@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/chunk-XTHCN77N.js

@@ -0,0 +1,91 @@
+import {
+  canonicalJson,
+  sha256Hex
+} from "./chunk-WQIYTNJV.js";
+import {
+  PeriodClosedError,
+  ValidationError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-audit/periods/periods.ts
+var PERIODS_COLLECTION = "_periods";
+var PERIOD_FREEZES_COLLECTION = "_period_freezes";
+var PERIOD_ARCHIVES_COLLECTION = "_period_archives";
+var PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+function periodExclusiveUpperBound(endDate) {
+  const ms = Date.parse(endDate);
+  if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate "${endDate}".`);
+  const dateOnly = /^\d{4}-\d{2}-\d{2}$/.test(endDate);
+  return new Date(ms + (dateOnly ? 864e5 : 1)).toISOString();
+}
+async function loadPeriods(adapter, vault, decrypt) {
+  const ids = await adapter.list(vault, PERIODS_COLLECTION);
+  const records = [];
+  for (const id of ids) {
+    const env = await adapter.get(vault, PERIODS_COLLECTION, id);
+    if (env) records.push(await decrypt(env));
+  }
+  records.sort((a, b) => a.closedAt.localeCompare(b.closedAt));
+  return records;
+}
+async function chainAnchor(records) {
+  const last = records[records.length - 1];
+  if (!last) return { priorPeriodHash: "" };
+  const hash = await sha256Hex(canonicalJson(last));
+  return { priorPeriodName: last.name, priorPeriodHash: hash };
+}
+function assertTsWritable(existing, incomingRecord, closedPeriods) {
+  for (const p of closedPeriods) {
+    if (p.kind !== "closed") continue;
+    if (p.dateField) {
+      const checkRecord = (label, r) => {
+        if (!r) return;
+        const v = r[p.dateField];
+        if (typeof v === "string" && v <= p.endDate) {
+          throw new PeriodClosedError(p.name, p.endDate, `${label}[${p.dateField}]=${v}`);
+        }
+      };
+      checkRecord("existing", existing?.record ?? null);
+      checkRecord("incoming", incomingRecord);
+      continue;
+    }
+    const existingTs = existing?.ts ?? null;
+    if (existingTs !== null && existingTs <= p.endDate) {
+      throw new PeriodClosedError(p.name, p.endDate, existingTs);
+    }
+  }
+}
+function validatePeriodName(name, existing) {
+  if (name.length === 0) {
+    throw new ValidationError("Period name cannot be empty.");
+  }
+  if (existing.some((p) => p.name === name)) {
+    throw new ValidationError(`Period "${name}" already exists.`);
+  }
+}
+async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
+  if (!ledger) return;
+  const { envelopePayloadHash } = await import("./ledger-PTK7XZYT.js");
+  await ledger.append({
+    op: "put",
+    collection,
+    id: name,
+    version: envelope._v,
+    actor,
+    payloadHash: await envelopePayloadHash(envelope)
+  });
+}
+
+export {
+  PERIODS_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound,
+  loadPeriods,
+  chainAnchor,
+  assertTsWritable,
+  validatePeriodName,
+  appendPeriodLedgerEntry
+};
+//# sourceMappingURL=chunk-XTHCN77N.js.map

package/dist/chunk-XUW3PXHU.js

@@ -0,0 +1,248 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-VCTXU4AT.js";
+import {
+  ValidationError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-party/directory/cover/custom.ts
+var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
+var MAX_CUSTOM_DEPTH = 8;
+function validateCustomInput(custom) {
+  if (custom === null || typeof custom !== "object" || Array.isArray(custom)) {
+    throw new ValidationError(
+      `setCover: custom must be a { [namespace]: value } object, got ${Array.isArray(custom) ? "array" : typeof custom}.`
+    );
+  }
+  for (const [ns, value] of Object.entries(custom)) {
+    if (!CUSTOM_KEY_PATTERN.test(ns)) {
+      throw new ValidationError(
+        `setCover: custom namespace "${ns}" is invalid. Keys must be reverse-DNS or package-style identifiers with at least one dot/dash-separated segment (e.g. "noydb.viewer", "com.acme.registry").`
+      );
+    }
+    assertJsonValue(value, ns, 1, /* @__PURE__ */ new Set());
+  }
+}
+function assertJsonValue(value, ns, depth, seen) {
+  if (value === null) return;
+  const t = typeof value;
+  if (t === "string" || t === "number" || t === "boolean") return;
+  if (t !== "object") {
+    throw new ValidationError(
+      `setCover: custom["${ns}"] contains a non-JSON value (${t}). Only strings, numbers, booleans, null, arrays, and plain objects are allowed.`
+    );
+  }
+  const container = value;
+  if (seen.has(container)) {
+    throw new ValidationError(
+      `setCover: custom["${ns}"] contains a circular reference.`
+    );
+  }
+  if (depth > MAX_CUSTOM_DEPTH) {
+    throw new ValidationError(
+      `setCover: custom["${ns}"] nests deeper than the ${MAX_CUSTOM_DEPTH}-level cap.`
+    );
+  }
+  seen.add(container);
+  const children = Array.isArray(container) ? container : Object.values(container);
+  for (const child of children) {
+    assertJsonValue(child, ns, depth + 1, seen);
+  }
+  seen.delete(container);
+}
+function mergeCustom(existing, patch) {
+  if (patch === void 0) {
+    return existing !== void 0 ? { custom: existing } : {};
+  }
+  const merged = { ...existing };
