@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-P2PEPSPK.js

@@ -1,230 +0,0 @@
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-REWTMYSF.js";
-
-// src/with-party/team/managed-passphrase.ts
-var MemorySealingKeyProvider = class {
-  id;
-  fingerprint;
-  keyBytes;
-  constructor(opts) {
-    this.id = opts.id;
-    const encoded = new TextEncoder().encode(opts.id);
-    let h = 0;
-    for (let i = 0; i < encoded.length; i++) {
-      h = h * 31 + encoded[i] >>> 0;
-    }
-    this.fingerprint = new Uint8Array([
-      h >>> 24 & 255,
-      h >>> 16 & 255,
-      h >>> 8 & 255,
-      h & 255
-    ]);
-    this.keyBytes = new Uint8Array(16);
-    for (let i = 0; i < 16; i++) {
-      this.keyBytes[i] = this.fingerprint[i % 4] ^ i * 17;
-    }
-  }
-  async seal(passphrase) {
-    const out = new Uint8Array(4 + passphrase.length);
-    out.set(this.fingerprint, 0);
-    for (let i = 0; i < passphrase.length; i++) {
-      out[4 + i] = passphrase[i] ^ this.keyBytes[i % 16];
-    }
-    return out;
-  }
-  async unseal(sealed) {
-    if (sealed.length < 4) {
-      throw new Error("MemorySealingKeyProvider: sealed input too short");
-    }
-    for (let i = 0; i < 4; i++) {
-      if (sealed[i] !== this.fingerprint[i]) {
-        throw new Error(
-          `MemorySealingKeyProvider("${this.id}"): provider-id mismatch on unseal (sealed bytes were produced by a different provider)`
-        );
-      }
-    }
-    const body = sealed.subarray(4);
-    const out = new Uint8Array(body.length);
-    for (let i = 0; i < body.length; i++) {
-      out[i] = body[i] ^ this.keyBytes[i % 16];
-    }
-    return out;
-  }
-};
-async function sealRsaOaepTlv(plaintext, publicKeyPem) {
-  const b64 = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----/, "").replace(/-----END PUBLIC KEY-----/, "").replace(/\s+/g, "");
-  const spki = base64ToBytes(b64);
-  const recipientPub = await crypto.subtle.importKey(
-    "spki",
-    spki,
-    { name: "RSA-OAEP", hash: "SHA-256" },
-    false,
-    ["encrypt"]
-  );
-  const cekBytes = crypto.getRandomValues(new Uint8Array(32));
-  const cek = await crypto.subtle.importKey("raw", cekBytes, "AES-GCM", false, ["encrypt"]);
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, cek, plaintext));
-  const wrapped = new Uint8Array(await crypto.subtle.encrypt({ name: "RSA-OAEP" }, recipientPub, cekBytes));
-  cekBytes.fill(0);
-  if (wrapped.length !== 256) {
-    throw new Error(`sealRsaOaepTlv: expected 256-byte RSA-OAEP wrap, got ${wrapped.length}`);
-  }
-  const out = new Uint8Array(1 + 256 + 12 + ct.length);
-  out[0] = 1;
-  out.set(wrapped, 1);
-  out.set(iv, 1 + 256);
-  out.set(ct, 1 + 256 + 12);
-  return out;
-}
-function parseRsaOaepTlv(bytes) {
-  if (bytes.length < 1 + 256 + 12 + 16) {
-    throw new Error("parseRsaOaepTlv: sealed input too short");
-  }
-  if (bytes[0] !== 1) {
-    throw new Error(`parseRsaOaepTlv: unknown TLV version ${bytes[0]}`);
-  }
-  return {
-    wrapped: bytes.subarray(1, 1 + 256),
-    iv: bytes.subarray(1 + 256, 1 + 256 + 12),
-    ct: bytes.subarray(1 + 256 + 12)
-  };
