@noy-db/hub 0.2.0-pre.8 → 0.3.0-pre.1

package/dist/snapshots/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/snapshots/engine.ts","../../src/snapshots/active.ts"],"sourcesContent":["import { writeNoydbBundle, readNoydbBundle } from '../bundle/bundle.js'\nimport { SnapshotNotFoundError } from '../errors.js'\nimport type { NoydbBundleStore } from '../types.js'\nimport type { Vault } from '../vault.js'\nimport type { SnapshotMeta, RetentionPolicy, SnapshotIndex } from './strategy.js'\n\nexport class SnapshotEngine {\n  constructor(\n    private readonly store: NoydbBundleStore,\n    private readonly retention: RetentionPolicy,\n  ) {}\n\n  private indexKey(vaultName: string): string {\n    return `${vaultName}__index`\n  }\n\n  private snapKey(vaultName: string, n: number): string {\n    return `${vaultName}__snap_${n.toString().padStart(6, '0')}`\n  }\n\n  private async readIndex(\n    vaultName: string,\n  ): Promise<{ index: SnapshotIndex; indexVersion: string | null }> {\n    const result = await this.store.readBundle(this.indexKey(vaultName))\n    if (!result) return { index: { snapshots: [], nextCounter: 1 }, indexVersion: null }\n    const text = new TextDecoder().decode(result.bytes)\n    return { index: JSON.parse(text) as SnapshotIndex, indexVersion: result.version }\n  }\n\n  private async writeIndex(\n    vaultName: string,\n    index: SnapshotIndex,\n    expectedVersion: string | null,\n  ): Promise<void> {\n    const bytes = new TextEncoder().encode(JSON.stringify(index))\n    await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion)\n  }\n\n  async snapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writeNoydbBundle(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.snapKey(vault.name, index.nextCounter)\n\n    // Write blob first. If the subsequent index write fails, the next snapshot()\n    // call will re-derive the same key (counter not persisted) and overwrite this blob.\n    // This is an accepted v1 trade-off: failure window is narrow and requires a store\n    // error between the two writes. A retry produces a fresh snapshot at the same key.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      ...(opts?.label !== undefined ? { label: opts.label } : {}),\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n    }\n\n    const newIndex: SnapshotIndex = {\n      snapshots: [...index.snapshots, meta],\n      nextCounter: index.nextCounter + 1,\n    }\n    const toDelete = this.applyRetention(newIndex)\n    await this.writeIndex(vault.name, newIndex, indexVersion)\n\n    for (const k of toDelete) {\n      await this.store.deleteBundle(k)\n    }\n\n    return meta\n  }\n\n  async listSnapshots(vaultId: string): Promise<SnapshotMeta[]> {\n    const { index } = await this.readIndex(vaultId)\n    return [...index.snapshots].reverse()\n  }\n\n  async restoreSnapshot(vault: Vault, version: string): Promise<void> {\n    if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version)\n    const result = await this.store.readBundle(version)\n    if (!result) throw new SnapshotNotFoundError(version)\n    const { dumpJson } = await readNoydbBundle(result.bytes)\n    await vault.load(dumpJson)\n  }\n\n  /**\n   * Applies the configured retention policy to `index`, mutating `index.snapshots`\n   * in place and returning the blob keys that should be deleted from the store.\n   * Called by `snapshot()` before the index is written.\n   *\n   * @internal — public for direct testing only\n   */\n  applyRetention(index: SnapshotIndex): string[] {\n    const prune = this.retention.prune ?? true\n    if (!prune) return []\n\n    const toDelete: string[] = []\n    let remaining = index.snapshots.slice()\n\n    if (this.retention.keepLast !== undefined && remaining.length > this.retention.keepLast) {\n      const excess = remaining.splice(0, remaining.length - this.retention.keepLast)\n      toDelete.push(...excess.map(m => m.version))\n    }\n\n    if (this.retention.maxAgeDays !== undefined) {\n      const cutoffMs = this.retention.maxAgeDays * 86_400_000\n      const now = Date.now()\n      const fresh = remaining.filter(m => now - new Date(m.exportedAt).getTime() <= cutoffMs)\n      toDelete.push(...remaining.filter(m => !fresh.includes(m)).map(m => m.version))\n      remaining = fresh\n    }\n\n    index.snapshots = remaining\n    return toDelete\n  }\n}\n","import { SnapshotEngine } from './engine.js'\nimport type { SnapshotStrategy, RetentionPolicy } from './strategy.js'\nimport type { NoydbBundleStore } from '../types.js'\nimport type { Vault } from '../vault.js'\n\nexport interface WithSnapshotsOptions {\n  /** Bundle store where snapshot blobs and the sidecar index are written. */\n  store: NoydbBundleStore\n  /**\n   * Declarative retention policy. Enforced eagerly after each `snapshot()` call.\n   * Defaults to no retention (all snapshots kept forever).\n   */\n  retention?: RetentionPolicy\n}\n\nexport function withSnapshots(opts: WithSnapshotsOptions): SnapshotStrategy {\n  const engine = new SnapshotEngine(opts.store, opts.retention ?? {})\n  return {\n    snapshot(vault, by, snapOpts) {\n      return engine.snapshot(vault as Vault, by, snapOpts)\n    },\n    listSnapshots(vaultId) {\n      return engine.listSnapshots(vaultId)\n    },\n    restoreSnapshot(vault, version) {\n      return engine.restoreSnapshot(vault as Vault, version)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YACmB,OACA,WACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGX,SAAS,WAA2B;AAC1C,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEQ,QAAQ,WAAmB,GAAmB;AACpD,WAAO,GAAG,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAc,UACZ,WACgE;AAChE,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,KAAK,SAAS,SAAS,CAAC;AACnE,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,KAAK;AACnF,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,WAAO,EAAE,OAAO,KAAK,MAAM,IAAI,GAAoB,cAAc,OAAO,QAAQ;AAAA,EAClF;AAAA,EAEA,MAAc,WACZ,WACA,OACA,iBACe;AACf,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,UAAM,KAAK,MAAM,YAAY,KAAK,SAAS,SAAS,GAAG,OAAO,eAAe;AAAA,EAC/E;AAAA,EAEA,MAAM,SACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,iBAAiB,OAAO,CAAC,CAAC;AAC9C,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,MAAM,WAAW;AAMtD,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACzD,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,IACb;AAEA,UAAM,WAA0B;AAAA,MAC9B,WAAW,CAAC,GAAG,MAAM,WAAW,IAAI;AAAA,MACpC,aAAa,MAAM,cAAc;AAAA,IACnC;AACA,UAAM,WAAW,KAAK,eAAe,QAAQ;AAC7C,UAAM,KAAK,WAAW,MAAM,MAAM,UAAU,YAAY;AAExD,eAAW,KAAK,UAAU;AACxB,YAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA0C;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU,OAAO;AAC9C,WAAO,CAAC,GAAG,MAAM,SAAS,EAAE,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,gBAAgB,