@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/store-coordination-provider-5KDS2RRP.js

@@ -0,0 +1,142 @@
+import {
+  loadFence,
+  saveFence
+} from "./chunk-SAL5X5OK.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/schema-update/client-registry.ts
+var META_COLLECTION = "_meta";
+var CLIENT_PREFIX = "schema-fence:client:";
+async function writeClientDoc(store, vault, clientId, doc) {
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify({ clientId, ...doc })
+  };
+  await store.put(vault, META_COLLECTION, `${CLIENT_PREFIX}${clientId}`, envelope);
+}
+async function listClientDocs(store, vault) {
+  const ids = await store.list(vault, META_COLLECTION);
+  const out = [];
+  for (const id of ids) {
+    if (!id.startsWith(CLIENT_PREFIX)) continue;
+    const env = await store.get(vault, META_COLLECTION, id);
+    if (!env) continue;
+    try {
+      const parsed = JSON.parse(env._data);
+      if (isClientDoc(parsed)) out.push(parsed);
+    } catch {
+    }
+  }
+  return out;
+}
+function isClientDoc(x) {
+  if (x === null || typeof x !== "object") return false;
+  const o = x;
+  return typeof o["clientId"] === "string" && typeof o["lastSeen"] === "number" && (o["quiescedAtVersion"] === null || typeof o["quiescedAtVersion"] === "number") && (o["sessionId"] === void 0 || typeof o["sessionId"] === "string");
+}
+
+// src/with-shape/schema-update/store-coordination-provider.ts
+var DEFAULT_POLL_INTERVAL_MS = 50;
+function toPresence(doc) {
+  return {
+    writerId: doc.clientId,
+    // Legacy docs written without a sessionId (and explicit empty) have no
+    // session — fall back to the writerId so every presence is session-addressable.
+    sessionId: doc.sessionId && doc.sessionId.length > 0 ? doc.sessionId : doc.clientId,
+    lastSeen: doc.lastSeen,
+    quiescedAtVersion: doc.quiescedAtVersion
+  };
+}
+function fenceEqual(a, b) {
+  return a.currentSchemaVersion === b.currentSchemaVersion && a.fenceState === b.fenceState;
+}
+function presenceListEqual(a, b) {
+  if (a.length !== b.length) return false;
+  const key = (w) => `${w.writerId}\0${w.sessionId}\0${w.lastSeen}\0${String(w.quiescedAtVersion)}`;
+  const bk = new Set(b.map(key));
+  return a.every((w) => bk.has(key(w)));
+}
+var StoreCoordinationProvider = class {
+  #store;
+  #pollIntervalMs;
+  constructor(store, opts) {
+    this.#store = store;
+    this.#pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  }
+  async setFence(vault, fence) {
+    await saveFence(this.#store, vault, fence);
+  }
+  async readFence(vault) {
+    return loadFence(this.#store, vault);
+  }
+  observeFence(vault, onChange) {
+    let last = null;
+    let busy = false;
+    const poll = async () => {
+      if (busy) return;
+      busy = true;
+      try {
+        const fence = await loadFence(this.#store, vault);
+        if (last === null || !fenceEqual(last, fence)) {
+          last = fence;
+          onChange(fence);
+        }
+      } catch {
+      } finally {
+        busy = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => void poll(), this.#pollIntervalMs);
+    unref(timer);
+    return () => clearInterval(timer);
+  }
+  async reportPresence(vault, p) {
+    await writeClientDoc(this.#store, vault, p.writerId, {
+      lastSeen: p.lastSeen,
+      quiescedAtVersion: p.quiescedAtVersion,
+      sessionId: p.sessionId
+    });
+  }
+  observePresence(vault, onChange) {
+    let last = null;
+    let busy = false;
+    const poll = async () => {
+      if (busy) return;
+      busy = true;
+      try {
+        const docs = await listClientDocs(this.#store, vault);
+        const writers = docs.map(toPresence);
+        if (last === null || !presenceListEqual(last, writers)) {
+          last = writers;
+          onChange(writers);
+        }
+      } catch {
+      } finally {
+        busy = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => void poll(), this.#pollIntervalMs);
+    unref(timer);
+    return () => clearInterval(timer);
+  }
+  async reachableWriters(vault, o) {
+    const docs = await listClientDocs(this.#store, vault);
+    return docs.map(toPresence).filter((w) => o.now - w.lastSeen <= o.staleMs);
+  }
+};
+function unref(timer) {
+  const t = timer;
+  if (typeof t.unref === "function") t.unref();
+}
+export {
+  StoreCoordinationProvider
+};
+//# sourceMappingURL=store-coordination-provider-5KDS2RRP.js.map

