@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.3

package/dist/adapter/index.d.ts

@@ -1,5 +1,5 @@
-export { dq as BundleVersionConflictError, eJ as ConflictError, cV as EncryptedEnvelope, ge as ListPageResult, gM as NetworkError, gS as NoydbBundleStore, cT as NoydbStore, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, j1 as TxOp, jg as VaultSnapshot } from '../index-_6At2_9_.js';
+export { dq as BundleVersionConflictError, e$ as ConflictError, cV as EncryptedEnvelope, gw as ListPageResult, h2 as NetworkError, h8 as NoydbBundleStore, cT as NoydbStore, iV as StoreCapabilities, iW as StoreCapabilityError, iX as StoreTime, jj as TxOp, jy as VaultSnapshot } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/adapter/index.js

@@ -4,7 +4,7 @@ import {
   ConflictError,
   NetworkError,
   StoreCapabilityError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/aggregate/index.d.ts

@@ -1,7 +1,7 @@
-import { aO as AggregateStrategy } from '../index-_6At2_9_.js';
-export { aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, a_ as LiveAggregation, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, b2 as avg, b3 as buildLiveAggregation, b4 as count, b5 as groupAndReduce, b6 as max, b7 as min, b8 as moneyMax, b9 as moneyMin, ba as moneySum, bb as reduceRecords, bc as reducerBuilder, bd as resetGroupByWarnings, be as sum } from '../index-_6At2_9_.js';
+import { aO as AggregateStrategy } from '../index-D05bV0_g.js';
+export { aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, a_ as LiveAggregation, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, b2 as avg, b3 as buildLiveAggregation, b4 as count, b5 as groupAndReduce, b6 as max, b7 as min, b8 as moneyMax, b9 as moneyMin, ba as moneySum, bb as reduceRecords, bc as reducerBuilder, bd as resetGroupByWarnings, be as sum } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/aggregate/index.js

@@ -18,10 +18,10 @@ import {
   reducerBuilder,
   resetGroupByWarnings,
   sum
-} from "../chunk-LV7M27WM.js";
-import "../chunk-M2YKN37S.js";
-import "../chunk-5LUY7UTV.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-NPVICKZE.js";
+import "../chunk-QLQS5A7X.js";
+import "../chunk-7IP75FP2.js";
+import "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/aggregate/active.ts

package/dist/api-LORZ2EZU.js

@@ -0,0 +1,17 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-MCJAUQGE.js";
+import "./chunk-2N4MUSF3.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-LORZ2EZU.js.map

package/dist/as/index.d.ts

@@ -1,7 +1,7 @@
-export { V as VaultDiff, d as diffVault } from '../vault-diff-BtpiBvic.js';
-export { N as NoydbPodHeader, W as WritePodOptions, r as readPod, a as readPodHeader, w as writePod } from '../bundle-PwBGkhpe.js';
-export { V as Vault } from '../index-_6At2_9_.js';
+export { V as VaultDiff, d as diffVault } from '../vault-diff-Fn0WeY2w.js';
+export { N as NoydbPodHeader, W as WritePodOptions, r as readPod, a as readPodHeader, w as writePod } from '../bundle-B-P3_Jvb.js';
+export { V as Vault } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/as/index.js

@@ -2,18 +2,21 @@ import "../chunk-CHFZDSE4.js";
 import {
   diffVault
 } from "../chunk-LB7FD65R.js";
-import "../chunk-AZAOEIKW.js";
+import "../chunk-VHEEU4ZO.js";
 import {
   readPod,
   readPodHeader,
   writePod
-} from "../chunk-FISN7WE4.js";
-import "../chunk-SMXWYP24.js";
+} from "../chunk-3UDPDRUC.js";
+import "../chunk-VBYVKOMJ.js";
 import "../chunk-ZJADGNYF.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+import "../chunk-5EZAJEES.js";
+import "../chunk-6RASM2J4.js";
+import "../chunk-CPAROOKP.js";
+import "../chunk-L4IRFTIF.js";
+import "../chunk-OCDUQUAP.js";
+import "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 export {
   diffVault,

package/dist/at/index.d.ts

@@ -1,5 +1,5 @@
-export { dg as SealingKeyProvider } from '../index-_6At2_9_.js';
+export { dg as SealingKeyProvider } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/attestation/index.d.ts