OAAc,SAAgC;AAClE,QAAI,CAAC,QAAQ,WAAW,GAAG,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,sBAAsB,OAAO;AACnF,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,OAAO;AAClD,QAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,OAAO;AACpD,UAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,OAAO,KAAK;AACvD,UAAM,MAAM,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAe,OAAgC;AAC7C,UAAM,QAAQ,KAAK,UAAU,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO,CAAC;AAEpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,YAAY,MAAM,UAAU,MAAM;AAEtC,QAAI,KAAK,UAAU,aAAa,UAAa,UAAU,SAAS,KAAK,UAAU,UAAU;AACvF,YAAM,SAAS,UAAU,OAAO,GAAG,UAAU,SAAS,KAAK,UAAU,QAAQ;AAC7E,eAAS,KAAK,GAAG,OAAO,IAAI,OAAK,EAAE,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,KAAK,UAAU,eAAe,QAAW;AAC3C,YAAM,WAAW,KAAK,UAAU,aAAa;AAC7C,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,UAAU,OAAO,OAAK,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,KAAK,QAAQ;AACtF,eAAS,KAAK,GAAG,UAAU,OAAO,OAAK,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,OAAK,EAAE,OAAO,CAAC;AAC9E,kBAAY;AAAA,IACd;AAEA,UAAM,YAAY;AAClB,WAAO;AAAA,EACT;AACF;;;ACzGO,SAAS,cAAc,MAA8C;AAC1E,QAAM,SAAS,IAAI,eAAe,KAAK,OAAO,KAAK,aAAa,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,IAAI,UAAU;AAC5B,aAAO,OAAO,SAAS,OAAgB,IAAI,QAAQ;AAAA,IACrD;AAAA,IACA,cAAc,SAAS;AACrB,aAAO,OAAO,cAAc,OAAO;AAAA,IACrC;AAAA,IACA,gBAAgB,OAAO,SAAS;AAC9B,aAAO,OAAO,gBAAgB,OAAgB,OAAO;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-fork/snapshots/engine.ts","../../src/with-fork/snapshots/active.ts"],"sourcesContent":["import { writePod, readPod } from '../../with-pod/bundle.js'\nimport { SnapshotNotFoundError } from '../../kernel/errors.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { SnapshotMeta, RetentionPolicy, SnapshotIndex } from './strategy.js'\n\nexport class SnapshotEngine {\n  constructor(\n    private readonly store: NoydbPodStore,\n    private readonly retention: RetentionPolicy,\n  ) {}\n\n  private indexKey(vaultName: string): string {\n    return `${vaultName}__index`\n  }\n\n  private snapKey(vaultName: string, n: number): string {\n    return `${vaultName}__snap_${n.toString().padStart(6, '0')}`\n  }\n\n  private autoKey(vaultName: string): string {\n    return `${vaultName}__auto`\n  }\n\n  private async readIndex(\n    vaultName: string,\n  ): Promise<{ index: SnapshotIndex; indexVersion: string | null }> {\n    const result = await this.store.readBundle(this.indexKey(vaultName))\n    if (!result) return { index: { snapshots: [], nextCounter: 1 }, indexVersion: null }\n    const text = new TextDecoder().decode(result.bytes)\n    return { index: JSON.parse(text) as SnapshotIndex, indexVersion: result.version }\n  }\n\n  private async writeIndex(\n    vaultName: string,\n    index: SnapshotIndex,\n    expectedVersion: string | null,\n  ): Promise<void> {\n    const bytes = new TextEncoder().encode(JSON.stringify(index))\n    await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion)\n  }\n\n  async snapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.snapKey(vault.name, index.nextCounter)\n\n    // Write blob first. If the subsequent index write fails, the next snapshot()\n    // call will re-derive the same key (counter not persisted) and overwrite this blob.\n    // This is an accepted v1 trade-off: failure window is narrow and requires a store\n    // error between the two writes. A retry produces a fresh snapshot at the same key.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      ...(opts?.label !== undefined ? { label: opts.label } : {}),\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n    }\n\n    const newIndex: SnapshotIndex = {\n      snapshots: [...index.snapshots, meta],\n      nextCounter: index.nextCounter + 1,\n      // Preserve the rolling auto slot — on-demand snapshots never touch it.\n      ...(index.auto ? { auto: index.auto } : {}),\n    }\n    const toDelete = this.applyRetention(newIndex)\n    await this.writeIndex(vault.name, newIndex, indexVersion)\n\n    for (const k of toDelete) {\n      await this.store.deleteBundle(k)\n    }\n\n    return meta\n  }\n\n  /**\n   * Rolling auto-snapshot. Overwrites the single fixed `<vault>__auto` key and\n   * stores its meta in `index.auto`, separate from the immutable `snapshots`\n   * pool — retention never prunes it. Used by the cadence scheduler.\n   */\n  async autoSnapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.autoKey(vault.name)\n\n    // Unconditional overwrite of the rolling slot.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      label: opts?.label ?? 'auto',\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n      auto: true,\n    }\n\n    index.auto = meta\n    await this.writeIndex(vault.name, index, indexVersion)\n    return meta\n  }\n\n  async listSnapshots(vaultId: string): Promise<SnapshotMeta[]> {\n    const { index } = await this.readIndex(vaultId)\n    const immutable = [...index.snapshots].reverse()\n    return index.auto ? [index.auto, ...immutable] : immutable\n  }\n\n  async restoreSnapshot(vault: Vault, version: string): Promise<void> {\n    if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version)\n    const result = await this.store.readBundle(version)\n    if (!result) throw new SnapshotNotFoundError(version)\n    const { dumpJson } = await readPod(result.bytes)\n    await vault.load(dumpJson)\n  }\n\n  /**\n   * Applies the configured retention policy to `index`, mutating `index.snapshots`\n   * in place and returning the blob keys that should be deleted from the store.\n   * Called by `snapshot()` before the index is written.\n   *\n   * @internal — public for direct testing only\n   */\n  applyRetention(index: SnapshotIndex): string[] {\n    const prune = this.retention.prune ?? true\n    if (!prune) return []\n\n    const toDelete: string[] = []\n    let remaining = index.snapshots.slice()\n\n    if (this.retention.keepLast !== undefined && remaining.length > this.retention.keepLast) {\n      const excess = remaining.splice(0, remaining.length - this.retention.keepLast)\n      toDelete.push(...excess.map(m => m.version))\n    }\n\n    if (this.retention.maxAgeDays !== undefined) {\n      const cutoffMs = this.retention.maxAgeDays * 86_400_000\n      const now = Date.now()\n      const fresh = remaining.filter(m => now - new Date(m.exportedAt).getTime() <= cutoffMs)\n      toDelete.push(...remaining.filter(m => !fresh.includes(m)).map(m => m.version))\n      remaining = fresh\n    }\n\n    index.snapshots = remaining\n    return toDelete\n  }\n}\n","import { SnapshotEngine } from './engine.js'\nimport type { SnapshotStrategy, RetentionPolicy } from './strategy.js'\nimport type { SnapshotPolicy } from './policy.