-}
-async function aesGcmOpen(cekBytes, iv, ct) {
-  const cek = await crypto.subtle.importKey("raw", cekBytes, "AES-GCM", false, ["decrypt"]);
-  return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv }, cek, ct));
-}
-var MemoryRecipientSealer = class {
-  id;
-  keypair;
-  constructor(opts) {
-    this.id = opts.id;
-    this.keypair = crypto.subtle.generateKey(
-      { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
-      true,
-      ["encrypt", "decrypt"]
-    );
-  }
-  async publishRecipientHint() {
-    const { publicKey } = await this.keypair;
-    const spki = await crypto.subtle.exportKey("spki", publicKey);
-    const pem = "-----BEGIN PUBLIC KEY-----\n" + bytesToBase64(new Uint8Array(spki)).match(/.{1,64}/g).join("\n") + "\n-----END PUBLIC KEY-----\n";
-    return { v: 1, pid: this.id, alg: "rsa-oaep-sha256", material: { publicKeyPem: pem } };
-  }
-  async sealForRecipient(plaintext, hint) {
-    if (hint.v !== 1) {
-      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`);
-    }
-    if (hint.alg !== "rsa-oaep-sha256") {
-      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`);
-    }
-    const pem = hint.material["publicKeyPem"];
-    if (typeof pem !== "string") {
-      throw new Error("MemoryRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string");
-    }
-    return sealRsaOaepTlv(plaintext, pem);
-  }
-  async seal(plaintext) {
-    const hint = await this.publishRecipientHint();
-    return this.sealForRecipient(plaintext, hint);
-  }
-  async unseal(bytes) {
-    const { wrapped, iv, ct } = parseRsaOaepTlv(bytes);
-    const { privateKey } = await this.keypair;
-    const cekBytes = new Uint8Array(await crypto.subtle.decrypt({ name: "RSA-OAEP" }, privateKey, wrapped));
-    const pt = await aesGcmOpen(cekBytes, iv, ct);
-    cekBytes.fill(0);
-    return pt;
-  }
-};
-var SEALED_PASSPHRASE_RECORD_ID = "sealed-passphrase";
-function bytesToBase64(bytes) {
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
-  return btoa(binary);
-}
-function base64ToBytes(b64) {
-  const binary = atob(b64);
-  const out = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
-  return out;
-}
-function parseSealedEnvelope(raw) {
-  if (typeof raw !== "object" || raw === null) return void 0;
-  const r = raw;
-  if (r._noydb_sealed !== 1) return void 0;
-  if (r.v === 1 && typeof r.pid === "string" && typeof r.payload === "string") {
-    return {
-      _noydb_sealed: 1,
-      providerId: r.pid,
-      sealed: base64ToBytes(r.payload)
-    };
-  }
-  if (typeof r.providerId === "string" && typeof r.sealed === "string") {
-    return {
-      _noydb_sealed: 1,
-      providerId: r.providerId,
-      sealed: base64ToBytes(r.sealed)
-    };
-  }
-  return void 0;
-}
-async function saveSealedPassphrase(store, vault, payload) {
-  const persisted = {
-    v: 1,
-    _noydb_sealed: 1,
-    pid: payload.providerId,
-    payload: bytesToBase64(payload.sealed)
-  };
-  const prior = await store.get(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    // AES-GCM bypassed — the sealing layer is the security boundary.
