@noy-db/hub 0.3.0-pre.4 → 0.3.0-pre.6

package/dist/chunk-YXGIPYH4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/presence.ts","../src/with-party/team/sync.ts","../src/with-party/team/sync-transaction.ts"],"sourcesContent":["/**\n * Presence handle — real-time awareness of who is viewing/editing a collection.\n * encrypted ephemeral channel keyed by collection DEK via HKDF.\n *\n * The presence key is derived from the collection DEK so:\n *  - The adapter never learns user identities from presence payloads.\n *  - Presence rotates automatically when the DEK rotates (revoked users\n *    can no longer participate after a DEK rotation).\n *\n * Two transport strategies:\n *  1. **Pub/sub** (real-time): used when the adapter implements\n *     `presencePublish` and `presenceSubscribe`.\n *  2. **Storage-poll** (fallback): presence records are written to a\n *     reserved `_presence_<collection>` collection on the sync adapter\n *     (if available) or local adapter, and polled periodically.\n */\n\nimport type { NoydbStore, PresencePeer } from '../../kernel/types.js'\nimport { encrypt, decrypt, generateIV, bufferToBase64, derivePresenceKey, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n/** Options for constructing a PresenceHandle. @internal */\nexport interface PresenceHandleOpts {\n  /** Local adapter for storage-poll fallback. */\n  adapter: NoydbStore\n  /** Remote (sync) adapter — preferred for broadcasting presence if available. */\n  syncAdapter?: NoydbStore\n  /** Vault name — used as part of the channel and storage key. */\n  vault: string\n  /** Collection name — used as HKDF `info` and channel suffix. */\n  collectionName: string\n  /** Calling user's ID, embedded unencrypted in storage records. */\n  userId: string\n  /** Whether encryption is active. When false, presence payloads are stored as JSON. */\n  encrypted: boolean\n  /** Callback that resolves the collection DEK (used to derive the presence key). */\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  /** How long (ms) before a peer's presence is considered stale. Default: 30_000. */\n  staleMs?: number\n  /** Poll interval (ms) for the storage-poll fallback. Default: 5_000. */\n  pollIntervalMs?: number\n}\n\n/**\n * Internal storage envelope for the storage-poll fallback.\n * Written to `_presence_<collection>` as `{ userId, lastSeen, iv, data }`.\n */\ninterface StoragePresenceRecord {\n  userId: string\n  lastSeen: string\n  iv: string    // base64 AES-GCM IV (empty when not encrypted)\n  data: string  // base64 ciphertext or JSON string when not encrypted\n}\n\n/** Presence handle for a single collection. */\nexport class PresenceHandle<P> {\n  private readonly adapter: NoydbStore\n  private readonly syncAdapter: NoydbStore | undefined\n  private readonly vault: string\n  private readonly collectionName: string\n  private readonly userId: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly staleMs: number\n  private readonly pollIntervalMs: number\n  private readonly channel: string\n  private readonly storageCollection: string\n\n  private presenceKey: EnclaveKey | null = null\n  private subscribers: Array<(peers: PresencePeer<P>[]) => void> = []\n  private unsubscribePubSub: (() => void) | null = null\n  private pollTimer: ReturnType<typeof setInterval> | null = null\n  private stopped = false\n\n  constructor(opts: PresenceHandleOpts) {\n    this.adapter = opts.adapter\n    this.syncAdapter = opts.syncAdapter\n    this.vault = opts.vault\n    this.collectionName = opts.collectionName\n    this.userId = opts.userId\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.staleMs = opts.staleMs ?? 30_000\n    this.pollIntervalMs = opts.pollIntervalMs ?? 5_000\n    // Channel used by pub/sub adapters — vault-scoped so two collections\n    // in the same vault don't bleed into each other's presence channels.\n    this.channel = `${opts.vault}:${opts.collectionName}:presence`\n    // Reserved collection name for the storage-poll fallback.\n    this.storageCollection = `_presence_${opts.collectionName}`\n  }\n\n  /**\n   * Announce yourself (or update your cursor/status).\n   * Encrypts `payload` with the presence key and publishes it.\n   */\n  async update(payload: P): Promise<void> {\n    if (this.stopped) return\n\n    const key = await this.getPresenceKey()\n    const now = new Date().toISOString()\n    const plaintext = JSON.stringify({ userId: this.userId, lastSeen: now, payload })\n    let encryptedPayload: string\n\n    if (this.encrypted && key) {\n      const iv = generateIV()\n      const ivB64 = bufferToBase64(iv)\n      const { data } = await encrypt(plaintext, key)\n      encryptedPayload = JSON.stringify({ iv: ivB64, data })\n    } else {\n      encryptedPayload = plaintext\n    }\n\n    // Pub/sub path — publish to any adapter that supports it\n    const pubAdapter = this.getPubSubAdapter()\n    if (pubAdapter?.presencePublish) {\n      await pubAdapter.presencePublish(this.channel, encryptedPayload)\n    }\n\n    // Storage-poll path — write a record to the storage adapter\n    await this.writeStorageRecord(payload, now)\n  }\n\n  /**\n   * Subscribe to presence updates. The callback receives a filtered, decrypted\n   * list of all currently-active peers (excluding yourself, excluding stale).\n   *\n   * Returns an unsubscribe function. Also call `stop()` to release all resources.\n   */\n  subscribe(cb: (peers: PresencePeer<P>[]) => void): () => void {\n    if (this.stopped) return () => {}\n\n    this.subscribers.push(cb)\n\n    // Start pub/sub listener on first subscriber\n    if (this.subscribers.length === 1) {\n      this.startListening()\n    }\n\n    return () => {\n      this.subscribers = this.subscribers.filter(s => s !== cb)\n      if (this.subscribers.length === 0) this.stopListening()\n    }\n  }\n\n  /** Stop all listening and clear resources. */\n  stop(): void {\n    this.stopped = true\n    this.stopListening()\n    this.subscribers = []\n  }\n\n  // ─── Private ────────────────────────────────────────────────────────\n\n  private async getPresenceKey(): Promise<EnclaveKey | null> {\n    if (!this.encrypted) return null\n    if (!this.presenceKey) {\n      try {\n        const dek = await this.getDEK(this.collectionName)\n        this.presenceKey = await derivePresenceKey(dek, this.collectionName)\n      } catch {\n        // no-op — presence degrades gracefully if crypto fails\n      }\n    }\n    return this.presenceKey\n  }\n\n  private getPubSubAdapter(): NoydbStore | undefined {\n    // Prefer the sync adapter (it broadcasts to other devices)\n    if (this.syncAdapter?.presencePublish) return this.syncAdapter\n    if (this.adapter.presencePublish) return this.adapter\n    return undefined\n  }\n\n  private startListening(): void {\n    const pubAdapter = this.getPubSubAdapter()\n\n    if (pubAdapter?.presenceSubscribe) {\n      // Real-time pub/sub path\n      this.unsubscribePubSub = pubAdapter.presenceSubscribe(\n        this.channel,\n        (encryptedPayload) => { void this.handlePubSubMessage(encryptedPayload) },\n      )\n    } else {\n      // Storage-poll fallback\n      this.pollTimer = setInterval(\n        () => { void this.pollStoragePresence() },\n        this.pollIntervalMs,\n      )\n      // Kick off an immediate poll\n      void this.pollStoragePresence()\n    }\n  }\n\n  private stopListening(): void {\n    if (this.unsubscribePubSub) {\n      this.unsubscribePubSub()\n      this.unsubscribePubSub = null\n    }\n    if (this.pollTimer) {\n      clearInterval(this.pollTimer)\n      this.pollTimer = null\n    }\n  }\n\n  private async handlePubSubMessage(encryptedPayload: string): Promise<void> {\n    try {\n      const peer = await this.decryptPresencePayload(encryptedPayload)\n      if (!peer || peer.userId === this.userId) return\n\n      const cutoff = new Date(Date.now() - this.staleMs).toISOString()\n      if (peer.lastSeen < cutoff) return\n\n      // Deliver only this new peer to subscribers; a full snapshot poll follows\n      // on next interval. For pub/sub, we could maintain a map of active peers,\n      // but for simplicity: emit a snapshot read from storage.\n      await this.pollStoragePresence()\n    } catch {\n      // Decrypt failure — stale key or tampered payload, ignore\n    }\n  }\n\n  private async decryptPresencePayload(\n    encryptedPayload: string,\n  ): Promise<{ userId: string; lastSeen: string; payload: P } | null> {\n    const key = await this.getPresenceKey()\n\n    if (!this.encrypted || !key) {\n      return JSON.parse(encryptedPayload) as { userId: string; lastSeen: string; payload: P }\n    }\n\n    const { iv: ivB64, data } = JSON.parse(encryptedPayload) as { iv: string; data: string }\n    const plaintext = await decrypt(ivB64, data, key)\n    return JSON.parse(plaintext) as { userId: string; lastSeen: string; payload: P }\n  }\n\n  private async writeStorageRecord(payload: P, now: string): Promise<void> {\n    const key = await this.getPresenceKey()\n    const plaintext = JSON.stringify(payload)\n    let iv = ''\n    let data: string\n\n    if (this.encrypted && key) {\n      const ivBytes = generateIV()\n      iv = bufferToBase64(ivBytes)\n      const result = await encrypt(plaintext, key)\n      data = result.data\n    } else {\n      data = plaintext\n    }\n\n    const record: StoragePresenceRecord = { userId: this.userId, lastSeen: now, iv, data }\n    const json = JSON.stringify(record)\n\n    // Use the sync adapter if available (so other devices can read it);\n    // fall back to local adapter.