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport interface WithSnapshotsOptions {\n  /** Bundle store where snapshot blobs and the sidecar index are written. */\n  store: NoydbPodStore\n  /**\n   * Declarative retention policy. Enforced eagerly after each on-demand `snapshot()`.\n   * Defaults to no retention (all on-demand snapshots kept forever). Never affects\n   * the rolling auto-snapshot.\n   */\n  retention?: RetentionPolicy\n  /**\n   * Automatic-snapshot cadence. Default `mode:'manual'` ⇒ no timers; snapshots\n   * stay on-demand. Set `mode:'debounce'`/`'interval'` to enable auto-snapshots\n   * to the rolling `<vault>__auto` key.\n   */\n  snapshotPolicy?: SnapshotPolicy\n}\n\nexport function withSnapshots(opts: WithSnapshotsOptions): SnapshotStrategy {\n  const engine = new SnapshotEngine(opts.store, opts.retention ?? {})\n  return {\n    snapshot(vault, by, snapOpts) {\n      return engine.snapshot(vault as Vault, by, snapOpts)\n    },\n    listSnapshots(vaultId) {\n      return engine.listSnapshots(vaultId)\n    },\n    restoreSnapshot(vault, version) {\n      return engine.restoreSnapshot(vault as Vault, version)\n    },\n    autoSnapshot(vault, by, snapOpts) {\n      return engine.autoSnapshot(vault as Vault, by, snapOpts)\n    },\n    ...(opts.snapshotPolicy ? { policy: opts.snapshotPolicy } : {}),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YACmB,OACA,WACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGX,SAAS,WAA2B;AAC1C,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEQ,QAAQ,WAAmB,GAAmB;AACpD,WAAO,GAAG,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AAAA,EAEQ,QAAQ,WAA2B;AACzC,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEA,MAAc,UACZ,WACgE;AAChE,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,KAAK,SAAS,SAAS,CAAC;AACnE,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,KAAK;AACnF,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,WAAO,EAAE,OAAO,KAAK,MAAM,IAAI,GAAoB,cAAc,OAAO,QAAQ;AAAA,EAClF;AAAA,EAEA,MAAc,WACZ,WACA,OACA,iBACe;AACf,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,UAAM,KAAK,MAAM,YAAY,KAAK,SAAS,SAAS,GAAG,OAAO,eAAe;AAAA,EAC/E;AAAA,EAEA,MAAM,SACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,MAAM,WAAW;AAMtD,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACzD,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,IACb;AAEA,UAAM,WAA0B;AAAA,MAC9B,WAAW,CAAC,GAAG,MAAM,WAAW,IAAI;AAAA,MACpC,aAAa,MAAM,cAAc;AAAA;AAAA,MAEjC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IAC3C;AACA,UAAM,WAAW,KAAK,eAAe,QAAQ;AAC7C,UAAM,KAAK,WAAW,MAAM,MAAM,UAAU,YAAY;AAExD,eAAW,KAAK,UAAU;AACxB,YAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,IAAI;AAGnC,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,OAAO,MAAM,SAAS;AAAA,MACtB,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAEA,UAAM,OAAO;AACb,UAAM,KAAK,WAAW,MAAM,MAAM,OAAO,YAAY;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA0C;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU,OAAO;AAC9C,UAAM,YAAY,CAAC,GAAG,MAAM,SAAS,EAAE,QAAQ;AAC/C,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,GAAG,SAAS,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAgB,OAAc,SAAgC;AAClE,QAAI,CAAC,QAAQ,WAAW,GAAG,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,sBAAsB,OAAO;AACnF,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,OAAO;AAClD,QAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,OAAO;AACpD,UAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,MAAM,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAe,OAAgC;AAC7C,UAAM,QAAQ,KAAK,UAAU,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO,CAAC;AAEpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,YAAY,MAAM,UAAU,MAAM;AAEtC,QAAI,KAAK,UAAU,aAAa,UAAa,UAAU,SAAS,KAAK,UAAU,UAAU;AACvF,YAAM,SAAS,UAAU,OAAO,GAAG,UAAU,SAAS,KAAK,UAAU,QAAQ;AAC7E,eAAS,KAAK,GAAG,OAAO,IAAI,OAAK,EAAE,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,KAAK,UAAU,eAAe,QAAW;AAC3C,YAAM,WAAW,KAAK,UAAU,aAAa;AAC7C,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,UAAU,OAAO,OAAK,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,KAAK,QAAQ;AACtF,eAAS,KAAK,GAAG,UAAU,OAAO,OAAK,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,OAAK,EAAE,OAAO,CAAC;AAC9E,kBAAY;AAAA,IACd;AAEA,UAAM,YAAY;AAClB,WAAO;AAAA,EACT;AACF;;;ACzIO,SAAS,cAAc,MAA8C;AAC1E,QAAM,SAAS,IAAI,eAAe,KAAK,OAAO,KAAK,aAAa,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,IAAI,UAAU;AAC5B,aAAO,OAAO,SAAS,OAAgB,IAAI,QAAQ;AAAA,IACrD;AAAA,IACA,cAAc,SAAS;AACrB,aAAO,OAAO,cAAc,OAAO;AAAA,IACrC;AAAA,IACA,gBAAgB,OAAO,SAAS;AAC9B,aAAO,OAAO,gBAAgB,OAAgB,OAAO;AAAA,IACvD;AAAA,IACA,aAAa,OAAO,IAAI,UAAU;AAChC,aAAO,OAAO,aAAa,OAAgB,IAAI,QAAQ;AAAA,IACzD;AAAA,IACA,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;AAAA,EAC/D;AACF;","names":[]}

package/dist/{stale-6ZDBTQT7.js → stale-3JWHNDIY.js}

@@ -3,11 +3,12 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-HNRHLRDC.js";
+} from "./chunk-BG3SPSR4.js";
+import "./chunk-PZ5AY32C.js";
 export {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-6ZDBTQT7.js.map
+//# sourceMappingURL=stale-3JWHNDIY.js.map

package/dist/stale-3JWHNDIY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/store-coordination-provider-3I7XWZZK.js

@@ -0,0 +1,142 @@
+import {
+  loadFence,
+  saveFence
+} from "./chunk-IAGBDSCS.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-5TDJ56JE.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/schema-update/client-registry.ts
+var META_COLLECTION = "_meta";
+var CLIENT_PREFIX = "schema-fence:client:";
+async function writeClientDoc(store, vault, clientId, doc) {
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify({ clientId, ...doc })
+  };
+  await store.put(vault, META_COLLECTION, `${CLIENT_PREFIX}${clientId}`, envelope);
+}
+async function listClientDocs(store, vault) {
+  const ids = await store.list(vault, META_COLLECTION);
+  const out = [];
+  for (const id of ids) {
+    if (!id.startsWith(CLIENT_PREFIX)) continue;
+    const env = await store.get(vault, META_COLLECTION, id);
+    if (!env) continue;
+    try {
+      const parsed = JSON.parse(env._data);
+      if (isClientDoc(parsed)) out.push(parsed);
+    } catch {
+    }
+  }
+  return out;
+}
+function isClientDoc(x) {
+  if (x === null || typeof x !== "object") return false;
+  const o = x;
+  return typeof o["clientId"] === "string" && typeof o["lastSeen"] === "number" && (o["quiescedAtVersion"] === null || typeof o["quiescedAtVersion"] === "number") && (o["sessionId"] === void 0 || typeof o["sessionId"] === "string");
+}
+
+// src/with-shape/schema-update/store-coordination-provider.ts
+var DEFAULT_POLL_INTERVAL_MS = 50;
+function toPresence(doc) {
+  return {
+    writerId: doc.clientId,
+    // Legacy docs written without a sessionId (and explicit empty) have no
+    // session — fall back to the writerId so every presence is session-addressable.