@@ -1,8 +1,8 @@
-import { dy as AttestationStrategy } from '../index-_6At2_9_.js';
-export { dz as AttestationError, dA as AttestationNotEnabledError, dB as IssueArgs, dC as IssueContext, dD as IssueResult, dE as NO_ATTESTATION, dF as RevokeContext, dG as getRevokedDocIdsCore, dH as issueAttestationCore, dI as publishRevocationListCore, dJ as revokeDocCore, dK as unrevokeDocCore } from '../index-_6At2_9_.js';
+import { dy as AttestationStrategy } from '../index-D05bV0_g.js';
+export { dz as AttestationError, dA as AttestationNotEnabledError, dB as IssueArgs, dC as IssueContext, dD as IssueResult, dE as NO_ATTESTATION, dF as RevokeContext, dG as getRevokedDocIdsCore, dH as issueAttestationCore, dI as publishRevocationListCore, dJ as revokeDocCore, dK as unrevokeDocCore } from '../index-D05bV0_g.js';
 export { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, decodeQr, isRevoked, signRevocationList, verifyAttestation, verifyRevocationList } from '@noy-db/attestation';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 
 /**

package/dist/attestation/index.js

@@ -1,36 +1,39 @@
-import {
-  issueAttestationCore
-} from "../chunk-AXRXJTE2.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-I2NOIW44.js";
+} from "../chunk-P6DN5QU7.js";
+import {
+  issueAttestationCore
+} from "../chunk-PUNJAEY6.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-JNUWZ6D3.js";
+} from "../chunk-E4YJUNPU.js";
 import {
   NO_ATTESTATION
-} from "../chunk-WYSO2NIH.js";
+} from "../chunk-ZRDYQZYH.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+import "../chunk-5EZAJEES.js";
+import "../chunk-6RASM2J4.js";
+import "../chunk-CPAROOKP.js";
+import "../chunk-L4IRFTIF.js";
+import "../chunk-OCDUQUAP.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-Y6UVIR43.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-F4SYPJGJ.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-PNKTBVF7.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-AE56T5HE.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -40,19 +43,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-TUFRGI6S.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-JV26NTQD.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-TUFRGI6S.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-JV26NTQD.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-TUFRGI6S.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-JV26NTQD.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-TUFRGI6S.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-JV26NTQD.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/attestation/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/index.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { withAttestation } from './active.js'\nexport { NO_ATTESTATION, type AttestationStrategy } from './strategy.js'\nexport { AttestationNotEnabledError } from '../../kernel/errors.js'\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../../kernel/errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;AChCA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore"]}
+{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/index.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { withAttestation } from './active.js'\nexport { NO_ATTESTATION, type AttestationStrategy } from './strategy.js'\nexport { AttestationNotEnabledError } from '../../kernel/errors.js'\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../../kernel/errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;AChCA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore"]}

package/dist/{backup-KMJQ66MF.js → backup-NGRJ46SH.js}

@@ -1,21 +1,24 @@
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-GYGWYIOZ.js";
+} from "./chunk-6I2YPLAG.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-26LGBE4T.js";
+} from "./chunk-U6OM4E67.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-5O3AOPDT.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-OCDUQUAP.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -216,4 +219,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-KMJQ66MF.js.map
+//# sourceMappingURL=backup-NGRJ46SH.js.map