\n    const storeAdapter = this.syncAdapter ?? this.adapter\n    const envelope = {\n      _noydb: 1 as const,\n      _v: 1,\n      _ts: now,\n      _iv: '',\n      _data: json,\n    }\n    try {\n      await storeAdapter.put(\n        this.vault,\n        this.storageCollection,\n        this.userId,\n        envelope,\n      )\n    } catch {\n      // Presence write failure is non-fatal — the user is still present locally\n    }\n  }\n\n  private async pollStoragePresence(): Promise<void> {\n    if (this.stopped || this.subscribers.length === 0) return\n\n    try {\n      const storeAdapter = this.syncAdapter ?? this.adapter\n      const ids = await storeAdapter.list(this.vault, this.storageCollection)\n      const cutoff = new Date(Date.now() - this.staleMs).toISOString()\n      const peers: PresencePeer<P>[] = []\n\n      for (const id of ids) {\n        if (id === this.userId) continue // skip ourselves\n        const envelope = await storeAdapter.get(this.vault, this.storageCollection, id)\n        if (!envelope) continue\n\n        const record = JSON.parse(envelope._data) as StoragePresenceRecord\n        if (record.lastSeen < cutoff) continue\n\n        let peerPayload: P\n        if (this.encrypted && this.presenceKey && record.iv) {\n          const plaintext = await decrypt(record.iv, record.data, this.presenceKey)\n          peerPayload = JSON.parse(plaintext) as P\n        } else {\n          peerPayload = JSON.parse(record.data) as P\n        }\n\n        peers.push({ userId: record.userId, payload: peerPayload, lastSeen: record.lastSeen })\n      }\n\n      for (const cb of this.subscribers) {\n        cb(peers)\n      }\n    } catch {\n      // Poll failure is non-fatal\n    }\n  }\n}\n","import type {\n  NoydbStore,\n  DirtyEntry,\n  Conflict,\n  ConflictStrategy,\n  CollectionConflictResolver,\n  PushOptions,\n  PullOptions,\n  PushResult,\n  PullResult,\n  SyncStatus,\n  EncryptedEnvelope,\n  SyncMetadata,\n  SyncTargetRole,\n} from '../../kernel/types.js'\nimport { NOYDB_SYNC_VERSION } from '../../kernel/types.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport type { SyncPolicy } from '../../kernel/sync-policy.js'\nimport { SyncScheduler } from '../../kernel/sync-policy.js'\n\n/** Sync engine: dirty tracking, push, pull, conflict resolution, scheduling. */\nexport class SyncEngine {\n  private readonly local: NoydbStore\n  private readonly remote: NoydbStore\n  private readonly strategy: ConflictStrategy\n  private readonly emitter: NoydbEventEmitter\n  private readonly vault: string\n  readonly role: SyncTargetRole\n  readonly label: string | undefined\n\n  private dirty: DirtyEntry[] = []\n  private lastPush: string | null = null\n  private lastPull: string | null = null\n  private loaded = false\n  private autoSyncInterval: ReturnType<typeof setInterval> | null = null\n  private isOnline = true\n\n  /** Sync scheduler. Manages push/pull timing. */\n  readonly scheduler: SyncScheduler | null\n\n  /** Per-collection conflict resolvers registered by Collection instances. */\n  private readonly conflictResolvers = new Map<string, CollectionConflictResolver>()\n\n  /**\n   * Expands a collection-name filter to include its satellite pair partner(s)\n   * (spec #591 convergence rule 5b) — wired from vault satellite declaration\n   * via `setPairExpander`. `undefined` when no satellite has ever been\n   * declared for this vault: identity behavior, zero change for non-satellite\n   * users.\n   */\n  private pairExpander?: (names: readonly string[]) => readonly string[]\n\n  constructor(opts: {\n    local: NoydbStore\n    remote: NoydbStore\n    vault: string\n    strategy: ConflictStrategy\n    emitter: NoydbEventEmitter\n    syncPolicy?: SyncPolicy\n    role?: SyncTargetRole\n    label?: string\n  }) {\n    this.local = opts.local\n    this.remote = opts.remote\n    this.vault = opts.vault\n    this.strategy = opts.strategy\n    this.emitter = opts.emitter\n    this.role = opts.role ?? 'sync-peer'\n    this.label = opts.label\n\n    // Create scheduler if a policy is provided\n    const policy = opts.syncPolicy\n    if (policy && policy.push.mode !== 'manual') {\n      this.scheduler = new SyncScheduler(policy, {\n        push: () => this.push().then(() => {}),\n        pull: () => this.pull().then(() => {}),\n        getDirtyCount: () => this.dirty.length,\n      })\n    } else {\n      this.scheduler = null\n    }\n  }\n\n  /** Start the sync scheduler. Called after vault is fully opened. */\n  startScheduler(): void {\n    this.scheduler?.start()\n  }\n\n  /** Stop the sync scheduler. Called on close. */\n  stopScheduler(): void {\n    this.scheduler?.stop()\n  }\n\n  /**\n   * Register a per-collection conflict resolver.\n   * Called by Collection when `conflictPolicy` is set.\n   *\n   * Pair-coupled (#591 rule 5b): registering for one satellite-pair member\n   * registers the same resolver for both — the pair converges under one\n   * resolution policy. Expands with whatever the pair-expander knows *at this\n   * call*; resolvers registered before their pair existed are covered by\n   * `remirrorPairResolvers` at pair-registration time.\n   */\n  registerConflictResolver(collection: string, resolver: CollectionConflictResolver): void {\n    for (const n of this.pairExpander?.([collection]) ?? [collection]) this.conflictResolvers.set(n, resolver)\n  }\n\n  /**\n   * Wire a satellite pair-expansion function (vault registration, #591 Task 11).\n   * The closure re-reads the live `SatelliteRegistry` on every call, so pairs\n   * declared after this is set are still picked up by `push`/`pull` filters.\n   */\n  setPairExpander(expander: (names: readonly string[]) => readonly string[]): void {\n    this.pairExpander = expander\n  }\n\n  /**\n   * Retroactively mirror per-collection conflict resolvers across a newly\n   * registered satellite pair (#591 rule 5b) — covers the NORMAL declaration\n   * order, where the base's `conflictPolicy` resolver was registered before\n   * the satellite was declared (so the call-time expansion in\n   * `registerConflictResolver` saw no pair yet). Tie-break: when BOTH members\n   * already carry (different) resolvers, the FIRST name in `names` wins —\n   * callers pass `[base, satellite]`, so the base's resolver is canonical.\n   * Idempotent; a later explicit registration on either member still\n   * overwrites both (last-wins, via the call-time expansion above).\n   */\n  remirrorPairResolvers(names: readonly string[]): void {\n    const canonical = names.map(n => this.conflictResolvers.get(n)).find(r => r !== undefined)\n    if (!canonical) return\n    for (const n of names) this.conflictResolvers.set(n, canonical)\n  }\n\n  /** Record a local change for later push. */\n  async trackChange(collection: string, id: string, action: 'put' | 'delete', version: number): Promise<void> {\n    await this.ensureLoaded()\n\n    // Deduplicate: if same collection+id already in dirty, update it\n    const idx = this.dirty.findIndex(d => d.collection === collection && d.id === id)\n    const entry: DirtyEntry = {\n      vault: this.vault,\n      collection,\n      id,\n      action,\n      version,\n      timestamp: new Date().toISOString(),\n    }\n\n    if (idx >= 0) {\n      this.dirty[idx] = entry\n    } else {\n      this.dirty.push(entry)\n    }\n\n    await this.persistMeta()\n\n    // Notify scheduler of the write (triggers on-change or debounce)\n    this.scheduler?.notifyChange()\n  }\n\n  /** Remove a dirty entry (satellite fan-out revert cleanup — spec #591). */\n  async removeDirty(collection: string, id: string): Promise<void> {\n    const before = this.dirty.length\n    this.dirty = this.dirty.filter(d => !(d.collection === collection && d.id === id))\n    if (this.dirty.length !== before) await this.persistMeta()\n  }\n\n  /** Push dirty records to remote adapter. Accepts optional `PushOptions` for partial sync. */\n  async push(options?: PushOptions): Promise<PushResult> {\n    await this.ensureLoaded()\n\n    let pushed = 0\n    const conflicts: Conflict[] = []\n    const errors: Error[] = []\n    const completed: number[] = []\n\n    // Partial sync: expand the filter to cover satellite pair partners (#591 rule 5b)\n    const filter = options?.collections ? new Set(this.pairExpander?.(options.collections) ?? options.collections) : null\n\n    for (let i = 0; i < this.dirty.length; i++) {\n      const entry = this.dirty[i]!\n\n      // Partial sync: skip collections not in the filter\n      if (filter && !filter.has(entry.collection)) {\n        continue\n      }\n\n      try {\n        if (entry.action === 'delete') {\n          await this.remote.delete(this.vault, entry.collection, entry.id)\n          completed.push(i)\n          pushed++\n        } else {\n          const envelope = await this.local.get(this.vault, entry.collection, entry.id)\n          if (!envelope) {\n            // Record was deleted locally after being marked dirty\n            completed.push(i)\n            continue\n          }\n\n          try {\n            await this.remote.put(\n              this.vault,\n              entry.collection,\n              entry.id,\n              envelope,\n              entry.version - 1,\n            )\n            completed.push(i)\n            pushed++\n          } catch (err) {\n            if (err instanceof ConflictError) {\n              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id)\n              if (remoteEnvelope) {\n                const { handled, conflict } = await this.handleConflict(\n                  entry.collection,\n                  entry.id,\n                  envelope,\n                  remoteEnvelope,\n                  'push',\n                )\n                conflicts.push(conflict)\n                if (handled === 'local') {\n                  await this.remote.put(this.vault, entry.collection, entry.id, conflict.local)\n                  completed.push(i)\n                  pushed++\n                } else if (handled === 'remote') {\n                  await this.local.put(this.vault, entry.collection, entry.id, conflict.remote)\n                  completed.push(i)\n                } else if (handled === 'merged' && conflict.local !