+  for (const [ns, value] of Object.entries(patch)) {
+    if (value === null) {
+      delete merged[ns];
+    } else {
+      merged[ns] = value;
+    }
+  }
+  return Object.keys(merged).length > 0 ? { custom: merged } : {};
+}
+function validateCoverSize(cover, schema) {
+  if (cover.custom !== void 0) {
+    const customSize = JSON.stringify(cover.custom).length;
+    if (customSize > schema.maxCustomBytes) {
+      throw new ValidationError(
+        `setCover: custom exceeds the ${schema.maxCustomBytes}-byte cap (got ${customSize} bytes serialized, after merging with the stored namespaces).`
+      );
+    }
+  }
+  const totalSize = JSON.stringify(cover).length;
+  if (totalSize > schema.maxCoverBytes) {
+    throw new ValidationError(
+      `setCover: the cover document exceeds the ${schema.maxCoverBytes}-byte cap (got ${totalSize} bytes serialized).`
+    );
+  }
+}
+
+// src/with-party/directory/cover/schema.ts
+var DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+);base64,/;
+function validateCoverInput(input, schema) {
+  const allowed = new Set(schema.fields);
+  for (const key of Object.keys(input)) {
+    const known = key === "name" || key === "description" || key === "icon" || key === "defaultLocale" || key === "custom" ? key : void 0;
+    if (!known) {
+      throw new ValidationError(
+        `setCover: unknown field "${key}". Allowed fields: ${[...allowed].join(", ")}.`
+      );
+    }
+    if (!allowed.has(known)) {
+      throw new ValidationError(
+        `setCover: field "${known}" is not enabled in this vault's schema. Allowed fields: ${[...allowed].join(", ")}.`
+      );
+    }
+  }
+  if (input.name !== void 0) {
+    validateText(input.name, "name", schema.maxStringChars);
+  }
+  if (input.description !== void 0) {
+    validateText(input.description, "description", schema.maxStringChars);
+  }
+  if (input.icon !== void 0) {
+    validateIcon(input.icon, schema);
+  }
+  if (input.defaultLocale !== void 0 && typeof input.defaultLocale !== "string") {
+    throw new ValidationError(
+      `setCover: defaultLocale must be a string (BCP-47), got ${typeof input.defaultLocale}.`
+    );
+  }
+  if (input.custom !== void 0) {
+    validateCustomInput(input.custom);
+  }
+}
+function validateText(value, field, maxChars) {
+  if (typeof value === "string") {
+    if (value.length > maxChars) {
+      throw new ValidationError(
+        `setCover: ${field} exceeds the ${maxChars}-character cap (got ${value.length}).`
+      );
+    }
+    return;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ValidationError(
+      `setCover: ${field} must be a string or { [locale]: string } map, got ${typeof value}.`
+    );
+  }
+  for (const [locale, str] of Object.entries(value)) {
+    if (typeof str !== "string") {
+      throw new ValidationError(
+        `setCover: ${field}[${locale}] must be a string, got ${typeof str}.`
+      );
+    }
+    if (str.length > maxChars) {
+      throw new ValidationError(
+        `setCover: ${field}[${locale}] exceeds the ${maxChars}-character cap (got ${str.length}).`
+      );
+    }
+  }
+}
+function validateIcon(icon, schema) {
+  if (typeof icon !== "string") {
+    throw new ValidationError(
+      `setCover: icon must be a data: URL string, got ${typeof icon}.`
+    );
+  }
+  if (icon.length > schema.maxIconBytes) {
+    throw new ValidationError(
+      `setCover: icon exceeds the ${schema.maxIconBytes}-byte cap (got ${icon.length}).`
+    );
+  }
+  const m = DATA_URL_PREFIX.exec(icon);
+  if (!m) {
+    throw new ValidationError(
+      "setCover: icon must be a base64 data URL (`data:image/png;base64,\u2026` or `data:image/svg+xml;base64,\u2026`). External URLs are not supported in v1."
+    );
+  }
+  const mime = m[1];
+  if (!schema.iconMimeTypes.includes(mime)) {
+    throw new ValidationError(
+      `setCover: icon MIME type "${mime}" is not allowed. Permitted types: ${schema.iconMimeTypes.join(", ")}.`
+    );
+  }
+}
+function isCover(x) {
+  if (x === null || typeof x !== "object" || Array.isArray(x)) return false;
+  const obj = x;
+  return obj["_noydb_public"] === 1 && typeof obj["version"] === "number";
+}
+var validatePublicEnvelopeInput = validateCoverInput;
+var isPublicEnvelope = isCover;
+
+// src/with-party/directory/cover/storage.ts
+var COVER_RECORD_ID = "public-envelope";
+async function loadCover(store, vault) {
+  const envelope = await store.get(vault, "_meta", COVER_RECORD_ID);
+  if (!envelope) return void 0;
+  try {
+    const parsed = JSON.parse(envelope._data);
+    if (!isCover(parsed)) return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function saveCover(store, vault, cover) {
+  const wireEnvelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(cover)
+  };
+  await store.put(vault, "_meta", COVER_RECORD_ID, wireEnvelope);
+}
+async function readCover(store, vault, opts = {}) {
+  const raw = await loadCover(store, vault);
+  if (!raw) return void 0;
+  if (opts.locale === void 0) return raw;
+  return resolveLocale(raw, opts.locale);
+}
+function resolveLocale(cover, locale) {
+  return {
+    ...cover,
+    ...cover.name !== void 0 ? { name: pickLocale(cover.name, locale, cover.defaultLocale) } : {},