package/dist/sync/index.js

@@ -2,17 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-TAKWLZZX.js";
+} from "../chunk-VXZNSPJM.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
-import "../chunk-S7VFUQM2.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-4OMCIY6F.js";
+} from "../chunk-NRYNRSGV.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -23,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-KJ2BCBTL.js";
+} from "../chunk-3QSOFZQB.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -32,14 +32,14 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-P33LUIML.js";
+} from "../chunk-S7TAPIRS.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-TAKWLZZX.js";
+} from "../chunk-VXZNSPJM.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-7BWJHO2A.js";
+import "../chunk-KKYEZCQG.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -57,19 +57,19 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-J4LPNIGK.js";
-import "../chunk-OVYRLHPE.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+} from "../chunk-CCIR2OJH.js";
+import "../chunk-JGUZMC3I.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   TeamNotEnabledError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.js

@@ -9,19 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-7P2SDJG3.js";
-import "../chunk-7BWJHO2A.js";
-import "../chunk-MCHVVJIA.js";
-import "../chunk-QA2KUPCP.js";
-import "../chunk-2OV5NVE7.js";
-import "../chunk-VEPTFUJY.js";
-import "../chunk-HYR4WZZ3.js";
+} from "../chunk-AKEOHKMT.js";
+import "../chunk-KKYEZCQG.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-3OPY6MK2.js";
-import "../chunk-YN5IAHN6.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   TiersNotEnabledError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-ICXIFFYZ.js";
+} from "../chunk-AAIIDAUC.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-S7VFUQM2.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-ZHTJJICG.js");
+      const { GuardExecutor } = await import("../executor-UPSH5O3F.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/verify-QK76NJ4G.js

