@noy-db/hub 0.4.0-pre.1 → 0.4.0-pre.11

package/README.md

@@ -39,7 +39,6 @@ pnpm add @noy-db/hub @noy-db/to-memory
 | [`to-icloud`](https://www.npmjs.com/package/@noy-db/to-icloud) | iCloud Drive (.icloud-aware) |
 | [`to-drive`](https://www.npmjs.com/package/@noy-db/to-drive) | Google Drive bundle |
 | [`to-meter`](https://www.npmjs.com/package/@noy-db/to-meter) | Wrap any store with metrics |
-| [`to-probe`](https://www.npmjs.com/package/@noy-db/to-probe) | Diagnostic suitability test |
 
 ### Optional ecosystem
 
@@ -58,9 +57,9 @@ import { memory } from '@noy-db/to-memory'
 type Invoice = { id: string; amount: number; customer: string }
 
 const db = await createNoydb({
-  store: memory(),
+  store: toMemory(),
   userId: 'alice',
-  passphrase: 'correct horse battery staple',
+  secret: 'correct horse battery staple',
 })
 
 const acme = await db.openVault('acme')
@@ -85,7 +84,7 @@ When a single principal holds grants across many vaults — multi-tenant apps, m
 
 ### `db.listAccessibleVaults(options?)` — enumerate
 
-Returns every vault the calling principal can unwrap, optionally filtered by minimum role. The walk is bounded by the local keyring index — vaults where the user has no keyring file or where the passphrase doesn't unwrap are silently dropped from the result.
+Returns every vault the calling principal can unwrap, optionally filtered by minimum role. The walk is bounded by the local keyring index — vaults where the user has no keyring file or where the secret doesn't unwrap are silently dropped from the result.
 
 ```ts
 // All vaults I can unlock

package/dist/api-ZDKTWNBB.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-DABACXEF.js";
+import "./chunk-JJZGIE4U.js";
+import "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-QBAC3GXA.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-ZDKTWNBB.js.map

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-MQ6WOPSY.js";
+} from "../chunk-DZ2JXHWK.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-TOPYT5U5.js";
+} from "../chunk-63FE525P.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-G6EQYAL6.js";
+} from "../chunk-CI32CAFS.js";
 import {
   NO_ATTESTATION
-} from "../chunk-S6Q37VGE.js";
+} from "../chunk-5GQEU4DN.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-DVUZMT2W.js";
-import "../chunk-WEYZTLXN.js";
-import "../chunk-IY23KFNZ.js";
-import "../chunk-N6WF5PKC.js";
-import "../chunk-6HY2X62D.js";
+import "../chunk-G2JUIDFA.js";
+import "../chunk-W3L64Y3J.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HOONYZY2.js";
-import "../chunk-LSASLXGC.js";
+import "../chunk-AKKRXT23.js";
+import "../chunk-QBAC3GXA.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-W2OG6JOL.js";
+} from "../chunk-QZWTRENR.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-LSR5PS6H.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-FCKN5O6C.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-3YFBLZRN.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-K7Z2EOMG.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-OCWDSWRQ.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-2TSAD2T4.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-OCWDSWRQ.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-2TSAD2T4.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-OCWDSWRQ.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-2TSAD2T4.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-OCWDSWRQ.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-2TSAD2T4.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-LU2DTZTI.js → backup-2UX7PRM5.js}

@@ -1,27 +1,27 @@
-import {
-  SEQUENCE_COLLECTION
-} from "./chunk-HPUWOVR7.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-F6T6L2UK.js";
+} from "./chunk-DMH3VZU5.js";
+import {
+  SEQUENCE_COLLECTION
