@noy-db/hub 0.4.0-pre.1 → 0.4.0-pre.2

package/dist/{chunk-A5BDDEXK.js → chunk-OTU5ZI3U.js}

@@ -1,9 +1,9 @@
 import {
   applyJoins
-} from "./chunk-RA5VTXXG.js";
+} from "./chunk-OGFPMCSP.js";
 import {
   reducerBuilder
-} from "./chunk-TAGR72IR.js";
+} from "./chunk-RI3OKC3Y.js";
 import {
   evaluateClause,
   hasFnClause,
@@ -14,7 +14,7 @@ import {
   CrossJoinTooLargeError,
   DanglingReferenceError,
   FieldNotQueryableError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/kernel/query/live.ts
 function buildLiveQuery(recompute, upstreams) {
@@ -1534,4 +1534,4 @@ export {
   executePlan,
   ScanBuilder
 };
-//# sourceMappingURL=chunk-A5BDDEXK.js.map
+//# sourceMappingURL=chunk-OTU5ZI3U.js.map

package/dist/{chunk-OF75ACKS.js → chunk-OVFCAS7U.js}

@@ -1,6 +1,6 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-F6T6L2UK.js";
+} from "./chunk-IGAIOGCN.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -8,11 +8,11 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-5OI6BR4H.js";
+} from "./chunk-YGBIBOCR.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-A7JJLVGH.js";
+} from "./chunk-MEKAMERX.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -23,11 +23,11 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-RM2XV574.js";
+} from "./chunk-JLHKBAFY.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-DVUZMT2W.js";
+} from "./chunk-PEY6ZTCF.js";
 import {
   bufferToBase64,
   decrypt,
@@ -37,14 +37,14 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 import {
   PartitionExtractionError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -492,4 +492,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-OF75ACKS.js.map
+//# sourceMappingURL=chunk-OVFCAS7U.js.map

package/dist/{chunk-KWVJAOIN.js → chunk-OWE4BNTM.js}

@@ -1,14 +1,14 @@
 import {
   openEnvelopeJson
-} from "./chunk-DVUZMT2W.js";
+} from "./chunk-PEY6ZTCF.js";
 import {
   encrypt,
   hmacSha256Hex,
   sha256Hex
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 
 // src/with-audit/forget/strategy.ts
 var NO_FORGET = { subjects: {} };
@@ -147,4 +147,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-KWVJAOIN.js.map
+//# sourceMappingURL=chunk-OWE4BNTM.js.map

package/dist/{chunk-DVUZMT2W.js → chunk-PEY6ZTCF.js}

@@ -1,19 +1,19 @@
 import {
   isDeleteMarker,
   isTombstone
-} from "./chunk-WEYZTLXN.js";
+} from "./chunk-QXPOEAKR.js";
 import {
   blindedEqual,
   openVdigPayload,
   sealVdigPayload
-} from "./chunk-IY23KFNZ.js";
+} from "./chunk-LLVW4V7R.js";
 import {
   dualReadSealedSlot,
   parseSealedSlot
-} from "./chunk-N6WF5PKC.js";
+} from "./chunk-M25ZIEB2.js";
 import {
   mintBidxTag
-} from "./chunk-6HY2X62D.js";
+} from "./chunk-5BB3N4KU.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -32,11 +32,11 @@ import {
   generateSalt,
   unwrapCek,
   wrapCek
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 import {
   ClassifiedConfigError,
   ClassifiedRotationError,
@@ -45,7 +45,7 @@ import {
   SchemaValidationError,
   TamperedError,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/kernel/enclave/record-keys/lifecycle.ts
 async function resolveStableCek(deps, id) {
@@ -1129,4 +1129,4 @@ export {
   issueChallenge,
   verifyBrokerProof
 };
-//# sourceMappingURL=chunk-DVUZMT2W.js.map
+//# sourceMappingURL=chunk-PEY6ZTCF.js.map

package/dist/{chunk-7O3AYBC7.js → chunk-PWZKD4HW.js}

@@ -1,35 +1,94 @@
 import {
   walkClosure
-} from "./chunk-OF75ACKS.js";
+} from "./chunk-OVFCAS7U.js";
 import {
   resolveManagedSecret
-} from "./chunk-LB6OH6K2.js";
+} from "./chunk-BCOKZC4B.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-A7JJLVGH.js";
+} from "./chunk-MEKAMERX.js";
 import {
   createOwnerKeyring
-} from "./chunk-3SV2EPMN.js";