-    _iv: "",
-    _data: JSON.stringify(persisted)
-  };
-  await store.put(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID, env);
-}
-async function loadSealedPassphrase(store, vault) {
-  const envelope = await store.get(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID);
-  if (!envelope) return void 0;
-  try {
-    return parseSealedEnvelope(JSON.parse(envelope._data));
-  } catch {
-    return void 0;
-  }
-}
-async function resolveManagedSecret(store, vault, provider) {
-  const existing = await loadSealedPassphrase(store, vault);
-  if (existing) {
-    if (existing.providerId !== provider.id) {
-      throw new Error(
-        `Managed-mode vault "${vault}" was sealed under provider id "${existing.providerId}" but the current SealingKeyProvider is "${provider.id}". Pass the same provider that originally enrolled the vault, or treat this as a fresh enrollment and clear \`_meta/sealed-passphrase\` first.`
-      );
-    }
-    const plaintext = await provider.unseal(existing.sealed);
-    return bytesToBase64(plaintext);
-  }
-  const random = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(random);
-  const sealed = await provider.seal(random);
-  await saveSealedPassphrase(store, vault, { providerId: provider.id, sealed });
-  return bytesToBase64(random);
-}
-
-export {
-  MemorySealingKeyProvider,
-  sealRsaOaepTlv,
-  parseRsaOaepTlv,
-  aesGcmOpen,
-  MemoryRecipientSealer,
-  SEALED_PASSPHRASE_RECORD_ID,
-  parseSealedEnvelope,
-  saveSealedPassphrase,
-  loadSealedPassphrase,
-  resolveManagedSecret
-};
-//# sourceMappingURL=chunk-P2PEPSPK.js.map

package/dist/chunk-P6TZ3IVN.js

@@ -1,453 +0,0 @@
-import {
-  SCHEMAS_COLLECTION
-} from "./chunk-J7OH6R4K.js";
-import {
-  BLOB_CHUNKS_COLLECTION,
-  BLOB_COLLECTION,
-  BLOB_INDEX_COLLECTION,
-  BLOB_SLOTS_PREFIX,
-  BLOB_VERSIONS_PREFIX
-} from "./chunk-WPNP3NF5.js";
-import {
-  assembleBundleContainer,
-  buildExtractedPartitionWrapper
-} from "./chunk-BJ2XF2RC.js";
-import {
-  generateULID
-} from "./chunk-ZJADGNYF.js";
-import {
-  LEDGER_COLLECTION
-} from "./chunk-I7FD46FF.js";
-import {
-  canonicalJson,
-  envelopePayloadHash,
-  hashEntry
-} from "./chunk-UMH35AQV.js";
-import {
-  openEnvelopeJson
-} from "./chunk-7TAV3BFQ.js";
-import {
-  NOYDB_BACKUP_VERSION,
-  NOYDB_FORMAT_VERSION
-} from "./chunk-REWTMYSF.js";
-import {
-  bufferToBase64,
-  decrypt,
-  decryptBytesWithAAD,
-  encrypt,
-  encryptBytesWithAAD,
-  generateDEK,
-  unwrapCek,
-  wrapCek
-} from "./chunk-5HZULLHE.js";
-import {
-  PartitionExtractionError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-cargo/walk-closure.ts
-async function walkClosure(vault, opts) {
-  const closure = /* @__PURE__ */ new Map();
-  const requireStringId = (collection, record) => {
-    const id = record["id"];
-    if (typeof id !== "string") {
-      throw new PartitionExtractionError(
-        `walkClosure: record in collection "${collection}" has a non-string id (${typeof id}); cannot include it in the partition closure.`
-      );
-    }
-    return id;
-  };
-  const add = (collection, id) => {
-    let set = closure.get(collection);
-    if (!set) {
-      set = /* @__PURE__ */ new Set();
-      closure.set(collection, set);
-    }
-    if (set.has(id)) return false;
-    set.add(id);
-    return true;
-  };
-  for (const [collectionName, predicate] of Object.entries(opts.seeds)) {
-    const coll = vault.collection(collectionName);
-    const records = await coll.list();
-    for (const record of records) {
-      if (await predicate(record)) {
-        add(collectionName, requireStringId(collectionName, record));
-      }
-    }
-  }
-  const { refRegistry } = vault._introspectState();
-  const maxDepth = opts.maxDepth ?? 16;
-  let cyclesDetected = false;
-  let inboundDepth = 0;
-  let outboundDepth = 0;
-  let frontier = [];
-  for (const [c, ids] of closure) for (const id of ids) frontier.push([c, id]);
-  while (frontier.length > 0) {
-    const next = [];