== envelope) {\n                  // Merged envelope is stored in conflict.local (the winner)\n                  const merged = conflict.local\n                  await this.remote.put(this.vault, entry.collection, entry.id, merged)\n                  await this.local.put(this.vault, entry.collection, entry.id, merged)\n                  completed.push(i)\n                  pushed++\n                }\n                // handled === 'deferred': leave in dirty log\n              }\n            } else {\n              throw err\n            }\n          }\n        }\n      } catch (err) {\n        errors.push(err instanceof Error ? err : new Error(String(err)))\n      }\n    }\n\n    // Remove completed entries from dirty log (reverse order to preserve indices)\n    for (const i of completed.sort((a, b) => b - a)) {\n      this.dirty.splice(i, 1)\n    }\n\n    this.lastPush = new Date().toISOString()\n    await this.persistMeta()\n\n    const result: PushResult = { pushed, conflicts, errors }\n    this.emitter.emit('sync:push', result)\n    return result\n  }\n\n  /** Pull remote records to local adapter. Accepts optional `PullOptions` for partial sync. */\n  async pull(options?: PullOptions): Promise<PullResult> {\n    await this.ensureLoaded()\n\n    let pulled = 0\n    const conflicts: Conflict[] = []\n    const errors: Error[] = []\n\n    // Partial sync: expand the filter to cover satellite pair partners (#591 rule 5b)\n    const filter = options?.collections ? new Set(this.pairExpander?.(options.collections) ?? options.collections) : null\n\n    try {\n      const remoteSnapshot = await this.remote.loadAll(this.vault)\n\n      for (const [collName, records] of Object.entries(remoteSnapshot)) {\n        // Partial sync: skip collections not in the filter\n        if (filter && !filter.has(collName)) {\n          continue\n        }\n\n        for (const [id, remoteEnvelope] of Object.entries(records)) {\n          // Partial sync: modifiedSince filter\n          if (options?.modifiedSince && remoteEnvelope._ts <= options.modifiedSince) {\n            continue\n          }\n\n          try {\n            const localEnvelope = await this.local.get(this.vault, collName, id)\n\n            if (!localEnvelope) {\n              // New record from remote\n              await this.local.put(this.vault, collName, id, remoteEnvelope)\n              pulled++\n            } else if (remoteEnvelope._v > localEnvelope._v) {\n              // Remote is newer — check if we have a dirty entry for this\n              const isDirty = this.dirty.some(d => d.collection === collName && d.id === id)\n              if (isDirty) {\n                // Both changed — conflict\n                const { handled, conflict } = await this.handleConflict(\n                  collName,\n                  id,\n                  localEnvelope,\n                  remoteEnvelope,\n                  'pull',\n                )\n                conflicts.push(conflict)\n                if (handled === 'remote') {\n                  await this.local.put(this.vault, collName, id, conflict.remote)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                } else if (handled === 'merged' && conflict.local !== localEnvelope) {\n                  const merged = conflict.local\n                  await this.local.put(this.vault, collName, id, merged)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                }\n                // 'local' or 'deferred': push handles it\n              } else {\n                // Remote is newer, no local changes — update\n                await this.local.put(this.vault, collName, id, remoteEnvelope)\n                pulled++\n              }\n            }\n            // Same version or local is newer — skip (push will handle)\n          } catch (err) {\n            errors.push(err instanceof Error ? err : new Error(String(err)))\n          }\n        }\n      }\n    } catch (err) {\n      errors.push(err instanceof Error ? err : new Error(String(err)))\n    }\n\n    this.lastPull = new Date().toISOString()\n    await this.persistMeta()\n\n    const result: PullResult = { pulled, conflicts, errors }\n    this.emitter.emit('sync:pull', result)\n    return result\n  }\n\n  /** Bidirectional sync: pull then push. */\n  async sync(options?: { push?: PushOptions; pull?: PullOptions }): Promise<{ pull: PullResult; push: PushResult }> {\n    const pullResult = await this.pull(options?.pull)\n    const pushResult = await this.push(options?.push)\n    return { pull: pullResult, push: pushResult }\n  }\n\n  /**\n   * Push a specific subset of dirty entries (for sync transactions, ).\n   * Entries are matched by collection+id from the dirty log; matched entries\n   * are removed from the dirty log on success.\n   */\n  async pushFiltered(predicate: (entry: DirtyEntry) => boolean): Promise<PushResult> {\n    await this.ensureLoaded()\n\n    let pushed = 0\n    const conflicts: Conflict[] = []\n    const errors: Error[] = []\n    const completed: number[] = []\n\n    for (let i = 0; i < this.dirty.length; i++) {\n      const entry = this.dirty[i]!\n      if (!predicate(entry)) continue\n\n      try {\n        if (entry.action === 'delete') {\n          await this.remote.delete(this.vault, entry.collection, entry.id)\n          completed.push(i)\n          pushed++\n        } else {\n          const envelope = await this.local.get(this.vault, entry.collection, entry.id)\n          if (!envelope) {\n            completed.push(i)\n            continue\n          }\n\n          try {\n            await this.remote.put(\n              this.vault,\n              entry.collection,\n              entry.id,\n              envelope,\n              entry.version - 1,\n            )\n            completed.push(i)\n            pushed++\n          } catch (err) {\n            if (err instanceof ConflictError) {\n              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id)\n              if (remoteEnvelope) {\n                const { handled, conflict } = await this.handleConflict(\n                  entry.collection,\n                  entry.id,\n                  envelope,\n                  remoteEnvelope,\n                  'push',\n                )\n                conflicts.push(conflict)\n                if (handled === 'local') {\n                  await this.remote.put(this.vault, entry.collection, entry.id, conflict.local)\n                  completed.push(i)\n                  pushed++\n                } else if (handled === 'remote') {\n                  await this.local.put(this.vault, entry.collection, entry.id, conflict.remote)\n                  completed.push(i)\n                } else if (handled === 'merged' && conflict.local !== envelope) {\n                  const merged = conflict.local\n                  await this.remote.put(this.vault, entry.collection, entry.id, merged)\n                  await this.local.put(this.vault, entry.collection, entry.id, merged)\n                  completed.push(i)\n                  pushed++\n                }\n              }\n            } else {\n              throw err\n            }\n          }\n        }\n      } catch (err) {\n        errors.push(err instanceof Error ? err : new Error(String(err)))\n      }\n    }\n\n    for (const i of completed.sort((a, b) => b - a)) {\n      this.dirty.splice(i, 1)\n    }\n\n    this.lastPush = new Date().toISOString()\n    await this.persistMeta()\n\n    const result: PushResult = { pushed, conflicts, errors }\n    this.emitter.emit('sync:push', result)\n    return result\n  }\n\n  /** Get current sync status. */\n  status(): SyncStatus {\n    return {\n      dirty: this.dirty.length,\n      lastPush: this.lastPush,\n      lastPull: this.lastPull,\n      online: this.isOnline,\n    }\n  }\n\n  // ─── Auto-Sync ───────────────────────────────────────────────────\n\n  /** Start auto-sync: listen for online/offline events, optional periodic sync. */\n  startAutoSync(intervalMs?: number): void {\n    // Online/offline detection\n    if (typeof globalThis.addEventListener === 'function') {\n      globalThis.addEventListener('online', this.handleOnline)\n      globalThis.addEventListener('offline', this.handleOffline)\n    }\n\n    // Periodic sync\n    if (intervalMs && intervalMs > 0) {\n      this.autoSyncInterval = setInterval(() => {\n        if (this.isOnline) {\n          void this.sync()\n        }\n      }, intervalMs)\n    }\n  }\n\n  /** Stop auto-sync and scheduler. */\n  stopAutoSync(): void {\n    this.stopScheduler()\n    if (typeof globalThis.removeEventListener === 'function') {\n      globalThis.removeEventListener('online', this.handleOnline)\n      globalThis.removeEventListener('offline', this.handleOffline)\n    }\n    if (this.autoSyncInterval) {\n      clearInterval(this.autoSyncInterval)\n      this.autoSyncInterval = null\n    }\n  }\n\n  private handleOnline = (): void => {\n    this.isOnline = true\n    this.emitter.emit('sync:online', undefined as never)\n    void this.sync()\n  }\n\n  private handleOffline = (): void => {\n    this.isOnline = false\n    this.emitter.emit('sync:offline', undefined as never)\n  }\n\n  /**\n   * Resolve a conflict, checking per-collection resolvers first,\n   * then falling back to the db-level `ConflictStrategy`.\n   *\n   * Returns the resolved `Conflict` object (possibly with `resolve` set for\n   * manual mode) and a `handled` discriminant:\n   * - `'local'` — keep the local envelope; push it to remote.\n   * - `'remote'` — keep the remote envelope; update local.\n   * - `'merged'` — a custom merge fn produced a new envelope stored as `conflict.local`.\n   * - `'deferred'` — manual mode, resolve was not called synchronously.\n   */\n  private async handleConflict(\n    collection: string,\n    id: string,\n    local: EncryptedEnvelope,\n    remote: EncryptedEnvelope,\n    _phase: 'push' | 'pull',\n  ): Promise<{ handled: 'local' | 'remote' | 'merged' | 'deferred'; conflict: Conflict }> {\n    const resolver = this.conflictResolvers.get(collection)\n\n    if (resolver) {\n      // Per-collection resolver is responsible for emitting sync:conflict\n      // (manual policy emits with a resolve callback; LWW/FWW/custom are silent).