+} from "./chunk-HVZT5T22.js";
 import {
   LedgerStore
-} from "./chunk-UFEVO57O.js";
+} from "./chunk-ZJGZDOQO.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   openEnvelopeJson
-} from "./chunk-DVUZMT2W.js";
+} from "./chunk-PEY6ZTCF.js";
 import {
   base64ToBuffer,
   wrapKey
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
+
+// src/with-cargo/active.ts
+function withCargo() {
+  return {
+    async extractPartition(vault, opts) {
+      const { extractPartitionCore } = await import("./extract-partition-QGQ2R42J.js");
+      return extractPartitionCore(vault, opts);
+    }
+  };
+}
+
+// src/with-cargo/describe-extraction.ts
+async function describeExtraction(vault, opts) {
+  const { closure, graph, danglingRefs } = await walkClosure(vault, opts);
+  const { name: vaultName, adapter } = vault._introspectState();
+  const encoder = new TextEncoder();
+  const byCollection = [];
+  const inaccessible = [];
+  let totalBytes = 0;
+  let totalRecords = 0;
+  for (const [collectionName, ids] of closure) {
+    let bytes = 0;
+    let oldestTs;
+    let newestTs;
+    let recordCount = 0;
+    for (const id of ids) {
+      const env = await adapter.get(vaultName, collectionName, id);
+      if (!env) {
+        inaccessible.push({ collection: collectionName, id });
+        continue;
+      }
+      recordCount++;
+      bytes += encoder.encode(JSON.stringify(env)).length;
+      const ts = env._ts;
+      if (oldestTs === void 0 || ts < oldestTs) oldestTs = ts;
+      if (newestTs === void 0 || ts > newestTs) newestTs = ts;
+    }
+    byCollection.push({
+      name: collectionName,
+      recordCount,
+      bytes,
+      // Spread conditionally — exactOptionalPropertyTypes forbids an
+      // explicit `undefined` on an optional property.
+      ...oldestTs !== void 0 ? { oldestTs } : {},
+      ...newestTs !== void 0 ? { newestTs } : {}
+    });
+    totalBytes += bytes;
+    totalRecords += recordCount;
+  }
+  byCollection.sort((a, b) => a.name.localeCompare(b.name));
+  return Object.freeze({
+    totalRecords,
+    totalBytes,
+    byCollection,
+    graph,
+    inaccessible,
+    danglingRefs
+  });
+}
 
 // src/with-cargo/adopt-partition.ts
 async function unsealDeks(seal, transferKey) {
@@ -182,7 +241,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-MTUBMWFE.js");
+    const { createNoydb } = await import("./noydb-U63S3Z7F.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -229,60 +288,12 @@ async function decryptExtractedPartition(bundleBytes, transferKey) {
   return out;
 }
 
-// src/with-cargo/describe-extraction.ts
-async function describeExtraction(vault, opts) {
-  const { closure, graph, danglingRefs } = await walkClosure(vault, opts);
-  const { name: vaultName, adapter } = vault._introspectState();
-  const encoder = new TextEncoder();
-  const byCollection = [];
-  const inaccessible = [];
-  let totalBytes = 0;
-  let totalRecords = 0;
-  for (const [collectionName, ids] of closure) {
-    let bytes = 0;
-    let oldestTs;
-    let newestTs;
-    let recordCount = 0;
-    for (const id of ids) {
-      const env = await adapter.get(vaultName, collectionName, id);
-      if (!env) {
-        inaccessible.push({ collection: collectionName, id });
-        continue;
-      }
-      recordCount++;
-      bytes += encoder.encode(JSON.stringify(env)).length;
-      const ts = env._ts;
-      if (oldestTs === void 0 || ts < oldestTs) oldestTs = ts;
-      if (newestTs === void 0 || ts > newestTs) newestTs = ts;
-    }
-    byCollection.push({
-      name: collectionName,
-      recordCount,
-      bytes,
-      // Spread conditionally — exactOptionalPropertyTypes forbids an
-      // explicit `undefined` on an optional property.
