@noy-db/hub 0.10.0-pre.0 → 0.10.0-pre.2

package/dist/sync/index.js

@@ -3,23 +3,21 @@ import {
   SyncEngine,
   SyncTransaction,
   bootstrapKeyrings
-} from "../chunk-N6EWQ5VB.js";
+} from "../chunk-37FOG6AE.js";
 import {
   NO_SYNC
-} from "../chunk-7UHLO4ZN.js";
-import "../chunk-A52BK5AY.js";
-import "../chunk-QVUMKG3Z.js";
-import "../chunk-6BEBWHNL.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+} from "../chunk-B2HU55QD.js";
+import "../chunk-JRCO67NG.js";
+import "../chunk-UXH4AKH3.js";
+import "../chunk-ZQQLOEWN.js";
+import "../chunk-KHSBMLQE.js";
+import "../chunk-VKZ3TDET.js";
+import "../chunk-F2FD4LSB.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
+import "../chunk-ISIXU45J.js";
 
 // src/with-sync/active.ts
 function withSync(options) {

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\nimport { bootstrapKeyrings } from './reserved-mirror.js'\n\n/**\n * core#107 — `arbiter: true` makes this device the vault's ARBITER: its\n * admission refusals are replicated so the writer finds out, instead of\n * staying local to the device that judged them.\n *\n * ⚠️ One arbiter, named by configuration on the device that is to be it\n * (the admin host, or the daemon) — ruled over a quorum because the failure\n * mode is legible: no arbiter configured means no replication, which is\n * exactly the pre-core#107 behaviour. It is NOT an authority proof: nothing\n * stops a member hand-writing `_sync_rejections`, and the reason that is\n * tolerable is the report-only ruling — a replicated refusal never deletes,\n * tombstones or retracts anything, so the worst a forged one does is show\n * somebody a notice about their own record.\n *\n * ⚠️ THE CONDITION THAT WOULD MAKE THAT NON-BOUNDARY A REAL ONE, named by\n * pilot-1 when they accepted it: every member is currently staff of the same\n * firm, and a forged refusal is sealed under the refused record's own\n * collection DEK — so a forger can only show a notice about a record they\n * could already read. ⛔ If EXTERNAL `client`-role users ever hold\n * collections of their own, \"who may write `_sync_rejections`\" stops being\n * cosmetic and this needs an authority design, not a flag. Do not read the\n * paragraph above as a general safety argument; it is an argument about one\n * topology, and this is the trigger to re-open it.\n */\nexport interface WithSyncOptions {\n  readonly arbiter?: boolean\n}\n\nexport function withSync(options?: WithSyncOptions): SyncStrategy {\n  return {\n    bootstrapKeyrings,\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine({ ...opts, ...(options?.arbiter === true && { arbiter: true }) })\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoEO,SAAS,SAAS,SAAyC;AAChE,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,EAAE,GAAG,MAAM,GAAI,SAAS,YAAY,QAAQ,EAAE,SAAS,KAAK,EAAG,CAAC;AAAA,IACxF;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\nimport { bootstrapKeyrings } from './reserved-mirror.js'\n\n/**\n * core#107 — `arbiter: true` makes this device the vault's ARBITER: its\n * admission refusals are replicated so the writer finds out, instead of\n * staying local to the device that judged them.\n *\n * ⚠️ One arbiter, named by configuration on the device that is to be it\n * (the admin host, or the daemon) — ruled over a quorum because the failure\n * mode is legible: no arbiter configured means no replication, which is\n * exactly the pre-core#107 behaviour. It is NOT an authority proof: nothing\n * stops a member hand-writing `_sync_rejections`, and the reason that is\n * tolerable is the report-only ruling — a replicated refusal never deletes,\n * tombstones or retracts anything, so the worst a forged one does is show\n * somebody a notice about their own record.\n *\n * ⚠️ THE CONDITION THAT WOULD MAKE THAT NON-BOUNDARY A REAL ONE, named by\n * pilot-1 when they accepted it: every member is currently staff of the same\n * firm, and a forged refusal is sealed under the refused record's own\n * collection DEK — so a forger can only show a notice about a record they\n * could already read. ⛔ If EXTERNAL `client`-role users ever hold\n * collections of their own, \"who may write `_sync_rejections`\" stops being\n * cosmetic and this needs an authority design, not a flag. Do not read the\n * paragraph above as a general safety argument; it is an argument about one\n * topology, and this is the trigger to re-open it.\n */\nexport interface WithSyncOptions {\n  readonly arbiter?: boolean\n}\n\nexport function withSync(options?: WithSyncOptions): SyncStrategy {\n  return {\n    bootstrapKeyrings,\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine({ ...opts, ...(options?.arbiter === true && { arbiter: true }) })\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoEO,SAAS,SAAS,SAAyC;AAChE,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,EAAE,GAAG,MAAM,GAAI,SAAS,YAAY,QAAQ,EAAE,SAAS,KAAK,EAAG,CAAC;AAAA,IACxF;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.js