+} from "./chunk-L2DGWBCT.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-DVUZMT2W.js";
-import "./chunk-WEYZTLXN.js";
-import "./chunk-IY23KFNZ.js";
-import "./chunk-N6WF5PKC.js";
-import "./chunk-6HY2X62D.js";
+import "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-HOONYZY2.js";
+import "./chunk-AKKRXT23.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-QBAC3GXA.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -239,4 +239,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-LU2DTZTI.js.map
+//# sourceMappingURL=backup-2UX7PRM5.js.map

package/dist/blobs/index.js

@@ -6,9 +6,10 @@ import {
   BLOB_EVICTION_AUDIT_COLLECTION,
   EXPORT_AUDIT_COLLECTION,
   ExportBlobsAbortedError,
+  NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "../chunk-2P7EGNKF.js";
+} from "../chunk-CXQW2NWO.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -17,28 +18,38 @@ import {
   BLOB_VERSIONS_PREFIX,
   BlobSet,
   DEFAULT_CHUNK_SIZE,
+  blobPinKey,
+  createBlobPinCache,
   detectMagic,
   detectMimeType,
-  isPreCompressed
-} from "../chunk-5OI6BR4H.js";
-import "../chunk-UC2ETWF3.js";
-import "../chunk-DRWBEDYO.js";
-import "../chunk-DVUZMT2W.js";
-import "../chunk-WEYZTLXN.js";
-import "../chunk-IY23KFNZ.js";
-import "../chunk-N6WF5PKC.js";
-import "../chunk-6HY2X62D.js";
+  isPreCompressed,
+  memoryBlobPinStore
+} from "../chunk-GWWOGNBK.js";
+import "../chunk-6UBZ6I5Z.js";
+import "../chunk-PTHKZWEH.js";
+import "../chunk-JYJFGD2H.js";
+import "../chunk-G2JUIDFA.js";
+import "../chunk-W3L64Y3J.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HOONYZY2.js";
-import "../chunk-LSASLXGC.js";
-import "../chunk-W2OG6JOL.js";
+import "../chunk-AKKRXT23.js";
+import "../chunk-QBAC3GXA.js";
+import {
+  BlobOfflineError
+} from "../chunk-QZWTRENR.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts
-function withBlobs() {
+function withBlobs(options = {}) {
+  const pinCache = createBlobPinCache(options.pinStore);
   return {
     openSlot(args) {
-      return new BlobSet(args);
+      return new BlobSet({ ...args, pinCache });
+    },
+    cacheStats() {
+      return { ...pinCache.stats };
     }
   };
 }
@@ -49,15 +60,19 @@ export {
   BLOB_INDEX_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX,
+  BlobOfflineError,
   BlobSet,
   DEFAULT_CHUNK_SIZE,
   EXPORT_AUDIT_COLLECTION,
   ExportBlobsAbortedError,
+  NO_BLOBS,
+  blobPinKey,
   createExportBlobsHandle,
   detectMagic,
   detectMimeType,
   importExternalObjects,
   isPreCompressed,
+  memoryBlobPinStore,
   memoryObjectProjection,
   runCompaction,
   withBlobs

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobStrategy } from '../../port/with/blob-strategy.js'\n\n/**\n * Build a default `BlobStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(): BlobStrategy {\n  return {\n    openSlot(args) {\n      return new BlobSet(args)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCO,SAAS,YAA0B;AACxC,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-SMIRGMS7.js";
+} from "../chunk-IXNCZTWA.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-DVUZMT2W.js";
-import "../chunk-WEYZTLXN.js";
-import "../chunk-IY23KFNZ.js";
-import "../chunk-N6WF5PKC.js";
-import "../chunk-6HY2X62D.js";
+} from "../chunk-G2JUIDFA.js";
+import "../chunk-W3L64Y3J.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HOONYZY2.js";
-import "../chunk-LSASLXGC.js";
+import "../chunk-AKKRXT23.js";
+import "../chunk-QBAC3GXA.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-W2OG6JOL.js";
+} from "../chunk-QZWTRENR.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-PWK45HDF.js");
+      const { enrollSeed } = await import("../seed-NUVJEL7T.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-PWK45HDF.js");
+      const { rotateSeed } = await import("../seed-NUVJEL7T.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-PWK45HDF.js");