+    ...cover.description !== void 0 ? { description: pickLocale(cover.description, locale, cover.defaultLocale) } : {}
+  };
+}
+function pickLocale(value, locale, defaultLocale) {
+  if (typeof value === "string") return value;
+  if (value[locale] !== void 0 && value[locale] !== "") return value[locale];
+  if (defaultLocale && value[defaultLocale] !== void 0 && value[defaultLocale] !== "") {
+    return value[defaultLocale];
+  }
+  for (const v of Object.values(value)) {
+    if (v !== "") return v;
+  }
+  return "";
+}
+var PUBLIC_ENVELOPE_RECORD_ID = COVER_RECORD_ID;
+var loadPublicEnvelope = loadCover;
+var savePublicEnvelope = saveCover;
+var readPublicEnvelope = readCover;
+
+export {
+  mergeCustom,
+  validateCoverSize,
+  validateCoverInput,
+  isCover,
+  validatePublicEnvelopeInput,
+  isPublicEnvelope,
+  COVER_RECORD_ID,
+  loadCover,
+  saveCover,
+  readCover,
+  resolveLocale,
+  pickLocale,
+  PUBLIC_ENVELOPE_RECORD_ID,
+  loadPublicEnvelope,
+  savePublicEnvelope,
+  readPublicEnvelope
+};
+//# sourceMappingURL=chunk-XUW3PXHU.js.map

package/dist/chunk-XUW3PXHU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/directory/cover/custom.ts","../src/with-party/directory/cover/schema.ts","../src/with-party/directory/cover/storage.ts"],"sourcesContent":["/**\n * The cover's namespaced `custom` extension slot (#800) — input\n * validation, the namespace-level patch merge, and the post-merge\n * size caps.\n *\n * Like everything on the cover, `custom` is plaintext, public by\n * design, and unauthenticated — payloads are hints (display defaults,\n * routing suggestions, registry pointers), never an input to\n * security, authorization, or data-integrity decisions.\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md\n *\n * @module\n */\nimport { ValidationError } from '../../../kernel/errors.js'\nimport type { Cover, JsonValue, ResolvedCoverSchema } from './types.js'\n\n/**\n * Namespace keys must be reverse-DNS or package-style identifiers —\n * at least one dot/dash-separated segment (`noydb.viewer`,\n * `com.acme.registry` pass; a bare `config` fails), so two frameworks\n * can't collide on a bare word.\n */\nconst CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i\n\n/** Maximum nesting depth of a namespace payload (containers, not leaves). */\nconst MAX_CUSTOM_DEPTH = 8\n\n/**\n * Validate the owner-supplied `custom` input: the field must be a\n * plain object, every key must match {@link CUSTOM_KEY_PATTERN}, and\n * every value must be JSON-serializable (no functions, `undefined`,\n * symbols, bigints, or cycles) within the depth cap. `null` is\n * accepted — it is the delete-this-namespace directive and never\n * persists. Throws `ValidationError` on the first violation.\n */\nexport function validateCustomInput(custom: Record<string, JsonValue>): void {\n  if (custom === null || typeof custom !== 'object' || Array.isArray(custom)) {\n    throw new ValidationError(\n      `setCover: custom must be a { [namespace]: value } object, got ${\n        Array.isArray(custom) ? 'array' : typeof custom\n      }.`,\n    )\n  }\n  for (const [ns, value] of Object.entries(custom)) {\n    if (!CUSTOM_KEY_PATTERN.test(ns)) {\n      throw new ValidationError(\n        `setCover: custom namespace \"${ns}\" is invalid. Keys must be ` +\n          'reverse-DNS or package-style identifiers with at least one ' +\n          'dot/dash-separated segment (e.g. \"noydb.viewer\", \"com.acme.registry\").',\n      )\n    }\n    assertJsonValue(value, ns, 1, new Set())\n  }\n}\n\nfunction assertJsonValue(\n  value: unknown,\n  ns: string,\n  depth: number,\n  seen: Set<object>,\n): void {\n  if (value === null) return\n  const t = typeof value\n  if (t === 'string' || t === 'number' || t === 'boolean') return\n  if (t !== 'object') {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] contains a non-JSON value (${t}). ` +\n        'Only strings, numbers, booleans, null, arrays, and plain objects are allowed.',\n    )\n  }\n  const container = value as object\n  if (seen.has(container)) {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] contains a circular reference.`,\n    )\n  }\n  if (depth > MAX_CUSTOM_DEPTH) {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] nests deeper than the ${MAX_CUSTOM_DEPTH}-level cap.`,\n    )\n  }\n  seen.add(container)\n  const children = Array.isArray(container) ? container : Object.values(container)\n  for (const child of children) {\n    assertJsonValue(child, ns, depth + 1, seen)\n  }\n  seen.delete(container)\n}\n\n/**\n * Namespace-level patch merge for `setCover`: provided namespaces\n * replace their previous value, absent namespaces are preserved, and\n * an explicit `null` deletes that namespace (so `null` never persists\n * as a namespace value). A whole-`custom`-absent patch preserves the\n * previous custom, consistent with the other cover fields. Rationale:\n * framework A must never need read-modify-write of framework B's data.\n *\n * Returns a spreadable fragment — `{ custom }` when the merge leaves\n * at least one namespace, `{}` when it leaves none (the field is\n * dropped from the persisted document rather than stored empty).