-      ...oldestTs !== void 0 ? { oldestTs } : {},
-      ...newestTs !== void 0 ? { newestTs } : {}
-    });
-    totalBytes += bytes;
-    totalRecords += recordCount;
-  }
-  byCollection.sort((a, b) => a.name.localeCompare(b.name));
-  return Object.freeze({
-    totalRecords,
-    totalBytes,
-    byCollection,
-    graph,
-    inaccessible,
-    danglingRefs
-  });
-}
-
 export {
   unsealDeks,
   adoptPartition,
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition,
+  withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-7O3AYBC7.js.map
+//# sourceMappingURL=chunk-PWZKD4HW.js.map

package/dist/chunk-PWZKD4HW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-cargo/active.ts","../src/with-cargo/describe-extraction.ts","../src/with-cargo/adopt-partition.ts","../src/with-cargo/decrypt-partition.ts"],"sourcesContent":["/**\n * Enable the cargo (partition extraction) capability.\n * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side\n * `extractPartition(vault, ...)` free function live. The extraction crypto\n * engine is dynamically imported here, so it stays out of the floor bundle\n * until opted in. The recipient-side `adoptPartition` /\n * `decryptExtractedPartition` free functions — and `diffVault` (shared\n * import/merge infra) — are ungated and unaffected.\n */\nimport type { CargoStrategy } from './strategy.js'\n\nexport function withCargo(): CargoStrategy {\n  return {\n    async extractPartition(vault, opts) {\n      const { extractPartitionCore } = await import('./extract-partition.js')\n      return extractPartitionCore(vault, opts)\n    },\n  }\n}\n","/**\n * Partition-extraction dry-run. Read-only preview of what an\n * `extractPartition` would move: record counts, byte totals, and the\n * timestamp span per collection — computed from raw encrypted\n * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { walkClosure, type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js'\n\nexport interface ExtractionPreview {\n  readonly totalRecords: number\n  /** Sum of serialized encrypted-envelope sizes (bytes). */\n  readonly totalBytes: number\n  readonly byCollection: ReadonlyArray<{\n    readonly name: string\n    readonly recordCount: number\n    readonly bytes: number\n    /** Earliest envelope `_ts` in this collection (lexicographic). */\n    readonly oldestTs?: string\n    readonly newestTs?: string\n  }>\n  readonly graph: { readonly depth: number; readonly cyclesDetected: boolean }\n  /** Records the walk reached but whose envelope couldn't be read. */\n  readonly inaccessible: ReadonlyArray<{ readonly collection: string; readonly id: string }>\n  /**\n   * #772: outbound FK edges whose referenced parent was excluded from the\n   * closure (missing, or tier-elevated and therefore invisible) — mirrors\n   * `ExtractPartitionResult.danglingRefs` (#759) so a preview/extract pair\n   * gives the SAME signal. A parent excluded this way never appears in\n   * `byCollection` at all; this is the only preview-time indicator.\n   */\n  readonly danglingRefs: ReadonlyArray<DanglingRefNotice>\n}\n\nexport async function describeExtraction(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ExtractionPreview> {\n  const { closure, graph, danglingRefs } = await walkClosure(vault, opts)\n\n  const { name: vaultName, adapter } = vault._introspectState()\n  const encoder = new TextEncoder()\n\n  const byCollection: Array<{\n    name: string; recordCount: number; bytes: number; oldestTs?: string; newestTs?: string\n  }> = []\n  const inaccessible: Array<{ collection: string; id: string }> = []\n  let totalBytes = 0\n  let totalRecords = 0\n\n  for (const [collectionName, ids] of closure) {\n    let bytes = 0\n    let oldestTs: string | undefined\n    let newestTs: string | undefined\n    let recordCount = 0\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) {\n        // Walk reached it (via decrypted list) but the raw store read\n        // returned nothing — surface rather than miscount.\n        inaccessible.push({ collection: collectionName, id })\n        continue\n      }\n      recordCount++\n      bytes += encoder.encode(JSON.stringify(env)).length\n      const ts = env._ts\n      if (oldestTs === undefined || ts < oldestTs) oldestTs = ts\n      if (newestTs === undefined || ts > newestTs) newestTs = ts\n    }\n\n    byCollection.push({\n      name: collectionName,\n      recordCount,\n      bytes,\n      // Spread conditionally — exactOptionalPropertyTypes forbids an\n      // explicit `undefined` on an optional property.\n      ...(oldestTs !== undefined ? { oldestTs } : {}),\n      ...(newestTs !== undefined ? { newestTs } : {}),\n    })\n    totalBytes += bytes\n    totalRecords += recordCount\n  }\n\n  byCollection.sort((a, b) => a.name.localeCompare(b.name))\n\n  return Object.freeze({\n    totalRecords,\n    totalBytes,\n    byCollection,\n    graph,\n    inaccessible,\n    danglingRefs,\n  })\n}\n","/**\n * Partition adoption. Recipient side: verify an extracted bundle,\n * validate the transfer key, import the re-keyed collections into a\n * destination store, and record an `_meta/adoption` marker. The bundle\n * stays UNOWNED after adoption — `createOwnerOnAdoptedPartition`\n * mints the owner; the transfer seal is then destroyed.