+    sessionId: doc.sessionId && doc.sessionId.length > 0 ? doc.sessionId : doc.clientId,
+    lastSeen: doc.lastSeen,
+    quiescedAtVersion: doc.quiescedAtVersion
+  };
+}
+function fenceEqual(a, b) {
+  return a.currentSchemaVersion === b.currentSchemaVersion && a.fenceState === b.fenceState;
+}
+function presenceListEqual(a, b) {
+  if (a.length !== b.length) return false;
+  const key = (w) => `${w.writerId}\0${w.sessionId}\0${w.lastSeen}\0${String(w.quiescedAtVersion)}`;
+  const bk = new Set(b.map(key));
+  return a.every((w) => bk.has(key(w)));
+}
+var StoreCoordinationProvider = class {
+  #store;
+  #pollIntervalMs;
+  constructor(store, opts) {
+    this.#store = store;
+    this.#pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  }
+  async setFence(vault, fence) {
+    await saveFence(this.#store, vault, fence);
+  }
+  async readFence(vault) {
+    return loadFence(this.#store, vault);
+  }
+  observeFence(vault, onChange) {
+    let last = null;
+    let busy = false;
+    const poll = async () => {
+      if (busy) return;
+      busy = true;
+      try {
+        const fence = await loadFence(this.#store, vault);
+        if (last === null || !fenceEqual(last, fence)) {
+          last = fence;
+          onChange(fence);
+        }
+      } catch {
+      } finally {
+        busy = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => void poll(), this.#pollIntervalMs);
+    unref(timer);
+    return () => clearInterval(timer);
+  }
+  async reportPresence(vault, p) {
+    await writeClientDoc(this.#store, vault, p.writerId, {
+      lastSeen: p.lastSeen,
+      quiescedAtVersion: p.quiescedAtVersion,
+      sessionId: p.sessionId
+    });
+  }
+  observePresence(vault, onChange) {
+    let last = null;
+    let busy = false;
+    const poll = async () => {
+      if (busy) return;
+      busy = true;
+      try {
+        const docs = await listClientDocs(this.#store, vault);
+        const writers = docs.map(toPresence);
+        if (last === null || !presenceListEqual(last, writers)) {
+          last = writers;
+          onChange(writers);
+        }
+      } catch {
+      } finally {
+        busy = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => void poll(), this.#pollIntervalMs);
+    unref(timer);
+    return () => clearInterval(timer);
+  }
+  async reachableWriters(vault, o) {
+    const docs = await listClientDocs(this.#store, vault);
+    return docs.map(toPresence).filter((w) => o.now - w.lastSeen <= o.staleMs);
+  }
+};
+function unref(timer) {
+  const t = timer;
+  if (typeof t.unref === "function") t.unref();
+}
+export {
+  StoreCoordinationProvider
+};
+//# sourceMappingURL=store-coordination-provider-3I7XWZZK.js.map

package/dist/store-coordination-provider-3I7XWZZK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/client-registry.ts","../src/with-shape/schema-update/store-coordination-provider.ts"],"sourcesContent":["/**\n * Schema-cutover client registry. Each client keeps a\n * heartbeat doc at `_meta/schema-fence:client:<clientId>` carrying its\n * liveness (`lastSeen`) and the fence generation it has quiesced for\n * (`quiescedAtVersion`). Plaintext envelope, like the fence doc.\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\n\nconst META_COLLECTION = '_meta'\nconst CLIENT_PREFIX = 'schema-fence:client:'\n\nexport interface ClientDoc {\n  readonly clientId: string\n  readonly lastSeen: number\n  readonly quiescedAtVersion: number | null\n  /**\n   * Session that owns this writer (one user's writers across vaults). Additive\n   * and optional so legacy client docs (written without it) keep parsing;\n   * readers default it.\n   */\n  readonly sessionId?: string\n}\n\nexport async function writeClientDoc(\n  store: NoydbStore,\n  vault: string,\n  clientId: string,\n  doc: { lastSeen: number; quiescedAtVersion: number | null; sessionId?: string },\n): Promise<void> {\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: JSON.stringify({ clientId, ...doc }),\n  }\n  await store.put(vault, META_COLLECTION, `${CLIENT_PREFIX}${clientId}`, envelope)\n}\n\nexport async function listClientDocs(store: NoydbStore, vault: string): Promise<ClientDoc[]> {\n  const ids = await store.list(vault, META_COLLECTION)\n  const out: ClientDoc[] = []\n  for (const id of ids) {\n    if (!id.startsWith(CLIENT_PREFIX)) continue\n    const env = await store.get(vault, META_COLLECTION, id)\n    if (!env) continue\n    try {\n      const parsed = JSON.parse(env._data) as unknown\n      if (isClientDoc(parsed)) out.push(parsed)\n    } catch { /* skip corrupt */ }\n  }\n  return out\n}\n\n/**\n * True when every *active* client (lastSeen within staleMs of now) has\n * `quiescedAtVersion === generation`. Stale clients are ignored. An empty\n * active set is vacuously quiesced.\n */\nexport async function activeQuiesced(\n  store: NoydbStore,\n  vault: string,\n  opts: { generation: number; now: number; staleMs: number; excludeClientId?: string },\n): Promise<boolean> {\n  const docs = await listClientDocs(store, vault)\n  const active = docs.filter(\n    d => d.lastSeen >= opts.now - opts.staleMs && d.clientId !== opts.excludeClientId,\n  )\n  return active.every(d => d.quiescedAtVersion === opts.generation)\n}\n\nfunction isClientDoc(x: unknown): x is ClientDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  return typeof o['clientId'] === 'string'\n    && typeof o['lastSeen'] === 'number'\n    && (o['quiescedAtVersion'] === null || typeof o['quiescedAtVersion'] === 'number')\n    && (o['sessionId'] === undefined || typeof o['sessionId'] === 'string')\n}\n","/**\n * Store-backed default {@link CoordinationProvider}.\n *\n * Maps the five coordination-port methods onto today's `_meta/schema-fence`\n * store ops so that, with no `by-*` provider injected, the fence service\n * reproduces its current store-polling behavior byte-for-byte. The `observe*`\n * methods are poll-emit (the legacy {@link FenceWatcher} model); `by-tabs` /\n * `by-peer` override them with real-time push.\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { Unsubscribe } from '../../port/with/write-hooks.js'\nimport { loadFence, saveFence, type FenceDoc } from './fence.js'\nimport { writeClientDoc, listClientDocs, type ClientDoc } from './client-registry.js'\nimport type { CoordinationProvider, FenceState, WriterPresence } from '../../port/by/types.js'\n\n/**\n * Default poll cadence for the `observe*` fallbacks (ms). Matches the\n * store-poll granularity the fence-controller uses while waiting for quorum\n * (`delay(50)`); the same value the migration cutover falls back to when no\n * real-time provider is injected.