@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/aggregate/index.js

@@ -18,11 +18,11 @@ import {
   reducerBuilder,
   resetGroupByWarnings,
   sum
-} from "../chunk-DFVUTGT2.js";
+} from "../chunk-EVHBK7BN.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-EOXAAJTY.js";
-import "../chunk-VEAVKDDB.js";
-import "../chunk-S7VFUQM2.js";
+import "../chunk-VCUQR6ZL.js";
+import "../chunk-GXLZXD2W.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/aggregate/active.ts

package/dist/api-3TH2GOFQ.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-INBQ43DI.js";
+import "./chunk-JGUZMC3I.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-3TH2GOFQ.js.map

package/dist/as/index.js

@@ -2,24 +2,24 @@ import "../chunk-CHFZDSE4.js";
 import {
   diffVault
 } from "../chunk-LB7FD65R.js";
-import "../chunk-5YESYH2C.js";
+import "../chunk-CXC3JLAQ.js";
 import {
   readPod,
   readPodHeader,
   writePod
-} from "../chunk-QSFOZUYL.js";
-import "../chunk-OXCSVM3B.js";
+} from "../chunk-PH7G7ZI7.js";
+import "../chunk-FJTWLQV3.js";
 import "../chunk-ZJADGNYF.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
-import "../chunk-S7VFUQM2.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   diffVault,

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-G6XV4H65.js";
+} from "../chunk-6MA575R5.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-GNMXXTMN.js";
+} from "../chunk-SGJGWBSC.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-PLS64NCS.js";
+} from "../chunk-NT2ZO4KI.js";
 import {
   NO_ATTESTATION
-} from "../chunk-QOC3VYL2.js";
+} from "../chunk-S2OWPVSO.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-NDI4CVZU.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-OG4V23SQ.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-Y46N2GJ3.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-DRDDCCHW.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-IXLOJ3IH.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-VF6TAJK2.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-IXLOJ3IH.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-VF6TAJK2.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-IXLOJ3IH.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-VF6TAJK2.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-IXLOJ3IH.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-VF6TAJK2.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/backup-2WVBIVXW.js

