@noy-db/hub 0.10.0-pre.1 → 0.10.0-pre.2

package/CHANGELOG.md

@@ -1,5 +1,86 @@
 # Changelog — hub
 
+## 0.10.0-pre.2
+
+**The capsule seam closes, and four correctness fixes land on paths every vault takes.**
+
+User-visible behaviour changes, each of which can change what your code does:
+
+- **`saveAll` REPLACES.** A collection absent from the snapshot is gone afterwards, and an empty
+  record set empties its collection. Reserved `_`-prefixed collections are carried forward unless
+  the snapshot names them — a snapshot carrying `_keyring` replaces the live keyring without
+  passing through any keyring code path (family#147).
+- **An absent record is at version 0.** `put` with `expectedVersion: 0` is a sentinel-free "write
+  only if absent"; a NONZERO expectation against nothing now **throws `ConflictError`** instead of
+  upserting (family#147, core#134).
+- **A push whose CAS is refused against an empty remote now CREATES**, rather than leaving the
+  entry dirty forever and conflicting on every subsequent push (family#147).
+- **A capsule that lacks a group is refused at startup**, in three places: `createNoydb()` for an
+  enabled service, `vault.collection()` for a declared field form, and the keyring entries for the
+  `authenticate`/`seal` posture groups — before any keyring is read or written (family#156).
+- **An export secret must be at least 12 characters**, with no opt-out, and so must every string
+  `recipients[].secret`. Any characters qualify — a passphrase, a generated token, a
+  password-manager string. This is deliberately NOT the owner phrase rule: a `.noydb` bundle is
+  built to travel (family#177).
+- **`attachSyncTarget` refuses a peer this device has diverged from.** A device that opened the
+  vault before attaching its peer self-provisioned a keyring and then diverged silently; the attach
+  now throws, naming both supported paths (family#178).
+- **`EnclaveNotSupportedError` is deprecated.** `CapsuleNotSupportedError` is canonical and the
+  conformance kit accepts both codes, so an existing fork keeps passing (family#168).
+- **A computed `dateField` no longer dodges a closed period.** The `beforePut` gate judged the record
+  *before* computed fields applied, and an absent date reads as outside every period — so the
+  closed-period guard never fired. Two bypasses are closed: a create, and **back-dating an update**
+  into a sealed period (family#202).
+- **`transitionGuard`'s `initial` no longer rejects pulled records.** It constrains local creates
+  only; the arc check on updates still runs on every origin (family#188).
+- **A guard no longer sees a change on every pulled record with a `money()` field** — it compared
+  `"100000"` against `"1000.00"` for the same value, so an issued (WORM) record never synced
+  (family#187).
+- **An unchanged re-put of a nested money field is accepted.** `put(id, await get(id, { locale }))`
+  was refused outright on an issued record, because the read's `<path>Formatted`/`<path>Number`
+  virtuals survived ingest and the frozen-field compare saw them as a change. Those virtuals are
+  also no longer **persisted** — raw storage stays clean across a round-trip (family#201).
+- **`first-writer-wins` gives a version tie to the remote.** On a tie the local copy won, which is
+  the second writer, overwriting the first on the remote (family#209).
+- **A changed materialized-view definition is detected on reopen.** The stored `queryHash` was
+  written and never compared, so a view kept serving rows built under the old definition until an
+  unrelated source write refreshed it. ⚠️ A changed `rowKey` is **not** covered — it is not part of
+  the hash (family#204, and family#211 for `rowKey`).
+- **A schema-manifest write and its ledger append are one unit.** The append re-read the record and
+  hashed whatever it found, recording that hash against *our* version, so a concurrent sync could
+  make a restore report `BACKUP_CORRUPTED` on untampered data (family#197). ⚠️ Cross-process
+  ordering of the two appends remains open (family#212).
+- **A declaration-only option on a reconcile `vault.collection()` is no longer dropped in silence.**
+  `archive` now attaches; `schemaUpdate` is refused with a message naming the option and the way out.
+  ⚠️ `schema` on a reconcile is **still** dropped — it needs a late-attach door (family#194, and
+  family#208 for `schema`).
+
+**Known limitations in this release, stated because you will meet them before the fixes:**
+
+- ⛔ **`vault.sequence()` is unique per DEVICE, not across devices.** Counters are CASed against the
+  local store and `_sequences` never syncs, so two devices issue the same numbers. Measured: A
+  `next()` → 1, A pushes, B pulls the whole vault, B `next()` → 1. Do not use it for a fleet-unique
+  invoice number until family#206 lands — it is the first item of the next cycle.
+- ⚠️ **`schema` passed to a second `vault.collection(name, { schema })` call has no effect** and is
+  not yet refused, because a materialized view opens its source collection first and makes the
+  consumer's own declaration the reconcile call (family#208).
+- ⚠️ **A changed materialized-view `rowKey` is not detected** — old-key rows survive beside new ones
+  until a full refresh (family#211).
+- **`rotateKeys` CASes each record it rewrites.** A concurrent write during a rotation was silently
+  lost, and the stored version regressed with it (family#163).
+- **Two concurrent first opens both succeed.** The loser of the keyring-create race now loads
+  rather than surfacing a raw `ConflictError` (family#164).
+- **The `.join()` dangling-ref warning no longer logs a decrypted value**, and its dedup set no
+  longer retains one for the process lifetime (family#167).
+- **One central segment check** around the mounted store: a vault or collection that is not a single
+  segment, and an id with an empty, `.` or `..` component, are refused before any store sees them.
+  A `/` and a NUL in an id stay legal — hub emits both (family#133, family#174).
+- **`vault.export()` records an audit entry**, appended after the decrypt and before `encode`, and
+  `exportAccessibleData` records the access it made before building (family#151, family#175).
+- Additive: `ExportChunk` carries `ids` always and `envelopeMeta` on request; `PRIMITIVE_GROUPS`,
+  `GROUPS_WITHOUT_PRIMITIVES` and `VDIG_ITERATIONS` publish on `@noy-db/hub/capsule`; a sealer takes
+  an optional vault context (family#151, family#166, family#168, family#157).
+
 ## 0.10.0-pre.1
 