package/dist/{backup-KMJQ66MF.js.map → backup-NGRJ46SH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data)\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\nexport async function loadVault(ctx: BackupContext, backupJson: string): Promise<void> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n\n  // 1. Restore data collections.\n  await ctx.adapter.saveAll(ctx.vault, backup.collections)\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    const envelope = {\n      _noydb: 1 as const,\n      _v: 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: JSON.stringify(keyringFile),\n    }\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`).\n  //    Required so verifyBackupIntegrity has the chain to walk.\n  if (backup._internal) {\n    for (const [internalName, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 5. Run the verification gate. Legacy backups (no ledgerHead)\n  //    skip this with a one-line warning so existing consumers can\n  //    still read them while migrating.\n  if (!backup.ledgerHead) {\n    console.warn(\n      `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n      `verifiable-backup integrity check skipped. ` +\n      `Re-export with a ledger-aware build to get tamper detection.`,\n    )\n    return\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiFA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,KAAK;AAAA,IACjD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA,IAC/B,GAAG,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EACrF;AACA,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAQA,eAAsB,UAAU,KAAoB,YAAmC;AACrF,QAAM,SAAS,KAAK,MAAM,UAAU;AAGpC,QAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAGvD,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AACnE,UAAM,WAAW;AAAA,MACf,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,KAAK,UAAU,WAAW;AAAA,IACnC;AACA,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAIA,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAKrB,MAAI,CAAC,OAAO,YAAY;AACtB,YAAQ;AAAA,MACN;AAAA,IAGF;AACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data)\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\nexport async function loadVault(ctx: BackupContext, backupJson: string): Promise<void> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n\n  // 1. Restore data collections.\n  await ctx.adapter.saveAll(ctx.vault, backup.collections)\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    const envelope = {\n      _noydb: 1 as const,\n      _v: 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: JSON.stringify(keyringFile),\n    }\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`).\n  //    Required so verifyBackupIntegrity has the chain to walk.\n  if (backup._internal) {\n    for (const [internalName, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 5. Run the verification gate. Legacy backups (no ledgerHead)\n  //    skip this with a one-line warning so existing consumers can\n  //    still read them while migrating.\n  if (!backup.ledgerHead) {\n    console.warn(\n      `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n      `verifiable-backup integrity check skipped. ` +\n      `Re-export with a ledger-aware build to get tamper detection.`,\n    )\n    return\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiFA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,KAAK;AAAA,IACjD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA,IAC/B,GAAG,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EACrF;AACA,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAQA,eAAsB,UAAU,KAAoB,YAAmC;AACrF,QAAM,SAAS,KAAK,MAAM,UAAU;AAGpC,QAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAGvD,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AACnE,UAAM,WAAW;AAAA,MACf,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,KAAK,UAAU,WAAW;AAAA,IACnC;AACA,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAIA,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAKrB,MAAI,CAAC,OAAO,YAAY;AACtB,YAAQ;AAAA,MACN;AAAA,IAGF;AACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}