\n      const winner = await resolver(id, local, remote)\n      const base: Conflict = {\n        vault: this.vault,\n        collection,\n        id,\n        local,\n        remote,\n        localVersion: local._v,\n        remoteVersion: remote._v,\n      }\n      if (winner === null) return { handled: 'deferred', conflict: base }\n      if (winner === local) return { handled: 'local', conflict: base }\n      if (winner === remote) return { handled: 'remote', conflict: base }\n      // Custom merge fn produced a new envelope — store as conflict.local for the caller\n      return {\n        handled: 'merged',\n        conflict: { ...base, local: winner, localVersion: winner._v },\n      }\n    }\n\n    // Fall back to db-level strategy — emit once\n    const baseConflict: Conflict = {\n      vault: this.vault,\n      collection,\n      id,\n      local,\n      remote,\n      localVersion: local._v,\n      remoteVersion: remote._v,\n    }\n    this.emitter.emit('sync:conflict', baseConflict)\n    const side = this.legacyResolve(baseConflict)\n    return { handled: side, conflict: baseConflict }\n  }\n\n  /** DB-level ConflictStrategy resolution (legacy, kept for backward compat). */\n  private legacyResolve(conflict: Conflict): 'local' | 'remote' {\n    if (typeof this.strategy === 'function') {\n      return this.strategy(conflict)\n    }\n    switch (this.strategy) {\n      case 'local-wins': return 'local'\n      case 'remote-wins': return 'remote'\n      case 'version':\n      default:\n        return conflict.localVersion >= conflict.remoteVersion ? 'local' : 'remote'\n    }\n  }\n\n  // ─── Persistence ─────────────────────────────────────────────────\n\n  private async ensureLoaded(): Promise<void> {\n    if (this.loaded) return\n\n    const envelope = await this.local.get(this.vault, '_sync', 'meta')\n    if (envelope) {\n      const meta = JSON.parse(envelope._data) as SyncMetadata\n      this.dirty = [...meta.dirty]\n      this.lastPush = meta.last_push\n      this.lastPull = meta.last_pull\n    }\n\n    this.loaded = true\n  }\n\n  private async persistMeta(): Promise<void> {\n    const meta: SyncMetadata = {\n      _noydb_sync: NOYDB_SYNC_VERSION,\n      last_push: this.lastPush,\n      last_pull: this.lastPull,\n      dirty: this.dirty,\n    }\n\n    const envelope: EncryptedEnvelope = {\n      _noydb: 1,\n      _v: 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: JSON.stringify(meta),\n    }\n\n    await this.local.put(this.vault, '_sync', 'meta', envelope)\n  }\n}\n","import type { SyncTransactionResult } from '../../kernel/types.js'\nimport type { SyncEngine } from './sync.js'\nimport type { Vault } from '../../kernel/vault.js'\n\ninterface TxOp {\n  readonly type: 'put' | 'delete'\n  readonly collection: string\n  readonly id: string\n  readonly record?: unknown\n}\n\n/**\n * Sync transaction.\n *\n * Stages local writes and then pushes only those records to remote in a\n * single batch. If any record conflicts during the push, the result\n * carries `status: 'conflict'` — no automatic rollback is performed;\n * the caller handles conflict resolution.\n *\n * Obtain via `db.transaction(compartmentName)`.\n */\nexport class SyncTransaction {\n  private readonly comp: Vault\n  private readonly engine: SyncEngine\n  private readonly ops: TxOp[] = []\n\n  /** @internal — constructed by `Noydb.transaction()` */\n  constructor(comp: Vault, engine: SyncEngine) {\n    this.comp = comp\n    this.engine = engine\n  }\n\n  /** Stage a record write. Does not write to any adapter until `commit()`. */\n  put(collection: string, id: string, record: unknown): this {\n    this.ops.push({ type: 'put', collection, id, record })\n    return this\n  }\n\n  /** Stage a record delete. Does not write to any adapter until `commit()`. */\n  delete(collection: string, id: string): this {\n    this.ops.push({ type: 'delete', collection, id })\n    return this\n  }\n\n  /**\n   * Commit the transaction.\n   *\n   * Phase 1 — writes all staged operations to the local adapter via the\n   * collection layer (encryption + dirty-log tracking).\n   *\n   * Phase 2 — pushes only the records that were written in this\n   * transaction to the remote adapter. Existing dirty entries from\n   * outside this transaction are not affected.\n   *\n   * If any record conflicts during the push, `status` is `'conflict'`\n   * and `conflicts` lists the affected records. No automatic rollback is\n   * performed.\n   */\n  async commit(): Promise<SyncTransactionResult> {\n    // Phase 1: write all staged ops to local via collection layer\n    for (const op of this.ops) {\n      if (op.type === 'put') {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        await (this.comp.collection<any>(op.collection)).put(op.id, op.record as any)\n      } else {\n        await this.comp.collection(op.collection).delete(op.id)\n      }\n    }\n\n    // Phase 2: push only the records from this transaction\n    const opSet = new Set<string>()\n    for (const op of this.ops) {\n      opSet.add(`${op.collection}::${op.id}`)\n    }\n\n    const pushResult = await this.engine.pushFiltered(\n      (entry) => opSet.has(`${entry.collection}::${entry.id}`),\n    )\n\n    return {\n      status: pushResult.conflicts.length > 0 ? 'conflict' : 'committed',\n      pushed: pushResult.pushed,\n      conflicts: pushResult.conflicts,\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsDO,IAAM,iBAAN,MAAwB;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,cAAiC;AAAA,EACjC,cAAyD,CAAC;AAAA,EAC1D,oBAAyC;AAAA,EACzC,YAAmD;AAAA,EACnD,UAAU;AAAA,EAElB,YAAY,MAA0B;AACpC,SAAK,UAAU,KAAK;AACpB,SAAK,cAAc,KAAK;AACxB,SAAK,QAAQ,KAAK;AAClB,SAAK,iBAAiB,KAAK;AAC3B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,iBAAiB,KAAK,kBAAkB;AAG7C,SAAK,UAAU,GAAG,KAAK,KAAK,IAAI,KAAK,cAAc;AAEnD,SAAK,oBAAoB,aAAa,KAAK,cAAc;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAA2B;AACtC,QAAI,KAAK,QAAS;AAElB,UAAM,MAAM,MAAM,KAAK,eAAe;AACtC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,YAAY,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ,UAAU,KAAK,QAAQ,CAAC;AAChF,QAAI;AAEJ,QAAI,KAAK,aAAa,KAAK;AACzB,YAAM,KAAK,WAAW;AACtB,YAAM,QAAQ,eAAe,EAAE;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,WAAW,GAAG;AAC7C,yBAAmB,KAAK,UAAU,EAAE,IAAI,OAAO,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,yBAAmB;AAAA,IACrB;AAGA,UAAM,aAAa,KAAK,iBAAiB;AACzC,QAAI,YAAY,iBAAiB;AAC/B,YAAM,WAAW,gBAAgB,KAAK,SAAS,gBAAgB;AAAA,IACjE;AAGA,UAAM,KAAK,mBAAmB,SAAS,GAAG;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,IAAoD;AAC5D,QAAI,KAAK,QAAS,QAAO,MAAM;AAAA,IAAC;AAEhC,SAAK,YAAY,KAAK,EAAE;AAGxB,QAAI,KAAK,YAAY,WAAW,GAAG;AACjC,WAAK,eAAe;AAAA,IACtB;AAEA,WAAO,MAAM;AACX,WAAK,cAAc,KAAK,YAAY,OAAO,OAAK,MAAM,EAAE;AACxD,UAAI,KAAK,YAAY,WAAW,EAAG,MAAK,cAAc;AAAA,IACxD;AAAA,EACF;AAAA;AAAA,EAGA,OAAa;AACX,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,cAAc,CAAC;AAAA,EACtB;AAAA;AAAA,EAIA,MAAc,iBAA6C;AACzD,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,QAAI,CAAC,KAAK,aAAa;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,OAAO,KAAK,cAAc;AACjD,aAAK,cAAc,MAAM,kBAAkB,KAAK,KAAK,cAAc;AAAA,MACrE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,mBAA2C;AAEjD,QAAI,KAAK,aAAa,gBAAiB,QAAO,KAAK;AACnD,QAAI,KAAK,QAAQ,gBAAiB,QAAO,KAAK;AAC9C,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAuB;AAC7B,UAAM,aAAa,KAAK,iBAAiB;AAEzC,QAAI,YAAY,mBAAmB;AAEjC,WAAK,oBAAoB,WAAW;AAAA,QAClC,KAAK;AAAA,QACL,CAAC,qBAAqB;AAAE,eAAK,KAAK,oBAAoB,gBAAgB;AAAA,QAAE;AAAA,MAC1E;AAAA,IACF,OAAO;AAEL,WAAK,YAAY;AAAA,QACf,MAAM;AAAE,eAAK,KAAK,oBAAoB;AAAA,QAAE;AAAA,QACxC,KAAK;AAAA,MACP;AAEA,WAAK,KAAK,oBAAoB;AAAA,IAChC;AAAA,EACF;AAAA,EAEQ,gBAAsB;AAC5B,QAAI,KAAK,mBAAmB;AAC1B,WAAK,kBAAkB;AACvB,WAAK,oBAAoB;AAAA,IAC3B;AACA,QAAI,KAAK,WAAW;AAClB,oBAAc,KAAK,SAAS;AAC5B,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,kBAAyC;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,uBAAuB,gBAAgB;AAC/D,UAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,OAAQ;AAE1C,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,YAAY;AAC/D,UAAI,KAAK,WAAW,OAAQ;AAK5B,YAAM,KAAK,oBAAoB;AAAA,IACjC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,uBACZ,kBACkE;AAClE,UAAM,MAAM,MAAM,KAAK,eAAe;AAEtC,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK;AAC3B,aAAO,KAAK,MAAM,gBAAgB;AAAA,IACpC;AAEA,UAAM,EAAE,IAAI,OAAO,KAAK,IAAI,KAAK,MAAM,gBAAgB;AACvD,UAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChD,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B;AAAA,EAEA,MAAc,mBAAmB,SAAY,KAA4B;AACvE,UAAM,MAAM,MAAM,KAAK,eAAe;AACtC,UAAM,YAAY,KAAK,UAAU,OAAO;AACxC,QAAI,KAAK;AACT,QAAI;AAEJ,QAAI,KAAK,aAAa,KAAK;AACzB,YAAM,UAAU,WAAW;AAC3B,WAAK,eAAe,OAAO;AAC3B,YAAM,SAAS,MAAM,QAAQ,WAAW,GAAG;AAC3C,aAAO,OAAO;AAAA,IAChB,OAAO;AACL,aAAO;AAAA,IACT;AAEA,UAAM,SAAgC,EAAE,QAAQ,KAAK,QAAQ,UAAU,KAAK,IAAI,KAAK;AACrF,UAAM,OAAO,KAAK,UAAU,MAAM;AAIlC,UAAM,eAAe,KAAK,eAAe,KAAK;AAC9C,UAAM,WAAW;AAAA,MACf,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,aAAa;AAAA,QACjB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,sBAAqC;AACjD,QAAI,KAAK,WAAW,KAAK,YAAY,WAAW,EAAG;AAEnD,QAAI;AACF,YAAM,eAAe,KAAK,eAAe,KAAK;AAC9C,YAAM,MAAM,MAAM,aAAa,KAAK,KAAK,OAAO,KAAK,iBAAiB;AACtE,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,YAAY;AAC/D,YAAM,QAA2B,CAAC;AAElC,iBAAW,MAAM,KAAK;AACpB,YAAI,OAAO,KAAK,OAAQ;AACxB,cAAM,WAAW,MAAM,aAAa,IAAI,KAAK,OAAO,KAAK,mBAAmB,EAAE;AAC9E,YAAI,CAAC,SAAU;AAEf,cAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,YAAI,OAAO,WAAW,OAAQ;AAE9B,YAAI;AACJ,YAAI,KAAK,aAAa,KAAK,eAAe,OAAO,IAAI;AACnD,gBAAM,YAAY,MAAM,QAAQ,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;AACxE,wBAAc,KAAK,MAAM,SAAS;AAAA,QACpC,OAAO;AACL,wBAAc,KAAK,MAAM,OAAO,IAAI;AAAA,QACtC;AAEA,cAAM,KAAK,EAAE,QAAQ,OAAO,QAAQ,SAAS,aAAa,UAAU,OAAO,SAAS,CAAC;AAAA,MACvF;AAEA,iBAAW,MAAM,KAAK,aAAa;AACjC,WAAG,KAAK;AAAA,MACV;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AC/RO,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACR;AAAA,EACA;AAAA,EAED,QAAsB,CAAC;AAAA,EACvB,WAA0B;AAAA,EAC1B,WAA0B;AAAA,EAC1B,SAAS;AAAA,EACT,mBAA0D;AAAA,EAC1D,WAAW;AAAA;AAAA,EAGV;AAAA;AAAA,EAGQ,oBAAoB,oBAAI,IAAwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzE;AAAA,EAER,YAAY,MAST;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,WAAW,KAAK;AACrB,SAAK,UAAU,KAAK;AACpB,SAAK,OAAO,KAAK,QAAQ;AACzB,SAAK,QAAQ,KAAK;AAGlB,UAAM,SAAS,KAAK;AACpB,QAAI,UAAU,OAAO,KAAK,SAAS,UAAU;AAC3C,WAAK,YAAY,IAAI,cAAc,QAAQ;AAAA,QACzC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM;AAAA,QAAC,CAAC;AAAA,QACrC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM;AAAA,QAAC,CAAC;AAAA,QACrC,eAAe,MAAM