\n */\nconst DEFAULT_POLL_INTERVAL_MS = 50\n\n/** Map a stored {@link ClientDoc} to the port's {@link WriterPresence}. */\nfunction toPresence(doc: ClientDoc): WriterPresence {\n  return {\n    writerId: doc.clientId,\n    // Legacy docs written without a sessionId (and explicit empty) have no\n    // session — fall back to the writerId so every presence is session-addressable.\n    sessionId: doc.sessionId && doc.sessionId.length > 0 ? doc.sessionId : doc.clientId,\n    lastSeen: doc.lastSeen,\n    quiescedAtVersion: doc.quiescedAtVersion,\n  }\n}\n\nfunction fenceEqual(a: FenceState, b: FenceState): boolean {\n  return a.currentSchemaVersion === b.currentSchemaVersion && a.fenceState === b.fenceState\n}\n\nfunction presenceListEqual(a: readonly WriterPresence[], b: readonly WriterPresence[]): boolean {\n  if (a.length !== b.length) return false\n  const key = (w: WriterPresence) => `${w.writerId}\\u0000${w.sessionId}\\u0000${w.lastSeen}\\u0000${String(w.quiescedAtVersion)}`\n  const bk = new Set(b.map(key))\n  return a.every((w) => bk.has(key(w)))\n}\n\nexport class StoreCoordinationProvider implements CoordinationProvider {\n  readonly #store: NoydbStore\n  readonly #pollIntervalMs: number\n\n  constructor(store: NoydbStore, opts?: { pollIntervalMs?: number }) {\n    this.#store = store\n    this.#pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS\n  }\n\n  async setFence(vault: string, fence: FenceState): Promise<void> {\n    // FenceState is structurally FenceDoc (currentSchemaVersion + fenceState).\n    await saveFence(this.#store, vault, fence as FenceDoc)\n  }\n\n  async readFence(vault: string): Promise<FenceState> {\n    // FenceDoc is structurally FenceState (currentSchemaVersion + fenceState).\n    return loadFence(this.#store, vault)\n  }\n\n  observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe {\n    let last: FenceState | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const fence = await loadFence(this.#store, vault)\n        if (last === null || !fenceEqual(last, fence)) {\n          last = fence\n          onChange(fence)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current state once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reportPresence(vault: string, p: WriterPresence): Promise<void> {\n    await writeClientDoc(this.#store, vault, p.writerId, {\n      lastSeen: p.lastSeen,\n      quiescedAtVersion: p.quiescedAtVersion,\n      sessionId: p.sessionId,\n    })\n  }\n\n  observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe {\n    let last: readonly WriterPresence[] | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const docs = await listClientDocs(this.#store, vault)\n        const writers = docs.map(toPresence)\n        if (last === null || !presenceListEqual(last, writers)) {\n          last = writers\n          onChange(writers)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current set once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reachableWriters(vault: string, o: { staleMs: number; now: number }): Promise<readonly WriterPresence[]> {\n    const docs = await listClientDocs(this.#store, vault)\n    return docs.map(toPresence).filter((w) => o.now - w.lastSeen <= o.staleMs)\n  }\n}\n\n/** Best-effort `unref` so a poll timer never holds the process open (Node only). */\nfunction unref(timer: ReturnType<typeof setInterval>): void {\n  const t = timer as unknown as { unref?: () => void }\n  if (typeof t.unref === 'function') t.unref()\n}\n"],"mappings":";;;;;;;;;;AASA,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AActB,eAAsB,eACpB,OACA,OACA,UACA,KACe;AACf,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,GAAG,aAAa,GAAG,QAAQ,IAAI,QAAQ;AACjF;AAEA,eAAsB,eAAe,OAAmB,OAAqC;AAC3F,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AACnD,QAAM,MAAmB,CAAC;AAC1B,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAG,WAAW,aAAa,EAAG;AACnC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,iBAAiB,EAAE;AACtD,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI,KAAK;AACnC,UAAI,YAAY,MAAM,EAAG,KAAI,KAAK,MAAM;AAAA,IAC1C,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AACA,SAAO;AACT;AAmBA,SAAS,YAAY,GAA4B;AAC/C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SAAO,OAAO,EAAE,UAAU,MAAM,YAC3B,OAAO,EAAE,UAAU,MAAM,aACxB,EAAE,mBAAmB,MAAM,QAAQ,OAAO,EAAE,mBAAmB,MAAM,cACrE,EAAE,WAAW,MAAM,UAAa,OAAO,EAAE,WAAW,MAAM;AAClE;;;ACvDA,IAAM,2BAA2B;AAGjC,SAAS,WAAW,KAAgC;AAClD,SAAO;AAAA,IACL,UAAU,IAAI;AAAA;AAAA;AAAA,IAGd,WAAW,IAAI,aAAa,IAAI,UAAU,SAAS,IAAI,IAAI,YAAY,IAAI;AAAA,IAC3E,UAAU,IAAI;AAAA,IACd,mBAAmB,IAAI;AAAA,EACzB;AACF;AAEA,SAAS,WAAW,GAAe,GAAwB;AACzD,SAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,eAAe,EAAE;AACjF;AAEA,SAAS,kBAAkB,GAA8B,GAAuC;AAC9F,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,MAAM,CAAC,MAAsB,GAAG,EAAE,QAAQ,KAAS,EAAE,SAAS,KAAS,EAAE,QAAQ,KAAS,OAAO,EAAE,iBAAiB,CAAC;AAC3H,QAAM,KAAK,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC;AAC7B,SAAO,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AACtC;AAEO,IAAM,4BAAN,MAAgE;AAAA,EAC5D;AAAA,EACA;AAAA,EAET,YAAY,OAAmB,MAAoC;AACjE,SAAK,SAAS;AACd,SAAK,kBAAkB,MAAM,kBAAkB;AAAA,EACjD;AAAA,EAEA,MAAM,SAAS,OAAe,OAAkC;AAE9D,UAAM,UAAU,KAAK,QAAQ,OAAO,KAAiB;AAAA,EACvD;AAAA,EAEA,MAAM,UAAU,OAAoC;AAElD,WAAO,UAAU,KAAK,QAAQ,KAAK;AAAA,EACrC;AAAA,EAEA,aAAa,OAAe,UAAgD;AAC1E,QAAI,OAA0B;AAC9B,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,KAAK,QAAQ,KAAK;AAChD,YAAI,SAAS,QAAQ,CAAC,WAAW,MAAM,KAAK,GAAG;AAC7C,iBAAO;AACP,mBAAS,KAAK;AAAA,QAChB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,eAAe,OAAe,GAAkC;AACpE,UAAM,eAAe,KAAK,QAAQ,OAAO,EAAE,UAAU;AAAA,MACnD,UAAU,EAAE;AAAA,MACZ,mBAAmB,EAAE;AAAA,MACrB,WAAW,EAAE;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,gBAAgB,OAAe,UAAqE;AAClG,QAAI,OAAyC;AAC7C,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,cAAM,UAAU,KAAK,IAAI,UAAU;AACnC,YAAI,SAAS,QAAQ,CAAC,kBAAkB,MAAM,OAAO,GAAG;AACtD,iBAAO;AACP,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,iBAAiB,OAAe,GAAyE;AAC7G,UAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,WAAO,KAAK,IAAI,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO;AAAA,EAC3E;AACF;AAGA,SAAS,MAAM,OAA6C;AAC1D,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAC7C;","names":[]}

package/dist/subject-index-O75wKshW.d.ts

@@ -0,0 +1,362 @@
+/**
+ * Ledger entry shape + canonical JSON + sha256 helpers.
