY,OAAO,KAAK,CAAC;AAAA,MACpF;AAKA,UAAI,KAAK,cAAc;AACrB,cAAM,mBAAmB,KAAK,OAAO,KAAK,OAAO,KAAK,YAAY;AAAA,MACpE;AACA,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,UAAU,uBAAwB;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,UAAU,uBAAwB;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,UAAU,uBAAwB;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAaA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}

package/dist/{chunk-BSEPI3HD.js → chunk-PR36DD2X.js} RENAMED Viewed

@@ -1,9 +1,9 @@
 import {
   assertTierAccess
-} from "./chunk-XQGKS4OW.js";
+} from "./chunk-VKZ3TDET.js";
 import {
   dekKey
-} from "./chunk-LJ744WXU.js";
+} from "./chunk-F2FD4LSB.js";
 import {
   applyRewrappedBody,
   buildRecordAad,
@@ -16,17 +16,17 @@ import {
   rewrapBodyToDek,
   sealedBodyArgs,
   unwrapCek
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-URGHKZPL.js";
+} from "./chunk-CR5UPYIJ.js";
 import {
   PersistedIndexCompensationError,
   TierDemoteDeniedError,
   TiersNotEnabledError,
   UniqueConstraintError,
   UnsupportedTierCompositionError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -57,7 +57,7 @@ function withTiers() {
       return checkUniqueAcrossTiers2(ctx, id, record);
     },
     async refreshDelegations(ctx, now) {
-      const { loadActiveDelegations, DELEGATIONS_COLLECTION } = await import("./delegation-7SSGIETH.js");
+      const { loadActiveDelegations, DELEGATIONS_COLLECTION } = await import("./delegation-SNALWRMO.js");
       const ids = await ctx.adapter.list(ctx.vault, DELEGATIONS_COLLECTION);
       if (ids.length === 0) return [];
       const delegationsDek = ctx.keyring.deks.get(DELEGATIONS_COLLECTION);
@@ -496,4 +496,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-BSEPI3HD.js.map
+//# sourceMappingURL=chunk-PR36DD2X.js.map

package/dist/{chunk-52ZFNK46.js → chunk-PV4HIC4E.js} RENAMED Viewed

@@ -1,7 +1,7 @@
 import {
   DerivationCapExceededError,
   DerivationOutputShapeError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-formula/derivations/executor.ts
 var DerivationExecutor = {
@@ -121,4 +121,4 @@ var DerivationExecutor = {
 export {
   DerivationExecutor
 };
-//# sourceMappingURL=chunk-52ZFNK46.js.map
+//# sourceMappingURL=chunk-PV4HIC4E.js.map

package/dist/{chunk-TU6ZJTYT.js → chunk-PZNK4HTV.js} RENAMED Viewed

@@ -1,9 +1,9 @@
 import {
   getAtPath
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-3M2KK7O7.js";
 import {
   EmbeddingModelMismatchError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-lookup/embeddings/descriptor.ts
 function embeddingSourceText(record, source) {
@@ -290,4 +290,4 @@ export {
   isVecIdFor,
   deriveChunkVectors
 };
-//# sourceMappingURL=chunk-TU6ZJTYT.js.map
+//# sourceMappingURL=chunk-PZNK4HTV.js.map

package/dist/{chunk-LUQBG637.js → chunk-QBLPLNPE.js} RENAMED Viewed

@@ -1,13 +1,13 @@
 import {
   validateProjectionLegs
-} from "./chunk-GHMINSER.js";
+} from "./chunk-5OWJSDTO.js";
 import {
   describeGroupKey
 } from "./chunk-XBKH4FOC.js";
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -208,4 +208,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-LUQBG637.js.map
+//# sourceMappingURL=chunk-QBLPLNPE.js.map