\n */\nexport function mergeCustom(\n  existing: Record<string, JsonValue> | undefined,\n  patch: Record<string, JsonValue> | undefined,\n): { custom: Record<string, JsonValue> } | Record<string, never> {\n  if (patch === undefined) {\n    return existing !== undefined ? { custom: existing } : {}\n  }\n  const merged: Record<string, JsonValue> = { ...existing }\n  for (const [ns, value] of Object.entries(patch)) {\n    if (value === null) {\n      delete merged[ns]\n    } else {\n      merged[ns] = value\n    }\n  }\n  return Object.keys(merged).length > 0 ? { custom: merged } : {}\n}\n\n/**\n * Post-merge size caps — validates the WOULD-BE-PERSISTED document\n * (after the namespace merge), so a small patch can't tip the stored\n * cover over a cap unnoticed. `maxCoverBytes` bounds the entire\n * serialized document, which also closes the unbounded locale-map\n * key-count hole for `name` / `description`. Sizes are measured as\n * `JSON.stringify` length. Throws `ValidationError` on violation.\n */\nexport function validateCoverSize(\n  cover: Cover,\n  schema: ResolvedCoverSchema,\n): void {\n  if (cover.custom !== undefined) {\n    const customSize = JSON.stringify(cover.custom).length\n    if (customSize > schema.maxCustomBytes) {\n      throw new ValidationError(\n        `setCover: custom exceeds the ${schema.maxCustomBytes}-byte cap ` +\n          `(got ${customSize} bytes serialized, after merging with the stored namespaces).`,\n      )\n    }\n  }\n  const totalSize = JSON.stringify(cover).length\n  if (totalSize > schema.maxCoverBytes) {\n    throw new ValidationError(\n      `setCover: the cover document exceeds the ${schema.maxCoverBytes}-byte cap ` +\n        `(got ${totalSize} bytes serialized).`,\n    )\n  }\n}\n","/**\n * Validate-on-write for the cover. Runs at every `setCover` call;\n * the developer's schema decides which fields are allowed and the\n * size caps that apply.\n *\n * @module\n */\nimport { ValidationError } from '../../../kernel/errors.js'\nimport { validateCustomInput } from './custom.js'\nimport type {\n  Cover,\n  CoverText,\n  JsonValue,\n  ResolvedCoverSchema,\n  CoverField,\n} from './types.js'\n\n/** Owner-supplied input — the subset of {@link Cover} the owner can set. */\nexport interface SetCoverInput {\n  readonly name?: CoverText\n  readonly description?: CoverText\n  readonly icon?: string\n  readonly defaultLocale?: string\n  /**\n   * Namespace-level patch for the cover's `custom` slot (#800):\n   * provided namespaces replace their previous value, absent\n   * namespaces are preserved, an explicit `null` deletes that\n   * namespace. Requires `'custom'` in the schema's `fields` list —\n   * the `cover: true` shorthand does NOT enable it.\n   */\n  readonly custom?: Record<string, JsonValue>\n}\n\nconst DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\\/[a-zA-Z0-9.+-]+);base64,/\n\n/**\n * Validate an owner-supplied cover input against the developer's\n * resolved schema. Throws `ValidationError` on the first violation;\n * returns void on success.\n *\n * The validator is deliberately strict: every fail mode is a hard\n * error rather than a silent drop, so the owner finds out immediately\n * which field they oversized rather than discovering a truncated\n * label months later.\n */\nexport function validateCoverInput(\n  input: SetCoverInput,\n  schema: ResolvedCoverSchema,\n): void {\n  const allowed = new Set<CoverField>(schema.fields)\n\n  // Reject any key not in the schema's allowed-field list.\n  for (const key of Object.keys(input)) {\n    const known: CoverField | undefined =\n      key === 'name' || key === 'description' || key === 'icon' || key === 'defaultLocale' || key === 'custom'\n        ? key\n        : undefined\n    if (!known) {\n      throw new ValidationError(\n        `setCover: unknown field \"${key}\". ` +\n          `Allowed fields: ${[...allowed].join(', ')}.`,\n      )\n    }\n    if (!allowed.has(known)) {\n      throw new ValidationError(\n        `setCover: field \"${known}\" is not enabled in this vault's schema. ` +\n          `Allowed fields: ${[...allowed].join(', ')}.`,\n      )\n    }\n  }\n\n  if (input.name !== undefined) {\n    validateText(input.name, 'name', schema.maxStringChars)\n  }\n  if (input.description !== undefined) {\n    validateText(input.description, 'description', schema.maxStringChars)\n  }\n  if (input.icon !== undefined) {\n    validateIcon(input.icon, schema)\n  }\n  if (input.defaultLocale !== undefined && typeof input.defaultLocale !== 'string') {\n    throw new ValidationError(\n      `setCover: defaultLocale must be a string (BCP-47), got ${typeof input.defaultLocale}.`,\n    )\n  }\n  if (input.custom !== undefined) {\n    validateCustomInput(input.custom)\n  }\n}\n\nfunction validateText(\n  value: CoverText,\n  field: string,\n  maxChars: number,\n): void {\n  if (typeof value === 'string') {\n    if (value.length > maxChars) {\n      throw new ValidationError(\n        `setCover: ${field} exceeds the ${maxChars}-character cap (got ${value.length}).