 **The first-entry pre-release.** Hub source since `0.10.0-pre.0`: two exports nothing could import are

package/dist/api-QSEKT4KS.js

@@ -0,0 +1,15 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-ANYX2M6P.js";
+import "./chunk-ZQQLOEWN.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-QSEKT4KS.js.map

package/dist/as/index.js

@@ -1,5 +1,5 @@
 import "../chunk-2DX4JCRI.js";
-import "../chunk-654RE5YC.js";
+import "../chunk-HDAPQF6Q.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
@@ -9,19 +9,16 @@ import {
 import "../chunk-RXLYKVTF.js";
 import "../chunk-QJNAHPVT.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-UORWAG7K.js";
+import "../chunk-FY4FFNKK.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-IF2M43G4.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-OJAFKGI7.js";
-import "../chunk-6B4X447I.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-YIVAKBCW.js";
-import "../chunk-6Y3UJT5H.js";
-import "../chunk-VUBRHJ4H.js";
+import "../chunk-PBRD75JF.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   ValidationError
-} from "../chunk-JGYCKX56.js";
+} from "../chunk-ISIXU45J.js";
 
 // src/port/as/active.ts
 function redactChunk(chunk, ctx, redact) {
@@ -82,7 +79,7 @@ function contextFor(vault) {
     // export fails instead.
     describe: (collection) => vault.collection(collection).describe(),
     plan: async (records, policy, formatId, idKey) => {
-      const { diffVault } = await import("../vault-diff-C6WUJFNP.js");
+      const { diffVault } = await import("../vault-diff-H7LT5ZBJ.js");
       const plan = await diffVault(vault, records, idKey ? { idKey } : {});
       return {
         plan,
@@ -122,6 +119,16 @@ function withFormats() {
       for await (const chunk of ctx.chunks(options.collections)) {
         chunks.push(redactChunk(chunk, ctx, options.redact));
       }
+      const { keyring } = vault._introspectState();
+      await vault._getLedgerOrNull()?.append({
+        op: "lifecycle",
+        collection: "",
+        id: "",
+        version: 0,
+        actor: keyring.userId,
+        payloadHash: "",
+        reason: `${format.tier ?? "plaintext"}-export:${format.id}`
+      });
       return format.encode(chunks);
     },
     async importWith(vault, format, input, options = {}) {

package/dist/as/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⭐ PASSED DOWN, not filtered here (core#45b). `ExportStreamOptions` now\n    // carries `collections` and narrows the read, so an excluded collection is\n    // neither fetched nor decrypted.\n    //\n    // ⚠️ The history is worth keeping, because the obvious edit here is the\n    // wrong one twice over. The option was first passed to `exportStream`\n    // when that interface had no field for it — silently dropped, every\n    // collection read, caught only by an as-json test expecting ['invoices']\n    // and getting ['invoices','payments']. The fix then was to filter after\n    // the read, which was correct output and a full decrypt: for a\n    // zero-knowledge store, a caller scoping an export to limit exposure got\n    // no limit at all. Neither the compiler nor any chunk-level assertion can\n    // tell these three implementations apart — only a store observation can\n    // (`__tests__/45-export-scope-narrows-read.test.ts`).\n    chunks: async function* (collections) {\n      yield* vault.exportStream({\n        granularity: 'collection',\n        ...(collections ? { collections } : {}),\n      })\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n *\n * ⭐ `collections` scopes the READ: an excluded collection is neither fetched\n * nor decrypted (core#45b, since 0.8 — through 0.7 it filtered output after a\n * full decrypt).\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeA,QAAQ,iBAAiB,aAAa;AACpC,aAAO,MAAM,aAAa;AAAA,QACxB,aAAa;AAAA,QACb,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACvC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAcO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⭐ PASSED DOWN, not filtered here (core#45b). `ExportStreamOptions` now\n    // carries `collections` and narrows the read, so an excluded collection is\n    // neither fetched nor decrypted.\n    //\n    // ⚠️ The history is worth keeping, because the obvious edit here is the\n    // wrong one twice over. The option was first passed to `exportStream`\n    // when that interface had no field for it — silently dropped, every\n    // collection read, caught only by an as-json test expecting ['invoices']\n    // and getting ['invoices','payments']. The fix then was to filter after\n    // the read, which was correct output and a full decrypt: for a\n    // zero-knowledge store, a caller scoping an export to limit exposure got\n    // no limit at all. Neither the compiler nor any chunk-level assertion can\n    // tell these three implementations apart — only a store observation can\n    // (`__tests__/45-export-scope-narrows-read.test.ts`).\n    chunks: async function* (collections) {\n      yield* vault.exportStream({\n        granularity: 'collection',\n        ...(collections ? { collections } : {}),\n      })\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n *\n * ⭐ `collections` scopes the READ: an excluded collection is neither fetched\n * nor decrypted (core#45b, since 0.8 — through 0.7 it filtered output after a\n * full decrypt).\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n\n      // family#151 — THE AUDIT ENTRY BELONGS HERE, not in each `as-*` package.\n      // Every format goes through this one method, so a per-package write is a\n      // duty each author can forget silently: a vault's ledger would then record\n      // some plaintext exports and not others, which is worse than recording\n      // none, because the gap is invisible.\n      //\n      // ⚠️ APPENDED AFTER THE DECRYPT AND BEFORE `encode`, deliberately. The\n      // chunks above are plaintext; that is the disclosure the entry exists to\n      // record, and a format whose `encode` throws has not un-disclosed it. The\n      // nearest analogue, `exportAccessibleData`, appends after its bytes are\n      // built and would under-record the same way — reported, not changed here.\n      //\n      // ⛔ `_getLedgerOrNull()`, so this is a NO-OP without a history strategy.\n      // Minting a `_ledger` DEK as a side effect of an export would create the\n      // audit trail the caller never opted into, on their first export.\n      //\n      // The reason carries the TIER as well as the format id: `plaintext-` is\n      // the privacy-relevant one, and `assertCanExport` above already treats\n      // the two as different grants.\n      const { keyring } = vault._introspectState()\n      await vault._getLedgerOrNull()?.append({\n        op: 'lifecycle',\n        collection: '',\n        id: '',\n        version: 0,\n        actor: keyring.userId,\n        payloadHash: '',\n        reason: `${format.tier ?? 'plaintext'}-export:${format.id}`,\n      })\n\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeA,QAAQ,iBAAiB,aAAa;AACpC,aAAO,MAAM,aAAa;AAAA,QACxB,aAAa;AAAA,QACb,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACvC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAcO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AAqBA,YAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,YAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,QACrC,IAAI;AAAA,QACJ,YAAY;AAAA,QACZ,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO,QAAQ;AAAA,QACf,aAAa;AAAA,QACb,QAAQ,GAAG,OAAO,QAAQ,WAAW,WAAW,OAAO,EAAE;AAAA,MAC3D,CAAC;AAED,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/at/index.js