package/dist/blobs/index.d.ts

@@ -1,8 +1,8 @@
-import { X as BlobStrategy } from '../index-_6At2_9_.js';
-export { Y as BLOB_CHUNKS_COLLECTION, Z as BLOB_COLLECTION, _ as BLOB_EVICTION_AUDIT_COLLECTION, $ as BLOB_INDEX_COLLECTION, a0 as BLOB_SLOTS_PREFIX, a1 as BLOB_VERSIONS_PREFIX, a2 as BlobEvictionEntry, a3 as BlobFieldPolicy, a4 as BlobFieldsConfig, a5 as BlobObject, a6 as BlobPutOptions, a7 as BlobResponseOptions, a8 as BlobSet, a9 as BlobStrategyOpenArgs, aa as CompactRunOptions, ab as CompactionContext, ac as CompactionResult, ad as DEFAULT_CHUNK_SIZE, ae as EXPORT_AUDIT_COLLECTION, af as ExportBlobsAbortedError, ag as ExportBlobsAuditEntry, ah as ExportBlobsHandle, ai as ExportBlobsOptions, aj as ExportedBlob, ak as ObjectListEntry, al as ObjectMeta, am as ObjectProjection, an as ObjectUrlOptions, ao as PutObjectOptions, ap as PutUrlOptions, aq as SlotInfo, ar as SlotRecord, as as VersionRecord, at as createExportBlobsHandle, au as memoryObjectProjection, av as runCompaction } from '../index-_6At2_9_.js';
-export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from '../mime-magic-B4RoFj3B.js';
+import { X as BlobStrategy } from '../index-D05bV0_g.js';
+export { Y as BLOB_CHUNKS_COLLECTION, Z as BLOB_COLLECTION, _ as BLOB_EVICTION_AUDIT_COLLECTION, $ as BLOB_INDEX_COLLECTION, a0 as BLOB_SLOTS_PREFIX, a1 as BLOB_VERSIONS_PREFIX, a2 as BlobEvictionEntry, a3 as BlobFieldPolicy, a4 as BlobFieldsConfig, a5 as BlobObject, a6 as BlobPutOptions, a7 as BlobResponseOptions, a8 as BlobSet, a9 as BlobStrategyOpenArgs, aa as CompactRunOptions, ab as CompactionContext, ac as CompactionResult, ad as DEFAULT_CHUNK_SIZE, ae as EXPORT_AUDIT_COLLECTION, af as ExportBlobsAbortedError, ag as ExportBlobsAuditEntry, ah as ExportBlobsHandle, ai as ExportBlobsOptions, aj as ExportedBlob, ak as ObjectListEntry, al as ObjectMeta, am as ObjectProjection, an as ObjectUrlOptions, ao as PutObjectOptions, ap as PutUrlOptions, aq as SlotInfo, ar as SlotRecord, as as VersionRecord, at as createExportBlobsHandle, au as memoryObjectProjection, av as runCompaction } from '../index-D05bV0_g.js';
+export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from '../mime-magic-Qr_4HjP6.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/blobs/index.js

@@ -8,7 +8,7 @@ import {
   ExportBlobsAbortedError,
   createExportBlobsHandle,
   runCompaction
-} from "../chunk-Y22T3KQE.js";
+} from "../chunk-2KSPDSWI.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -20,10 +20,13 @@ import {
   detectMagic,
   detectMimeType,
   isPreCompressed
-} from "../chunk-DFEMTNPJ.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-55HDKLI3.js";
+import "../chunk-5EZAJEES.js";
+import "../chunk-6RASM2J4.js";
+import "../chunk-CPAROOKP.js";
+import "../chunk-L4IRFTIF.js";
+import "../chunk-OCDUQUAP.js";
+import "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-shape/blobs/active.ts

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-shape/blobs/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from './blob-set.js'\nimport type { BlobStrategy } from './strategy.js'\n\n/**\n * Build a default `BlobStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(): BlobStrategy {\n  return {\n    openSlot(args) {\n      return new BlobSet(args)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCO,SAAS,YAA0B;AACxC,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-shape/blobs/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from './blob-set.js'\nimport type { BlobStrategy } from './strategy.js'\n\n/**\n * Build a default `BlobStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(): BlobStrategy {\n  return {\n    openSlot(args) {\n      return new BlobSet(args)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCO,SAAS,YAA0B;AACxC,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}