+          const { mintStoreCredentials } = await import("../seed-NUVJEL7T.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/broker/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../kernel/enclave/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `kernel/enclave/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}
+{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../kernel/enclave/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `kernel/enclave/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../kernel/enclave/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}

package/dist/cargo/index.js

@@ -1,98 +1,107 @@
 import {
+  adoptPartition,
+  createOwnerOnAdoptedPartition,
+  decryptExtractedPartition,
+  describeExtraction,
+  diffVault,
+  unsealDeks,
   withCargo
-} from "../chunk-GVZQ4NAM.js";
+} from "../chunk-YZJSJOUI.js";
 import {
-  CustodyApi,
-  NO_CARGO
-} from "../chunk-O7WJ47EF.js";
+  NO_CARGO,
+  isQuorum,
+  runDrainBarrier
+} from "../chunk-TG634KCO.js";
+import {
+  extractPartition,
+  walkClosure
+} from "../chunk-PEATRIYJ.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-UNCOC7QH.js";
+} from "../chunk-H2GPHUZD.js";
+import "../chunk-FQZ6XTQ7.js";
+import "../chunk-I5GEJX3R.js";
+import "../chunk-X45JYIAY.js";
+import "../chunk-DMH3VZU5.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
 import {
-  diffVault
-} from "../chunk-LB7FD65R.js";
-import "../chunk-YJV2UZ7H.js";
-import "../chunk-GQNGCEP5.js";
-import {
-  isQuorum,
-  runDrainBarrier
-} from "../chunk-ISMV2QVG.js";
+  CustodyApi
+} from "../chunk-YWWQM7KP.js";
+import "../chunk-GWWOGNBK.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-TAGR72IR.js";
+} from "../chunk-KRCBZYTZ.js";
+import "../chunk-XZHEOSQ2.js";
+import "../chunk-CADUYBQD.js";
 import {
   readPath
 } from "../chunk-IGJCYUT5.js";
-import {
-  decryptExtractedPartition,
-  describeExtraction
-} from "../chunk-7O3AYBC7.js";
-import {
-  extractPartition,
-  walkClosure
-} from "../chunk-OF75ACKS.js";
-import "../chunk-LB6OH6K2.js";
-import "../chunk-F6T6L2UK.js";
-import "../chunk-5OI6BR4H.js";
-import "../chunk-A7JJLVGH.js";
-import "../chunk-J6Q7UVQE.js";
-import "../chunk-GULTLPFB.js";
-import "../chunk-JVBO4SZL.js";
-import "../chunk-3SV2EPMN.js";
-import "../chunk-PK6QCH2C.js";
-import "../chunk-UC2ETWF3.js";
+import "../chunk-LNPUSMZL.js";
+import "../chunk-TUXQSFHZ.js";
+import "../chunk-UADPR6F4.js";
+import "../chunk-6UBZ6I5Z.js";
+import "../chunk-BLCWSJLN.js";
+import "../chunk-JJZGIE4U.js";
+import "../chunk-PTHKZWEH.js";
 import {
   generateULID
 } from "../chunk-ZJADGNYF.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-UFEVO57O.js";
+import "../chunk-ABS7FMMD.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-DRWBEDYO.js";
-import "../chunk-RM2XV574.js";
-import "../chunk-DVUZMT2W.js";
-import "../chunk-WEYZTLXN.js";
-import "../chunk-IY23KFNZ.js";
-import "../chunk-N6WF5PKC.js";
-import "../chunk-6HY2X62D.js";
+import "../chunk-JYJFGD2H.js";
+import "../chunk-IXTSNGYY.js";
+import "../chunk-G2JUIDFA.js";
+import "../chunk-W3L64Y3J.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-HOONYZY2.js";
-import "../chunk-LSASLXGC.js";
+} from "../chunk-AKKRXT23.js";
+import "../chunk-QBAC3GXA.js";
 import {
+  AdoptionStateError,
   CargoNotEnabledError,
   CrossShardJoinError,
   DataResidencyError,
   NoAccessError,
+  PartitionExtractionError,
   ReservedVaultNameError,
   STATE_VAULT_NAME,
   ShardProvisioningError,
+  TransferSealError,
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-W2OG6JOL.js";
+} from "../chunk-QZWTRENR.js";
 import "../chunk-PZ5AY32C.js";
 export {
+  AdoptionStateError,
   CargoNotEnabledError,
   CrossShardJoinError,
   CustodyApi,
   DataResidencyError,
   NO_CARGO,
   NoAccessError,
+  PartitionExtractionError,