\n *\n * @module\n */\nimport { base64ToBuffer, wrapKey, type EnclaveKey } from '../kernel/enclave/index.js'\nimport { TransferSealError, AdoptionStateError, ValidationError } from '../kernel/errors.js'\nimport type { NoydbStore, VaultSnapshot, KeyringFile } from '../kernel/types.js'\nimport { createOwnerKeyring } from '../with-party/team/keyring.js'\nimport { resolveManagedSecret } from '../with-party/team/managed-passphrase.js'\nimport type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js'\nimport type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js'\nimport type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js'\nimport { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { LEDGER_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport type { TransferSealPayload } from '../with-pod/bundle.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/bundle.js'\n\n/**\n * Reverse of `sealDeks`. Imports the transfer key, decrypts the\n * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and\n * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a\n * wrong key (AES-GCM auth-tag failure) or malformed payload.\n */\nexport async function unsealDeks(\n  seal: TransferSealPayload,\n  transferKey: Uint8Array,\n): Promise<Map<string, EnclaveKey>> {\n  if (transferKey.byteLength !== 32) {\n    throw new TransferSealError(\n      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`,\n    )\n  }\n  const key = await crypto.subtle.importKey('raw', transferKey as BufferSource, 'AES-GCM', false, ['decrypt'])\n  const raw = base64ToBuffer(seal.payload)\n  let plaintext: ArrayBuffer\n  try {\n    plaintext = await crypto.subtle.decrypt(\n      { name: 'AES-GCM', iv: raw.slice(0, 12) as BufferSource },\n      key,\n      raw.slice(12) as BufferSource,\n    )\n  } catch {\n    throw new TransferSealError(\n      'transfer seal could not be opened — wrong transfer key (AES-GCM authentication failed).',\n    )\n  }\n  let dekMap: Record<string, string>\n  try {\n    dekMap = JSON.parse(new TextDecoder().decode(plaintext)) as Record<string, string>\n  } catch {\n    throw new TransferSealError('transfer seal payload is not valid JSON after decryption.')\n  }\n  const deks = new Map<string, EnclaveKey>()\n  for (const [collection, b64] of Object.entries(dekMap)) {\n    // Extractable: the recipient must be able to re-wrap these under their\n    // own KEK (AES-KW) at owner-creation. Matches generateDEK.\n    const dek = await crypto.subtle.importKey('raw', base64ToBuffer(b64) as BufferSource, 'AES-GCM', true, ['encrypt', 'decrypt'])\n    deks.set(collection, dek)\n  }\n  return deks\n}\n\nexport interface AdoptPartitionOptions {\n  readonly transferKey: Uint8Array\n  readonly destinationStore: NoydbStore\n  readonly vaultName: string\n}\n\nexport interface AdoptPartitionResult {\n  readonly vaultName: string\n  readonly needsOwner: true\n  readonly sealId: string\n}\n\nexport async function adoptPartition(\n  bundleBytes: Uint8Array,\n  opts: AdoptPartitionOptions,\n): Promise<AdoptPartitionResult> {\n  const { transferKey, destinationStore, vaultName } = opts\n\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new ValidationError(\n      'adoptPartition requires an extracted-partition bundle with a transfer seal. '\n      + 'For ordinary backups use readPod + vault.load.',\n    )\n  }\n\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n\n  // Validate the transfer key by unsealing in memory; throws\n  // TransferSealError on mismatch. DEKs are discarded here — they stay\n  // sealed at rest (in _meta/adoption) until owner-creation wraps them under the\n  // recipient's KEK.\n  await unsealDeks(seal, transferKey)\n\n  // Single-occupancy per vaultName: an `_meta/adoption` marker already present\n  // means this slot holds a partition (adopted-and-unowned, or already owned).\n  // saveAll below would overwrite its data and replace the marker, stranding the\n  // prior adoption's transfer seal. Refuse regardless of sealId — re-adopting the\n  // SAME bundle is a redundant call, and adopting a DIFFERENT bundle here would\n  // clobber the existing partition. Either way, pick a fresh vaultName.\n  const existing = await destinationStore.get(vaultName, '_meta', 'adoption')\n  if (existing) {\n    const prior = JSON.parse(existing._data) as { sealId?: string }\n    if (prior.sealId === seal.sealId) {\n      throw new AdoptionStateError(\n        `partition (sealId ${seal.sealId}) is already adopted into vault \"${vaultName}\".`,\n      )\n    }\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds an adopted partition (sealId ${prior.sealId}); `\n      + `adopting a different partition (sealId ${seal.sealId}) here would overwrite it. `\n      + `Adopt into a fresh vaultName instead.