@@ -1,10 +1,10 @@
 import {
   MemoryDeviceSeal,
   withTeam
-} from "../chunk-ZOFNZLAA.js";
+} from "../chunk-VLZPUG5A.js";
 import {
   beginEchoUnlock
-} from "../chunk-35CNOVQE.js";
+} from "../chunk-X67E7NIJ.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -34,8 +34,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-GLSCL74M.js";
-import "../chunk-B3B6HV5S.js";
+} from "../chunk-5AVIUJP4.js";
+import "../chunk-XMBBTETD.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -56,20 +56,18 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-QVUMKG3Z.js";
-import "../chunk-6BEBWHNL.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+} from "../chunk-UXH4AKH3.js";
+import "../chunk-ZQQLOEWN.js";
+import "../chunk-KHSBMLQE.js";
+import "../chunk-VKZ3TDET.js";
+import "../chunk-F2FD4LSB.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   TeamNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-ISIXU45J.js";
 export {
   MemoryDeviceSeal,
   NO_TEAM,

package/dist/tiers/index.js

@@ -12,19 +12,16 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-BSEPI3HD.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+} from "../chunk-PR36DD2X.js";
+import "../chunk-VKZ3TDET.js";
+import "../chunk-F2FD4LSB.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   TiersNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-ISIXU45J.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,

package/dist/to/index.js

@@ -1,6 +1,6 @@
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-URGHKZPL.js";
+} from "../chunk-CR5UPYIJ.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
@@ -9,7 +9,7 @@ import {
   StoreCapabilityError,
   UnknownStoreKindError,
   isConflictError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-ISIXU45J.js";
 
 // src/port/to/locator.ts
 function isPodStore(store) {

package/dist/transactions/index.js

@@ -3,15 +3,15 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-PFHDQY5L.js";
+} from "../chunk-56Z4NOC6.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-ISIXU45J.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-7SY3M6TZ.js"));
+var loadGuardExecutor = lazy(() => import("../executor-BJZJNVBB.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-ISIXU45J.js";
 
 // src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";

package/dist/vault-diff-H7LT5ZBJ.js

@@ -0,0 +1,8 @@
+import {
+  diffVault
+} from "./chunk-7VJ2SIEI.js";
+import "./chunk-SVLR4POP.js";
+export {
+  diffVault
+};
+//# sourceMappingURL=vault-diff-H7LT5ZBJ.js.map

package/dist/vault-head/index.js

@@ -8,14 +8,11 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+} from "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
+import "../chunk-ISIXU45J.js";
 
 // src/with-commit/vault-head/head.ts
 function bucketIndex(collection, id, buckets) {

package/dist/vault-head/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../capsule/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../capsule/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}

package/dist/walk-Z4N7PCZ2.js

@@ -0,0 +1,17 @@
+import {
+  dumpVaultSchema
+} from "./chunk-HDAPQF6Q.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-FY4FFNKK.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-PBRD75JF.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-Z4N7PCZ2.js.map

package/dist/with-audit/portability/export-accessible.d.ts

@@ -41,6 +41,8 @@ export interface ExportAccessibleOptions {
 }
 /**
  * Produce a re-keyed, access-scoped `.noydb` bundle of the caller's accessible
- * data. Appends a tamper-evident audit entry (`reason: 'user-export:<userId>'`).
+ * data. Appends a tamper-evident audit entry (`reason: 'user-export:<userId>'`)
+ * BEFORE building, so a build that fails part-way still records the access it
+ * already made (family#175).
  */
 export declare function exportAccessibleData(vault: Vault, opts?: ExportAccessibleOptions): Promise<Uint8Array>;