,KAAK,MAAM;AAAA,MAClC,CAAC;AAAA,IACH,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA;AAAA,EAGA,iBAAuB;AACrB,SAAK,WAAW,MAAM;AAAA,EACxB;AAAA;AAAA,EAGA,gBAAsB;AACpB,SAAK,WAAW,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,yBAAyB,YAAoB,UAA4C;AACvF,eAAW,KAAK,KAAK,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAG,MAAK,kBAAkB,IAAI,GAAG,QAAQ;AAAA,EAC3G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,UAAiE;AAC/E,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,sBAAsB,OAAgC;AACpD,UAAM,YAAY,MAAM,IAAI,OAAK,KAAK,kBAAkB,IAAI,CAAC,CAAC,EAAE,KAAK,OAAK,MAAM,MAAS;AACzF,QAAI,CAAC,UAAW;AAChB,eAAW,KAAK,MAAO,MAAK,kBAAkB,IAAI,GAAG,SAAS;AAAA,EAChE;AAAA;AAAA,EAGA,MAAM,YAAY,YAAoB,IAAY,QAA0B,SAAgC;AAC1G,UAAM,KAAK,aAAa;AAGxB,UAAM,MAAM,KAAK,MAAM,UAAU,OAAK,EAAE,eAAe,cAAc,EAAE,OAAO,EAAE;AAChF,UAAM,QAAoB;AAAA,MACxB,OAAO,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAEA,QAAI,OAAO,GAAG;AACZ,WAAK,MAAM,GAAG,IAAI;AAAA,IACpB,OAAO;AACL,WAAK,MAAM,KAAK,KAAK;AAAA,IACvB;AAEA,UAAM,KAAK,YAAY;AAGvB,SAAK,WAAW,aAAa;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,YAAY,YAAoB,IAA2B;AAC/D,UAAM,SAAS,KAAK,MAAM;AAC1B,SAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,cAAc,EAAE,OAAO,GAAG;AACjF,QAAI,KAAK,MAAM,WAAW,OAAQ,OAAM,KAAK,YAAY;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,KAAK,SAA4C;AACrD,UAAM,KAAK,aAAa;AAExB,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,SAAkB,CAAC;AACzB,UAAM,YAAsB,CAAC;AAG7B,UAAM,SAAS,SAAS,cAAc,IAAI,IAAI,KAAK,eAAe,QAAQ,WAAW,KAAK,QAAQ,WAAW,IAAI;AAEjH,aAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,YAAM,QAAQ,KAAK,MAAM,CAAC;AAG1B,UAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,GAAG;AAC3C;AAAA,MACF;AAEA,UAAI;AACF,YAAI,MAAM,WAAW,UAAU;AAC7B,gBAAM,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC/D,oBAAU,KAAK,CAAC;AAChB;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC5E,cAAI,CAAC,UAAU;AAEb,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,KAAK,OAAO;AAAA,cAChB,KAAK;AAAA,cACL,MAAM;AAAA,cACN,MAAM;AAAA,cACN;AAAA,cACA,MAAM,UAAU;AAAA,YAClB;AACA,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF,SAAS,KAAK;AACZ,gBAAI,eAAe,eAAe;AAChC,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AACnF,kBAAI,gBAAgB;AAClB,sBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,kBACvC,MAAM;AAAA,kBACN,MAAM;AAAA,kBACN;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,0BAAU,KAAK,QAAQ;AACvB,oBAAI,YAAY,SAAS;AACvB,wBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,SAAS,KAAK;AAC5E,4BAAU,KAAK,CAAC;AAChB;AAAA,gBACF,WAAW,YAAY,UAAU;AAC/B,wBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,SAAS,MAAM;AAC5E,4BAAU,KAAK,CAAC;AAAA,gBAClB,WAAW,YAAY,YAAY,SAAS,UAAU,UAAU;AAE9D,wBAAM,SAAS,SAAS;AACxB,wBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,wBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACnE,4BAAU,KAAK,CAAC;AAChB;AAAA,gBACF;AAAA,cAEF;AAAA,YACF,OAAO;AACL,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,MACjE;AAAA,IACF;AAGA,eAAW,KAAK,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;AAC/C,WAAK,MAAM,OAAO,GAAG,CAAC;AAAA,IACxB;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,UAAM,KAAK,YAAY;AAEvB,UAAM,SAAqB,EAAE,QAAQ,WAAW,OAAO;AACvD,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAA4C;AACrD,UAAM,KAAK,aAAa;AAExB,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,SAAkB,CAAC;AAGzB,UAAM,SAAS,SAAS,cAAc,IAAI,IAAI,KAAK,eAAe,QAAQ,WAAW,KAAK,QAAQ,WAAW,IAAI;AAEjH,QAAI;AACF,YAAM,iBAAiB,MAAM,KAAK,OAAO,QAAQ,KAAK,KAAK;AAE3D,iBAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,cAAc,GAAG;AAEhE,YAAI,UAAU,CAAC,OAAO,IAAI,QAAQ,GAAG;AACnC;AAAA,QACF;AAEA,mBAAW,CAAC,IAAI,cAAc,KAAK,OAAO,QAAQ,OAAO,GAAG;AAE1D,cAAI,SAAS,iBAAiB,eAAe,OAAO,QAAQ,eAAe;AACzE;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,gBAAgB,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,EAAE;AAEnE,gBAAI,CAAC,eAAe;AAElB,oBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,IAAI,cAAc;AAC7D;AAAA,YACF,WAAW,eAAe,KAAK,cAAc,IAAI;AAE/C,oBAAM,UAAU,KAAK,MAAM,KAAK,OAAK,EAAE,eAAe,YAAY,EAAE,OAAO,EAAE;AAC7E,kBAAI,SAAS;AAEX,sBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,kBACvC;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,0BAAU,KAAK,QAAQ;AACvB,oBAAI,YAAY,UAAU;AACxB,wBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,IAAI,SAAS,MAAM;AAC9D,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF,WAAW,YAAY,YAAY,SAAS,UAAU,eAAe;AACnE,wBAAM,SAAS,SAAS;AACxB,wBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,IAAI,MAAM;AACrD,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF;AAAA,cAEF,OAAO;AAEL,sBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,IAAI,cAAc;AAC7D;AAAA,cACF;AAAA,YACF;AAAA,UAEF,SAAS,KAAK;AACZ,mBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,IACjE;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,UAAM,KAAK,YAAY;AAEvB,UAAM,SAAqB,EAAE,QAAQ,WAAW,OAAO;AACvD,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAAuG;AAChH,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,IAAI;AAChD,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,IAAI;AAChD,WAAO,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,WAAgE;AACjF,UAAM,KAAK,aAAa;AAExB,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,SAAkB,CAAC;AACzB,UAAM,YAAsB,CAAC;AAE7B,aAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,YAAM,QAAQ,KAAK,MAAM,CAAC;AAC1B,UAAI,CAAC,UAAU,KAAK,EAAG;AAEvB,UAAI;AACF,YAAI,MAAM,WAAW,UAAU;AAC7B,gBAAM,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC/D,oBAAU,KAAK,CAAC;AAChB;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC5E,cAAI,CAAC,UAAU;AACb,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,KAAK,OAAO;AAAA,cAChB,KAAK;AAAA,cACL,MAAM;AAAA,cACN,MAAM;AAAA,cACN;AAAA,cACA,MAAM,UAAU;AAAA,YAClB;AACA,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF,SAAS,KAAK;AACZ,gBAAI,eAAe,eAAe;AAChC,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AACnF,kBAAI,gBAAgB;AAClB,sBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,kBACvC,MAAM;AAAA,kBACN,MAAM;AAAA,kBACN;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,0BAAU,KAAK,QAAQ;AACvB,oBAAI,YAAY,SAAS;AACvB,wBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,SAAS,KAAK;AAC5E,4BAAU,KAAK,CAAC;AAChB;AAAA,gBACF,WAAW,YAAY,UAAU;AAC/B,wBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,SAAS,MAAM;AAC5E,4BAAU,KAAK,CAAC;AAAA,gBAClB,WAAW,YAAY,YAAY,SAAS,UAAU,UAAU;AAC9D,wBAAM,SAAS,SAAS;AACxB,wBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,wBAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACnE,4BAAU,KAAK,CAAC;AAChB;AAAA,gBACF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,MACjE;AAAA,IACF;AAEA,eAAW,KAAK,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;AAC/C,WAAK,MAAM,OAAO,GAAG,CAAC;AAAA,IACxB;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,UAAM,KAAK,YAAY;AAEvB,UAAM,SAAqB,EAAE,QAAQ,WAAW,OAAO;AACvD,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,SAAqB;AACnB,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,cAAc,YAA2B;AAEvC,QAAI,OAAO,WAAW,qBAAqB,YAAY;AACrD,iBAAW,iBAAiB,UAAU,KAAK,YAAY;AACvD,iBAAW,iBAAiB,WAAW,KAAK,aAAa;AAAA,IAC3D;AAGA,QAAI,cAAc,aAAa,GAAG;AAChC,WAAK,mBAAmB,YAAY,MAAM;AACxC,YAAI,KAAK,UAAU;AACjB,eAAK,KAAK,KAAK;AAAA,QACjB;AAAA,MACF,GAAG,UAAU;AAAA,IACf;AAAA,EACF;AAAA;AAAA,EAGA,eAAqB;AACnB,SAAK,cAAc;AACnB,QAAI,OAAO,WAAW,wBAAwB,YAAY;AACxD,iBAAW,oBAAoB,UAAU,KAAK,YAAY;AAC1D,iBAAW,oBAAoB,WAAW,KAAK,aAAa;AAAA,IAC9D;AACA,QAAI,KAAK,kBAAkB;AACzB,oBAAc,KAAK,gBAAgB;AACnC,WAAK,mBAAmB;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,eAAe,MAAY;AACjC,SAAK,WAAW;AAChB,SAAK,QAAQ,KAAK,eAAe,MAAkB;AACnD,SAAK,KAAK,KAAK;AAAA,EACjB;AAAA,EAEQ,gBAAgB,MAAY;AAClC,SAAK,WAAW;AAChB,SAAK,QAAQ,KAAK,gBAAgB,MAAkB;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,eACZ,YACA,IACA,OACA,QACA,QACsF;AACtF,UAAM,WAAW,KAAK,kBAAkB,IAAI,UAAU;AAEtD,QAAI,UAAU;AAGZ,YAAM,SAAS,MAAM,SAAS,IAAI,OAAO,MAAM;AAC/C,YAAM,OAAiB;AAAA,QACrB,OAAO,KAAK;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO;AAAA,MACxB;AACA,UAAI,WAAW,KAAM,QAAO,EAAE,SAAS,YAAY,UAAU,KAAK;AAClE,UAAI,WAAW,MAAO,QAAO,EAAE,SAAS,SAAS,UAAU,KAAK;AAChE,UAAI,WAAW,OAAQ,QAAO,EAAE,SAAS,UAAU,UAAU,KAAK;AAElE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU,EAAE,GAAG,MAAM,OAAO,QAAQ,cAAc,OAAO,GAAG;AAAA,MAC9D;AAAA,IACF;AAGA,UAAM,eAAyB;AAAA,MAC7B,OAAO,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,eAAe,OAAO;AAAA,IACxB;AACA,SAAK,QAAQ,KAAK,iBAAiB,YAAY;AAC/C,UAAM,OAAO,KAAK,cAAc,YAAY;AAC5C,WAAO,EAAE,SAAS,MAAM,UAAU,aAAa;AAAA,EACjD;AAAA;AAAA,EAGQ,cAAc,UAAwC;AAC5D,QAAI,OAAO,KAAK,aAAa,YAAY;AACvC,aAAO,KAAK,SAAS,QAAQ;AAAA,IAC/B;AACA,YAAQ,KAAK,UAAU;AAAA,MACrB,KAAK;AAAc,eAAO;AAAA,MAC1B,KAAK;AAAe,eAAO;AAAA,MAC3B,KAAK;AAAA,MACL;AACE,eAAO,SAAS,gBAAgB,SAAS,gBAAgB,UAAU;AAAA,IACvE;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,eAA8B;AAC1C,QAAI,KAAK,OAAQ;AAEjB,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,SAAS,MAAM;AACjE,QAAI,UAAU;AACZ,YAAM,OAAO,KAAK,MAAM,SAAS,KAAK;AACtC,WAAK,QAAQ,CAAC,GAAG,KAAK,KAAK;AAC3B,WAAK,WAAW,KAAK;AACrB,WAAK,WAAW,KAAK;AAAA,IACvB;AAEA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,cAA6B;AACzC,UAAM,OAAqB;AAAA,MACzB,aAAa;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,IACd;AAEA,UAAM,WAA8B;AAAA,MAClC,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAC5D;AACF;;;AClkBO,IAAM,kBAAN,MAAsB;AAAA,EACV;AAAA,EACA;AAAA,EACA,MAAc,CAAC;AAAA;AAAA,EAGhC,YAAY,MAAa,QAAoB;AAC3C,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,YAAoB,IAAY,QAAuB;AACzD,SAAK,IAAI,KAAK,EAAE,MAAM,OAAO,YAAY,IAAI,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAO,YAAoB,IAAkB;AAC3C,SAAK,IAAI,KAAK,EAAE,MAAM,UAAU,YAAY,GAAG,CAAC;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,SAAyC;AAE7C,eAAW,MAAM,KAAK,KAAK;AACzB,UAAI,GAAG,SAAS,OAAO;AAErB,cAAO,KAAK,KAAK,WAAgB,GAAG,UAAU,EAAG,IAAI,GAAG,IAAI,GAAG,MAAa;AAAA,MAC9E,OAAO;AACL,cAAM,KAAK,KAAK,WAAW,GAAG,UAAU,EAAE,OAAO,GAAG,EAAE;AAAA,MACxD;AAAA,IACF;AAGA,UAAM,QAAQ,oBAAI,IAAY;AAC9B,eAAW,MAAM,KAAK,KAAK;AACzB,YAAM,IAAI,GAAG,GAAG,UAAU,KAAK,GAAG,EAAE,EAAE;AAAA,IACxC;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO;AAAA,MACnC,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,UAAU,KAAK,MAAM,EAAE,EAAE;AAAA,IACzD;AAEA,WAAO;AAAA,MACL,QAAQ,WAAW,UAAU,SAAS,IAAI,aAAa;AAAA,MACvD,QAAQ,WAAW;AAAA,MACnB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-TVRQ3RYH.js → chunk-ZHK3F5RB.js}