`,\n      )\n    }\n    return\n  }\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new ValidationError(\n      `setCover: ${field} must be a string or { [locale]: string } map, got ${typeof value}.`,\n    )\n  }\n  // Locale map. Each value must be a non-empty string within the cap.\n  for (const [locale, str] of Object.entries(value)) {\n    if (typeof str !== 'string') {\n      throw new ValidationError(\n        `setCover: ${field}[${locale}] must be a string, got ${typeof str}.`,\n      )\n    }\n    if (str.length > maxChars) {\n      throw new ValidationError(\n        `setCover: ${field}[${locale}] exceeds the ${maxChars}-character cap (got ${str.length}).`,\n      )\n    }\n  }\n}\n\nfunction validateIcon(icon: string, schema: ResolvedCoverSchema): void {\n  if (typeof icon !== 'string') {\n    throw new ValidationError(\n      `setCover: icon must be a data: URL string, got ${typeof icon}.`,\n    )\n  }\n  if (icon.length > schema.maxIconBytes) {\n    throw new ValidationError(\n      `setCover: icon exceeds the ${schema.maxIconBytes}-byte cap (got ${icon.length}).`,\n    )\n  }\n  const m = DATA_URL_PREFIX.exec(icon)\n  if (!m) {\n    throw new ValidationError(\n      'setCover: icon must be a base64 data URL ' +\n        '(`data:image/png;base64,…` or `data:image/svg+xml;base64,…`). ' +\n        'External URLs are not supported in v1.',\n    )\n  }\n  const mime = m[1]!\n  if (!schema.iconMimeTypes.includes(mime)) {\n    throw new ValidationError(\n      `setCover: icon MIME type \"${mime}\" is not allowed. ` +\n        `Permitted types: ${schema.iconMimeTypes.join(', ')}.`,\n    )\n  }\n}\n\n/**\n * Lightweight runtime predicate — used by the bundle header\n * validator to recognise a cover without requiring it. (The wire\n * discriminator keeps its frozen name: `_noydb_public: 1`.)\n */\nexport function isCover(x: unknown): x is Cover {\n  if (x === null || typeof x !== 'object' || Array.isArray(x)) return false\n  const obj = x as Record<string, unknown>\n  return obj['_noydb_public'] === 1 && typeof obj['version'] === 'number'\n}\n\n// ─── Deprecated aliases (#799 public-envelope → cover; remove after one pre-release window) ───\n\n/** @deprecated Use {@link SetCoverInput}. */\nexport type SetPublicEnvelopeInput = SetCoverInput\n/** @deprecated Use {@link validateCoverInput}. */\nexport const validatePublicEnvelopeInput = validateCoverInput\n/** @deprecated Use {@link isCover}. */\nexport const isPublicEnvelope = isCover\n","/**\n * Persistence helpers for `_meta/public-envelope` — the cover's\n * frozen wire location. Mirrors the bypass-AES pattern used by\n * `_meta/handle` and `_meta/policy` — the document is plaintext\n * JSON, the envelope's `_iv` field is left empty.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../../kernel/types.js'\nimport type { Cover } from './types.js'\nimport { isCover } from './schema.js'\n\n/**\n * Reserved id for the vault-level cover record. The VALUE is frozen\n * wire format — the record predates the #799 rename and stays at\n * `_meta/public-envelope` so existing vaults need no migration.\n */\nexport const COVER_RECORD_ID = 'public-envelope'\n\n/**\n * Read the cover from `_meta/public-envelope`. Returns `undefined`\n * when no cover has been persisted (fresh vault, or a vault written\n * before the feature was enabled). Tolerates corrupted documents —\n * a JSON parse failure surfaces as `undefined`, not a thrown error,\n * mirroring `_meta/handle`'s contract.\n */\nexport async function loadCover(\n  store: NoydbStore,\n  vault: string,\n): Promise<Cover | undefined> {\n  const envelope = await store.get(vault, '_meta', COVER_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isCover(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/** Persist the cover. Idempotent — overwrites any prior write. */\nexport async function saveCover(\n  store: NoydbStore,\n  vault: string,\n  cover: Cover,\n): Promise<void> {\n  const wireEnvelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: JSON.stringify(cover),\n  }\n  await store.put(vault, '_meta', COVER_RECORD_ID, wireEnvelope)\n}\n\n/**\n * Public, no-key reader. Plain function, not a method on `Noydb` —\n * the whole point is it works without an authenticated session, so\n * a UI can show \"Acme 2026 Tax Records\" before unlocking.\n *\n * Resolves any `name` / `description` locale map through the supplied\n * `locale` (when provided). Omitting `locale` returns the raw\n * cover, which a multilingual picker can render as it pleases.\n */\nexport async function readCover(\n  store: NoydbStore,\n  vault: string,\n  opts: { readonly locale?: string } = {},\n): Promise<Cover | undefined> {\n  const raw = await loadCover(store, vault)\n  if (!raw) return undefined\n  if (opts.locale === undefined) return raw\n  return resolveLocale(raw, opts.locale)\n}\n\n/**\n * Resolve the locale-map fields (`name`, `description`) of a cover\n * to plain strings for the requested locale, falling back through\n * `defaultLocale` and then any available translation.\n *\n * @internal\n */\nexport function resolveLocale(\n  cover: Cover,\n  locale: string,\n): Cover {\n  return {\n    ...cover,\n    ...(cover.name !== undefined ? { name: pickLocale(cover.name, locale, cover.defaultLocale) } : {}),\n    ...