package/dist/with-cargo/vault-diff.d.ts

@@ -88,7 +88,16 @@ export interface VaultDiff<T = unknown> {
         readonly modify: number;
         readonly delete: number;
         readonly total: number;
+        /** family#151 — `skipped.length`, so a caller reading only the summary sees it. */
+        readonly skipped: number;
     };
+    /**
+     * Records this diff could not key, and therefore says nothing about
+     * (family#151). Empty for a vault-to-vault diff. ⚠️ A non-empty value means
+     * the diff is INCOMPLETE — an importer walking only the buckets will not
+     * write these rows, which used to happen silently.
+     */
+    readonly skipped: readonly VaultDiffSkipped[];
     /**
      * Format the diff as a human-readable string.
      *
@@ -127,6 +136,25 @@ export interface DiffOptions {
  *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the
  *     full vault state. Parsed and reduced to the map shape above.
  */
+/**
+ * A record neither side could key, and therefore one this diff does NOT report
+ * on (family#151).
+ *
+ * ⛔ IT EXISTS BECAUSE THE SKIP WAS SILENT. A record with no `idKey` field was
+ * dropped from the map on both sides, so it appeared in no bucket — and
+ * `@noy-db/hub/as`'s `plan().apply()` walks only `added`/`modified`/`deleted`.
+ * An import therefore did not write it, with no error and no count. A diff that
+ * omits a record is reporting a difference it did not find.
+ *
+ * ⚠️ Only reachable on the object/string candidate path. A vault-to-vault diff
+ * keys both sides by the hub id, which every record has.
+ */
+export interface VaultDiffSkipped {
+    readonly collection: string;
+    readonly side: 'vault' | 'candidate';
+    /** Position within that side's record list for the collection. */
+    readonly index: number;
+}
 export type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
 /**
  * Compute the diff between a live vault and a candidate state.

package/dist/with-commit/sequence/index.d.ts

@@ -23,6 +23,28 @@ import { type EnclaveKey } from '../../capsule/index.js';
 export { withSequence } from './active.js';
 export { NO_SEQUENCE, type SequenceStrategy } from './strategy.js';
 export { SequenceNotEnabledError } from '../../kernel/errors.js';
+/**
+ * ⛔ **COUNTERS NEVER SYNC — A SEQUENCE IS UNIQUE PER DEVICE, NOT ACROSS A
+ * FLEET (family#206).** `_sequences` is absent from `RESERVED_REPLICATION`
+ * (`with-sync/reserved-mirror.ts:108`, whose replicated set is `_keyring`,
+ * `_broker_member`, `_broker`, `_meta`, `_users`, `_delegations`,
+ * `_rejections`), and `next()` CASes the counter record against the LOCAL
+ * store. So two devices issuing from the same sequence name produce the SAME
+ * numbers, and `next()`'s "no duplicates under concurrency" guarantee holds
+ * within one device only.
+ *
+ * ⚠️ The CAS is doing real work and it is not the gap here — it serializes
+ * concurrent writers against ONE store. What is missing is replication of the
+ * counter itself, which is why the failure is invisible to any single-device
+ * test and to every in-tree simulation that shares a store.
+ *
+ * ⛔ Do not use this for an invoice number that must be unique across devices
+ * until family#206 lands — it is the first item of the next cycle.
+ *
+ * ⭐ Measured: with sync on both devices, A `next()` → 1, A pushes, B pulls the
+ * whole vault, B `next()` → 1. Two records numbered 1 after a COMPLETE sync
+ * cycle — the pull cannot help, because there is nothing replicating to pull.
+ */
 export declare const SEQUENCE_COLLECTION = "_sequences";
 /** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */
 export interface NextOptions {