@@ -3,15 +3,12 @@ import {
   MemorySealer,
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
-} from "../chunk-GU6QXHPZ.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-OJAFKGI7.js";
-import "../chunk-6B4X447I.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-YIVAKBCW.js";
-import "../chunk-6Y3UJT5H.js";
-import "../chunk-VUBRHJ4H.js";
-import "../chunk-JGYCKX56.js";
+} from "../chunk-OIBFIWVJ.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
+import "../chunk-ISIXU45J.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,

package/dist/attestation/index.js

@@ -1,19 +1,19 @@
 import {
   issueAttestationCore
-} from "../chunk-B5PWQMZN.js";
+} from "../chunk-HRLMUZLI.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-4ZRNXWF6.js";
-import "../chunk-B6EWMGFX.js";
+} from "../chunk-QZXUISRF.js";
+import "../chunk-NUBI6PYH.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-RRI3JBD6.js";
+} from "../chunk-XMARKBUC.js";
 import {
   NO_ATTESTATION
-} from "../chunk-ZMDSBTFT.js";
+} from "../chunk-ECDM6YRX.js";
 import {
   decodeQr,
   isRevoked,
@@ -22,27 +22,24 @@ import {
   verifyRevocationList
 } from "../chunk-GMKGGY7V.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-OJAFKGI7.js";
-import "../chunk-6B4X447I.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-YIVAKBCW.js";
-import "../chunk-6Y3UJT5H.js";
-import "../chunk-VUBRHJ4H.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-JGYCKX56.js";
+} from "../chunk-ISIXU45J.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-NPLQHB3S.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-EIHEDAXM.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-CP6XZLE3.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-5P7IZC2K.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -52,19 +49,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-2NYMID63.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-IF5PX2JY.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-2NYMID63.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-IF5PX2JY.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-2NYMID63.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-IF5PX2JY.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-2NYMID63.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-IF5PX2JY.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/attestation/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/verifier.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * The pure verifier surface, re-exported through hub-owned signatures.\n *\n * `export { … } from '@noy-db/attestation'` would compile fine and bundle\n * fine — but tsc emits that specifier verbatim into hub's `.d.ts`, so a\n * consumer would need `@noy-db/attestation` installed just to TYPECHECK\n * against a package that bundles it. Binding each value to a locally-typed\n * `const` makes the declaration name only `./types.js`.\n * `__tests__/no-runtime-dependencies.test.ts` asserts the emitted `dist`\n * never names the package, and pins these types assignable to attestation's.\n */\nimport {\n  verifyAttestation as _verifyAttestation,\n  decodeQr as _decodeQr,\n  verifyRevocationList as _verifyRevocationList,\n  isRevoked as _isRevoked,\n  signRevocationList as _signRevocationList,\n} from '@noy-db/attestation'\nimport type {\n  QrPayload,\n  RevocationList,\n  SignatureScheme,\n  VerifyInput,\n  VerifyResult,\n} from './types.js'\n\nexport const verifyAttestation: (\n  input: VerifyInput,\n  scheme?: SignatureScheme,\n) => Promise<VerifyResult> = _verifyAttestation\n\nexport const decodeQr: (s: string) => QrPayload = _decodeQr\n\nexport const verifyRevocationList: (\n  list: RevocationList,\n  publicKeyB64: string,\n  scheme?: SignatureScheme,\n) => Promise<boolean> = _verifyRevocationList\n\nexport const isRevoked: (docId: string, list: RevocationList) => boolean = _isRevoked\n\nexport const signRevocationList: (\n  revokedDocIds: readonly string[],\n  asOf: string,\n  keyId: string,\n  privateKeyPkcs8B64: string,\n  scheme?: SignatureScheme,\n) => Promise<RevocationList> = _signRevocationList\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;ACtBO,IAAMC,qBAGgB;AAEtB,IAAMC,YAAqC;AAE3C,IAAMC,wBAIW;AAEjB,IAAMC,aAA8D;AAEpE,IAAMC,sBAMkB;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore","verifyAttestation","decodeQr","verifyRevocationList","isRevoked","signRevocationList"]}
+{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/verifier.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * The pure verifier surface, re-exported through hub-owned signatures.\n *\n * `export { … } from '@noy-db/attestation'` would compile fine and bundle\n * fine — but tsc emits that specifier verbatim into hub's `.d.ts`, so a\n * consumer would need `@noy-db/attestation` installed just to TYPECHECK\n * against a package that bundles it. Binding each value to a locally-typed\n * `const` makes the declaration name only `./types.js`.\n * `__tests__/no-runtime-dependencies.test.ts` asserts the emitted `dist`\n * never names the package, and pins these types assignable to attestation's.\n */\nimport {\n  verifyAttestation as _verifyAttestation,\n  decodeQr as _decodeQr,\n  verifyRevocationList as _verifyRevocationList,\n  isRevoked as _isRevoked,\n  signRevocationList as _signRevocationList,\n} from '@noy-db/attestation'\nimport type {\n  QrPayload,\n  RevocationList,\n  SignatureScheme,\n  VerifyInput,\n  VerifyResult,\n} from './types.js'\n\nexport const verifyAttestation: (\n  input: VerifyInput,\n  scheme?: SignatureScheme,\n) => Promise<VerifyResult> = _verifyAttestation\n\nexport const decodeQr: (s: string) => QrPayload = _decodeQr\n\nexport const verifyRevocationList: (\n  list: RevocationList,\n  publicKeyB64: string,\n  scheme?: SignatureScheme,\n) => Promise<boolean> = _verifyRevocationList\n\nexport const isRevoked: (docId: string, list: RevocationList) => boolean = _isRevoked\n\nexport const signRevocationList: (\n  revokedDocIds: readonly string[],\n  asOf: string,\n  keyId: string,\n  privateKeyPkcs8B64: string,\n  scheme?: SignatureScheme,\n) => Promise<RevocationList> = _signRevocationList\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;ACtBO,IAAMC,qBAGgB;AAEtB,IAAMC,YAAqC;AAE3C,IAAMC,wBAIW;AAEjB,IAAMC,aAA8D;AAEpE,IAAMC,sBAMkB;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore","verifyAttestation","decodeQr","verifyRevocationList","isRevoked","signRevocationList"]}

package/dist/{backup-6EKBNC67.js → backup-BHKVK5SD.js}

@@ -3,36 +3,33 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-IF2M43G4.js";
+} from "./chunk-PBRD75JF.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-B24ODIKE.js";
+} from "./chunk-JRCO67NG.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-VPG2UJYR.js";
+} from "./chunk-7KNYLHVX.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   buildRecordEnvelope
-} from "./chunk-WRLWEYHY.js";
-import "./chunk-OJAFKGI7.js";
-import "./chunk-6B4X447I.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-YIVAKBCW.js";
-import "./chunk-6Y3UJT5H.js";
+} from "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-VUBRHJ4H.js";
+} from "./chunk-CR5UPYIJ.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-pod/backup.ts
 function internalCollectionNames(dataCollections) {
@@ -327,4 +324,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-6EKBNC67.js.map
+//# sourceMappingURL=backup-BHKVK5SD.js.map