-    for (const [collectionName, id] of frontier) {
-      for (const inbound of refRegistry.getInbound(collectionName)) {
-        const childColl = vault.collection(inbound.collection);
-        const childRecords = await childColl.list();
-        for (const child of childRecords) {
-          const fk = child[inbound.field];
-          if (typeof fk !== "string" && typeof fk !== "number") continue;
-          if (String(fk) !== id) continue;
-          const childId = requireStringId(inbound.collection, child);
-          if (add(inbound.collection, childId)) {
-            next.push([inbound.collection, childId]);
-          } else {
-            cyclesDetected = true;
-          }
-        }
-      }
-    }
-    if (next.length > 0 && ++inboundDepth > maxDepth) {
-      throw new PartitionExtractionError(
-        `walkClosure exceeded maxDepth=${maxDepth}; the FK graph may be unexpectedly deep or cyclic. Raise maxDepth or narrow the seeds.`
-      );
-    }
-    frontier = next;
-  }
-  let outboundFrontier = [];
-  for (const [c, ids] of closure) for (const id of ids) outboundFrontier.push([c, id]);
-  while (outboundFrontier.length > 0) {
-    const next = [];
-    for (const [collectionName, id] of outboundFrontier) {
-      const outbound = refRegistry.getOutbound(collectionName);
-      if (Object.keys(outbound).length === 0) continue;
-      const coll = vault.collection(collectionName);
-      const record = await coll.get(id);
-      if (!record) continue;
-      for (const [field, descriptor] of Object.entries(outbound)) {
-        const rawId = record[field];
-        if (typeof rawId !== "string" && typeof rawId !== "number") continue;
-        const parentId = String(rawId);
-        if (add(descriptor.target, parentId)) {
-          next.push([descriptor.target, parentId]);
-        }
-      }
-    }
-    if (next.length > 0 && ++outboundDepth > maxDepth) {
-      throw new PartitionExtractionError(
-        `walkClosure exceeded maxDepth=${maxDepth} during outbound completion.`
-      );
-    }
-    outboundFrontier = next;
-  }
-  const depth = Math.max(inboundDepth, outboundDepth);
-  return { closure, graph: { depth, cyclesDetected } };
-}
-
-// src/with-cargo/extract-partition.ts
-async function reKeyClosure(vault, closure, fieldProjection) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const collections = {};
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collectionName, ids] of closure) {
-    const srcDek = await getDEK(collectionName);
-    const destDek = await generateDEK();
-    deks.set(collectionName, destDek);
-    const out = {};
-    const projList = fieldProjection?.[collectionName];
-    const proj = projList ? new Set(projList) : void 0;
-    const project = (plaintext) => {
-      if (!proj) return plaintext;
-      const rec = JSON.parse(plaintext);
-      const kept = {};
-      if ("id" in rec) kept["id"] = rec["id"];
-      for (const f of proj) if (f in rec) kept[f] = rec[f];
-      return JSON.stringify(kept);
-    };
-    for (const id of ids) {
-      const env = await adapter.get(vaultName, collectionName, id);
-      if (!env) continue;
-      if (env._cek !== void 0) {
-        const cek = await unwrapCek(env._cek, srcDek);
-        const plaintext2 = await decrypt(env._iv, env._data, cek);
-        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek);
-        const wrapped = await wrapCek(cek, destDek);
-        out[id] = { ...env, _iv: iv2, _data: data2, _cek: wrapped };
-        continue;
-      }
-      const plaintext = await openEnvelopeJson(env, srcDek);
-      const { iv, data } = await encrypt(project(plaintext), destDek);
-      out[id] = { ...env, _iv: iv, _data: data };
-    }
-    collections[collectionName] = out;
-  }
-  return { collections, deks };
-}
-async function reKeySchemas(vault, closure, destDeks, fieldProjection) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const out = {};
-  for (const collectionName of closure.keys()) {