@@ -0,0 +1,139 @@
+import {
+  blindedEqual,
+  evaluateKofN,
+  openVdigPayload
+} from "./chunk-XS6DLN67.js";
+import {
+  dualReadSealedSlot
+} from "./chunk-NM3IFKBL.js";
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  generateSalt
+} from "./chunk-37WOJQWY.js";
+import {
+  ClassifiedConfigError,
+  ClassifiedVerifyError
+} from "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/kernel/enclave/classify/verify.ts
+async function padOnce(iter = VDIG_ITERATIONS) {
+  const dummy = await pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
+  await blindedEqual(dummy, dummy);
+}
+async function padFalse() {
+  await padOnce();
+  return { ok: false };
+}
+function refuseSealedResidue(collection, field) {
+  throw new ClassifiedConfigError(
+    collection,
+    `field "${field}" carries a recoverable _sealed slot but no _vdig \u2014 storage-form transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`
+  );
+}
+async function verifyDigestField(ctx, id, field, candidate, policy) {
+  const env = await ctx.getEnvelope(id);
+  if (env === null) return padFalse();
+  const blob = env._vdig?.[field];
+  if (blob === void 0) {
+    if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
+    return padFalse();
+  }
+  const cek = await ctx.resolveCek(env);
+  if (cek === void 0) return padFalse();
+  let payload;
+  try {
+    payload = await openVdigPayload(blob, cek, ctx.collection, id, field);
+  } catch {
+    return padFalse();
+  }
+  const normalized = normalizeForVerify(policy.normalize, candidate);
+  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter);
+  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash));
+  if (!ok) return { ok: false };
+  if (policy.rotateDays !== void 0 && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 864e5) {
+    return { ok: true, mustRotate: true };
+  }
+  return { ok: true };
+}
+async function verifyTextField(ctx, id, field, candidate, normalize) {
+  const env = await ctx.getEnvelope(id);
+  const blob = env?._sealed?.[field];
+  let stored;
+  if (env !== null && blob !== void 0) {
+    const cek = await ctx.resolveCek(env);
+    const dek = await ctx.getDEK();
+    try {
+      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)));
+    } catch {
+      stored = void 0;
+    }
+  }
+  await padOnce();
+  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate));
+  const b = stored !== void 0 ? new TextEncoder().encode(normalizeForVerify(normalize, stored)) : a;
+  const eq = await blindedEqual(a, b);
+  return { ok: stored !== void 0 && eq };
+}
+async function matchGroupFields(ctx, id, answers, members, opts) {
+  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {
+    throw new ClassifiedVerifyError(
+      ctx.collection,
+      "*",
+      `matchGroup min ${opts.min} out of range 1..${members.length}`
+    );
+  }
+  const normalized = /* @__PURE__ */ new Map();
+  for (const m of members) {
+    const answer = answers[m.field];
+    if (answer === void 0) continue;
+    if (typeof answer !== "string") {
+      throw new ClassifiedVerifyError(ctx.collection, m.field, "candidate must be a string");
+    }
+    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer));
+  }
+  const env = await ctx.getEnvelope(id);
+  if (env !== null) {
+    for (const m of members) {
+      if (env._sealed?.[m.field] !== void 0 && env._vdig?.[m.field] === void 0) {
+        refuseSealedResidue(ctx.collection, m.field);
+      }
+    }
+  }
+  const cek = env !== null ? await ctx.resolveCek(env) : void 0;
+  const results = [];
+  for (const m of members) {
+    const candidate = normalized.get(m.field);
+    const blob = env?._vdig?.[m.field];
+    if (env === null || cek === void 0 || blob === void 0) {
+      await padOnce();
+      results.push(false);
+      continue;
+    }
+    try {
+      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field);
+      if (candidate === void 0) {
+        await padOnce(payload.iter);
+        results.push(false);
+        continue;
+      }
+      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter);
+      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)));
+    } catch {
+      await padOnce();
+      results.push(false);
+    }
+  }
+  return { passed: evaluateKofN(results, opts.min) };
+}
+export {
+  matchGroupFields,
+  verifyDigestField,
+  verifyTextField
+};
+//# sourceMappingURL=verify-QK76NJ4G.js.map

package/dist/via/blob/active.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Active blob strategy factory. Calling `blobs()` returns a
+ * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound
+ * to the caller's record. The returned strategy is passed into
+ * `createNoydb({ blobStrategy: blobs() })` to light up the
+ * `collection.blob(id)` path.
+ *
+ * This module is only reachable through the `@noy-db/hub/blobs`
+ * subpath — a consumer that never imports the subpath ships none of
+ * this (ESM tree-shaking + hub's `"sideEffects": false`).
+ */
+import type { BlobStrategy } from '../../port/with/blob-strategy.js';
+/**
+ * Build a default `BlobStrategy` ready to pass into `createNoydb`.
+ *
+ * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to
+ * avoid shadowing the very common local idiom
+ * `const blobs = invoices.blob(id)` in user code.
+ *
+ * @example
+ * ```ts
+ * import { createNoydb } from '@noy-db/hub'
+ * import { withBlobs } from '@noy-db/hub/blobs'
+ *
+ * const db = await createNoydb({
+ *   store, user, secret,
+ *   blobStrategy: withBlobs(),
+ * })
+ *
+ * // Now live — delegates to BlobSet.
+ * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)
+ * ```
+ */
+export declare function withBlobs(): BlobStrategy;