`,\n    )\n  }\n\n  // The marker-only check above misses a worse case: a vaultName already in use\n  // by an ORDINARY vault (createNoydb + openVault) carries no `_meta/adoption`,\n  // yet `saveAll` below is destructive on SQL adapters (`DELETE FROM ... WHERE\n  // vault = ?` followed by upsert) and would wipe the legitimate keyring +\n  // data. Refuse adoption into ANY occupied slot — a fresh vaultName is the\n  // documented precondition.\n  const existingKeyring = await destinationStore.list(vaultName, '_keyring')\n  if (existingKeyring.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds a keyring (an unrelated owner exists at this slot); `\n      + `adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`,\n    )\n  }\n\n  const backup = JSON.parse(dump) as { collections: VaultSnapshot; _internal?: VaultSnapshot }\n  await destinationStore.saveAll(vaultName, backup.collections)\n\n  // Import carried internal collections (e.g. _schemas from carrySchemas).\n  // saveAll only writes data collections; _internal is written per-record.\n  if (backup._internal) {\n    for (const [collection, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await destinationStore.put(vaultName, collection, id, envelope)\n      }\n    }\n  }\n\n  const adoptedAt = new Date().toISOString()\n  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true as const, transferSeal: seal }\n  await destinationStore.put(vaultName, '_meta', 'adoption', {\n    _noydb: 1, _v: 1, _ts: adoptedAt, _iv: '', _data: JSON.stringify(adoption),\n  })\n\n  return { vaultName, needsOwner: true, sealId: seal.sealId }\n}\n\nexport interface CreateOwnerResult {\n  readonly vaultName: string\n  readonly userId: string\n}\n\n/** Standard-mode owner: recipient supplies the passphrase. */\nexport interface CreateOwnerStandardOptions {\n  readonly userId: string\n  readonly passphrase: string\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Managed-mode owner: the passphrase is minted + sealed under\n * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition\n * auto-unlocks on the recipient's device. Managed mode mandates a strong\n * (Shamir) recovery profile at creation, which needs the\n * `shamirRecovery` provider injected.\n */\nexport interface CreateOwnerManagedOptions {\n  readonly userId: string\n  readonly passphraseMode: 'managed'\n  readonly sealingKey: SealingKeyProvider\n  readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>\n  readonly shamirRecovery: ShamirRecoveryProvider\n  readonly transferKey: Uint8Array\n}\n\nexport type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions\n\nfunction isManaged(o: CreateOwnerOptions): o is CreateOwnerManagedOptions {\n  return 'passphraseMode' in o && o.passphraseMode === 'managed'\n}\n\n/**\n * Mint the first owner keyring on an adopted-but-unowned partition,\n * then destroy the transfer seal.\n *\n * Standard mode: the recipient supplies a passphrase. Managed mode: the\n * passphrase is minted + sealed under a `SealingKeyProvider` and a strong\n * (Shamir) recovery profile is enrolled — orchestrated via the existing\n * `openVaultAndEnrollRecovery` ceremony.\n *\n * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base\n * keyring, then wraps the partition's DEKs (recovered from the seal) under that\n * KEK and re-persists the merged keyring file.\n *\n * Idempotent under retry: the seal is destroyed LAST (Stage D), after the\n * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —\n * strong-recovery enrollment (Stage C). A failure in the fallible enrollment\n * step leaves the seal intact, and re-running with the same `userId` +\n * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery\n * arrays may re-enroll an already-enrolled profile on retry; managed mode's\n * mandated single Shamir profile does not.)\n */\nexport async function createOwnerOnAdoptedPartition(\n  store: NoydbStore,\n  vaultName: string,\n  opts: CreateOwnerOptions,\n): Promise<CreateOwnerResult> {\n  const { userId, transferKey } = opts\n\n  // Managed mode requires a strong (Shamir) recovery profile, validated BEFORE\n  // any disk write — same gate as createNoydb.\n  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === 'shamir')) {\n    throw new AdoptionStateError(\n      'managed-mode adoption requires at least one strong (shamir) recovery profile in '\n      + '`recovery` — paper alone is not strong when there is no user passphrase to fall back on.',\n    )\n  }\n\n  // 1. Verify adopted-unowned state.\n  const adoptionEnv = await store.get(vaultName, '_meta', 'adoption')\n  if (!adoptionEnv) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" is not an adopted partition (no _meta/adoption). `\n      + `createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`,\n    )\n  }\n  const adoption = JSON.parse(adoptionEnv._data) as {\n    sealId: string; adoptedAt: string; needsOwner?: boolean\n    consumedAt?: string; transferSeal?: TransferSealPayload\n  }\n  if (adoption.consumedAt !