-    if (fieldProjection?.[collectionName]) continue;
-    const env = await adapter.get(vaultName, SCHEMAS_COLLECTION, collectionName);
-    if (!env) continue;
-    const destDek = destDeks.get(collectionName);
-    if (!destDek) continue;
-    const srcDek = await getDEK(collectionName);
-    const plaintext = await openEnvelopeJson(env, srcDek);
-    const { iv, data } = await encrypt(plaintext, destDek);
-    out[collectionName] = { ...env, _iv: iv, _data: data };
-  }
-  return out;
-}
-var paddedIndex = (n) => String(n).padStart(10, "0");
-async function reKeyLedger(vault, closure, reKeyedCollections, ledgerDek) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const srcLedgerDek = await getDEK(LEDGER_COLLECTION);
-  const ids = (await adapter.list(vaultName, LEDGER_COLLECTION)).sort();
-  const srcEntries = [];
-  for (const id of ids) {
-    const env = await adapter.get(vaultName, LEDGER_COLLECTION, id);
-    if (!env) continue;
-    srcEntries.push(JSON.parse(await openEnvelopeJson(env, srcLedgerDek)));
-  }
-  const kept = srcEntries.filter(
-    (e) => (e.op === "put" || e.op === "delete") && (closure.get(e.collection)?.has(e.id) ?? false)
-  );
-  const latestPutIndex = /* @__PURE__ */ new Map();
-  for (let i = kept.length - 1; i >= 0; i--) {
-    const e = kept[i];
-    if (e.op !== "put") continue;
-    const key = `${e.collection}/${e.id}`;
-    if (!latestPutIndex.has(key)) latestPutIndex.set(key, i);
-  }
-  const entries = {};
-  let prevHash = "";
-  let last;
-  for (let i = 0; i < kept.length; i++) {
-    const src = kept[i];
-    const key = `${src.collection}/${src.id}`;
-    const isLatestPut = src.op === "put" && latestPutIndex.get(key) === i;
-    const reKeyedEnv = reKeyedCollections[src.collection]?.[src.id];
-    const payloadHash = isLatestPut && reKeyedEnv ? await envelopePayloadHash(reKeyedEnv) : src.payloadHash;
-    const entry = {
-      index: i,
-      prevHash,
-      op: src.op,
-      collection: src.collection,
-      id: src.id,
-      version: src.version,
-      ts: src.ts,
-      actor: src.actor,
-      payloadHash,
-      ...src.reason !== void 0 ? { reason: src.reason } : {}
-    };
-    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek);
-    entries[paddedIndex(i)] = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: i + 1,
-      _ts: entry.ts,
-      _iv: iv,
-      _data: data,
-      _by: entry.actor
-    };
-    prevHash = await hashEntry(entry);
-    last = entry;
-  }
-  return {
-    entries,
-    head: last ? { hash: prevHash, index: last.index, ts: last.ts } : { hash: "", index: -1, ts: "" }
-  };
-}
-function chunkAAD(eTag, chunkIndex, chunkCount) {
-  return new TextEncoder().encode(`${eTag}:${chunkIndex}:${chunkCount}`);
-}
-async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const internal = {};
-  const carriedRefs = /* @__PURE__ */ new Map();
-  const addRef = (eTag) => {
-    if (!eTag) return;
-    carriedRefs.set(eTag, (carriedRefs.get(eTag) ?? 0) + 1);
-  };
-  const place = (collection, id, env) => {
-    let bucket = internal[collection];
-    if (!bucket) {
-      bucket = {};
-      internal[collection] = bucket;
-    }
-    bucket[id] = env;
-  };
-  for (const [collectionName, ids] of closure) {
-    const destDek = destDeks.get(collectionName);
-    if (!destDek) continue;
-    const srcDek = await getDEK(collectionName);
-    const projList = fieldProjection?.[collectionName];
-    const proj = projList ? new Set(projList) : void 0;
-    const slotsCollection = `${BLOB_SLOTS_PREFIX}${collectionName}`;
-    for (const id of ids) {
-      const env = await adapter.get(vaultName, slotsCollection, id);
-      if (!env) continue;
-      const slots = JSON.parse(await openEnvelopeJson(env, srcDek));
-      const kept = {};
-      for (const [slotName, slot] of Object.entries(slots)) {
-        if (proj && !proj.has(slotName)) continue;
-        kept[slotName] = slot;
-        addRef(slot.eTag);
-      }
-      if (Object.keys(kept).length === 0) continue;