@@ -0,0 +1,225 @@
+import {
+  SEQUENCE_COLLECTION
+} from "./chunk-7QLY64AD.js";
+import {
+  SCHEMAS_COLLECTION
+} from "./chunk-HK4XTXO4.js";
+import {
+  LEDGER_COLLECTION,
+  LEDGER_DELTAS_COLLECTION
+} from "./chunk-I7FD46FF.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import {
+  NOYDB_BACKUP_VERSION
+} from "./chunk-JC75UBMT.js";
+import {
+  BackupCorruptedError,
+  BackupLedgerError
+} from "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-pod/backup.ts
+async function dumpVault(ctx) {
+  const snapshot = await ctx.adapter.loadAll(ctx.vault);
+  const keyringIds = await ctx.adapter.list(ctx.vault, "_keyring");
+  const keyrings = {};
+  for (const keyringId of keyringIds) {
+    const envelope = await ctx.adapter.get(ctx.vault, "_keyring", keyringId);
+    if (envelope) {
+      keyrings[keyringId] = JSON.parse(envelope._data);
+    }
+  }
+  const internalSnapshot = {};
+  const internalNames = [
+    LEDGER_COLLECTION,
+    LEDGER_DELTAS_COLLECTION,
+    SCHEMAS_COLLECTION,
+    SEQUENCE_COLLECTION,
+    "_history",
+    // full-snapshot version history — so history()/getVersion()/diff() survive the bundle
+    "_blob_index",
+    "_blob_chunks",
+    "_blob_eviction_audit",
+    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`])
+  ];
+  for (const internalName of internalNames) {
+    const ids = await ctx.adapter.list(ctx.vault, internalName);
+    if (ids.length === 0) continue;
+    const records = {};
+    for (const id of ids) {
+      const envelope = await ctx.adapter.get(ctx.vault, internalName, id);
+      if (envelope) records[id] = envelope;
+    }
+    internalSnapshot[internalName] = records;
+  }
+  const ledgerForHead = ctx.getLedgerOrNull();
+  const head = ledgerForHead ? await ledgerForHead.head() : null;
+  const backup = {
+    _noydb_backup: NOYDB_BACKUP_VERSION,
+    _compartment: ctx.vault,
+    _exported_at: (/* @__PURE__ */ new Date()).toISOString(),
+    _exported_by: ctx.userId(),
+    keyrings,
+    collections: snapshot,
+    ...Object.keys(internalSnapshot).length > 0 ? { _internal: internalSnapshot } : {},
+    ...head ? {
+      ledgerHead: {
+        hash: head.hash,
+        index: head.entry.index,
+        ts: head.entry.ts
+      }
+    } : {}
+  };
+  return JSON.stringify(backup);
+}
+async function loadVault(ctx, backupJson) {
+  const backup = JSON.parse(backupJson);
+  await ctx.adapter.saveAll(ctx.vault, backup.collections);
+  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {
+    const envelope = {
+      _noydb: 1,
+      _v: 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: JSON.stringify(keyringFile)
+    };
+    await ctx.adapter.put(ctx.vault, "_keyring", userId, envelope);
+  }
+  if (backup._internal) {
+    for (const [internalName, records] of Object.entries(backup._internal)) {
+      for (const [id, envelope] of Object.entries(records)) {
+        await ctx.adapter.put(ctx.vault, internalName, id, envelope);
+      }
+    }
+  }
+  await ctx.reloadKeyringAndRebuildDEK();
+  ctx.clearCollectionCache();
+  ctx.resetLedgerStore();
+  if (!backup.ledgerHead) {
+    console.warn(
+      `[noy-db] Loaded a legacy backup with no ledgerHead \u2014 verifiable-backup integrity check skipped. Re-export with a ledger-aware build to get tamper detection.`
+    );
+    return;
+  }
+  const result = await verifyBackupIntegrity(ctx);
+  if (!result.ok) {
+    if (result.kind === "data") {
+      throw new BackupCorruptedError(
+        result.collection,
+        result.id,
+        result.message
+      );
+    }
+    throw new BackupLedgerError(result.message, result.divergedAt);
+  }
+  if (result.head !== backup.ledgerHead.hash) {
+    throw new BackupLedgerError(
+      `Backup ledger head mismatch: embedded "${backup.ledgerHead.hash}" but reconstructed "${result.head}".`
+    );
+  }
+}
+async function verifyBackupIntegrity(ctx) {
+  const ledgerForVerify = ctx.getLedgerOrNull();
+  if (!ledgerForVerify) {
+    return { ok: true, head: "", length: 0 };
+  }
+  const chainResult = await ledgerForVerify.verify();
+  if (!chainResult.ok) {
+    return {
+      ok: false,
+      kind: "chain",
+      divergedAt: chainResult.divergedAt,
+      message: `Ledger chain diverged at index ${chainResult.divergedAt}: expected prevHash "${chainResult.expected}" but found "${chainResult.actual}".`
+    };
+  }
+  const allEntries = await ledgerForVerify.loadAllEntries();
+  const seen = /* @__PURE__ */ new Set();
+  const latest = /* @__PURE__ */ new Map();
+  for (let i = allEntries.length - 1; i >= 0; i--) {
+    const entry = allEntries[i];
+    if (!entry) continue;
+    if (entry.op === "amendment" || entry.op === "lifecycle") continue;
+    const key = `${entry.collection}/${entry.id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (entry.op === "delete") continue;
+    latest.set(key, {
+      collection: entry.collection,
+      id: entry.id,
+      expectedHash: entry.payloadHash
+    });
+  }
+  for (const { collection, id, expectedHash } of latest.values()) {
+    const envelope = await ctx.adapter.get(ctx.vault, collection, id);
+    if (!envelope) {
+      return {
+        ok: false,
+        kind: "data",
+        collection,
+        id,
+        message: `Ledger expects data record "${collection}/${id}" to exist, but the adapter has no envelope for it.`
+      };
+    }
+    const actualHash = await ctx.envelopePayloadHash(envelope);
+    if (actualHash !== expectedHash) {
+      return {
+        ok: false,
+        kind: "data",
+        collection,
+        id,
+        message: `Data envelope "${collection}/${id}" has been tampered with: expected payloadHash "${expectedHash}", got "${actualHash}".`
+      };
+    }
+  }
+  return {
+    ok: true,
+    head: chainResult.head,
+    length: chainResult.length
+  };
+}
+async function exportVaultJSON(ctx, opts = {}) {
+  const collections = {};
+  let ledgerHead;
+  const allDictionaries = {};
+  for await (const chunk of ctx.exportStream({
+    granularity: "collection",
+    withLedgerHead: opts.withLedgerHead === true,
+    // Thread the export locale so records are read at the
+    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).
+    ...opts.resolveLabels !== void 0 ? { resolveLabels: opts.resolveLabels } : {}
+  })) {
+    collections[chunk.collection] = {
+      schema: null,
+      // Standard Schema validators are not JSON-serializable
+      refs: chunk.refs,
+      records: chunk.records
+    };
+    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead;
+    if (!opts.resolveLabels && chunk.dictionaries) {
+      allDictionaries[chunk.collection] = chunk.dictionaries;
+    }
+  }
+  const hasDictionaries = Object.keys(allDictionaries).length > 0;
+  return JSON.stringify({
+    _noydb_export: 1,
+    _compartment: ctx.vault,
+    _exported_at: (/* @__PURE__ */ new Date()).toISOString(),
+    _exported_by: ctx.userId(),
+    collections,
+    ...hasDictionaries ? { _dictionaries: allDictionaries } : {},
+    ...ledgerHead ? { ledgerHead } : {}
+  });
+}
+export {
+  dumpVault,
+  exportVaultJSON,
+  loadVault,
+  verifyBackupIntegrity
+};
+//# sourceMappingURL=backup-2WVBIVXW.js.map