package/dist/{backup-6EKBNC67.js.map → backup-BHKVK5SD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport { MANIFEST_COLLECTION } from '../with-shape/manifest/reserved-collections.js'\n// #1025 — imported from the dependency-light `window.ts`, not `periods.ts`: that\n// module exists precisely so a consumer can name the period collections without\n// dragging the ledger hash-chain machinery (`sha256Hex`/`canonicalJson`) into a\n// bundle that opted out of the periods service. Same reason the sync engine's\n// period-scoped pull imports it.\nimport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  PERIOD_REOPENS_COLLECTION,\n} from '../with-audit/periods/window.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  LoadPodOptions,\n  LoadPodResult,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { buildRecordEnvelope } from '../capsule/index.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /**\n   * core#71 — reset every sync engine attached to the vault after a restore:\n   * the dirty log, the watermarks, the adopted epoch. A restore is a new base;\n   * the pre-restore dirty entries refer to records the load just replaced.\n   * Absent on test constructions without sync.\n   */\n  resetSync?(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\n/**\n * core#111 — the internal collections a pod carries, derived from its DATA\n * collection names. ⭐ ONE definition, used by the dump AND by the load's\n * clear step: they must agree or a restore leaves rows behind that the pod\n * says should not exist.\n *\n * ⛔ The load side CANNOT just clear what the pod carries. The dump skips a\n * collection with no rows (`if (ids.length === 0) continue`), so a pod taken\n * while `_periods` was empty does not mention `_periods` at all — and a store\n * that has since closed a period would keep those rows through a restore.\n * Absence in a pod means \"empty at dump time\", never \"leave whatever is there\".\n */\nfunction internalCollectionNames(dataCollections: readonly string[]): string[] {\n  return [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    MANIFEST_COLLECTION, // #941: the pod's manifest-set record(s) travel in the bundle too\n    // #1025: the accounting-period close state + its companions. The bundle is\n    // the backup/restore path, so without these a restore discarded the\n    // hash-chained evidence that a month was ever closed — the artifact\n    // `closePeriod` exists to produce — and dropped the write gate with it, so\n    // the restored vault silently accepted back-dated writes into a sealed\n    // month. The companions matter as much as the close: a bounded reopen\n    // window (`reopenPeriod({ until })`) is state a restore must not lose.\n    PERIODS_COLLECTION,\n    PERIOD_REOPENS_COLLECTION,\n    PERIOD_FREEZES_COLLECTION,\n    PERIOD_ARCHIVES_COLLECTION,\n    PERIOD_TARGET_PURGES_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    // #753 spec §7 Q3: `_blob_intent` markers travel too — restoring mid-op\n    // state (a blob row without its marker) would reproduce the ambiguity\n    // the journal exists to prevent. Note: `_mv_stale` does NOT travel\n    // today (a pre-existing, separate gap) — observed here, tracked on\n    // #761, not fixed in this pass.\n    '_blob_intent',\n    // #769: `_blob_slots_<c>` envelopes travel verbatim (raw ciphertext,\n    // same DEK, same vault) — including any `SlotRecord.pendingRelease`\n    // resume breadcrumb they carry. This is INTENTIONALLY the opposite of\n    // `extract-partition`'s `reKeyBlobs`, which STRIPS `pendingRelease`:\n    // a full-vault backup restores into the SAME vault it was taken from,\n    // so a breadcrumb taken mid-rehome (together with its `_blob_intent`\n    // marker, carried above) is resumable on restore — carry-and-resume is\n    // correct here. A partition extraction crosses vaults: the breadcrumb's\n    // old eTag may not exist in the destination, so it must be stripped\n    // there instead. Asymmetry: backup = same-vault-resumable = carry;\n    // partition = cross-vault = strip-breadcrumb-carry-marker.\n    ...dataCollections.flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n}\n\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data ?? '')\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = internalCollectionNames(Object.keys(snapshot))\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\n/**\n * core#77 — reconcile ONE collection against the pod's rows: write what\n * differs, delete what the pod does not carry, leave the rest untouched.\n *\n * Identity is `(id, _v)`, not a content hash — chunk rows are not\n * content-addressed today. That is enough to avoid rewriting 10 GB that has\n * not changed; it is NOT enough to dedupe across records, and nothing here\n * claims otherwise.\n *\n * ⛔ The DELETE half is what keeps this a restore rather than a merge: an id\n * the store holds and the pod does not is removed, exactly as `saveAll`\n * removes it in replace mode (core#111 — a restore rewinds).\n */\nasync function reconcileCollection(\n  ctx: BackupContext,\n  collection: string,\n  podRows: Record<string, EncryptedEnvelope>,\n): Promise<{ written: number; skipped: number; deleted: number }> {\n  let written = 0, skipped = 0, deleted = 0\n  for (const [id, envelope] of Object.entries(podRows)) {\n    const local = await ctx.adapter.get(ctx.vault, collection, id)\n    if (local && local._v === envelope._v) { skipped++; continue }\n    await ctx.adapter.put(ctx.vault, collection, id, envelope)\n    written++\n  }\n  for (const id of await ctx.adapter.list(ctx.vault, collection)) {\n    if (id in podRows) continue\n    await ctx.adapter.delete(ctx.vault, collection, id)\n    deleted++\n  }\n  return { written, skipped, deleted }\n}\n\n/** Fold the per-collection counters into the returned report. */\nfunction podReport(mode: 'replace' | 'incremental', per: Record<string, { written: number; skipped: number; deleted: number }>): LoadPodResult {\n  let written = 0, skipped = 0, deleted = 0\n  for (const r of Object.values(per)) { written += r.written; skipped += r.skipped; deleted += r.deleted }\n  return { mode, written, skipped, deleted, collections: per }\n}\n\nexport async function loadVault(\n  ctx: BackupContext,\n  backupJson: string,\n  options?: LoadPodOptions,\n): Promise<LoadPodResult> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n  const mode = options?.mode ?? 'replace'\n  const per: Record<string, { written: number; skipped: number; deleted: number }> = {}\n\n  // core#77 — a pod from ANOTHER vault is refused in incremental mode. In\n  // replace mode `saveAll` overwrites wholesale and the result is at least\n  // coherent; \"write only the differences\" between unrelated vaults is not a\n  // restore, it is a silent union of two histories, and the keyrings that\n  // arrive with it would not open what is already here.