package/dist/with-party/team/delegation.d.ts

@@ -4,9 +4,10 @@
  * A higher-tier user can issue a delegation that grants another user
  * temporary access to records at a specified tier. The delegation is
  * persisted as an encrypted envelope in the reserved `_delegations`
- * collection. The target user's runtime scans this collection on every
- * open and, while `until` is still in the future, merges the
- * unwrapped tier DEKs into their in-memory DEK map.
+ * collection. While `until` is still in the future, the target merges the
+ * unwrapped tier DEKs into their in-memory DEK map by calling
+ * `Vault.refreshDelegations()` — EXPLICIT, never automatic; the core#56
+ * section below says why a read path must not scan on open.
  *
  * ## Token shape
  *
@@ -39,14 +40,14 @@
  * The ciphertext is stored as a normal noy-db envelope — the
  * `_delegations` collection has its own DEK shared across all vault
  * users, so an operator can enumerate active delegations for audit
- * without being able to *use* them (the `wrappedDek` inside is still
- * keyed to the target user's KEK).
+ * without being able to *use* them (the `wrappedDek` inside is keyed to
+ * the token's own content key — see the core#65 section above).
  *
  * ## Revocation
  *
- * Delete the `_delegations/<id>` envelope. The target user's runtime
- * reloads the delegation list at each open and at periodic intervals
- * (tracked by the caller — this module is pure logic).
+ * Delete the `_delegations/<id>` envelope. The target picks the change up
+ * at its next `Vault.refreshDelegations()` call — this module is pure
+ * logic and schedules nothing.
  *
  * @module
  */
@@ -56,8 +57,9 @@ import { type EnclaveKey } from '../../capsule/index.js';
 export declare const DELEGATIONS_COLLECTION = "_delegations";
 /**
  * Durable payload of a delegation token. Encrypted under the vault's
- * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped
- * under the target user's KEK.
+ * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped under
+ * the token's per-token CONTENT KEY — see {@link DelegationToken.sealedCek},
+ * which carries the pre-core#65 exception.
  */
 export interface DelegationToken {
     readonly id: string;
@@ -75,8 +77,10 @@ export interface DelegationToken {
     readonly until: string;
     /**
      * The delegated tier DEK for {@link DelegationToken.collection}, wrapped
-     * under the target's KEK. Present on a per-collection token; absent on a
-     * collection-wide one, which carries {@link DelegationToken.wrappedDeks}.
+     * under the token's content key — see {@link DelegationToken.sealedCek},
+     * which carries the pre-core#65 exception. Present on a per-collection
+     * token; absent on a collection-wide one, which carries
+     * {@link DelegationToken.wrappedDeks}.
      */
     readonly wrappedDek?: string;
     /**