package/dist/bundle/index.d.ts

@@ -1,11 +1,11 @@
-import { T as TransferSealPayload } from '../bundle-PwBGkhpe.js';
-export { C as COMPRESSION_BROTLI, b as COMPRESSION_GZIP, c as COMPRESSION_NONE, d as CompressionAlgo, F as FLAG_COMPRESSED, e as FLAG_HAS_INTEGRITY_HASH, f as NOYDB_BUNDLE_FORMAT_VERSION, g as NOYDB_BUNDLE_MAGIC, h as NOYDB_BUNDLE_PREFIX_BYTES, i as NoydbBundleHeader, j as NoydbBundleReadResult, N as NoydbPodHeader, R as ReadNoydbBundleOptions, k as WriteNoydbBundleOptions, W as WritePodOptions, l as encodeBundleHeader, m as readNoydbBundle, n as readNoydbBundleHeader, r as readPod, a as readPodHeader, o as resetBrotliSupportCache, v as validateBundleHeader, p as writeNoydbBundle, w as writePod } from '../bundle-PwBGkhpe.js';
+import { T as TransferSealPayload } from '../bundle-B-P3_Jvb.js';
+export { C as COMPRESSION_BROTLI, b as COMPRESSION_GZIP, c as COMPRESSION_NONE, d as CompressionAlgo, F as FLAG_COMPRESSED, e as FLAG_HAS_INTEGRITY_HASH, f as NOYDB_BUNDLE_FORMAT_VERSION, g as NOYDB_BUNDLE_MAGIC, h as NOYDB_BUNDLE_PREFIX_BYTES, i as NoydbBundleHeader, j as NoydbBundleReadResult, N as NoydbPodHeader, R as ReadNoydbBundleOptions, k as WriteNoydbBundleOptions, W as WritePodOptions, l as encodeBundleHeader, m as readNoydbBundle, n as readNoydbBundleHeader, r as readPod, a as readPodHeader, o as resetBrotliSupportCache, v as validateBundleHeader, p as writeNoydbBundle, w as writePod } from '../bundle-B-P3_Jvb.js';
 export { g as generateULID, i as isULID } from '../ulid-DRH25k3y.js';
-import { V as Vault, df as WalkClosureOptions, cT as NoydbStore, dg as SealingKeyProvider, dh as RecoveryEnrollmentInput, di as ShamirRecoveryProvider, dj as EnclaveKey } from '../index-_6At2_9_.js';
-export { dk as AdoptionStateError, dl as BackupCorruptedError, dm as BackupLedgerError, dn as BundleIntegrityError, dp as BundleSealMismatchError, dq as BundleVersionConflictError, dr as ClosureResult, ds as ExtractPartitionResult, dt as PartitionExtractionError, du as PodVersionConflictError, dv as TransferSealError, dw as extractPartition, dx as walkClosure } from '../index-_6At2_9_.js';
+import { V as Vault, df as WalkClosureOptions, cT as NoydbStore, dg as SealingKeyProvider, dh as RecoveryEnrollmentInput, di as ShamirRecoveryProvider, dj as EnclaveKey } from '../index-D05bV0_g.js';
+export { dk as AdoptionStateError, dl as BackupCorruptedError, dm as BackupLedgerError, dn as BundleIntegrityError, dp as BundleSealMismatchError, dq as BundleVersionConflictError, dr as ClosureResult, ds as ExtractPartitionResult, dt as PartitionExtractionError, du as PodVersionConflictError, dv as TransferSealError, dw as extractPartition, dx as walkClosure } from '../index-D05bV0_g.js';
 export { D as DecryptedRecord, d as decryptExtractedPartition } from '../decrypt-partition-IHtxEnTi.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-Ccd1hS7a.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/bundle/index.js

@@ -1,18 +1,18 @@
 import {
   extractPartition,
   walkClosure
-} from "../chunk-76722EBH.js";
+} from "../chunk-IWVWB7BZ.js";
 import "../chunk-CHFZDSE4.js";
 import {
   adoptPartition,
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition,
   unsealDeks
-} from "../chunk-QZISFCVG.js";
-import "../chunk-26LGBE4T.js";
-import "../chunk-ZCGAHGUS.js";
-import "../chunk-DFEMTNPJ.js";
-import "../chunk-AZAOEIKW.js";
+} from "../chunk-6DP5HBQD.js";
+import "../chunk-U6OM4E67.js";
+import "../chunk-AY4P6PHN.js";
+import "../chunk-55HDKLI3.js";
+import "../chunk-VHEEU4ZO.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -31,19 +31,22 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-FISN7WE4.js";
-import "../chunk-SMXWYP24.js";
-import "../chunk-WWGT2MDV.js";
-import "../chunk-ITNUCOXM.js";
+} from "../chunk-3UDPDRUC.js";
+import "../chunk-VBYVKOMJ.js";
+import "../chunk-5A6TC3RQ.js";
+import "../chunk-2N4MUSF3.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-LXQT4WMP.js";
+import "../chunk-DHIN36UC.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-AIWULCUO.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+import "../chunk-6EVZXETK.js";
+import "../chunk-5EZAJEES.js";
+import "../chunk-6RASM2J4.js";
+import "../chunk-CPAROOKP.js";
+import "../chunk-L4IRFTIF.js";
+import "../chunk-OCDUQUAP.js";
 import {
   AdoptionStateError,
   BackupCorruptedError,
@@ -54,7 +57,7 @@ import {
   PartitionExtractionError,
   PodVersionConflictError,
   TransferSealError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-cargo/describe-extraction.ts