@@ -1,21 +1,22 @@
 import {
+  SYNC_CREDENTIALS_COLLECTION,
   ensureCollectionDEK,
   grant,
   revoke,
   rotateKeys
-} from "./chunk-VAWY44JW.js";
+} from "./chunk-WAL4MRBK.js";
 import {
   openEnvelopeJson
-} from "./chunk-OVO2RZAE.js";
+} from "./chunk-7AGLCOYE.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-LN22XH4B.js";
 import {
   encrypt
-} from "./chunk-TLJOJBZD.js";
+} from "./chunk-5HZULLHE.js";
 import {
   PermissionDeniedError
-} from "./chunk-U23JUUPX.js";
+} from "./chunk-OJ64XMPJ.js";
 
 // src/with-party/team/active.ts
 function withTeam() {
@@ -33,7 +34,6 @@ function withTeam() {
 }
 
 // src/with-party/team/sync-credentials.ts
-var SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 function requireAdminAccess(keyring) {
   if (keyring.role !== "owner" && keyring.role !== "admin") {
     throw new PermissionDeniedError(
@@ -90,11 +90,10 @@ async function credentialStatus(adapter, vault, keyring, adapterId) {
 
 export {
   withTeam,
-  SYNC_CREDENTIALS_COLLECTION,
   putCredential,
   getCredential,
   deleteCredential,
   listCredentials,
   credentialStatus
 };
-//# sourceMappingURL=chunk-TVRQ3RYH.js.map
+//# sourceMappingURL=chunk-ZHK3F5RB.js.map