package/dist/with-party/team/keyring.d.ts

@@ -147,6 +147,56 @@ export declare function loadKeyring(store: NoydbStore, vault: string, opts: Load
  * otherwise. Placed before managed-secret secret resolution (which persists
  * on first open), so a fail-closed open writes nothing.
  */
+/**
+ * ⚠️ family#162 — THIS GATE'S FAIL-CLOSED PROPERTY RESTS ON THE STORE
+ * CONTRACT. It decides "genuinely-new vault" from `list()` returning empty, so
+ * a store that answers a read FAILURE with `[]` turns the refusal below into a
+ * pass: hub then self-provisions a second owner into a vault that already has
+ * one. `NoydbStore`'s docstring states the rule (absence and failure are
+ * different answers); `to-file` violated it in `get`, `list` and `loadAll`.
+ *
+ * ⛔ Hub cannot verify it. A `[]` is a `[]` — there is no second question to
+ * ask that a store answering wrongly would answer differently. So the guard is
+ * the contract plus each store honouring it, and what hub owes is to NOT
+ * swallow a store that does throw. `__tests__/162-...` asserts that.
+ */
+/**
+ * Refuse to attach a sync peer whose keyring for this user is a DIFFERENT file
+ * from the local one (family#178).
+ *
+ * ⛔ WHAT IT CATCHES, measured on two devices. A second device that attaches its
+ * peer with `attachSyncTarget` rather than the construction-time `sync` option
+ * finds no `_keyring` at open, self-provisions a brand-new owner keyring, and
+ * then diverges permanently: each device reads only its own records, under two
+ * different keyrings, with NO error anywhere. Device 1 cannot read device 2's
+ * data and device 2 cannot read device 1's.
+ *
+ * ⭐ THE TRIGGER IS A LOCAL WRITE BEFORE THE ATTACH. With no local write the
+ * reserved-keyring mirror adopts the peer's keyring on the first pull and
+ * everything works — so a two-device test WITHOUT the write passes and proves
+ * nothing. Once the device has written under its self-provisioned keyring the
+ * mirror will not supersede it, and the divergence sticks.
+ *
+ * ⛔ WHY THE CHECK IS HERE AND NOT AT FIRST KEYRING ACCESS. It cannot be there:
+ * `Noydb.vault()` throws unless the vault is already open, so `attachSyncTarget`
+ * necessarily runs AFTER `openVault` — and `openVault` is where the
+ * self-provision happens. At that moment no peer is attached and none can be
+ * consulted. "Bootstrap from any attached peer at first keyring access" is empty
+ * on a first open, and "refuse while an attached peer has not been checked"
+ * would refuse every first open.
+ *
+ * ⚠️ IT REFUSES RATHER THAN REPAIRS, deliberately. Adopting the peer's keyring
+ * would discard the local one, and every record this device already wrote is
+ * sealed under the discarded DEKs — so a "repair" trades a visible divergence
+ * for silent data loss. Refusing leaves both copies intact and tells the caller
+ * the two supported paths.
+ *
+ * ⚠️ The invariant it rests on was verified, not assumed: a legitimate pair ends
+ * with BYTE-IDENTICAL `_keyring/<user>` on both stores (measured for the
+ * construction-time form), because the keyring is per-user and mirrored. Two
+ * different files for one userId cannot both be right.
+ */
+export declare function assertPeerKeyringMatches(local: NoydbStore, peer: NoydbStore, vault: string, userId: string): Promise<void>;
 export declare function assertKeyringOpenAllowed(store: NoydbStore, vault: string, userId: string, create: boolean): Promise<void>;
 /**
  * Options for {@link createOwnerKeyring} (#846b). The `SecretPolicy` knobs are
@@ -193,6 +243,33 @@ export interface CreateOwnerKeyringOptions extends SecretPolicy {
  * `NoydbOptions.validateSecret`. Direct callers (CLI, scripts,
  * test fixtures) opt in explicitly.
  */
+/**
+ * Create the owner keyring, yielding to whoever won a concurrent create
+ * (family#164).
+ *
+ * ⛔ TWO CONCURRENT FIRST OPENS LEFT ONE CALLER WITH A RAW `ConflictError`.
+ * {@link writeKeyringFile} CASes a create at `expectedVersion: 0` (core#134),
+ * so the second create is correctly REFUSED — but nothing caught the refusal,
+ * and `Version conflict: expected 0, found 1` reached the caller out of
+ * `openVault`. A caller who does not retry reads that as a vault it cannot
+ * open; a caller who does retry succeeds, which is what made this a latent race
+ * rather than a visible one.
+ *
+ * ⭐ The loser is a READER, not a failure. A keyring now exists for this
+ * principal, written from the same secret, so loading it is both correct and
+ * what the caller asked for. Retried ONCE: a second conflict would mean a third
+ * writer, and looping against a shared store is how a race becomes a hang.
+ *
+ * ⚠️ RESIDUAL, measured rather than assumed. On a store whose
+ * `capabilities.casAtomic` is false the CAS is advisory, so two creates could in
+ * principle both land and the second clobber the first — which WOULD be
+ * permanent unopenability, because the first session's collection DEKs are
+ * wrapped under a KEK nobody holds. I could not reproduce it: the
+ * 600K-iteration KEK derivation dominates any store's read-then-write window by
+ * orders of magnitude, so the two writes serialise in practice. Recorded
+ * because "could not reproduce" is not "cannot happen".
+ */
+export declare function createOwnerKeyringOrLoad(store: NoydbStore, vault: string, options: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
 export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;