== undefined || adoption.transferSeal === undefined) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`,\n    )\n  }\n\n  // 2. Recover the partition DEKs from the seal (throws on wrong key) BEFORE\n  //    writing any keyring, so a bad transfer key leaves no trace. Always\n  //    validated, including when resuming a partial prior call.\n  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey)\n\n  // The ceremony below is split into stages so a failure in the fallible\n  // managed-enrollment step (network/provider outage) leaves the call RETRYABLE\n  // — the seal is destroyed only once everything durable is in place. Each stage\n  // detects its own prior completion rather than relying on a single resume bit.\n\n  // A keyring present for a DIFFERENT user (with the seal still unconsumed) is a\n  // genuine second-owner attempt — refuse it. A same-user keyring is a resumed\n  // partial call and is handled by the stage checks below.\n  const existingKeyring = await store.get(vaultName, '_keyring', userId)\n  const otherOwners = (await store.list(vaultName, '_keyring')).filter((u) => u !== userId)\n  if (otherOwners.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has a keyring for a different owner; cannot create owner \"${userId}\".`,\n    )\n  }\n\n  // Stage A — mint the owner keyring + merge the partition DEKs. Considered done\n  // only when the keyring already holds every partition DEK. createOwnerKeyring\n  // overwrites (fresh KEK + fresh _users DEK), so re-running is safe ONLY while\n  // no recovery has been enrolled yet — guaranteed here because enrollment\n  // (Stage C) runs strictly after Stage A completes.\n  const partitionCollections = [...partitionDeks.keys()]\n  const priorDeks = existingKeyring ? (JSON.parse(existingKeyring._data) as KeyringFile).deks : {}\n  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks)\n  if (!ownerMinted) {\n    // Resolve the owner passphrase. Managed mode mints a random passphrase, seals\n    // it under the provider, and persists _meta/sealed-passphrase (so the\n    // partition auto-unlocks on the recipient's device); standard mode uses the\n    // caller's passphrase. Idempotent under retry — resolveManagedSecret's reopen\n    // arm reuses an already-sealed passphrase.\n    const passphrase = isManaged(opts)\n      ? await resolveManagedSecret(store, vaultName, opts.sealingKey)\n      : opts.passphrase\n\n    // Mint the owner keyring (KEK + _users DEK + canary, written to disk).\n    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase)\n\n    // Merge the partition DEKs (wrapped under the new KEK) into the keyring.\n    const env = await store.get(vaultName, '_keyring', userId)\n    if (!env) throw new AdoptionStateError(`keyring write for \"${userId}\" did not persist`)\n    const keyringFile = JSON.parse(env._data) as KeyringFile\n    const kek = unlocked.kek\n    if (!kek) throw new AdoptionStateError(`owner keyring for \"${userId}\" has no KEK to wrap partition DEKs under`)\n    const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n    for (const [collection, dek] of partitionDeks) {\n      mergedDeks[collection] = await wrapKey(dek, kek)\n    }\n    const mergedFile: KeyringFile = { ...keyringFile, deks: mergedDeks }\n    await store.put(vaultName, '_keyring', userId, { ...env, _data: JSON.stringify(mergedFile) })\n  }\n\n  // Stage B — record the ownership transition on the carried\n  // audit chain (carryLedger sealed the _ledger DEK). No-op without that DEK.\n  // Idempotent: appended only if the closing `transfer-seal-consumed` entry is\n  // absent, so a retry does not duplicate the pair.\n  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION)\n  if (ledgerDek) {\n    const ledger = new LedgerStore({\n      adapter: store,\n      vault: vaultName,\n      encrypted: true,\n      getDEK: async () => ledgerDek,\n      actor: userId,\n    })\n    const creationReason = `creation-of-new-owner:${userId}`\n    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`\n    // Gate each append on its own presence — a crash or store error strictly\n    // between the two adjacent puts would otherwise re-append the first one\n    // on retry. The pair is the audit record, not a single transaction.\n    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason))\n    if (!recordedReasons.has(creationReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: creationReason })\n    }\n    if (!recordedReasons.has(consumedReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: consumedReason })\n    }\n  }\n\n  // Stage C — Managed mode: enroll the mandatory strong recovery\n  //    by orchestrating the existing public ceremony. The partition is\n  //    now a managed-mode vault on disk (sealed passphrase + keyring), so we\n  //    open it as a normal client and let openVaultAndEnrollRecovery do the\n  //    gate-bypass + enroll + re-assert. Dynamic import keeps the Noydb class\n  //    out of the @noy-db/hub/cargo static graph. Runs BEFORE seal destruction\n  //    so a failure here leaves the seal intact and the call retryable.