(cover.description !== undefined ? { description: pickLocale(cover.description, locale, cover.defaultLocale) } : {}),\n  }\n}\n\n/**\n * Resolve a `string | { [locale]: string }` value to a string for a\n * given locale. Exported so the bundle reader can reuse it without\n * duplicating the fallback chain.\n *\n * **Looser than `resolveI18nText`** — the hub's record-field resolver\n * throws `LocaleNotSpecifiedError` when no translation matches, but\n * label semantics deliberately prefer \"show *something*\" over\n * throwing. The fallback chain is:\n *   1. Exact `locale` match.\n *   2. `defaultLocale` (when supplied on the cover).\n *   3. First non-empty value in the map.\n *   4. Empty string (only if every translation is empty — pathological).\n *\n * This deviation is documented in `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`.\n */\nexport function pickLocale(\n  value: string | Record<string, string>,\n  locale: string,\n  defaultLocale: string | undefined,\n): string {\n  if (typeof value === 'string') return value\n  if (value[locale] !== undefined && value[locale] !== '') return value[locale]\n  if (defaultLocale && value[defaultLocale] !== undefined && value[defaultLocale] !== '') {\n    return value[defaultLocale]\n  }\n  for (const v of Object.values(value)) {\n    if (v !== '') return v\n  }\n  return ''\n}\n\n// ─── Deprecated aliases (#799 public-envelope → cover; remove after one pre-release window) ───\n\n/** @deprecated Use {@link COVER_RECORD_ID}. */\nexport const PUBLIC_ENVELOPE_RECORD_ID = COVER_RECORD_ID\n/** @deprecated Use {@link loadCover}. */\nexport const loadPublicEnvelope = loadCover\n/** @deprecated Use {@link saveCover}. */\nexport const savePublicEnvelope = saveCover\n/** @deprecated Use {@link readCover}. */\nexport const readPublicEnvelope = readCover\n"],"mappings":";;;;;;;;AAuBA,IAAM,qBAAqB;AAG3B,IAAM,mBAAmB;AAUlB,SAAS,oBAAoB,QAAyC;AAC3E,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,iEACE,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAC3C;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,QAAI,CAAC,mBAAmB,KAAK,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,+BAA+B,EAAE;AAAA,MAGnC;AAAA,IACF;AACA,oBAAgB,OAAO,IAAI,GAAG,oBAAI,IAAI,CAAC;AAAA,EACzC;AACF;AAEA,SAAS,gBACP,OACA,IACA,OACA,MACM;AACN,MAAI,UAAU,KAAM;AACpB,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,YAAY,MAAM,UAAW;AACzD,MAAI,MAAM,UAAU;AAClB,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE,iCAAiC,CAAC;AAAA,IAE3D;AAAA,EACF;AACA,QAAM,YAAY;AAClB,MAAI,KAAK,IAAI,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE;AAAA,IACzB;AAAA,EACF;AACA,MAAI,QAAQ,kBAAkB;AAC5B,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE,4BAA4B,gBAAgB;AAAA,IACrE;AAAA,EACF;AACA,OAAK,IAAI,SAAS;AAClB,QAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,YAAY,OAAO,OAAO,SAAS;AAC/E,aAAW,SAAS,UAAU;AAC5B,oBAAgB,OAAO,IAAI,QAAQ,GAAG,IAAI;AAAA,EAC5C;AACA,OAAK,OAAO,SAAS;AACvB;AAcO,SAAS,YACd,UACA,OAC+D;AAC/D,MAAI,UAAU,QAAW;AACvB,WAAO,aAAa,SAAY,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC1D;AACA,QAAM,SAAoC,EAAE,GAAG,SAAS;AACxD,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC/C,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,EAAE;AAAA,IAClB,OAAO;AACL,aAAO,EAAE,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,EAAE,QAAQ,OAAO,IAAI,CAAC;AAChE;AAUO,SAAS,kBACd,OACA,QACM;AACN,MAAI,MAAM,WAAW,QAAW;AAC9B,UAAM,aAAa,KAAK,UAAU,MAAM,MAAM,EAAE;AAChD,QAAI,aAAa,OAAO,gBAAgB;AACtC,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,cAAc,kBAC3C,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,KAAK,UAAU,KAAK,EAAE;AACxC,MAAI,YAAY,OAAO,eAAe;AACpC,UAAM,IAAI;AAAA,MACR,4CAA4C,OAAO,aAAa,kBACtD,SAAS;AAAA,IACrB;AAAA,EACF;AACF;;;ACnHA,IAAM,kBAAkB;AAYjB,SAAS,mBACd,OACA,QACM;AACN,QAAM,UAAU,IAAI,IAAgB,OAAO,MAAM;AAGjD,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAM,QACJ,QAAQ,UAAU,QAAQ,iBAAiB,QAAQ,UAAU,QAAQ,mBAAmB,QAAQ,WAC5F,MACA;AACN,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,4BAA4B,GAAG,sBACV,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI,KAAK,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,4DACJ,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,QAAW;AAC5B,iBAAa,MAAM,MAAM,QAAQ,OAAO,cAAc;AAAA,EACxD;AACA,MAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAa,MAAM,aAAa,eAAe,OAAO,cAAc;AAAA,EACtE;AACA,MAAI,MAAM,SAAS,QAAW;AAC5B,iBAAa,MAAM,MAAM,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,kBAAkB,UAAa,OAAO,MAAM,kBAAkB,UAAU;AAChF,UAAM,IAAI;AAAA,MACR,0DAA0D,OAAO,MAAM,aAAa;AAAA,IACtF;AAAA,EACF;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,wBAAoB,MAAM,MAAM;AAAA,EAClC;AACF;AAEA,SAAS,aACP,OACA,OACA,UACM;AACN,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,MAAM,SAAS,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,gBAAgB,QAAQ,uBAAuB,MAAM,MAAM;AAAA,MAC/E;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR,aAAa,KAAK,sDAAsD,OAAO,KAAK;AAAA,IACtF;AAAA,EACF;AAEA,aAAW,CAAC,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,IAAI,MAAM,2BAA2B,OAAO,GAAG;AAAA,MACnE;AAAA,IACF;AACA,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,IAAI,MAAM,iBAAiB,QAAQ,uBAAuB,IAAI,MAAM;