package/dist/chunk-ZHK3F5RB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/active.ts","../src/with-party/team/sync-credentials.ts"],"sourcesContent":["/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n  }\n}\n","/**\n * _sync_credentials reserved collection —\n *\n * Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as\n * encrypted records inside the vault itself. Tokens are wrapped with the\n * compartment's own DEK, live on disk as ciphertext like any other record, and\n * are accessed only through the dedicated API in this module — never via\n * `vault.collection('_sync_credentials')`.\n *\n * Design decisions\n * ────────────────\n *\n * **Why a reserved collection, not a separate store?**\n * The compartment's existing encryption stack (AES-256-GCM + collection DEK)\n * is exactly the right primitive for protecting OAuth tokens at rest. Using a\n * separate store would require a new encryption surface, new adapter calls,\n * and a new backup/restore path — all of which already exist for collections.\n *\n * **Why not exposed as a regular collection?**\n * The same reason `_keyring` and `_ledger` aren't: they have invariants that\n * must be enforced (naming scheme, no cross-user leakage, no schema\n * validation, no history/ledger writes for privacy). Routing through a\n * dedicated API enforces those invariants.\n *\n * **Token lifecycle:**\n * - `putCredential(vault, adapterId, token)` — store or overwrite\n * - `getCredential(vault, adapterId)` — load and decrypt\n * - `deleteCredential(vault, adapterId)` — remove\n * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)\n *\n * The `adapterId` is the record ID within the `_sync_credentials` collection.\n * It should be a stable, human-readable identifier for the adapter instance\n * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).\n *\n * **ACL:** only `owner` and `admin` roles can read/write sync credentials.\n * Operators, viewers, and clients cannot call this API. The check is made\n * against the caller's keyring role at call time.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson } from '../../kernel/enclave/index.js'\nimport { ensureCollectionDEK } from './keyring.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\n\n/**\n * The reserved collection name. Never collides with user collections.\n * Canonical definition lives in `reserved-secret-collections.ts` (shared with\n * the `vault.collection()` guard and grant DEK-propagation); re-exported here\n * for existing consumers.\n */\nexport { SYNC_CREDENTIALS_COLLECTION } from './reserved-secret-collections.js'\nimport { SYNC_CREDENTIALS_COLLECTION } from './reserved-secret-collections.js'\n\n// ─── Token types ──────────────────────────────────────────────────────\n\n/**\n * An OAuth/auth token stored in `_sync_credentials`.\n *\n * Fields mirror the OAuth2 token response shape. `customData` is an escape\n * hatch for adapter-specific secrets (API keys, connection strings, etc.)\n * that don't fit the OAuth2 shape.\n */\nexport interface SyncCredential {\n  /** Stable identifier for the adapter instance (e.g. 'google-drive'). */\n  readonly adapterId: string\n  /** OAuth token type, usually 'Bearer'. */\n  readonly tokenType: string\n  /** The access token. Expires at `expiresAt` if set. */\n  readonly accessToken: string\n  /** Long-lived refresh token for renewing the access token. */\n  readonly refreshToken?: string\n  /** ISO timestamp when `accessToken` expires. Absent means \"no expiry\". */\n  readonly expiresAt?: string\n  /** Space-separated OAuth scopes. */\n  readonly scopes?: string\n  /** Adapter-specific opaque data (API keys, endpoints, etc.). */\n  readonly customData?: Record<string, string>\n}\n\n// ─── Access check ─────────────────────────────────────────────────────\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // FR-6: custodian is INTENTIONALLY excluded. Sync credentials are the\n  // firm's hosting/infrastructure secrets (OAuth tokens, connection strings) —\n  // not the custodian's operational scope. A custodian operates the DATA but\n  // must never mint or read transport credentials that could be used to\n  // re-home or impersonate the firm's vault. Do NOT add 'custodian' here.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Sync credentials require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/**\n * Store or overwrite a sync credential for the given adapter.\n *\n * The credential is encrypted with the `_sync_credentials` collection DEK\n * (auto-generated on first use). The record ID is the `adapterId`.\n *\n * Requires owner or admin role.\n */\nexport async function putCredential(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  credential: SyncCredential,\n): Promise<void> {\n  requireAdminAccess(keyring)\n\n  const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n  const { iv, data } = await encrypt(JSON.stringify(credential), dek)\n\n  const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId)\n  const version = existing ? existing._v + 1 : 1\n\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: keyring.userId,\n  }\n\n  await adapter.put(\n    vault,\n    SYNC_CREDENTIALS_COLLECTION,\n    credential.adapterId,\n    envelope,\n    existing ? existing._v : undefined,\n  )\n}\n\n/**\n * Load and decrypt a sync credential for the given adapter ID.\n *\n * Returns `null` if no credential exists for this adapter.\n * Requires owner or admin role.\n */\nexport async function getCredential(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  adapterId: string,\n): Promise<SyncCredential | null> {\n  requireAdminAccess(keyring)\n\n  const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n  const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n  if (!envelope) return null\n\n  const plaintext = await openEnvelopeJson(envelope, dek)\n  return JSON.parse(plaintext) as SyncCredential\n}\n\n/**\n * Delete a sync credential by adapter ID.\n *\n * No-op if the credential doesn't exist. Requires owner or admin role.\n */\nexport async function deleteCredential(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  adapterId: string,\n): Promise<void> {\n  requireAdminAccess(keyring)\n  await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n}\n\n/**\n * List all adapter IDs that have stored credentials.\n *\n * Returns only the IDs, never the credential payloads. Useful for\n * displaying \"connected adapters\" in UI without decrypting tokens.\n * Requires owner or admin role.\n */\nexport async function listCredentials(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n): Promise<string[]> {\n  requireAdminAccess(keyring)\n  return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION)\n}\n\n/**\n * Check whether a credential exists and whether its access token has expired.\n *\n * Returns `{ exists: false }` if no credential is stored, or\n * `{ exists: true, expired: boolean }` based on the `expiresAt` field.\n * Requires owner or admin role.\n */\nexport async function credentialStatus(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  adapterId: string,\n): Promise<{ exists: false } | { exists: true; expired: boolean }> {\n  const credential = await getCredential(adapter, vault, keyring, adapterId)\n  if (!credential) return { exists: false }\n\n  const expired = credential.expiresAt\n    ? Date.now() > new Date(credential.expiresAt).getTime()\n    : false\n\n  return { exists: true, expired }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAcO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,EACF;AACF;;;ACyDA,SAAS,mBAAmB,SAAgC;AAM1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,gEAAgE,QAAQ,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAYA,eAAsB,cACpB,SACA,OACA,SACA,YACe;AACf,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,UAAU,GAAG,GAAG;AAElE,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,WAAW,SAAS;AAC3F,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAE7C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AAEA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,WAAW,SAAS,KAAK;AAAA,EAC3B;AACF;AAQA,eAAsB,cACpB,SACA,OACA,SACA,WACgC;AAChC,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,SAAS;AAChF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,SAAO,KAAK,MAAM,SAAS;AAC7B;AAOA,eAAsB,iBACpB,SACA,OACA,SACA,WACe;AACf,qBAAmB,OAAO;AAC1B,QAAM,QAAQ,OAAO,OAAO,6BAA6B,SAAS;AACpE;AASA,eAAsB,gBACpB,SACA,OACA,SACmB;AACnB,qBAAmB,OAAO;AAC1B,SAAO,QAAQ,KAAK,OAAO,2BAA2B;AACxD;AASA,eAAsB,iBACpB,SACA,OACA,SACA,WACiE;AACjE,QAAM,aAAa,MAAM,cAAc,SAAS,OAAO,SAAS,SAAS;AACzE,MAAI,CAAC,WAAY,QAAO,EAAE,QAAQ,MAAM;AAExC,QAAM,UAAU,WAAW,YACvB,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,SAAS,EAAE,QAAQ,IACpD;AAEJ,SAAO,EAAE,QAAQ,MAAM,QAAQ;AACjC;","names":[]}

package/dist/{chunk-G4MGYGSS.js → chunk-ZRJBLWKQ.js}

@@ -1,19 +1,19 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-P3NGV5RV.js";
+} from "./chunk-V76PHWLE.js";
 import {
   openEnvelopeJson
-} from "./chunk-OVO2RZAE.js";
+} from "./chunk-7AGLCOYE.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-LN22XH4B.js";
 import {
   encrypt
-} from "./chunk-TLJOJBZD.js";
+} from "./chunk-5HZULLHE.js";
 import {
   NoydbError
-} from "./chunk-U23JUUPX.js";
+} from "./chunk-OJ64XMPJ.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-G4MGYGSS.js.map
+//# sourceMappingURL=chunk-ZRJBLWKQ.js.map

package/dist/classified/index.d.ts

@@ -1,6 +1,6 @@
-import { dL as ClassifiedFieldSpec, dM as ClassifiedStrategy } from '../index-D4GQe1Rx.js';
-export { dN as ClassifiedConfigError, dO as ClassifiedEntry, dP as ClassifiedGroup, dQ as ClassifiedList, dR as ClassifiedRevealCtx, dS as ClassifiedRevealError, dT as ClassifiedRider, dU as ClassifiedRotationError, dV as ClassifiedStorage, dW as ClassifiedVerdict, dX as ClassifiedVerifyCtx, dY as ClassifiedVerifyError, dZ as NO_CLASSIFIED, d_ as isClassifiedFieldSpec, d$ as isClassifiedGroup } from '../index-D4GQe1Rx.js';
-export { C as ClassifiedNeverStoredError, a as ClassifiedValidationError, R as ResolvedClassified, c as classified, l as luhnCheck, r as resolveClassifiedFields } from '../validators-Ctgkj5qd.js';
+import { dL as ClassifiedFieldSpec, dM as ClassifiedStrategy } from '../index-B-LKCpm6.js';
+export { dN as ClassifiedConfigError, dO as ClassifiedEntry, dP as ClassifiedGroup, dQ as ClassifiedList, dR as ClassifiedRevealCtx, dS as ClassifiedRevealError, dT as ClassifiedRider, dU as ClassifiedRotationError, dV as ClassifiedStorage, dW as ClassifiedVerdict, dX as ClassifiedVerifyCtx, dY as ClassifiedVerifyError, dZ as NO_CLASSIFIED, d_ as isClassifiedFieldSpec, d$ as isClassifiedGroup } from '../index-B-LKCpm6.js';
+export { C as ClassifiedNeverStoredError, a as ClassifiedValidationError, R as ResolvedClassified, c as classified, l as luhnCheck, r as resolveClassifiedFields } from '../validators-Bdiv0ucK.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-VFRNWE5P.js";
+} from "../chunk-OLVIGEHQ.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,13 +11,13 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-AF5ZRTZ4.js";
+} from "../chunk-47C4CI7R.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-U23JUUPX.js";
+} from "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ClassifiedConfigError,

package/dist/{collection-facade-MKEBZDWW.js → collection-facade-5V3JS7SD.js}

@@ -8,22 +8,22 @@ import {
   search,
   similarTo,
   warmIndex
-} from "./chunk-GOUNIHFA.js";
+} from "./chunk-CYWF3JJE.js";
 import "./chunk-AURFOK3D.js";
-import "./chunk-SEQ2JI3Y.js";
-import "./chunk-VAWY44JW.js";
-import "./chunk-TB5RNNJ4.js";
-import "./chunk-M66NAZA4.js";
-import "./chunk-OVO2RZAE.js";
+import "./chunk-WQAT24C2.js";
+import "./chunk-WAL4MRBK.js";
+import "./chunk-C6A2DPRE.js";
+import "./chunk-TWJVOYU2.js";
+import "./chunk-7AGLCOYE.js";
 import "./chunk-QKVILR7N.js";
+import "./chunk-5UOPIPZC.js";
+import "./chunk-UWZ7O4NR.js";
 import "./chunk-LN22XH4B.js";
-import "./chunk-PGFY7IRW.js";
-import "./chunk-TCIUO62Z.js";
-import "./chunk-UOEWDCUX.js";
+import "./chunk-VFQOE76I.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-TLJOJBZD.js";
-import "./chunk-4K3MQ5S3.js";
-import "./chunk-U23JUUPX.js";
+import "./chunk-5HZULLHE.js";
+import "./chunk-BASCPHNM.js";
+import "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   buildPersistedIndexCallbacks,
@@ -36,4 +36,4 @@ export {
   similarTo,
   warmIndex
 };
-//# sourceMappingURL=collection-facade-MKEBZDWW.js.map
+//# sourceMappingURL=collection-facade-5V3JS7SD.js.map