\n  if (isManaged(opts)) {\n    const { createNoydb } = await import('../kernel/noydb.js')\n    const db = await createNoydb({\n      store,\n      user: userId,\n      passphraseMode: 'managed',\n      sealingKey: opts.sealingKey,\n      shamirRecovery: opts.shamirRecovery,\n    })\n    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery })\n  }\n\n  // Stage D — Destroy the transfer seal LAST — the commit point. Everything\n  //    above is either idempotent or resumable, so the seal is only consumed\n  //    once the owner keyring (and, in managed mode, strong recovery) is\n  //    durably in place. Retain sealId + consumedAt for audit.\n  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: new Date().toISOString() }\n  await store.put(vaultName, '_meta', 'adoption', { ...adoptionEnv, _data: JSON.stringify(consumed) })\n\n  return { vaultName, userId }\n}\n","/**\n * Read-side counterpart to `extractPartition`: decrypt an\n * extracted-partition bundle's records to plaintext using its transfer\n * key, WITHOUT adopting it into a vault. Used by an outward\n * orchestration layer's reconcile/merge and field-authority flows to\n * compare incoming records against a receiver. The transfer key validates the bundle\n * (wrong key throws).\n * @module\n */\nimport type { EncryptedEnvelope } from '../kernel/types.js'\nimport { openEnvelopeJson } from '../kernel/enclave/index.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/bundle.js'\nimport { unsealDeks } from './adopt-partition.js'\n\n/** One decrypted record from an extracted-partition compartment. */\nexport interface DecryptedRecord {\n  readonly id: string\n  readonly record: Record<string, unknown>\n  /** Source envelope write timestamp (ISO) — for last-write-wins merges. */\n  readonly ts: string\n  /** Source envelope version. */\n  readonly version: number\n  /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */\n  readonly source?: string\n  /** ISO-8601 timestamp the provenance source was recorded (FR-5). */\n  readonly sourceTs?: string\n}\n\n/**\n * Decrypt every record of an extracted-partition bundle to plaintext,\n * grouped by collection. Throws if the bundle isn't an\n * extracted-partition or the transfer key is wrong.\n */\nexport async function decryptExtractedPartition(\n  bundleBytes: Uint8Array,\n  transferKey: Uint8Array,\n): Promise<Record<string, DecryptedRecord[]>> {\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new Error('decryptExtractedPartition: bundle is not an extracted-partition.')\n  }\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n  const deks = await unsealDeks(seal, transferKey) // throws TransferSealError on wrong key\n  const backup = JSON.parse(dump) as { collections: Record<string, Record<string, EncryptedEnvelope>> }\n  const out: Record<string, DecryptedRecord[]> = {}\n  for (const [collection, byId] of Object.entries(backup.collections)) {\n    const dek = deks.get(collection)\n    if (dek === undefined) continue // no DEK sealed for this collection — skip\n    const recs: DecryptedRecord[] = []\n    for (const [id, env] of Object.entries(byId)) {\n      const plaintext = await openEnvelopeJson(env, dek)\n      const body = JSON.parse(plaintext) as Record<string, unknown>\n      recs.push({\n        id,\n        record: { ...body, id },\n        ts: env._ts,\n        version: env._v,\n        ...(env._source !== undefined ? { source: env._source } : {}),\n        ...(env._sourceTs !== undefined ? { sourceTs: env._sourceTs } : {}),\n      })\n    }\n    out[collection] = recs\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,iBAAiB,OAAO,MAAM;AAClC,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,iCAAwB;AACtE,aAAO,qBAAqB,OAAO,IAAI;AAAA,IACzC;AAAA,EACF;AACF;;;ACkBA,eAAsB,mBACpB,OACA,MAC4B;AAC5B,QAAM,EAAE,SAAS,OAAO,aAAa,IAAI,MAAM,YAAY,OAAO,IAAI;AAEtE,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,eAED,CAAC;AACN,QAAM,eAA0D,CAAC;AACjE,MAAI,aAAa;AACjB,MAAI,eAAe;AAEnB,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,QAAI,QAAQ;AACZ,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAElB,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,KAAK;AAGR,qBAAa,KAAK,EAAE,YAAY,gBAAgB,GAAG,CAAC;AACpD;AAAA,MACF;AACA;AACA,eAAS,QAAQ,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE;AAC7C,YAAM,KAAK,IAAI;AACf,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AACxD,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AAAA,IAC1D;AAEA,iBAAa,KAAK;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,kBAAc;AACd,oBAAgB;AAAA,EAClB;AAEA,eAAa,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAExD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;;;ACpEA,eAAsB,WACpB,MACA,aACkC;AAClC,MAAI,YAAY,eAAe,IAAI;AACjC,UAAM,IAAI;AAAA,MACR,sCAAsC,YAAY,UAAU;