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,QAAmC;AACrE,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI;AAAA,MACR,kDAAkD,OAAO,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,KAAK,SAAS,OAAO,cAAc;AACrC,UAAM,IAAI;AAAA,MACR,8BAA8B,OAAO,YAAY,kBAAkB,KAAK,MAAM;AAAA,IAChF;AAAA,EACF;AACA,QAAM,IAAI,gBAAgB,KAAK,IAAI;AACnC,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,OAAO,EAAE,CAAC;AAChB,MAAI,CAAC,OAAO,cAAc,SAAS,IAAI,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,6BAA6B,IAAI,sCACX,OAAO,cAAc,KAAK,IAAI,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAOO,SAAS,QAAQ,GAAwB;AAC9C,MAAI,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,EAAG,QAAO;AACpE,QAAM,MAAM;AACZ,SAAO,IAAI,eAAe,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM;AACjE;AAOO,IAAM,8BAA8B;AAEpC,IAAM,mBAAmB;;;ACvJzB,IAAM,kBAAkB;AAS/B,eAAsB,UACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,eAAe;AAChE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,QAAQ,MAAM,EAAG,QAAO;AAC7B,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,UACpB,OACA,OACA,OACe;AACf,QAAM,eAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,iBAAiB,YAAY;AAC/D;AAWA,eAAsB,UACpB,OACA,OACA,OAAqC,CAAC,GACV;AAC5B,QAAM,MAAM,MAAM,UAAU,OAAO,KAAK;AACxC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,KAAK,WAAW,OAAW,QAAO;AACtC,SAAO,cAAc,KAAK,KAAK,MAAM;AACvC;AASO,SAAS,cACd,OACA,QACO;AACP,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,WAAW,MAAM,MAAM,QAAQ,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,IAChG,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,WAAW,MAAM,aAAa,QAAQ,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,EACvH;AACF;AAkBO,SAAS,WACd,OACA,QACA,eACQ;AACR,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,MAAM,MAAM,UAAa,MAAM,MAAM,MAAM,GAAI,QAAO,MAAM,MAAM;AAC5E,MAAI,iBAAiB,MAAM,aAAa,MAAM,UAAa,MAAM,aAAa,MAAM,IAAI;AACtF,WAAO,MAAM,aAAa;AAAA,EAC5B;AACA,aAAW,KAAK,OAAO,OAAO,KAAK,GAAG;AACpC,QAAI,MAAM,GAAI,QAAO;AAAA,EACvB;AACA,SAAO;AACT;AAKO,IAAM,4BAA4B;AAElC,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB;","names":[]}

package/dist/chunk-YCH5GBN6.js

@@ -0,0 +1,99 @@
+import {
+  SYNC_CREDENTIALS_COLLECTION,
+  ensureCollectionDEK,
+  grant,
+  revoke,
+  rotateKeys
+} from "./chunk-554KLAAN.js";
+import {
+  openEnvelopeJson
+} from "./chunk-W4TCUGQR.js";
+import {
+  encrypt
+} from "./chunk-HOONYZY2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-VCTXU4AT.js";
+import {
+  PermissionDeniedError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-party/team/active.ts
+function withTeam() {
+  return {
+    async grant(team, vault, options, factors) {
+      return team.runGrant(grant, vault, options, factors);
+    },
+    async revoke(team, vault, options, factors) {
+      return team.runRevoke(revoke, vault, options, factors);
+    },
+    async rotate(team, vault, collections) {
+      return team.runRotate(rotateKeys, vault, collections);
+    }
+  };
+}
+
+// src/with-party/team/sync-credentials.ts
+function requireAdminAccess(keyring) {
+  if (keyring.role !== "owner" && keyring.role !== "admin") {
+    throw new PermissionDeniedError(
+      `Sync credentials require owner or admin role. Current role: "${keyring.role}"`
+    );
+  }
+}
+async function putCredential(adapter, vault, keyring, credential) {
+  requireAdminAccess(keyring);
+  const getDek = await ensureCollectionDEK(adapter, vault, keyring);
+  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
+  const { iv, data } = await encrypt(JSON.stringify(credential), dek);
+  const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId);
+  const version = existing ? existing._v + 1 : 1;
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _by: keyring.userId
+  };
+  await adapter.put(
+    vault,
+    SYNC_CREDENTIALS_COLLECTION,
+    credential.adapterId,
+    envelope,
+    existing ? existing._v : void 0
+  );
+}
+async function getCredential(adapter, vault, keyring, adapterId) {
+  requireAdminAccess(keyring);
+  const getDek = await ensureCollectionDEK(adapter, vault, keyring);
+  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
+  const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
+  if (!envelope) return null;
+  const plaintext = await openEnvelopeJson(envelope, dek);
+  return JSON.parse(plaintext);
+}
+async function deleteCredential(adapter, vault, keyring, adapterId) {
+  requireAdminAccess(keyring);
+  await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
+}
+async function listCredentials(adapter, vault, keyring) {
+  requireAdminAccess(keyring);
+  return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION);
+}
+async function credentialStatus(adapter, vault, keyring, adapterId) {
+  const credential = await getCredential(adapter, vault, keyring, adapterId);
+  if (!credential) return { exists: false };
+  const expired = credential.expiresAt ? Date.now() > new Date(credential.expiresAt).getTime() : false;
+  return { exists: true, expired };
+}
+
+export {
+  withTeam,
+  putCredential,
+  getCredential,
+  deleteCredential,
+  listCredentials,
+  credentialStatus
+};
+//# sourceMappingURL=chunk-YCH5GBN6.js.map

package/dist/chunk-YTGDPCPW.js

@@ -0,0 +1,155 @@
+import {