\n  if (mode === 'incremental' && backup._compartment !== ctx.vault) {\n    throw new BackupLedgerError(\n      `Incremental load refused: this pod was taken from vault \"${backup._compartment}\" ` +\n      `and is being loaded into \"${ctx.vault}\". Incremental mode reconciles a vault against ` +\n      `its OWN pod; use mode: 'replace' to overwrite this vault with a foreign pod.`,\n    )\n  }\n\n  // 1. Restore data collections.\n  if (mode === 'incremental') {\n    const localData = await ctx.adapter.loadAll(ctx.vault)\n    const names = new Set([...Object.keys(backup.collections), ...Object.keys(localData)])\n    for (const name of names) {\n      const r = await reconcileCollection(ctx, name, backup.collections[name] ?? {})\n      if (r.written || r.skipped || r.deleted) per[name] = r\n    }\n  } else {\n    await ctx.adapter.saveAll(ctx.vault, backup.collections)\n  }\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    // ⛔ core#132 — NO CAS HERE, deliberately. A pod restore is state\n    // REPLACEMENT (core#111 made the internal collections wholesale too): the\n    // pod is authoritative and there is no \"version this was based on\" to\n    // compare against. CASing a restore would make it fail precisely when the\n    // store has drifted, which is the case it exists to fix.\n    const envelope = buildRecordEnvelope({ collection: '_keyring', id: userId, version: 1 },\n      { iv: '', data: JSON.stringify(keyringFile) })\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`, history,\n  //    periods, blobs). Required so verifyBackupIntegrity has the chain to walk.\n  //\n  // ⛔⛔ CLEAR FIRST (core#111). This used to `put` the pod's rows id by id and\n  // leave everything else, so entries written AFTER the pod survived the\n  // restore. With history on that is not a cosmetic leftover: the ledger chain\n  // still named `notes/n2`, whose envelope `saveAll` had just removed, and the\n  // integrity check refused the restore outright —\n  //   BackupCorruptedError: Ledger expects data record \"notes/n2\" to exist …\n  // which made restoring an OLDER pod possible only onto a store whose ledger\n  // had not moved. That is never the case that matters: a restore is a step\n  // BACK (core#71/#72).\n  //\n  // ⭐ A restore rewinds the ledger too, and now says so. The internal\n  // collections are replaced wholesale, the way `saveAll` already treats the\n  // data ones — anything else asks the chain to describe a store it does not\n  // match. The names come from `internalCollectionNames`, NOT from the pod's\n  // own keys: see the ⛔ on that function for why absence in a pod cannot mean\n  // \"leave it alone\".\n  //\n  // ⚠️ Known residue, deliberately not chased here: `_blob_slots_<c>` /\n  // `_blob_versions_<c>` for a DATA collection the pod does not carry are not\n  // cleared, because the names are derived from the pod's collections and the\n  // store contract has no way to enumerate `_`-prefixed collections\n  // (`loadAll` skips them). Those rows are already orphaned — `saveAll` has\n  // just removed the collection they describe — so they are unreachable\n  // rather than misleading.\n  //\n  // core#77 — in INCREMENTAL mode the same names are reconciled instead of\n  // cleared and rewritten. ⭐ This is the half that matters for the 10 GB\n  // case: `_blob_chunks` is an internal collection, so a clear-and-rewrite\n  // here would re-upload every chunk and leave \"incremental\" saving only the\n  // record envelopes. Reconciling reaches the SAME end state — extras are\n  // still deleted, so the restore still rewinds — at a cost proportional to\n  // what actually differs.\n  const internalNamesToLoad = internalCollectionNames(Object.keys(backup.collections))\n  if (mode === 'incremental') {\n    for (const internalName of internalNamesToLoad) {\n      const r = await reconcileCollection(ctx, internalName, backup._internal?.[internalName] ?? {})\n      if (r.written || r.skipped || r.deleted) per[internalName] = r\n    }\n  } else {\n    for (const internalName of internalNamesToLoad) {\n      for (const id of await ctx.adapter.list(ctx.vault, internalName)) {\n        await ctx.adapter.delete(ctx.vault, internalName, id)\n      }\n    }\n    if (backup._internal) {\n      for (const [internalName, records] of Object.entries(backup._internal)) {\n        for (const [id, envelope] of Object.entries(records)) {\n          await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n        }\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 6. core#71 — a restore is a new base for sync: the pre-restore dirty log\n  //    named records the load replaced, and the watermarks described a state\n  //    that is gone. `replaceRemote` (core#72) is the explicit act that makes\n  //    the restore authoritative on the target; without it, `load()` stays a\n  //    local view — and now says so in `syncTargetStatus()` instead of pushing\n  //    stale entries.\n  await ctx.resetSync?.()\n\n  // 5. Run the verification gate. A backup with no ledgerHead cannot be\n  //    integrity-checked, and skipping silently would collapse\n  //    *unverifiable* into *clean* — so it always warns. But the REMEDY\n  //    depends on the reader, not the pod (#1303): the pod cannot say\n  //    whether its exporter predates the ledger or never enabled it, and\n  //    the reader knows its own configuration.\n  //\n  //    - Reader HAS the ledger: the pod is behind it. \"Re-export\" is\n  //      actionable; keep the migration wording.\n  //    - Reader has NO ledger: nothing is stale and nothing is migrating —\n  //      the consumer priced the ledger (#1248 measured ~2.4x) and declined.\n  //      Prescribing a re-export is advice they should not take, and\n  //      repeating it on every read trains people to filter the one line\n  //      that also fires on a genuinely stale pod. State the consequence,\n  //      name the discriminator, prescribe nothing.\n  if (!backup.ledgerHead) {\n    if (ctx.getLedgerOrNull()) {\n      console.warn(\n        `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n        `verifiable-backup integrity check skipped. ` +\n        `Re-export with a ledger-aware build to get tamper detection.`,\n      )\n    } else {\n      console.warn(\n        `[noy-db] Loaded a backup with no ledgerHead — this pod is not integrity-checked. ` +\n        `This reader has no ledger enabled (withHistory() is not configured), so nothing is stale: ` +\n        `enable the ledger on both the exporter and this reader if tamper detection is wanted.