+ *
+ * This file holds the PURE primitives used by the hash-chained ledger:
+ * the entry type, the deterministic (sort-stable) JSON encoder, and
+ * the sha256 hasher that produces `prevHash` and `ledger.head()`.
+ *
+ * Everything here is validator-free and side-effect free — the only
+ * runtime dep is Web Crypto's `subtle.digest` for the sha256 call,
+ * which we already use for every other hashing operation in the core.
+ *
+ * The hash chain property works like this:
+ *
+ *   hash(entry[i])       = sha256(canonicalJSON(entry[i]))
+ *   entry[i+1].prevHash  = hash(entry[i])
+ *
+ * Any modification to `entry[i]` (field values, field order, whitespace)
+ * produces a different `hash(entry[i])`, which means `entry[i+1]`'s
+ * stored `prevHash` no longer matches the recomputed hash, which means
+ * `verify()` returns `{ ok: false, divergedAt: i + 1 }`. The chain is
+ * append-only and tamper-evident without external anchoring.
+ */
+interface LedgerEntry {
+    /**
+     * Zero-based sequential position of this entry in the chain. The
+     * canonical adapter key is this number zero-padded to 10 digits
+     * (`"0000000001"`) so lexicographic ordering matches numeric order.
+     */
+    readonly index: number;
+    /**
+     * Hex-encoded sha256 of the canonical JSON of the PREVIOUS entry.
+     * The genesis entry (index 0) has `prevHash === ''` — the first
+     * entry in a fresh vault has nothing to point back to.
+     */
+    readonly prevHash: string;
+    /**
+     * Which kind of mutation this entry records. only supports
+     * data operations (`put`, `delete`, `amendment`). Access-control
+     * operations (`grant`, `revoke`, `rotate`) will be added in a
+     * follow-up once the keyring write path is instrumented — that's
+     * tracked in the epic issue.
+     *
+     * `'amendment'` is the multi-record audit entry written by the
+     * guards service when an admin/owner uses `withTransactions(...)`
+     * to repair a constraint-violating state. See `amendment` field
+     * below for the structured payload.
+     *
+     * `'lifecycle'` records a non-data audit event (e.g. partition
+     * handover) — `collection`/`id` are empty and the event detail
+     * lives in `reason` (e.g. `'partition-handed-over:<sealId>'`). Like
+     * `amendment`, it carries no data envelope, so `verifyBackupIntegrity`
+     * skips it in the data cross-check (it still participates in the
+     * tamper-evident chain).
+     *
+     * `'forget'` is the single summary entry written by `vault.forget()`
+     * (GDPR crypto-shred). `collection`/`id` are empty and `version`
+     * is 0 — a forget is not scoped to one record. `payloadHash` carries
+     * `sha256Hex(subjectId)` so the ledger PROVES "subject X existed and
+     * was erased on date D" without retaining the subject id or any
+     * plaintext; `reason` holds a JSON summary of the shred counts. Like
+     * `amendment`/`lifecycle` it carries no data envelope and is skipped
+     * by the reconstruct walker (it still participates in the chain, so
+     * `verify()` passes after a shred).
+     */
+    readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle' | 'migration' | 'forget';
+    /** The collection the mutation targeted. */
+    readonly collection: string;
+    /** The record id the mutation targeted. */
+    readonly id: string;
+    /**
+     * The record version AFTER this mutation. For `put` this is the
+     * newly assigned version; for `delete` this is the version that
+     * was deleted (the last version visible to reads).
+     */
+    readonly version: number;
+    /** ISO timestamp of the mutation. */
+    readonly ts: string;
+    /** User id of the actor who performed the mutation. */
+    readonly actor: string;
+    /**
+     * Hex-encoded sha256 over the encrypted envelope's `_data` field, plus its
+     * sealed-field ciphertext map (`_sealed`) when the record carries one —
+     * so the ledger attests to both the open body and every sealed
+     * value. A record with no `_sealed` hashes `_data` alone.
+     * For `put`, this is the hash of the new ciphertext. For `delete`,
+     * it's the hash of the last visible ciphertext at deletion time, or the empty
+     * string if nothing was there to delete. Hashing the ciphertext (not the
+     * plaintext) preserves zero-knowledge — see the file docstring. The exact
+     * recipe lives in `envelopePayloadHash` (`hash.ts`).
+     */
+    readonly payloadHash: string;
+    /**
+     * Optional human-readable tag describing why this mutation happened.
+     * Threaded through `collection.put(_, _, { reason })`. Common
+     * values include `'import:csv'`, `'import:json'`, `'import:xlsx'` from
+     * `as-*` ImportPlan.apply(), but consumers can use any string for
+     * domain-specific audit filtering. Auto-strip via `canonicalJson` —
+     * absent on the wire, never serialized as `null`.
+     *
+     * Audit consumers filter: `entries.filter(e => e.reason?.startsWith('import:'))`.