   ReservedVaultNameError,
   STATE_VAULT_NAME,
   ShardProvisioningError,
+  TransferSealError,
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError,
+  adoptPartition,
   createDeedOwner,
+  createOwnerOnAdoptedPartition,
   decryptExtractedPartition,
   describeExtraction,
   diffVault,
@@ -108,6 +117,7 @@ export {
   reduceRecords,
   runDrainBarrier,
   sha256Hex,
+  unsealDeks,
   walkClosure,
   withCargo
 };

package/dist/{chunk-YTGDPCPW.js → chunk-2J6UEN2V.js}

@@ -1,7 +1,7 @@
 import {
   ConflictError,
   PodVersionConflictError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -12,20 +12,31 @@ function wrapPodStore(bundle, options) {
   const versions = /* @__PURE__ */ new Map();
   const loaded = /* @__PURE__ */ new Set();
   let batchDepth = 0;
+  const loading = /* @__PURE__ */ new Map();
   async function load(vault) {
     if (loaded.has(vault)) return snapshots.get(vault);
-    const result = await bundle.readBundle(vault);
-    if (result) {
-      const text = new TextDecoder().decode(result.bytes);
-      const format = JSON.parse(text);
-      snapshots.set(vault, format.data);
-      versions.set(vault, result.version);
-    } else {
-      snapshots.set(vault, {});
-      versions.set(vault, null);
+    const inFlight = loading.get(vault);
+    if (inFlight) return inFlight;
+    const pending = (async () => {
+      const result = await bundle.readBundle(vault);
+      if (result) {
+        const text = new TextDecoder().decode(result.bytes);
+        const format = JSON.parse(text);
+        snapshots.set(vault, format.data);
+        versions.set(vault, result.version);
+      } else {
+        snapshots.set(vault, {});
+        versions.set(vault, null);
+      }
+      loaded.add(vault);
+      return snapshots.get(vault);
+    })();
+    loading.set(vault, pending);
+    try {
+      return await pending;
+    } finally {
+      loading.delete(vault);
     }
-    loaded.add(vault);
-    return snapshots.get(vault);
   }
   async function flush(vault) {
     const snapshot = snapshots.get(vault) ?? {};
@@ -59,15 +70,22 @@ function wrapPodStore(bundle, options) {
       }
     }
   }
+  const flushChain = /* @__PURE__ */ new Map();
+  function serialFlush(vault) {
+    const prev = flushChain.get(vault) ?? Promise.resolve();
+    const next = prev.then(() => flush(vault), () => flush(vault));
+    flushChain.set(vault, next);
+    return next;
+  }
   async function maybeFlush(vault) {
     if (autoFlush && batchDepth === 0) {
-      await flush(vault);
+      await serialFlush(vault);
     }
   }
   const store = {
     name: bundle.name ?? "bundle",
     async flush(vaultId) {
-      await flush(vaultId);
+      await serialFlush(vaultId);
     },
     async batch(vaultId, fn) {
       await load(vaultId);
@@ -77,7 +95,7 @@ function wrapPodStore(bundle, options) {
       } finally {
         batchDepth--;
       }
-      await flush(vaultId);
+      await serialFlush(vaultId);
     },
     async get(vault, collection, id) {
       const snap = await load(vault);
@@ -111,12 +129,18 @@ function wrapPodStore(bundle, options) {
       return Object.keys(snap[collection] ?? {});
     },
     async loadAll(vault) {
-      return await load(vault);
+      const snap = await load(vault);
+      const out = {};
+      for (const [collection, records] of Object.entries(snap)) {
+        if (collection.startsWith("_")) continue;
+        out[collection] = { ...records };
+      }
+      return out;
     },
     async saveAll(vault, data) {
       snapshots.set(vault, data);
       loaded.add(vault);
-      await flush(vault);
+      await serialFlush(vault);
     }
   };
   return store;
@@ -152,4 +176,4 @@ export {
   wrapBundleStore,
   createBundleStore
 };
-//# sourceMappingURL=chunk-YTGDPCPW.js.map
+//# sourceMappingURL=chunk-2J6UEN2V.js.map