package/dist/with-party/team/managed-secret.d.ts

@@ -78,14 +78,51 @@ export interface NoydbSealer {
      * parses this; it's purely audit metadata.
      */
     readonly id: string;
-    /** Seal raw secret bytes. Output bytes are opaque to hub. */
-    seal(secret: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Seal raw secret bytes. Output bytes are opaque to hub.
+     *
+     * `ctx` is ADDITIVE and OPTIONAL (family#157): hub passes it where the bytes
+     * belong to one vault, so a provider can scope its key material — a KMS
+     * encryption context, a per-vault keychain account, a key-id suffix. An
+     * existing provider that ignores the second argument keeps working unchanged.
+     *
+     * ⛔ A provider MUST stay functional when `ctx` is ABSENT, and must not treat
+     * absence as an error. Hub omits it deliberately where sealed bytes have to
+     * TRAVEL — see {@link SealContext}.
+     */
+    seal(secret: Uint8Array, ctx?: SealContext): Promise<Uint8Array>;
     /**
      * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or
      * any other failure — hub treats a thrown error as "this provider
      * cannot unlock this vault" and surfaces it to the caller.
+     *
+     * ⚠️ Hub passes the SAME `ctx` it sealed under at every paired call site, so a
+     * provider that binds key material to `ctx.vault` can unseal its own output.
+     * It is not passed where it was not available at seal time.
      */
-    unseal(sealed: Uint8Array): Promise<Uint8Array>;
+    unseal(sealed: Uint8Array, ctx?: SealContext): Promise<Uint8Array>;
+}
+/**
+ * What hub knows about the bytes it is asking a {@link NoydbSealer} to seal
+ * (family#157). Deliberately one field — anything a provider needs beyond the
+ * vault name belongs in its own construction, not in a per-call argument.
+ *
+ * ⛔ **Hub does NOT pass this on every call, and the exception is load-bearing.**
+ * A pod's auto-unlock credentials (`with-pod/pod.ts`) are sealed WITHOUT a
+ * context, because a pod is a PORTABLE bundle: `ReadPodOptions` carries no
+ * vault, and the pod may be read into a differently-named vault or merely
+ * inspected with no vault at all. A provider that bound those bytes to a vault
+ * name would produce a credential only the originating vault could open, which
+ * defeats the entire point of the format.
+ *
+ * ⭐ So the rule for a provider author is the asymmetry itself: `ctx` present
+ * means "these bytes stay in this vault" and `ctx` absent means "these bytes
+ * are meant to travel". Scoping to `ctx.vault` when it IS given is safe for
+ * exactly that reason.
+ */
+export interface SealContext {
+    /** The vault whose secret is being sealed or unsealed. */
+    readonly vault: string;
 }
 /**
  * In-memory test provider. NOT secure — uses a deterministic

package/dist/with-party/team/noydb-facade.d.ts

@@ -397,7 +397,7 @@ export declare class TeamFacade {
      * recovery / TOTP / email-OTP factor proof at the moment of
      * recovery, so the issuer affirmatively re-asserts identity.
      *
-     * The recipient should call `db.rotateSecret` on first session
+     * The recipient should call `db.team.rotateSecret` on first session
      * to choose their own phrase — the temp acts as a single-use
      * bridge.
      *
@@ -407,7 +407,7 @@ export declare class TeamFacade {
      *   secret: 'temporary-correct-horse-battery-staple-printer',
      * }, { factors: [{ kind: 'recovery' }] })
      * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-     * // and immediately calls db.rotateSecret to set his own.
+     * // and immediately calls db.team.rotateSecret to set his own.
      * ```
      *
      * @throws `NoAccessError` when no keyring exists for the target.

package/dist/with-party/team/peer-recover.d.ts

@@ -27,7 +27,7 @@
  *      their own phrase.
  *
  * Caller must be at least as privileged as the target. The hub
- * `db.recoverUser` method gates this with the `peer-recover-user`
+ * `db.team.recoverUser` method gates this with the `peer-recover-user`
  * policy gate (the `peer-recover-user` factor-proof requirement); the function below
  * enforces only the role + anti-privilege-escalation invariants.
  *
@@ -42,7 +42,7 @@ export interface RecoverUserOptions {
     readonly userId: string;
     /**
      * Temporary secret under which the new keyring is wrapped.
-     * The recipient should call `db.rotateSecret` immediately on
+     * The recipient should call `db.team.rotateSecret` immediately on
      * acceptance to choose their own phrase — this temp acts as a
      * single-use bridge in invite / peer-recovery flows.
      */