`,\n      )\n    }\n    return podReport(mode, per)\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n  return podReport(mode, per)\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoHA,SAAS,wBAAwB,iBAA8C;AAC7E,SAAO;AAAA,IACL;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,GAAG,gBAAgB,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EAC/E;AACF;AAEA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,SAAS,EAAE;AAAA,IACvD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB,wBAAwB,OAAO,KAAK,QAAQ,CAAC;AACnE,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAqBA,eAAe,oBACb,KACA,YACA,SACgE;AAChE,MAAI,UAAU,GAAG,UAAU,GAAG,UAAU;AACxC,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,UAAM,QAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC7D,QAAI,SAAS,MAAM,OAAO,SAAS,IAAI;AAAE;AAAW;AAAA,IAAS;AAC7D,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,IAAI,QAAQ;AACzD;AAAA,EACF;AACA,aAAW,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU,GAAG;AAC9D,QAAI,MAAM,QAAS;AACnB,UAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,YAAY,EAAE;AAClD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,SAAS,QAAQ;AACrC;AAGA,SAAS,UAAU,MAAiC,KAA2F;AAC7I,MAAI,UAAU,GAAG,UAAU,GAAG,UAAU;AACxC,aAAW,KAAK,OAAO,OAAO,GAAG,GAAG;AAAE,eAAW,EAAE;AAAS,eAAW,EAAE;AAAS,eAAW,EAAE;AAAA,EAAQ;AACvG,SAAO,EAAE,MAAM,SAAS,SAAS,SAAS,aAAa,IAAI;AAC7D;AAEA,eAAsB,UACpB,KACA,YACA,SACwB;AACxB,QAAM,SAAS,KAAK,MAAM,UAAU;AACpC,QAAM,OAAO,SAAS,QAAQ;AAC9B,QAAM,MAA6E,CAAC;AAOpF,MAAI,SAAS,iBAAiB,OAAO,iBAAiB,IAAI,OAAO;AAC/D,UAAM,IAAI;AAAA,MACR,4DAA4D,OAAO,YAAY,+BAClD,IAAI,KAAK;AAAA,IAExC;AAAA,EACF;AAGA,MAAI,SAAS,eAAe;AAC1B,UAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AACrD,UAAM,QAAQ,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,OAAO,WAAW,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC;AACrF,eAAW,QAAQ,OAAO;AACxB,YAAM,IAAI,MAAM,oBAAoB,KAAK,MAAM,OAAO,YAAY,IAAI,KAAK,CAAC,CAAC;AAC7E,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAS,KAAI,IAAI,IAAI;AAAA,IACvD;AAAA,EACF,OAAO;AACL,UAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAAA,EACzD;AAGA,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AAMnE,UAAM,WAAW;AAAA,MAAoB,EAAE,YAAY,YAAY,IAAI,QAAQ,SAAS,EAAE;AAAA,MACpF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,WAAW,EAAE;AAAA,IAAC;AAC/C,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAqCA,QAAM,sBAAsB,wBAAwB,OAAO,KAAK,OAAO,WAAW,CAAC;AACnF,MAAI,SAAS,eAAe;AAC1B,eAAW,gBAAgB,qBAAqB;AAC9C,YAAM,IAAI,MAAM,oBAAoB,KAAK,cAAc,OAAO,YAAY,YAAY,KAAK,CAAC,CAAC;AAC7F,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAS,KAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,EACF,OAAO;AACL,eAAW,gBAAgB,qBAAqB;AAC9C,iBAAW,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY,GAAG;AAChE,cAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,cAAc,EAAE;AAAA,MACtD;AAAA,IACF;AACA,QAAI,OAAO,WAAW;AACpB,iBAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,mBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,gBAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAQrB,QAAM,IAAI,YAAY;AAiBtB,MAAI,CAAC,OAAO,YAAY;AACtB,QAAI,IAAI,gBAAgB,GAAG;AACzB,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF;AACA,WAAO,UAAU,MAAM,GAAG;AAAA,EAC5B;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACA,SAAO,UAAU,MAAM,GAAG;AAC5B;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport { MANIFEST_COLLECTION } from '../with-shape/manifest/reserved-collections.js'\n// #1025 — imported from the dependency-light `window.ts`, not `periods.ts`: that\n// module exists precisely so a consumer can name the period collections without\n// dragging the ledger hash-chain machinery (`sha256Hex`/`canonicalJson`) into a\n// bundle that opted out of the periods service. Same reason the sync engine's\n// period-scoped pull imports it.\nimport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  PERIOD_REOPENS_COLLECTION,\n} from '../with-audit/periods/window.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  LoadPodOptions,\n  LoadPodResult,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { buildRecordEnvelope } from '../capsule/index.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /**\n   * core#71 — reset every sync engine attached to the vault after a restore:\n   * the dirty log, the watermarks, the adopted epoch. A restore is a new base;\n   * the pre-restore dirty entries refer to records the load just replaced.\n   * Absent on test constructions without sync.\n   */\n  resetSync?(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\n/**\n * core#111 — the internal collections a pod carries, derived from its DATA\n * collection names. ⭐ ONE definition, used by the dump AND by the load's\n * clear step: they must agree or a restore leaves rows behind that the pod\n * says should not exist.\n *\n * ⛔ The load side CANNOT just clear what the pod carries. The dump skips a\n * collection with no rows (`if (ids.length === 0) continue`), so a pod taken\n * while `_periods` was empty does not mention `_periods` at all — and a store\n * that has since closed a period would keep those rows through a restore.\n * Absence in a pod means \"empty at dump time\", never \"leave whatever is there\".\n */\nfunction internalCollectionNames(dataCollections: readonly string[]): string[] {\n  return [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    MANIFEST_COLLECTION, // #941: the pod's manifest-set record(s) travel in the bundle too\n    // #1025: the accounting-period close state + its companions. The bundle is\n    // the backup/restore path, so without these a restore discarded the\n    // hash-chained evidence that a month was ever closed — the artifact\n    // `closePeriod` exists to produce — and dropped the write gate with it, so\n    // the restored vault silently accepted back-dated writes into a sealed\n    // month. The companions matter as much as the close: a bounded reopen\n    // window (`reopenPeriod({ until })`) is state a restore must not lose.\n    PERIODS_COLLECTION,\n    PERIOD_REOPENS_COLLECTION,\n    PERIOD_FREEZES_COLLECTION,\n    PERIOD_ARCHIVES_COLLECTION,\n    PERIOD_TARGET_PURGES_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    // #753 spec §7 Q3: `_blob_intent` markers travel too — restoring mid-op\n    // state (a blob row without its marker) would reproduce the ambiguity\n    // the journal exists to prevent. Note: `_mv_stale` does NOT travel\n    // today (a pre-existing, separate gap) — observed here, tracked on\n    // #761, not fixed in this pass.