+  ConflictError,
+  PodVersionConflictError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-pod/pod-store.ts
+var BUNDLE_STORE_VERSION = 1;
+var MAX_CONFLICT_RETRIES = 3;
+function wrapPodStore(bundle, options) {
+  const autoFlush = options?.autoFlush !== false;
+  const snapshots = /* @__PURE__ */ new Map();
+  const versions = /* @__PURE__ */ new Map();
+  const loaded = /* @__PURE__ */ new Set();
+  let batchDepth = 0;
+  async function load(vault) {
+    if (loaded.has(vault)) return snapshots.get(vault);
+    const result = await bundle.readBundle(vault);
+    if (result) {
+      const text = new TextDecoder().decode(result.bytes);
+      const format = JSON.parse(text);
+      snapshots.set(vault, format.data);
+      versions.set(vault, result.version);
+    } else {
+      snapshots.set(vault, {});
+      versions.set(vault, null);
+    }
+    loaded.add(vault);
+    return snapshots.get(vault);
+  }
+  async function flush(vault) {
+    const snapshot = snapshots.get(vault) ?? {};
+    const format = {
+      _noydb_bundle_store: BUNDLE_STORE_VERSION,
+      vault,
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      data: snapshot
+    };
+    const bytes = new TextEncoder().encode(JSON.stringify(format));
+    const expectedVersion = versions.get(vault) ?? null;
+    for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {
+      try {
+        const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion);
+        versions.set(vault, newVersion);
+        return;
+      } catch (err) {
+        if (err instanceof PodVersionConflictError && attempt < MAX_CONFLICT_RETRIES - 1) {
+          const remote = await bundle.readBundle(vault);
+          if (remote) {
+            const remoteText = new TextDecoder().decode(remote.bytes);
+            const remoteFormat = JSON.parse(remoteText);
+            const localSnap = snapshots.get(vault) ?? {};
+            const mergedSnap = mergeSnapshots(remoteFormat.data, localSnap);
+            snapshots.set(vault, mergedSnap);
+            versions.set(vault, remote.version);
+          }
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+  async function maybeFlush(vault) {
+    if (autoFlush && batchDepth === 0) {
+      await flush(vault);
+    }
+  }
+  const store = {
+    name: bundle.name ?? "bundle",
+    async flush(vaultId) {
+      await flush(vaultId);
+    },
+    async batch(vaultId, fn) {
+      await load(vaultId);
+      batchDepth++;
+      try {
+        await fn();
+      } finally {
+        batchDepth--;
+      }
+      await flush(vaultId);
+    },
+    async get(vault, collection, id) {
+      const snap = await load(vault);
+      return snap[collection]?.[id] ?? null;
+    },
+    async put(vault, collection, id, envelope, expectedVersion) {
+      const snap = await load(vault);
+      if (expectedVersion !== void 0) {
+        const current = snap[collection]?.[id];
+        const currentVersion = current?._v ?? 0;
+        if (currentVersion !== expectedVersion) {
+          throw new ConflictError(
+            currentVersion,
+            `Expected version ${expectedVersion} but found ${currentVersion} on ${collection}/${id}`
+          );
+        }
+      }
+      snap[collection] ??= {};
+      snap[collection][id] = envelope;
+      await maybeFlush(vault);
+    },
+    async delete(vault, collection, id) {
+      const snap = await load(vault);
+      if (snap[collection]) {
+        delete snap[collection][id];
+        await maybeFlush(vault);
+      }
+    },
+    async list(vault, collection) {
+      const snap = await load(vault);
+      return Object.keys(snap[collection] ?? {});
+    },
+    async loadAll(vault) {
+      return await load(vault);
+    },
+    async saveAll(vault, data) {
+      snapshots.set(vault, data);
+      loaded.add(vault);
+      await flush(vault);
+    }
+  };
+  return store;
+}
+function mergeSnapshots(remote, local) {
+  const merged = {};
+  for (const [coll, records] of Object.entries(remote)) {
+    merged[coll] = { ...records };
+  }
+  for (const [coll, records] of Object.entries(local)) {
+    if (!merged[coll]) {
+      merged[coll] = { ...records };
+      continue;
+    }
+    for (const [id, envelope] of Object.entries(records)) {
+      const existing = merged[coll][id];
+      if (!existing || envelope._ts >= existing._ts) {
+        merged[coll][id] = envelope;
+      }
+    }
+  }
+  return merged;
+}
+function createPodStore(factory) {
+  return factory;
+}
+var wrapBundleStore = wrapPodStore;
+var createBundleStore = createPodStore;
+
+export {
+  wrapPodStore,
+  createPodStore,
+  wrapBundleStore,
+  createBundleStore
+};
+//# sourceMappingURL=chunk-YTGDPCPW.js.map

package/dist/chunk-YZQOGE2L.js

@@ -0,0 +1,23 @@
+import {
+  appendPeriodLedgerEntry,
+  assertTsWritable,
+  chainAnchor,
+  loadPeriods,
+  validatePeriodName
+} from "./chunk-XTHCN77N.js";
+
+// src/with-audit/periods/active.ts
+function withPeriods() {
+  return {
+    loadPeriods,
+    chainAnchor,
+    assertTsWritable,
+    validatePeriodName,
+    appendPeriodLedgerEntry
+  };
+}
+
+export {
+  withPeriods
+};
+//# sourceMappingURL=chunk-YZQOGE2L.js.map