package/dist/bundle/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-cargo/describe-extraction.ts"],"sourcesContent":["/**\n * Partition-extraction dry-run. Read-only preview of what an\n * `extractPartition` would move: record counts, byte totals, and the\n * timestamp span per collection — computed from raw encrypted\n * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { walkClosure, type WalkClosureOptions } from './walk-closure.js'\n\nexport interface ExtractionPreview {\n  readonly totalRecords: number\n  /** Sum of serialized encrypted-envelope sizes (bytes). */\n  readonly totalBytes: number\n  readonly byCollection: ReadonlyArray<{\n    readonly name: string\n    readonly recordCount: number\n    readonly bytes: number\n    /** Earliest envelope `_ts` in this collection (lexicographic). */\n    readonly oldestTs?: string\n    readonly newestTs?: string\n  }>\n  readonly graph: { readonly depth: number; readonly cyclesDetected: boolean }\n  /** Records the walk reached but whose envelope couldn't be read. */\n  readonly inaccessible: ReadonlyArray<{ readonly collection: string; readonly id: string }>\n}\n\nexport async function describeExtraction(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ExtractionPreview> {\n  const { closure, graph } = await walkClosure(vault, opts)\n\n  const { name: vaultName, adapter } = vault._introspectState()\n  const encoder = new TextEncoder()\n\n  const byCollection: Array<{\n    name: string; recordCount: number; bytes: number; oldestTs?: string; newestTs?: string\n  }> = []\n  const inaccessible: Array<{ collection: string; id: string }> = []\n  let totalBytes = 0\n  let totalRecords = 0\n\n  for (const [collectionName, ids] of closure) {\n    let bytes = 0\n    let oldestTs: string | undefined\n    let newestTs: string | undefined\n    let recordCount = 0\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) {\n        // Walk reached it (via decrypted list) but the raw store read\n        // returned nothing — surface rather than miscount.\n        inaccessible.push({ collection: collectionName, id })\n        continue\n      }\n      recordCount++\n      bytes += encoder.encode(JSON.stringify(env)).length\n      const ts = env._ts\n      if (oldestTs === undefined || ts < oldestTs) oldestTs = ts\n      if (newestTs === undefined || ts > newestTs) newestTs = ts\n    }\n\n    byCollection.push({\n      name: collectionName,\n      recordCount,\n      bytes,\n      // Spread conditionally — exactOptionalPropertyTypes forbids an\n      // explicit `undefined` on an optional property.\n      ...(oldestTs !== undefined ? { oldestTs } : {}),\n      ...(newestTs !== undefined ? { newestTs } : {}),\n    })\n    totalBytes += bytes\n    totalRecords += recordCount\n  }\n\n  byCollection.sort((a, b) => a.name.localeCompare(b.name))\n\n  return Object.freeze({\n    totalRecords,\n    totalBytes,\n    byCollection,\n    graph,\n    inaccessible,\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,mBACpB,OACA,MAC4B;AAC5B,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI;AAExD,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,eAED,CAAC;AACN,QAAM,eAA0D,CAAC;AACjE,MAAI,aAAa;AACjB,MAAI,eAAe;AAEnB,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,QAAI,QAAQ;AACZ,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAElB,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,KAAK;AAGR,qBAAa,KAAK,EAAE,YAAY,gBAAgB,GAAG,CAAC;AACpD;AAAA,MACF;AACA;AACA,eAAS,QAAQ,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE;AAC7C,YAAM,KAAK,IAAI;AACf,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AACxD,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AAAA,IAC1D;AAEA,iBAAa,KAAK;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,kBAAc;AACd,oBAAgB;AAAA,EAClB;AAEA,eAAa,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAExD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/with-cargo/describe-extraction.ts"],"sourcesContent":["/**\n * Partition-extraction dry-run. Read-only preview of what an\n * `extractPartition` would move: record counts, byte totals, and the\n * timestamp span per collection — computed from raw encrypted\n * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { walkClosure, type WalkClosureOptions } from './walk-closure.js'\n\nexport interface ExtractionPreview {\n  readonly totalRecords: number\n  /** Sum of serialized encrypted-envelope sizes (bytes). */\n  readonly totalBytes: number\n  readonly byCollection: ReadonlyArray<{\n    readonly name: string\n    readonly recordCount: number\n    readonly bytes: number\n    /** Earliest envelope `_ts` in this collection (lexicographic). */\n    readonly oldestTs?: string\n    readonly newestTs?: string\n  }>\n  readonly graph: { readonly depth: number; readonly cyclesDetected: boolean }\n  /** Records the walk reached but whose envelope couldn't be read. */\n  readonly inaccessible: ReadonlyArray<{ readonly collection: string; readonly id: string }>\n}\n\nexport async function describeExtraction(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ExtractionPreview> {\n  const { closure, graph } = await walkClosure(vault, opts)\n\n  const { name: vaultName, adapter } = vault._introspectState()\n  const encoder = new TextEncoder()\n\n  const byCollection: Array<{\n    name: string; recordCount: number; bytes: number; oldestTs?: string; newestTs?: string\n  }> = []\n  const inaccessible: Array<{ collection: string; id: string }> = []\n  let totalBytes = 0\n  let totalRecords = 0\n\n  for (const [collectionName, ids] of closure) {\n    let bytes = 0\n    let oldestTs: string | undefined\n    let newestTs: string | undefined\n    let recordCount = 0\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) {\n        // Walk reached it (via decrypted list) but the raw store read\n        // returned nothing — surface rather than miscount.\n        inaccessible.push({ collection: collectionName, id })\n        continue\n      }\n      recordCount++\n      bytes += encoder.encode(JSON.stringify(env)).length\n      const ts = env._ts\n      if (oldestTs === undefined || ts < oldestTs) oldestTs = ts\n      if (newestTs === undefined || ts > newestTs) newestTs = ts\n    }\n\n    byCollection.push({\n      name: collectionName,\n      recordCount,\n      bytes,\n      // Spread conditionally — exactOptionalPropertyTypes forbids an\n      // explicit `undefined` on an optional property.\n      ...(oldestTs !== undefined ? { oldestTs } : {}),\n      ...(newestTs !== undefined ? { newestTs } : {}),\n    })\n    totalBytes += bytes\n    totalRecords += recordCount\n  }\n\n  byCollection.sort((a, b) => a.name.localeCompare(b.name))\n\n  return Object.freeze({\n    totalRecords,\n    totalBytes,\n    byCollection,\n    graph,\n    inaccessible,\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,mBACpB,OACA,MAC4B;AAC5B,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI;AAExD,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,eAED,CAAC;AACN,QAAM,eAA0D,CAAC;AACjE,MAAI,aAAa;AACjB,MAAI,eAAe;AAEnB,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,QAAI,QAAQ;AACZ,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAElB,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,KAAK;AAGR,qBAAa,KAAK,EAAE,YAAY,gBAAgB,GAAG,CAAC;AACpD;AAAA,MACF;AACA;AACA,eAAS,QAAQ,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE;AAC7C,YAAM,KAAK,IAAI;AACf,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AACxD,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AAAA,IAC1D;AAEA,iBAAa,KAAK;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,kBAAc;AACd,oBAAgB;AAAA,EAClB;AAEA,eAAa,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAExD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{bundle-PwBGkhpe.d.ts → bundle-B-P3_Jvb.d.ts}