package/dist/{computed-BMMEFRFJ.js → computed-6FOFXQPE.js}

@@ -1,11 +1,11 @@
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-5EWYUR5P.js";
-import "./chunk-U23JUUPX.js";
+} from "./chunk-VK6OC22R.js";
+import "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-BMMEFRFJ.js.map
+//# sourceMappingURL=computed-6FOFXQPE.js.map

package/dist/{config-drift-KGM7ZRW4.js → config-drift-SWZNEH5H.js}

@@ -9,11 +9,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-K6DDSIXN.js");
+  const { persistClassifiedMarker } = await import("./register-OVONZ2MJ.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-5E6YB2JY.js");
+  const { loadPersistedSchema } = await import("./storage-DVKYH7UU.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -21,4 +21,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=config-drift-KGM7ZRW4.js.map
+//# sourceMappingURL=config-drift-SWZNEH5H.js.map

package/dist/consent/index.d.ts

@@ -1,5 +1,5 @@
-import { bp as ConsentStrategy } from '../index-D4GQe1Rx.js';
-export { bq as CONSENT_AUDIT_COLLECTION, br as ConsentAuditEntry, bs as ConsentAuditFilter, bt as ConsentContext, bu as ConsentOp, bv as loadConsentEntries, bw as writeConsentEntry } from '../index-D4GQe1Rx.js';
+import { bp as ConsentStrategy } from '../index-B-LKCpm6.js';
+export { bq as CONSENT_AUDIT_COLLECTION, br as ConsentAuditEntry, bs as ConsentAuditFilter, bt as ConsentContext, bu as ConsentOp, bv as loadConsentEntries, bw as writeConsentEntry } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/consent/index.js

@@ -2,17 +2,17 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-OPTFANOX.js";
+} from "../chunk-TSAT3E7Y.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-OVO2RZAE.js";
+import "../chunk-7AGLCOYE.js";
 import "../chunk-QKVILR7N.js";
+import "../chunk-5UOPIPZC.js";
+import "../chunk-UWZ7O4NR.js";
 import "../chunk-LN22XH4B.js";
-import "../chunk-PGFY7IRW.js";
-import "../chunk-TCIUO62Z.js";
-import "../chunk-UOEWDCUX.js";
+import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-TLJOJBZD.js";
-import "../chunk-U23JUUPX.js";
+import "../chunk-5HZULLHE.js";
+import "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/crdt/index.d.ts

@@ -1,5 +1,5 @@
-import { bf as CrdtStrategy } from '../index-D4GQe1Rx.js';
-export { bg as CrdtMode, bh as CrdtState, bi as LwwMapState, bj as RgaState, bk as YjsState, bl as buildLwwMapState, bm as buildRgaState, bn as mergeCrdtStates, bo as resolveCrdtSnapshot } from '../index-D4GQe1Rx.js';
+import { bf as CrdtStrategy } from '../index-B-LKCpm6.js';
+export { bg as CrdtMode, bh as CrdtState, bi as LwwMapState, bj as RgaState, bk as YjsState, bl as buildLwwMapState, bm as buildRgaState, bn as mergeCrdtStates, bo as resolveCrdtSnapshot } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/dead-filter-MGWMNRO2.js

@@ -0,0 +1,28 @@
+import {
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/satellites/dead-filter.ts
+async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
+  const { loadPersistedSchema } = await import("./storage-DVKYH7UU.js");
+  const out = /* @__PURE__ */ new Map();
+  for (const name of collectionNames) {
+    if (name.startsWith("_")) continue;
+    let dek;
+    try {
+      dek = await getDEK(name);
+    } catch {
+      continue;
+    }
+    const persisted = await loadPersistedSchema(store, vaultName, name, dek);
+    const marker = persisted?.satellite;
+    if (!marker) continue;
+    out.set(name, await liveBaseIdSet(store, vaultName, marker.base));
+  }
+  return out;
+}
+export {
+  liveBaseIdSetsForBundle
+};
+//# sourceMappingURL=dead-filter-MGWMNRO2.js.map

package/dist/dead-filter-MGWMNRO2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/{delegation-BQNIEHZE.js → delegation-AUY42TGU.js}

@@ -3,18 +3,18 @@ import {
   issueDelegation,
   loadActiveDelegations,
   revokeDelegation
-} from "./chunk-VPCMJ5Z4.js";
-import "./chunk-BMQOH7MM.js";
+} from "./chunk-RLP65PI3.js";
+import "./chunk-26FSVNBL.js";
 import "./chunk-ZJADGNYF.js";
-import "./chunk-OVO2RZAE.js";
+import "./chunk-7AGLCOYE.js";
 import "./chunk-QKVILR7N.js";
+import "./chunk-5UOPIPZC.js";
+import "./chunk-UWZ7O4NR.js";
 import "./chunk-LN22XH4B.js";
-import "./chunk-PGFY7IRW.js";
-import "./chunk-TCIUO62Z.js";
-import "./chunk-UOEWDCUX.js";
+import "./chunk-VFQOE76I.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-TLJOJBZD.js";
-import "./chunk-U23JUUPX.js";
+import "./chunk-5HZULLHE.js";
+import "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DELEGATIONS_COLLECTION,
@@ -22,4 +22,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-BQNIEHZE.js.map
+//# sourceMappingURL=delegation-AUY42TGU.js.map

package/dist/derivations/index.d.ts

@@ -1,6 +1,6 @@
-export { w as withDerivation, a as withRollup } from '../with-rollup-bQRPc3y1.js';
-import { c2 as DerivationStrategy, c3 as DerivationContext } from '../index-D4GQe1Rx.js';
-export { c4 as ArrayOutputSpec, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, ca as DerivationRegistry, cb as DerivationStrategyHandle, cc as DerivedFromMeta, cd as OutputSpec, ce as RecordOutputSpec } from '../index-D4GQe1Rx.js';
+export { w as withDerivation, a as withRollup } from '../with-rollup-JXTxc9cu.js';
+import { c2 as DerivationStrategy, c3 as DerivationContext } from '../index-B-LKCpm6.js';
+export { c4 as ArrayOutputSpec, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, ca as DerivationRegistry, cb as DerivationStrategyHandle, cc as DerivedFromMeta, cd as OutputSpec, ce as RecordOutputSpec } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/derivations/index.js

@@ -1,28 +1,28 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-HMXLN43G.js";
+} from "../chunk-OWGAXPRE.js";
 import {
   DerivationRegistry
-} from "../chunk-RDHAGBEB.js";
+} from "../chunk-7KTL4RHZ.js";
 import {
   DerivationExecutor
-} from "../chunk-XYYW64LB.js";
-import "../chunk-OVO2RZAE.js";
+} from "../chunk-7CZ6YXMO.js";
+import "../chunk-7AGLCOYE.js";
 import "../chunk-QKVILR7N.js";
+import "../chunk-5UOPIPZC.js";
+import "../chunk-UWZ7O4NR.js";
 import "../chunk-LN22XH4B.js";
-import "../chunk-PGFY7IRW.js";
-import "../chunk-TCIUO62Z.js";
-import "../chunk-UOEWDCUX.js";
+import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-TLJOJBZD.js";
+import "../chunk-5HZULLHE.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-U23JUUPX.js";
+} from "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-FWSEWWI7.js

@@ -0,0 +1,21 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-55LSDABW.js";
+import "./chunk-7AGLCOYE.js";
+import "./chunk-QKVILR7N.js";
+import "./chunk-5UOPIPZC.js";
+import "./chunk-UWZ7O4NR.js";
+import "./chunk-LN22XH4B.js";
+import "./chunk-VFQOE76I.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-5HZULLHE.js";
+import "./chunk-OJ64XMPJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-FWSEWWI7.js.map

package/dist/{dev-unlock-Cqd5Xv5J.d.ts → dev-unlock-DxecHstJ.d.ts}

@@ -1,4 +1,4 @@
-import { cR as Role, cF as UnlockedKeyring } from './index-D4GQe1Rx.js';
+import { cR as Role, cF as UnlockedKeyring } from './index-B-LKCpm6.js';
 
 /**
  * Session tokens —

package/dist/{enclave-YN6223OG.js → enclave-UYZGSE2C.js}

@@ -12,24 +12,24 @@ import {
   rotateRecordCek,
   sealRecordToHost,
   writeEnvelopeBody
-} from "./chunk-OVO2RZAE.js";
+} from "./chunk-7AGLCOYE.js";
 import {
   buildTombstone,
   isTombstone
 } from "./chunk-QKVILR7N.js";
-import "./chunk-LN22XH4B.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
   evaluateKofN
-} from "./chunk-PGFY7IRW.js";
-import "./chunk-TCIUO62Z.js";
+} from "./chunk-5UOPIPZC.js";
+import "./chunk-UWZ7O4NR.js";
+import "./chunk-LN22XH4B.js";
 import {
   computeBidxTarget,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag
-} from "./chunk-UOEWDCUX.js";
+} from "./chunk-VFQOE76I.js";
 import {
   pbkdf2VerifyDigest
 } from "./chunk-LP7BEXCT.js";
@@ -60,8 +60,8 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "./chunk-TLJOJBZD.js";
-import "./chunk-U23JUUPX.js";
+} from "./chunk-5HZULLHE.js";
+import "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -114,4 +114,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-YN6223OG.js.map
+//# sourceMappingURL=enclave-UYZGSE2C.js.map

package/dist/executor-EUPYHCLU.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-7CZ6YXMO.js";
+import "./chunk-OJ64XMPJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-EUPYHCLU.js.map

package/dist/executor-KZ4B3PRT.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-HU55NPHZ.js";
+import "./chunk-OJ64XMPJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-KZ4B3PRT.js.map