package/dist/via/blob/binding.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The blob `ViaBinding` (#629 Task 7) — wires the `blobFields` declaration
+ * into the kernel's generic Via port as a deliberately THIN binding:
+ * declaration + posture + `describeFragment` + `erase` glue, and nothing
+ * else. Blob content is fully out-of-band (`collection.blob(id)` →
+ * `BlobSet` writing `_blob_*` side-collections; it never touches
+ * `_putInternal` or the record codec), so this binding declares **no
+ * write/read pipeline hooks** — in particular no `encodeAtRest`/
+ * `decodeAtRest`: a blobFields collection must not flip the pipeline's
+ * `hasAtRestHooks`, or the codec would abandon its inline seal path for a
+ * feature that never seals record fields. The routing/compaction/TTL/
+ * legal-hold/exportBlobs machinery stays service-side in
+ * `with-shape/blobs/` (the i18n-dictionary precedent — that machinery
+ * does real chunk AEAD + key-lifecycle work `via-enclave-isolation`
+ * forbids under `via/*`).
+ *
+ * Like classified (see `port/with/classified-strategy.ts`), the link is
+ * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module
+ * load. `blobFields` policies are plain object literals (there is no
+ * `blob.*()` declaration factory to hang a lazy link on), so the binder
+ * must be installed before `compileViaBindings` ever sees one.
+ *
+ * There is no `declare`-time validation: `blobFields` has never had a
+ * construction-time refusal matrix (policies are consulted lazily by
+ * `vault.compact()` and `BlobSet.put`), and inventing one here would
+ * break the behavior lock.
+ *
+ * `covers` (#629 Task 8) is a passive coverage predicate, not a pipeline
+ * hook — it lets `ViaPipeline.postureFor` recognize a `blobFields` slot so
+ * `.where()`/`.orderBy()`/`.aggregate()` can refuse it (posture
+ * `queryable: 'none'`); it does not participate in clause building or
+ * evaluation.
+ */
+import type { ViaBinding, ViaEraseReport } from '../../kernel/via/index.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
+/**
+ * Config a blob collection's `blobFields` declaration resolves to — the
+ * binding's construction input. `purgeBlobsForRecord` is an OPTIONAL
+ * vault/service-provided closure for the `erase` hook, mapping
+ * `collection.blob(id).shredAllForRecord()`'s `{shredded, retainedShared,
+ * residue}: string[]` accounting onto `ViaEraseReport` — `shredded`/
+ * `retainedShared` become counts, each residue eTag becomes a tagged
+ * `{kind: 'blob-residue', eTag}` entry.
+ *
+ * DELIBERATELY left unwired by `compileViaBindings` (#629 Task 10, resolved
+ * within parity-first — see task-10-report.md "blob purge" section):
+ * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is
+ * gated SOLELY on the vault's `blobStrategy` being configured, never on a
+ * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,
+ * and IS exercised by those tests, on collections with no `blobFields` at
+ * all). Routing it exclusively through this binding would silently stop
+ * blob crypto-shredding for every such collection; `vault.forget()` keeps
+ * calling `collection.blob(id).shredAllForRecord()` directly for that
+ * reason. The hook stays real/tested (see `blob-binding.test.ts`) for a
+ * future caller that wants it.
+ */
+export interface BlobViaConfig {
+    readonly fields: BlobFieldsConfig;
+    readonly collectionName: string;
+    /** Purge one record's blob slots (crypto-shred participation). Returns the erase report for `forget()`'s summary. */
+    readonly purgeBlobsForRecord?: (id: string) => Promise<ViaEraseReport>;
+}
+/**
+ * One field's blob knobs as they appear on `describeFragment()`'s payload
+ * (#657 — the second real `ViaBinding.describeFragment` consumer after
+ * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).
+ * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;
+ * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the
+ * decrypted record) as presence flags, since a predicate has no serializable
+ * form — mirrors `buildBlobDescribeFragment`'s per-field shape below.
+ */
+export interface BlobDescribeFragmentEntry {
+    readonly retainDays?: number;
+    readonly evictWhen?: true;
+    readonly legalHold?: true;
+    readonly retainUntil?: true;
+    readonly external?: true;
+    readonly public?: true;
+    readonly backlink?: string;
+}
+/** The `'blob'` binding's `describeFragment()` payload shape. */
+export interface BlobDescribeFragment {
+    readonly blobFields: Record<string, BlobDescribeFragmentEntry>;
+}
+export declare function blobBinding(cfg: BlobViaConfig): ViaBinding;
+export declare function linkBlobVia(): void;