+     */
+    readonly reason?: string;
+    /**
+     * Optional hex-encoded sha256 of the encrypted JSON Patch delta
+     * blob stored alongside this entry in `_ledger_deltas/`. Present
+     * only for `put` operations that had a previous version — the
+     * genesis put of a new record, and every `delete`, leave this
+     * field undefined.
+     *
+     * The delta payload itself lives in a sibling internal collection
+     * (`_ledger_deltas/<paddedIndex>`) and is encrypted with the
+     * ledger DEK. Callers use `ledger.loadDelta(index)` to decrypt and
+     * deserialize it when reconstructing a historical version.
+     *
+     * Why optional instead of always-present: the first put of a
+     * record has no previous version to diff against, so storing an
+     * empty patch would be noise. For deletes there's no "next" state
+     * to describe with a delta. Both cases set this field to undefined.
+     *
+     * Note: the canonical-JSON hasher treats `undefined` as invalid
+     * (it's one of the guard rails), so on the wire this field is
+     * either `{ deltaHash: '<hex>' }` or absent from the JSON
+     * entirely — never `{ deltaHash: undefined }`.
+     */
+    readonly deltaHash?: string;
+    /**
+     * Present only when `op === 'amendment'`. Records the human reason,
+     * the role of the actor, the (collection, id, vBefore, vAfter) tuple
+     * for every record touched, and which guard invariants passed.
+     *
+     * See docs/superpowers/specs/2026-05-18-guards-design.md.
+     */
+    readonly amendment?: {
+        readonly reason: string;
+        readonly role: 'admin' | 'owner';
+        readonly changes: ReadonlyArray<{
+            readonly collection: string;
+            readonly id: string;
+            readonly vBefore: number;
+            readonly vAfter: number;
+        }>;
+        readonly invariantsPassed: ReadonlyArray<string>;
+    };
+}
+/**
+ * Canonical (sort-stable) JSON encoder.
+ *
+ * This function is the load-bearing primitive of the hash chain:
+ * `sha256(canonicalJSON(entry))` must produce the same hex string
+ * every time, on every machine, for the same logical entry — otherwise
+ * `verify()` would return `{ ok: false }` on cross-platform reads.
+ *
+ * JavaScript's `JSON.stringify` is almost canonical, but NOT quite:
+ * it preserves the insertion order of object keys, which means
+ * `{a:1,b:2}` and `{b:2,a:1}` serialize differently. We fix this by
+ * recursively walking objects and sorting their keys before
+ * concatenation.
+ *
+ * Arrays keep their original order (reordering them would change
+ * semantics). Numbers, strings, booleans, and `null` use the default
+ * JSON encoding. `undefined` and functions are rejected — ledger
+ * entries are plain data, and silently dropping `undefined` would
+ * break the "same input → same hash" property if a caller forgot to
+ * omit a field.
+ *
+ * Performance: one pass per nesting level; O(n log n) for key sorting
+ * at each object. Entries are small (< 1 KB) so this is negligible
+ * compared to the sha256 call.
+ */
+declare function canonicalJson(value: unknown): string;
+/**
+ * Compute a hex-encoded sha256 of a string via Web Crypto's subtle API.
+ *
+ * We use hex (not base64) for hashes because hex is case-insensitive,
+ * fixed-length (64 chars), and easier to compare visually in debug
+ * output. Base64 would save a few bytes in storage but every encrypted
+ * ledger entry is already much larger than the hash itself.
+ */
+declare function sha256Hex(input: string): Promise<string>;
+/**
+ * Compute the canonical hash of a ledger entry. Short wrapper around
+ * `canonicalJson` + `sha256Hex`; callers use this instead of composing
+ * the two functions every time, so any future change to the hashing
+ * pipeline (e.g., adding a domain-separation prefix) lives in one place.
+ */
+declare function hashEntry(entry: LedgerEntry): Promise<string>;
+/**
+ * Pad an index to the canonical 10-digit form used as the adapter key.
+ * Ten digits is enough for ~10 billion ledger entries per vault
+ * — far beyond any realistic use case, but cheap enough that the extra
+ * digits don't hurt storage.
+ */
+declare function paddedIndex(index: number): string;
+/** Parse a padded adapter key back into a number. Returns NaN on malformed input. */
+declare function parseIndex(key: string): number;
+
+/**
+ * `withForgetCascade` — declaration surface for GDPR right-to-erasure via
+ * per-record CEK crypto-shred.
+ *
+ * This file holds only the *declaration* shape and the disabled sentinel.
+ * The actual erasure machinery lives in:
+ *   - `subject-index.ts` — the encrypted `_subject_index` reserved collection
+ *   - `vault.ts` `forget()` — the per-record tombstone + ledger flow
+ *   - `collection.ts` `_writeTombstone` — the envelope rewrite
+ *
+ * A `ForgetStrategy` declares which collections carry erasable subject data
+ * and the (dotted-path) field on each record that names the data subject.
+ * Declaring a collection here ALSO forces `perRecordKeys: true` for it (a
+ * shred can only erase a record whose body is keyed off a per-record CEK),
+ * so adopters opt into the CEK foundation transitively.
+ *
+ * @module
+ */
+
+/**
+ * User-supplied declaration passed to {@link withForgetCascade}. Maps a
+ * collection name to the record field (dotted path supported, e.g.
+ * `'billing.buyerId'`) that identifies the data subject for erasure.
+ *
+ * ```ts
+ * withForgetCascade({ subjects: { invoices: 'buyerId', contacts: 'id' } })
+ * ```
+ */
+interface SubjectDeclaration {
+    readonly subjects: Record<string, string>;
+}
+/**
+ * Resolved forget strategy threaded through Noydb → every Vault. Carries
+ * the same `subjects` map the user declared. `NO_FORGET` (empty map) is the
+ * off-by-default sentinel; `vault.forget()` throws
+ * `ForgetStrategyNotConfiguredError` when the map is empty.
+ */
+interface ForgetStrategy {
+    /** Collection → subject-field (dotted path). Empty under `NO_FORGET`. */
+    readonly subjects: Readonly<Record<string, string>>;
+}
+/**
+ * Disabled sentinel — no collections declare a subject field. `vault.forget()`
+ * refuses with `ForgetStrategyNotConfiguredError`; no write hooks register; no
+ * collection is forced into `perRecordKeys`. Non-adopters pay nothing.
+ */
+declare const NO_FORGET: ForgetStrategy;
+/**
+ * The outcome of a `vault.forget(subjectId)` call.
+ *
+ * `unmigratedRecords` lists `collection:id` pairs that were tombstoned but
+ * whose body had NOT been migrated to a per-record CEK at shred time (legacy
+ * body still under the shared collection DEK). Those records are tombstoned
+ * (live envelope + history stripped) but their pre-shred ciphertext, if it
+ * leaked into a backup before migration, remains decryptable under the
+ * collection DEK — so erasure-completeness is NOT guaranteed for them. Run
+ * the per-record-CEK migration pass, then re-forget, to close the gap.