@@ -1,4 +1,4 @@
-import { dL as PublicEnvelope, dg as SealingKeyProvider, dM as BundleRecipient, dN as RecipientSealer, dO as RecipientHint, V as Vault } from './index-_6At2_9_.js';
+import { e0 as PublicEnvelope, dg as SealingKeyProvider, e1 as BundleRecipient, e2 as RecipientSealer, e3 as RecipientHint, V as Vault } from './index-D05bV0_g.js';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-QHJW5EXU.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-JFYIHLU3.js";
+import "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 export {
   isQuorum,

package/dist/cargo/index.d.ts

@@ -1,9 +1,9 @@
-export { el as AccessibleVault, aP as AggregateResult, aQ as AggregateSpec, ew as CargoNotEnabledError, ex as CargoStrategy, ey as ChangeEvent, ci as Collection, kZ as CrossShardJoinError, eP as CustodyApi, eX as DataResidencyError, fD as GrantCustodianOptions, aB as IndexDef, fX as JoinStrategy, g5 as LiberateOptions, g6 as LiberateResult, a_ as LiveAggregation, gg as LiveQuery, gI as NO_CARGO, gO as NoAccessError, gR as Noydb, gY as Operator, dS as Query, hU as ReservedVaultNameError, hW as RetrieveHit, hX as RetrieveOptions, dg as SealingKeyProvider, iv as ShardProvisioningError, j4 as UnknownShardError, ec as Unsubscribe, jc as ValidationError, V as Vault, jh as VaultTemplateNotFoundError, jo as WriteConflict, jp as WriteQueue, b5 as groupAndReduce, k3 as liberateVault, kl as readPath, bb as reduceRecords, k_ as sha256Hex } from '../index-_6At2_9_.js';
+export { eC as AccessibleVault, aP as AggregateResult, aQ as AggregateSpec, eN as CargoNotEnabledError, eO as CargoStrategy, eP as ChangeEvent, ci as Collection, lf as CrossShardJoinError, f5 as CustodyApi, fd as DataResidencyError, fV as GrantCustodianOptions, aB as IndexDef, gd as JoinStrategy, gn as LiberateOptions, go as LiberateResult, a_ as LiveAggregation, gy as LiveQuery, g_ as NO_CARGO, h4 as NoAccessError, h7 as Noydb, he as Operator, e7 as Query, ia as ReservedVaultNameError, ic as RetrieveHit, id as RetrieveOptions, dg as SealingKeyProvider, iN as ShardProvisioningError, jm as UnknownShardError, et as Unsubscribe, ju as ValidationError, V as Vault, jz as VaultTemplateNotFoundError, jG as WriteConflict, jH as WriteQueue, b5 as groupAndReduce, kl as liberateVault, kD as readPath, bb as reduceRecords, lg as sha256Hex } from '../index-D05bV0_g.js';
 export { g as generateULID } from '../ulid-DRH25k3y.js';
 export { C as CoordinationProvider, D as DrainBarrierOptions, F as FenceState, a as WriteHook, c as WriterPresence, i as isQuorum, r as runDrainBarrier } from '../index-B9QdHytu.js';
 export { FuseOptions, fuseRetrieval } from '../kernel/index.js';
-export { a as CollectionMeta, V as VaultMeta } from '../describe-Ccd1hS7a.js';
-export { a as DeedMarker, S as STATE_VAULT_NAME, c as createDeedOwner, i as isDeedVault, l as loadDeedMarker, w as withCargo } from '../index-CGLLRtFc.js';
-export { d as diffVault } from '../vault-diff-BtpiBvic.js';
+export { a as CollectionMeta, V as VaultMeta } from '../describe-0tiXAjoO.js';
+export { a as DeedMarker, S as STATE_VAULT_NAME, c as createDeedOwner, i as isDeedVault, l as loadDeedMarker, w as withCargo } from '../index-DTMUUwwW.js';
+export { d as diffVault } from '../vault-diff-Fn0WeY2w.js';
 import '../subject-index-O75wKshW.js';
 import '@noy-db/attestation';