package/dist/via/blob/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @noy-db/hub/blobs — opt-in blob / document service.
+ *
+ * @category capability
+ *
+ * This subpath fronts every blob-storage entry point: `BlobSet`
+ * (slot-based attachments with chunked encryption and dedup),
+ * `mime-magic` (MIME detection from magic bytes), `blob-compaction`
+ * (TTL eviction via `blobFields`), `export-blobs` (bulk export
+ * primitive), and the legacy `attachments` API. The barrel + the
+ * `withBlobs()` factory live here in `via/blob/` (#629 Task 7);
+ * the content-crypto machinery itself stays in `with-shape/blobs/`
+ * (service-side — it does real chunk AEAD/key-lifecycle work the
+ * `via-enclave-isolation` guard forbids under `via/*`).
+ *
+ * Hub's root barrel (`@noy-db/hub`) still re-exports `BlobSet` + the
+ * MIME helpers for backward compatibility with `@noy-db/as-blob`,
+ * `@noy-db/as-zip`, and any consumer written before this split. New
+ * code should prefer this subpath so the import boundary is explicit.
+ */
+export { withBlobs } from './active.js';
+export type { BlobStrategy, BlobStrategyOpenArgs } from '../../port/with/blob-strategy.js';
+export { memoryObjectProjection } from '../../with-shape/blobs/object-projection.js';
+export type { ObjectProjection, ObjectMeta, ObjectListEntry, PutObjectOptions, ObjectUrlOptions, PutUrlOptions, } from '../../with-shape/blobs/object-projection.js';
+export { importExternalObjects } from '../../with-shape/blobs/import-external.js';
+export type { ImportableCollection, ImportExternalOptions, ImportExternalResult, } from '../../with-shape/blobs/import-external.js';
+export { BlobSet } from '../../with-shape/blobs/blob-set.js';
+export { BLOB_COLLECTION, BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION, BLOB_SLOTS_PREFIX, BLOB_VERSIONS_PREFIX, DEFAULT_CHUNK_SIZE, } from '../../with-shape/blobs/blob-set.js';
+export type { BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from '../../kernel/types.js';
+export { detectMimeType, detectMagic, isPreCompressed } from '../../with-shape/blobs/mime-magic.js';
+export { runCompaction, BLOB_EVICTION_AUDIT_COLLECTION } from '../../with-shape/blobs/blob-compaction.js';
+export type { BlobFieldsConfig, BlobFieldPolicy, BlobEvictionEntry, CompactRunOptions, CompactionResult, CompactionContext, } from '../../with-shape/blobs/blob-compaction.js';
+export { createExportBlobsHandle, ExportBlobsAbortedError, EXPORT_AUDIT_COLLECTION, } from '../../with-shape/blobs/export-blobs.js';
+export type { ExportBlobsOptions, ExportedBlob, ExportBlobsHandle, ExportBlobsAuditEntry, } from '../../with-shape/blobs/export-blobs.js';

package/dist/via/classified/active.d.ts

@@ -0,0 +1,3 @@
+import type { ClassifiedStrategy } from './strategy.js';
+/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */
+export declare function withClassified(): ClassifiedStrategy;