\n    '_blob_intent',\n    // #769: `_blob_slots_<c>` envelopes travel verbatim (raw ciphertext,\n    // same DEK, same vault) — including any `SlotRecord.pendingRelease`\n    // resume breadcrumb they carry. This is INTENTIONALLY the opposite of\n    // `extract-partition`'s `reKeyBlobs`, which STRIPS `pendingRelease`:\n    // a full-vault backup restores into the SAME vault it was taken from,\n    // so a breadcrumb taken mid-rehome (together with its `_blob_intent`\n    // marker, carried above) is resumable on restore — carry-and-resume is\n    // correct here. A partition extraction crosses vaults: the breadcrumb's\n    // old eTag may not exist in the destination, so it must be stripped\n    // there instead. Asymmetry: backup = same-vault-resumable = carry;\n    // partition = cross-vault = strip-breadcrumb-carry-marker.\n    ...dataCollections.flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n}\n\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data ?? '')\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = internalCollectionNames(Object.keys(snapshot))\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\n/**\n * core#77 — reconcile ONE collection against the pod's rows: write what\n * differs, delete what the pod does not carry, leave the rest untouched.\n *\n * Identity is `(id, _v)`, not a content hash — chunk rows are not\n * content-addressed today. That is enough to avoid rewriting 10 GB that has\n * not changed; it is NOT enough to dedupe across records, and nothing here\n * claims otherwise.\n *\n * ⛔ The DELETE half is what keeps this a restore rather than a merge: an id\n * the store holds and the pod does not is removed, exactly as `saveAll`\n * removes it in replace mode (core#111 — a restore rewinds).\n */\nasync function reconcileCollection(\n  ctx: BackupContext,\n  collection: string,\n  podRows: Record<string, EncryptedEnvelope>,\n): Promise<{ written: number; skipped: number; deleted: number }> {\n  let written = 0, skipped = 0, deleted = 0\n  for (const [id, envelope] of Object.entries(podRows)) {\n    const local = await ctx.adapter.get(ctx.vault, collection, id)\n    if (local && local._v === envelope._v) { skipped++; continue }\n    await ctx.adapter.put(ctx.vault, collection, id, envelope)\n    written++\n  }\n  for (const id of await ctx.adapter.list(ctx.vault, collection)) {\n    if (id in podRows) continue\n    await ctx.adapter.delete(ctx.vault, collection, id)\n    deleted++\n  }\n  return { written, skipped, deleted }\n}\n\n/** Fold the per-collection counters into the returned report. */\nfunction podReport(mode: 'replace' | 'incremental', per: Record<string, { written: number; skipped: number; deleted: number }>): LoadPodResult {\n  let written = 0, skipped = 0, deleted = 0\n  for (const r of Object.values(per)) { written += r.written; skipped += r.skipped; deleted += r.deleted }\n  return { mode, written, skipped, deleted, collections: per }\n}\n\nexport async function loadVault(\n  ctx: BackupContext,\n  backupJson: string,\n  options?: LoadPodOptions,\n): Promise<LoadPodResult> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n  const mode = options?.mode ?? 'replace'\n  const per: Record<string, { written: number; skipped: number; deleted: number }> = {}\n\n  // core#77 — a pod from ANOTHER vault is refused in incremental mode. In\n  // replace mode `saveAll` overwrites wholesale and the result is at least\n  // coherent; \"write only the differences\" between unrelated vaults is not a\n  // restore, it is a silent union of two histories, and the keyrings that\n  // arrive with it would not open what is already here.\n  if (mode === 'incremental' && backup._compartment !== ctx.vault) {\n    throw new BackupLedgerError(\n      `Incremental load refused: this pod was taken from vault \"${backup._compartment}\" ` +\n      `and is being loaded into \"${ctx.vault}\". Incremental mode reconciles a vault against ` +\n      `its OWN pod; use mode: 'replace' to overwrite this vault with a foreign pod.`,\n    )\n  }\n\n  // 1. Restore data collections.\n  if (mode === 'incremental') {\n    const localData = await ctx.adapter.loadAll(ctx.vault)\n    const names = new Set([...Object.keys(backup.collections), ...Object.keys(localData)])\n    for (const name of names) {\n      const r = await reconcileCollection(ctx, name, backup.collections[name] ?? {})\n      if (r.written || r.skipped || r.deleted) per[name] = r\n    }\n  } else {\n    await ctx.adapter.saveAll(ctx.vault, backup.collections)\n  }\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    // ⛔ core#132 — NO CAS HERE, deliberately. A pod restore is state\n    // REPLACEMENT (core#111 made the internal collections wholesale too): the\n    // pod is authoritative and there is no \"version this was based on\" to\n    // compare against. CASing a restore would make it fail precisely when the\n    // store has drifted, which is the case it exists to fix.\n    const envelope = buildRecordEnvelope({ collection: '_keyring', id: userId, version: 1 },\n      { iv: '', data: JSON.stringify(keyringFile) })\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`, history,\n  //    periods, blobs). Required so verifyBackupIntegrity has the chain to walk.\n  //\n  // ⛔⛔ CLEAR FIRST (core#111). This used to `put` the pod's rows id by id and\n  // leave everything else, so entries written AFTER the pod survived the\n  // restore. With history on that is not a cosmetic leftover: the ledger chain\n  // still named `notes/n2`, whose envelope `saveAll` had just removed, and the\n  // integrity check refused the restore outright —\n  //   BackupCorruptedError: Ledger expects data record \"notes/n2\" to exist …\n  // which made restoring an OLDER pod possible only onto a store whose ledger\n  // had not moved. That is never the case that matters: a restore is a step\n  // BACK (core#71/#72).\n  //\n  // ⭐ A restore rewinds the ledger too, and now says so. The internal\n  // collections are replaced wholesale, the way `saveAll` already treats the\n  // data ones — anything else asks the chain to describe a store it does not\n  // match. The names come from `internalCollectionNames`, NOT from the pod's\n  // own keys: see the ⛔ on that function for why absence in a pod cannot mean\n  // \"leave it alone\".\n  //\n  // ⚠️ Known residue, deliberately not chased here: `_blob_slots_<c>` /\n  // `_blob_versions_<c>` for a DATA collection the pod does not carry are not\n  // cleared, because the names are derived from the pod's collections and the\n  // store contract has no way to enumerate `_`-prefixed collections\n  // (`loadAll` skips them). Those rows are already orphaned — `saveAll` has\n  // just removed the collection they describe — so they are unreachable\n  // rather than misleading.