+ *
+ * Blob attachments: a shredded record's **erasable** blobs (on a
+ * `perRecordKeys` collection) are crypto-shredded inline — `blobsShredded`
+ * counts those taken to refCount 0 (BlobObject deleted → chunks permanently
+ * undecryptable), `blobsRetainedShared` counts those still referenced by
+ * another record (shared content legitimately persists for its other owner).
+ * `blobResidueCollections` now lists only collections with blobs that could
+ * NOT be crypto-shredded: **legacy** blobs (no per-blob `_cek`, chunks under
+ * the shared `_blob` DEK — migrate them), or a session without the blob
+ * service loaded. An all-erasable subject yields an empty residue list.
+ */
+interface ForgetResult {
+    /** The subject id passed to `forget()`. Echoed for caller convenience. */
+    readonly subject: string;
+    /** Count of live records rewritten to a tombstone. */
+    readonly recordsShredded: number;
+    /** Count of `_history` envelopes tombstoned across all shredded records. */
+    readonly historyVersionsShredded: number;
+    /** Distinct collections that had at least one record shredded. */
+    readonly collections: readonly string[];
+    /** `collection:id` pairs shredded while still un-migrated (see type docs). */
+    readonly unmigratedRecords: readonly string[];
+    /** Count of erasable blobs crypto-shredded (refCount → 0, BlobObject deleted). */
+    readonly blobsShredded: number;
+    /** Count of erasable blobs retained because still referenced elsewhere (shared). */
+    readonly blobsRetainedShared: number;
+    /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */
+    readonly blobResidueCollections: readonly string[];
+    /**
+     * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted
+     * across the shredded records. These live under the retained
+     * collection DEK, so crypto-shred alone would leave the indexed field VALUES
+     * readable — `forget()` must delete them.
+     */
+    readonly indexPostingsPurged: number;
+    /**
+     * `collection:id:field` entries whose persisted `_idx` side-car could NOT be
+     * deleted — index residue that still leaks the indexed value under the
+     * retained collection DEK. Non-empty means erasure is INCOMPLETE: retry, or
+     * purge the side-car out of band.
+     */
+    readonly indexResidue: readonly string[];
+    /**
+     * Count of `_sealed[field]` slots dropped from the live store across the
+     * shredded records. For slots written under `sensitive` +
+     * `perRecordKeys` (the current path), the key derives off the per-record CEK,
+     * so tombstoning the record — which drops `_cek` and `_sealed` — also
+     * crypto-shreds the value. A legacy slot (written before per-record CEKs) keys
+     * off the collection DEK instead, so dropping it removes it from the live store but a
+     * pre-forget backup remains recoverable by a DEK holder (same caveat `_data`
+     * carries); migrate by re-`put`ting before forgetting for full crypto-shred.
+     */
+    readonly sealedFieldsShredded: number;
+    /** Count of `_sealed_cek` host-delivery envelopes deleted (#H-1). A record sealed to an
+     * at-* host via sealRecordToHost persists its raw CEK there; forget() must destroy them. */
+    readonly sealedCekEnvelopesPurged: number;
+    /** `collection:id` whose `_sealed_cek` purge failed (residue — the host-recoverable CEK may survive). */
+    readonly sealedCekResidue: readonly string[];
+    /** `collection:id:field` sealed slots that were DEK-derived (legacy, written before per-record CEKs) and thus NOT crypto-shredded
+     * by dropping `_cek` — the collection DEK is retained, so synced/backup copies stay decryptable (#M-1). */
+    readonly sealedResidue: readonly string[];
+    /** The single `op:'forget'` ledger entry appended for this erasure. */
+    readonly ledgerEntry: LedgerEntry;
+}
+
+/**
+ * The encrypted subject index.
+ *
+ * GDPR crypto-shred needs to answer "which records belong to data subject
+ * X?" portably (the index must travel with the vault/bundle) WITHOUT leaking
+ * subject-equivalence to the store. The rejected alternative — an unencrypted
+ * subject tag in envelope metadata — would let anyone with store access see
+ * which records share a subject. Instead we keep a reserved `_subject_index`
+ * collection, encrypted under its OWN DEK (`getDEK('_subject_index')`):
+ *
+ *   - record id  = `HMAC-SHA256(indexDEK, subjectId)` (M-2). A bare
+ *     `sha256Hex(subjectId)` would be offline-computable: an attacker with
+ *     store access and a candidate list (emails / customer ids are low-entropy)
+ *     could dictionary the hash to confirm "subject X is present here." Keying
+ *     the id with the vault-only index DEK removes that capability — without the
+ *     DEK the id cannot be derived. (Legacy entries written before M-2 used the
+ *     bare sha256 id; the read/remove paths dual-look-up both forms.)
+ *   - record body = AES-GCM(JSON `{ r: [{ collection, id }], p }`) under the
+ *     index DEK, where `p` pads the plaintext to a bucketed length so the
+ *     ciphertext `_data` length does not leak the approximate record count.
+ *     Legacy bodies were a bare `[{ collection, id }]` array; reads accept both.
+ *
+ * ## Concurrency (RISK #3 — known v1 limitation)
+ *
+ * `addSubjectRef` / `removeSubjectRef` are read-modify-write with no CAS. The
+ * design assumes a SINGLE WRITER (the noy-db single-process write model). Two
+ * concurrent writers racing on the SAME subject can lose an entry (last-write
+ * wins on the ref list). This is documented, not fixed in v1:
+ * `rebuildSubjectIndex` performs a full scan to recover a correct index from
+ * the canonical records, so a lost ref is recoverable. A CAS-backed index is
+ * deferred to a later slice.
+ *
+ * @module
+ */
+
+/** Reserved collection holding the encrypted subject → records index. */
+declare const SUBJECT_INDEX_COLLECTION = "_subject_index";
+/** A single record reference held in a subject's index entry. */
+interface SubjectRef {
+    readonly collection: string;
+    readonly id: string;
+}
+
+export { type ForgetStrategy as F, type LedgerEntry as L, NO_FORGET as N, type SubjectDeclaration as S, type ForgetResult as a, SUBJECT_INDEX_COLLECTION as b, type SubjectRef as c, canonicalJson as d, parseIndex as e, hashEntry as h, paddedIndex as p, sha256Hex as s };

package/dist/sync/index.d.ts

@@ -1,9 +1,7 @@
-import { aZ as SyncStrategy } from '../types-DGU60JDt.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { cr as SyncStrategy } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/sync/index.js

@@ -2,13 +2,14 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-WPLVTJ5D.js";
-import "../chunk-2QR2PQTT.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-IUEN57TV.js";
+import "../chunk-VQNJ7UZL.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/team/sync-active.ts
+// src/with-party/team/sync-active.ts
 function withSync() {
   return {
     buildSyncEngine(opts) {

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}