package/dist/blobs/index.js

@@ -8,7 +8,7 @@ import {
   ExportBlobsAbortedError,
   createExportBlobsHandle,
   runCompaction
-} from "../chunk-BQISD5ZV.js";
+} from "../chunk-TBNF5DV5.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -20,16 +20,16 @@ import {
   detectMagic,
   detectMimeType,
   isPreCompressed
-} from "../chunk-XH7XP3OL.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+} from "../chunk-CZMCOFEA.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
-import "../chunk-S7VFUQM2.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts

package/dist/broker/index.js

@@ -0,0 +1,92 @@
+import {
+  NO_BROKER
+} from "../chunk-HIOLCOK3.js";
+import {
+  issueChallenge,
+  verifyBrokerProof
+} from "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import {
+  BrokerEnrolmentError,
+  BrokerNotEnabledError,
+  BrokerProofError
+} from "../chunk-FZCGIJEJ.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-party/broker/active.ts
+var DEFAULT_SKEW_MS = 6e4;
+var MIN_CACHE_MS = 1e3;
+function cacheFloor(creds, skewMs) {
+  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2;
+  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS);
+}
+function withBroker(config) {
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    async enroll(ctx) {
+      const { enrollSeed } = await import("../seed-VI4FU7UH.js");
+      return enrollSeed({ ...ctx, config });
+    },
+    async rotate(ctx) {
+      const vaultPrefix = `${ctx.vault}\0`;
+      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix));
+      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
+      await Promise.allSettled(inFlight);
+      for (const [key] of scoped) cache.delete(key);
+      const { rotateSeed } = await import("../seed-VI4FU7UH.js");
+      return rotateSeed({ ...ctx, config });
+    },
+    credentialSource(ctx, profile) {
+      const key = `${ctx.vault}\0${profile ?? ""}`;
+      return async () => {
+        let entry = cache.get(key);
+        if (!entry) {
+          entry = {};
+          cache.set(key, entry);
+        }
+        const now = Date.now();
+        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds;
+        if (entry.inFlight) return entry.inFlight;
+        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
+        const capturedEntry = entry;
+        const inFlight = (async () => {
+          const { mintStoreCredentials } = await import("../seed-VI4FU7UH.js");
+          const creds = await mintStoreCredentials({ ...ctx, config }, profile);
+          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
+          return creds;
+        })();
+        entry.inFlight = inFlight;
+        try {
+          return await inFlight;
+        } finally {
+          capturedEntry.inFlight = void 0;
+        }
+      };
+    }
+  };
+}
+
+// src/with-party/broker/index.ts
+var MIN_CHALLENGE_TTL_MS = 1e4;
+var MAX_CHALLENGE_TTL_MS = 6e4;
+function issueChallenge2(opts) {
+  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS;
+  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS);
+  return issueChallenge({ ttlMs: clamped });
+}
+export {
+  BrokerEnrolmentError,
+  BrokerNotEnabledError,
+  BrokerProofError,
+  NO_BROKER,
+  issueChallenge2 as issueChallenge,
+  verifyBrokerProof,
+  withBroker
+};
+//# sourceMappingURL=index.js.map

package/dist/broker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../kernel/enclave/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `kernel/enclave/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}

package/dist/bundle/index.js

@@ -1,18 +1,18 @@
 import {
   extractPartition,
   walkClosure
-} from "../chunk-YMVQD5Q5.js";
+} from "../chunk-F3LGBRSV.js";
 import "../chunk-CHFZDSE4.js";
 import {
   adoptPartition,
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition,
   unsealDeks
-} from "../chunk-5VG4IJR7.js";
-import "../chunk-T7WSLRAU.js";
-import "../chunk-YCXCR7VG.js";
-import "../chunk-XH7XP3OL.js";
-import "../chunk-5YESYH2C.js";
+} from "../chunk-7ZOSHEVS.js";
+import "../chunk-HK4XTXO4.js";
+import "../chunk-FF7S3XDW.js";
+import "../chunk-CZMCOFEA.js";
+import "../chunk-CXC3JLAQ.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -31,25 +31,25 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-QSFOZUYL.js";
-import "../chunk-OXCSVM3B.js";
-import "../chunk-J4LPNIGK.js";
-import "../chunk-OVYRLHPE.js";
+} from "../chunk-PH7G7ZI7.js";
+import "../chunk-FJTWLQV3.js";
+import "../chunk-CCIR2OJH.js";
+import "../chunk-JGUZMC3I.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-3JXPAHOZ.js";
+import "../chunk-HBBZWEC5.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-UF362QVH.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+import "../chunk-EIZ4YOG2.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   AdoptionStateError,
   BackupCorruptedError,
@@ -60,7 +60,7 @@ import {
   PartitionExtractionError,
   PodVersionConflictError,
   TransferSealError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-cargo/describe-extraction.ts

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-TWKKOM55.js";
-import "../chunk-S7VFUQM2.js";
+} from "../chunk-NAR6IDKH.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   isQuorum,