package/dist/{chunk-UADW5NOU.js → chunk-QZXUISRF.js} RENAMED Viewed

@@ -1,11 +1,11 @@
 import {
   ENCLAVE_SCHEME
-} from "./chunk-B6EWMGFX.js";
+} from "./chunk-NUBI6PYH.js";
 import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-IPF5ORDI.js";
+} from "./chunk-XMARKBUC.js";
 import {
   signRevocationList
 } from "./chunk-GMKGGY7V.js";
@@ -14,11 +14,11 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-audit/attestation/revoke.ts
 function requireOwner(ctx, op) {
@@ -82,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-UADW5NOU.js.map
+//# sourceMappingURL=chunk-QZXUISRF.js.map

package/dist/{chunk-BMAXBTYH.js → chunk-RBXYO7MD.js} RENAMED Viewed

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-FUHUGKDN.js";
+} from "./chunk-XROQP6IQ.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-U43RSPPX.js";
+} from "./chunk-23A4SBRR.js";
 import {
   buildRecordEnvelope
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   NoydbError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -157,4 +157,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-BMAXBTYH.js.map
+//# sourceMappingURL=chunk-RBXYO7MD.js.map

package/dist/{chunk-PZN76MMV.js → chunk-RIACRFWA.js} RENAMED Viewed

@@ -1,14 +1,14 @@
 import {
   dictCollectionName
-} from "./chunk-WVQDY3UM.js";
+} from "./chunk-AHA7UALU.js";
 import {
   getAtPath,
   presentI18nForJoin
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-3M2KK7O7.js";
 import {
   UnknownDictCodeError,
   ValidationError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/via/lookup/registry.ts
 function enforceStaticDictOnPut(staticFields, record) {
@@ -320,4 +320,4 @@ export {
   buildPresentForJoin,
   isLookupDescriptor
 };
-//# sourceMappingURL=chunk-PZN76MMV.js.map
+//# sourceMappingURL=chunk-RIACRFWA.js.map

package/dist/{chunk-ICHHNI5E.js → chunk-RL6RNDJQ.js} RENAMED Viewed

@@ -1,10 +1,10 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-IF2M43G4.js";
+} from "./chunk-PBRD75JF.js";
 import {
   assemblePodContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-4N4OIVK3.js";
+} from "./chunk-2NVQ5SEA.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -12,7 +12,7 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-7IV7GVOS.js";
+} from "./chunk-YCTSQV7K.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -23,7 +23,7 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-QHG7GQKM.js";
+} from "./chunk-5JNEDW7I.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -43,13 +43,13 @@ import {
   unwrapCek,
   wrapCek,
   writeEnvelopeBody
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-URGHKZPL.js";
+} from "./chunk-CR5UPYIJ.js";
 import {
   PartitionExtractionError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -490,4 +490,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-ICHHNI5E.js.map
+//# sourceMappingURL=chunk-RL6RNDJQ.js.map

package/dist/{chunk-4WLI37WK.js → chunk-SJ2P7UXD.js} RENAMED Viewed

@@ -4,25 +4,25 @@ import {
 import {
   bindDistinctReducers,
   reducerBuilder
-} from "./chunk-4KYKRYRT.js";
+} from "./chunk-TOTCZFRF.js";
 import {
   LiveMaintainer
 } from "./chunk-VHM7HCKB.js";
 import {
   gateTerminal
-} from "./chunk-O3NGOHXQ.js";
+} from "./chunk-KA4AAUST.js";
 import {
   readPath
-} from "./chunk-SXPLIRQH.js";
+} from "./chunk-NLDBQHDV.js";
 import {
   applyI18nLocale
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-3M2KK7O7.js";
 import {
   viaBinder
-} from "./chunk-PIO6NW7O.js";
+} from "./chunk-ZG7DBIVX.js";
 import {
   GroupCardinalityError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 // src/with-lookup/reduce/reduction.ts
 function reduceRecords(records, spec) {
@@ -754,4 +754,4 @@ export {
   compareReduced,
   GroupedReduction
 };
-//# sourceMappingURL=chunk-4WLI37WK.js.map
+//# sourceMappingURL=chunk-SJ2P7UXD.js.map