\n  //\n  // core#77 — in INCREMENTAL mode the same names are reconciled instead of\n  // cleared and rewritten. ⭐ This is the half that matters for the 10 GB\n  // case: `_blob_chunks` is an internal collection, so a clear-and-rewrite\n  // here would re-upload every chunk and leave \"incremental\" saving only the\n  // record envelopes. Reconciling reaches the SAME end state — extras are\n  // still deleted, so the restore still rewinds — at a cost proportional to\n  // what actually differs.\n  const internalNamesToLoad = internalCollectionNames(Object.keys(backup.collections))\n  if (mode === 'incremental') {\n    for (const internalName of internalNamesToLoad) {\n      const r = await reconcileCollection(ctx, internalName, backup._internal?.[internalName] ?? {})\n      if (r.written || r.skipped || r.deleted) per[internalName] = r\n    }\n  } else {\n    for (const internalName of internalNamesToLoad) {\n      for (const id of await ctx.adapter.list(ctx.vault, internalName)) {\n        await ctx.adapter.delete(ctx.vault, internalName, id)\n      }\n    }\n    if (backup._internal) {\n      for (const [internalName, records] of Object.entries(backup._internal)) {\n        for (const [id, envelope] of Object.entries(records)) {\n          await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n        }\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 6. core#71 — a restore is a new base for sync: the pre-restore dirty log\n  //    named records the load replaced, and the watermarks described a state\n  //    that is gone. `replaceRemote` (core#72) is the explicit act that makes\n  //    the restore authoritative on the target; without it, `load()` stays a\n  //    local view — and now says so in `syncTargetStatus()` instead of pushing\n  //    stale entries.\n  await ctx.resetSync?.()\n\n  // 5. Run the verification gate. A backup with no ledgerHead cannot be\n  //    integrity-checked, and skipping silently would collapse\n  //    *unverifiable* into *clean* — so it always warns. But the REMEDY\n  //    depends on the reader, not the pod (#1303): the pod cannot say\n  //    whether its exporter predates the ledger or never enabled it, and\n  //    the reader knows its own configuration.\n  //\n  //    - Reader HAS the ledger: the pod is behind it. \"Re-export\" is\n  //      actionable; keep the migration wording.\n  //    - Reader has NO ledger: nothing is stale and nothing is migrating —\n  //      the consumer priced the ledger (#1248 measured ~2.4x) and declined.\n  //      Prescribing a re-export is advice they should not take, and\n  //      repeating it on every read trains people to filter the one line\n  //      that also fires on a genuinely stale pod. State the consequence,\n  //      name the discriminator, prescribe nothing.\n  if (!backup.ledgerHead) {\n    if (ctx.getLedgerOrNull()) {\n      console.warn(\n        `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n        `verifiable-backup integrity check skipped. ` +\n        `Re-export with a ledger-aware build to get tamper detection.`,\n      )\n    } else {\n      console.warn(\n        `[noy-db] Loaded a backup with no ledgerHead — this pod is not integrity-checked. ` +\n        `This reader has no ledger enabled (withHistory() is not configured), so nothing is stale: ` +\n        `enable the ledger on both the exporter and this reader if tamper detection is wanted.`,\n      )\n    }\n    return podReport(mode, per)\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n  return podReport(mode, per)\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoHA,SAAS,wBAAwB,iBAA8C;AAC7E,SAAO;AAAA,IACL;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,GAAG,gBAAgB,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EAC/E;AACF;AAEA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,SAAS,EAAE;AAAA,IACvD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB,wBAAwB,OAAO,KAAK,QAAQ,CAAC;AACnE,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAqBA,eAAe,oBACb,KACA,YACA,SACgE;AAChE,MAAI,UAAU,GAAG,UAAU,GAAG,UAAU;AACxC,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,UAAM,QAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC7D,QAAI,SAAS,MAAM,OAAO,SAAS,IAAI;AAAE;AAAW;AAAA,IAAS;AAC7D,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,IAAI,QAAQ;AACzD;AAAA,EACF;AACA,aAAW,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU,GAAG;AAC9D,QAAI,MAAM,QAAS;AACnB,UAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,YAAY,EAAE;AAClD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,SAAS,QAAQ;AACrC;AAGA,SAAS,UAAU,MAAiC,KAA2F;AAC7I,MAAI,UAAU,GAAG,UAAU,GAAG,UAAU;AACxC,aAAW,KAAK,OAAO,OAAO,GAAG,GAAG;AAAE,eAAW,EAAE;AAAS,eAAW,EAAE;AAAS,eAAW,EAAE;AAAA,EAAQ;AACvG,SAAO,EAAE,MAAM,SAAS,SAAS,SAAS,aAAa,IAAI;AAC7D;AAEA,eAAsB,UACpB,KACA,YACA,SACwB;AACxB,QAAM,SAAS,KAAK,MAAM,UAAU;AACpC,QAAM,OAAO,SAAS,QAAQ;AAC9B,QAAM,MAA6E,CAAC;AAOpF,MAAI,SAAS,iBAAiB,OAAO,iBAAiB,IAAI,OAAO;AAC/D,UAAM,IAAI;AAAA,MACR,4DAA4D,OAAO,YAAY,+BAClD,IAAI,KAAK;AAAA,IAExC;AAAA,EACF;AAGA,MAAI,SAAS,eAAe;AAC1B,UAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AACrD,UAAM,QAAQ,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,OAAO,WAAW,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC;AACrF,eAAW,QAAQ,OAAO;AACxB,YAAM,IAAI,MAAM,oBAAoB,KAAK,MAAM,OAAO,YAAY,IAAI,KAAK,CAAC,CAAC;AAC7E,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAS,KAAI,IAAI,IAAI;AAAA,IACvD;AAAA,EACF,OAAO;AACL,UAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAAA,EACzD;AAGA,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AAMnE,UAAM,WAAW;AAAA,MAAoB,EAAE,YAAY,YAAY,IAAI,QAAQ,SAAS,EAAE;AAAA,MACpF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,WAAW,EAAE;AAAA,IAAC;AAC/C,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAqCA,QAAM,sBAAsB,wBAAwB,OAAO,KAAK,OAAO,WAAW,CAAC;AACnF,MAAI,SAAS,eAAe;AAC1B,eAAW,gBAAgB,qBAAqB;AAC9C,YAAM,IAAI,MAAM,oBAAoB,KAAK,cAAc,OAAO,YAAY,YAAY,KAAK,CAAC,CAAC;AAC7F,UAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAS,KAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,EACF,OAAO;AACL,eAAW,gBAAgB,qBAAqB;AAC9C,iBAAW,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY,GAAG;AAChE,cAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,cAAc,EAAE;AAAA,MACtD;AAAA,IACF;AACA,QAAI,OAAO,WAAW;AACpB,iBAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,mBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,gBAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAQrB,QAAM,IAAI,YAAY;AAiBtB,MAAI,CAAC,OAAO,YAAY;AACtB,QAAI,IAAI,gBAAgB,GAAG;AACzB,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF;AACA,WAAO,UAAU,MAAM,GAAG;AAAA,EAC5B;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACA,SAAO,UAAU,MAAM,GAAG;AAC5B;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}