-      const { iv, data } = await encrypt(JSON.stringify(kept), destDek);
-      place(slotsCollection, id, { ...env, _iv: iv, _data: data });
-    }
-    const versionsCollection = `${BLOB_VERSIONS_PREFIX}${collectionName}`;
-    const versionKeys = await adapter.list(vaultName, versionsCollection);
-    for (const key of versionKeys) {
-      const [recordId, slotName] = key.split("::");
-      if (recordId === void 0 || !ids.has(recordId)) continue;
-      if (proj && slotName !== void 0 && !proj.has(slotName)) continue;
-      const env = await adapter.get(vaultName, versionsCollection, key);
-      if (!env) continue;
-      const record = JSON.parse(await openEnvelopeJson(env, srcDek));
-      addRef(record.eTag);
-      const { iv, data } = await encrypt(JSON.stringify(record), destDek);
-      place(versionsCollection, key, { ...env, _iv: iv, _data: data });
-    }
-  }
-  if (carriedRefs.size === 0) return { internal };
-  const srcBlobDek = await getDEK(BLOB_COLLECTION);
-  const transferBlobDek = await generateDEK();
-  for (const [eTag, refCount] of carriedRefs) {
-    const idxEnv = await adapter.get(vaultName, BLOB_INDEX_COLLECTION, eTag);
-    if (!idxEnv) continue;
-    const blob = JSON.parse(await openEnvelopeJson(idxEnv, srcBlobDek));
-    let contentCek;
-    let chunksPassthrough;
-    if (blob._cek !== void 0) {
-      contentCek = await unwrapCek(blob._cek, srcBlobDek);
-      chunksPassthrough = true;
-    } else {
-      contentCek = await generateDEK();
-      chunksPassthrough = false;
-    }
-    for (let i = 0; i < blob.chunkCount; i++) {
-      const chunkId = `${eTag}_${i}`;
-      const chunkEnv = await adapter.get(vaultName, BLOB_CHUNKS_COLLECTION, chunkId);
-      if (!chunkEnv) {
-        throw new PartitionExtractionError(
-          `reKeyBlobs: blob chunk ${i}/${blob.chunkCount} missing for eTag "${eTag}"; cannot carry an incomplete blob into the partition.`
-        );
-      }
-      if (chunksPassthrough) {
-        place(BLOB_CHUNKS_COLLECTION, chunkId, chunkEnv);
-      } else {
-        const aad = chunkAAD(eTag, i, blob.chunkCount);
-        const plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, srcBlobDek, aad);
-        const { iv: iv2, data: data2 } = await encryptBytesWithAAD(plain, contentCek, aad);
-        place(BLOB_CHUNKS_COLLECTION, chunkId, { ...chunkEnv, _iv: iv2, _data: data2 });
-      }
-    }
-    const { _cekPending, ...rest } = blob;
-    void _cekPending;
-    const carried = { ...rest, refCount, _cek: await wrapCek(contentCek, transferBlobDek) };
-    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek);
-    place(BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
-  }
-  return { internal, blobDek: transferBlobDek };
-}
-async function sealDeks(deks) {
-  const dekMap = {};
-  for (const [collection, dek] of deks) {
-    const raw = await crypto.subtle.exportKey("raw", dek);
-    dekMap[collection] = bufferToBase64(raw);
-  }
-  const transferKey = crypto.getRandomValues(new Uint8Array(32));
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["encrypt"]);
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(JSON.stringify(dekMap));
-  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext);
-  const combined = new Uint8Array(iv.byteLength + ct.byteLength);
-  combined.set(iv, 0);
-  combined.set(new Uint8Array(ct), iv.byteLength);
-  const sealId = bufferToBase64(crypto.getRandomValues(new Uint8Array(12)));
-  return {
-    seal: { v: 1, alg: "aes-256-gcm-pre-shared", sealId, payload: bufferToBase64(combined) },
-    transferKey
-  };
-}
-async function extractPartition(vault, opts) {
-  return vault.cargoStrategy.extractPartition(vault, opts);
-}
-async function extractPartitionCore(vault, opts) {
-  if (vault.role === "custodian") {
-    throw new PartitionExtractionError(
-      "extractPartition is owner-only; a custodian cannot extract-and-sever (FR-6: producing a re-keyed standalone partition is an ownership operation; use the Deed owner)."
-    );
-  }
-  if (vault.role !== "owner") {
-    throw new PartitionExtractionError(
-      `extractPartition requires the 'owner' role on the source vault; caller is '${vault.role}'. Producing a re-keyed standalone partition is an ownership operation.`
-    );
-  }
-  if (opts.carrySchemas) await vault._drainPendingSchemaWrites();
-  const { closure } = await walkClosure(vault, opts);
-  const { collections, deks } = await reKeyClosure(vault, closure, opts.fieldProjection);
-  let ledgerHead;
-  let ledgerEntries;
-  if (opts.carryLedger && vault._getLedgerOrNull() !== null) {
-    const ledgerDek = await generateDEK();
-    const built = await reKeyLedger(vault, closure, collections, ledgerDek);
-    if (built.head.index >= 0) {
-      ledgerEntries = built.entries;
-      ledgerHead = built.head;
-      deks.set(LEDGER_COLLECTION, ledgerDek);
-    }
-  }
-  const blobs = await reKeyBlobs(vault, closure, deks, opts.fieldProjection);
-  if (blobs.blobDek) deks.set(BLOB_COLLECTION, blobs.blobDek);
-  const internalSchemas = opts.carrySchemas ? await reKeySchemas(vault, closure, deks, opts.fieldProjection) : {};
-  const internal = {};
-  if (Object.keys(internalSchemas).length > 0) internal[SCHEMAS_COLLECTION] = internalSchemas;
-  if (ledgerEntries) internal[LEDGER_COLLECTION] = ledgerEntries;
-  for (const [collection, records] of Object.entries(blobs.internal)) internal[collection] = records;
-  const hasInternal = Object.keys(internal).length > 0;
-  const { seal, transferKey } = await sealDeks(deks);
-  await vault._getLedgerOrNull()?.append({
-    op: "lifecycle",
-    collection: "",
-    id: "",
-    version: 0,
-    actor: "",
-    payloadHash: "",
-    reason: `partition-handed-over:${seal.sealId}`
-  });
-  const { name: vaultName } = vault._introspectState();
-  const backup = {
-    _noydb_backup: NOYDB_BACKUP_VERSION,
-    _compartment: vaultName,
-    _exported_at: (/* @__PURE__ */ new Date()).toISOString(),
-    _exported_by: "",
-    // unowned — no source user travels
-    keyrings: {},
-    collections,
-    ...hasInternal ? { _internal: internal } : {},
-    ...ledgerHead ? { ledgerHead: { hash: ledgerHead.hash, index: ledgerHead.index, ts: ledgerHead.ts } } : {}
-  };
-  const bodyJsonStr = JSON.stringify(buildExtractedPartitionWrapper(JSON.stringify(backup), seal));
-  const handle = generateULID();
-  const bundleBytes = await assembleBundleContainer({
-    handle,
-    bodyJsonStr,
-    compression: opts.compression,
-    headerExtras: {
-      bundleKind: "extracted-partition",
-      transferSeal: { v: seal.v, alg: seal.alg, sealId: seal.sealId }
-      // indicator only
-    }
-  });
-  return { bundleBytes, transferKey, sealId: seal.sealId };
-}
-
-export {
-  walkClosure,
-  reKeyClosure,
-  reKeySchemas,
-  reKeyLedger,
-  reKeyBlobs,
-  sealDeks,
-  extractPartition,
-  extractPartitionCore
-};
-//# sourceMappingURL=chunk-P6TZ3IVN.js.map