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,aAA6B,WAAW,OAAO,CAAC,SAAS,CAAC;AAC3G,QAAM,MAAM,eAAe,KAAK,OAAO;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,OAAO,OAAO;AAAA,MAC9B,EAAE,MAAM,WAAW,IAAI,IAAI,MAAM,GAAG,EAAE,EAAkB;AAAA,MACxD;AAAA,MACA,IAAI,MAAM,EAAE;AAAA,IACd;AAAA,EACF,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,kBAAkB,2DAA2D;AAAA,EACzF;AACA,QAAM,OAAO,oBAAI,IAAwB;AACzC,aAAW,CAAC,YAAY,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAGtD,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe,GAAG,GAAmB,WAAW,MAAM,CAAC,WAAW,SAAS,CAAC;AAC7H,SAAK,IAAI,YAAY,GAAG;AAAA,EAC1B;AACA,SAAO;AACT;AAcA,eAAsB,eACpB,aACA,MAC+B;AAC/B,QAAM,EAAE,aAAa,kBAAkB,UAAU,IAAI;AAErD,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAM3D,QAAM,WAAW,MAAM,WAAW;AAQlC,QAAM,WAAW,MAAM,iBAAiB,IAAI,WAAW,SAAS,UAAU;AAC1E,MAAI,UAAU;AACZ,UAAM,QAAQ,KAAK,MAAM,SAAS,KAAK;AACvC,QAAI,MAAM,WAAW,KAAK,QAAQ;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,KAAK,MAAM,oCAAoC,SAAS;AAAA,MAC/E;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,gDAAgD,MAAM,MAAM,6CACnC,KAAK,MAAM;AAAA,IAEzD;AAAA,EACF;AAQA,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,WAAW,UAAU;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AAI5D,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACpE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,iBAAiB,IAAI,WAAW,YAAY,IAAI,QAAQ;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,WAAW,YAAY,MAAe,cAAc,KAAK;AACjG,QAAM,iBAAiB,IAAI,WAAW,SAAS,YAAY;AAAA,IACzD,QAAQ;AAAA,IAAG,IAAI;AAAA,IAAG,KAAK;AAAA,IAAW,KAAK;AAAA,IAAI,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC3E,CAAC;AAED,SAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,KAAK,OAAO;AAC5D;AAgCA,SAAS,UAAU,GAAuD;AACxE,SAAO,oBAAoB,KAAK,EAAE,mBAAmB;AACvD;AAuBA,eAAsB,8BACpB,OACA,WACA,MAC4B;AAC5B,QAAM,EAAE,QAAQ,YAAY,IAAI;AAIhC,MAAI,UAAU,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,IAAI,WAAW,SAAS,UAAU;AAClE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,MAAM,YAAY,KAAK;AAI7C,MAAI,SAAS,eAAe,UAAa,SAAS,iBAAiB,QAAW;AAC5E,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,qDAAqD,SAAS,UAAU;AAAA,IAC7F;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM,WAAW,SAAS,cAAc,WAAW;AAUzE,QAAM,kBAAkB,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACrE,QAAM,eAAe,MAAM,MAAM,KAAK,WAAW,UAAU,GAAG,OAAO,CAAC,MAAM,MAAM,MAAM;AACxF,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,uEAAuE,MAAM;AAAA,IAClG;AAAA,EACF;AAOA,QAAM,uBAAuB,CAAC,GAAG,cAAc,KAAK,CAAC;AACrD,QAAM,YAAY,kBAAmB,KAAK,MAAM,gBAAgB,KAAK,EAAkB,OAAO,CAAC;AAC/F,QAAM,cAAc,oBAAoB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,KAAK,SAAS;AAChG,MAAI,CAAC,aAAa;AAMhB,UAAM,aAAa,UAAU,IAAI,IAC7B,MAAM,qBAAqB,OAAO,WAAW,KAAK,UAAU,IAC5D,KAAK;AAGT,UAAM,WAAW,MAAM,mBAAmB,OAAO,WAAW,QAAQ,UAAU;AAG9E,UAAM,MAAM,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACzD,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,mBAAmB;AACtF,UAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AACxC,UAAM,MAAM,SAAS;AACrB,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,2CAA2C;AAC9G,UAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,eAAW,CAAC,YAAY,GAAG,KAAK,eAAe;AAC7C,iBAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACjD;AACA,UAAM,aAA0B,EAAE,GAAG,aAAa,MAAM,WAAW;AACnE,UAAM,MAAM,IAAI,WAAW,YAAY,QAAQ,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAAA,EAC9F;AAMA,QAAM,YAAY,cAAc,IAAI,iBAAiB;AACrD,MAAI,WAAW;AACb,UAAM,SAAS,IAAI,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,YAAY;AAAA,MACpB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,iBAAiB,yBAAyB,MAAM;AACtD,UAAM,iBAAiB,0BAA0B,SAAS,MAAM;AAIhE,UAAM,kBAAkB,IAAI,KAAK,MAAM,OAAO,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AACpF,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AACA,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AAAA,EACF;AASA,MAAI,UAAU,IAAI,GAAG;AACnB,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,UAAM,KAAK,MAAM,YAAY;AAAA,MAC3B;AAAA,MACA,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,2BAA2B,WAAW,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EAC5E;AAMA,QAAM,WAAW,EAAE,QAAQ,SAAS,QAAQ,WAAW,SAAS,WAAW,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChH,QAAM,MAAM,IAAI,WAAW,SAAS,YAAY,EAAE,GAAG,aAAa,OAAO,KAAK,UAAU,QAAQ,EAAE,CAAC;AAEnG,SAAO,EAAE,WAAW,OAAO;AAC7B;;;ACrUA,eAAsB,0BACpB,aACA,aAC4C;AAC5C,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAC3D,QAAM,OAAO,MAAM,WAAW,MAAM,WAAW;AAC/C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACnE,UAAM,MAAM,KAAK,IAAI,UAAU;AAC/B,QAAI,QAAQ,OAAW;AACvB,UAAM,OAA0B,CAAC;AACjC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC5C,YAAM,YAAY,MAAM,iBAAiB,KAAK,GAAG;AACjD,YAAM,OAAO,KAAK,MAAM,SAAS;AACjC,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ,EAAE,GAAG,MAAM,GAAG;AAAA,QACtB,IAAI,IAAI;AAAA,QACR,SAAS,IAAI;AAAA,QACb,GAAI,IAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,QAC3D,GAAI,IAAI,cAAc,SAAY,EAAE,UAAU,IAAI,UAAU,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-SMGEYW6G.js → chunk-QAFWRGVD.js}

@@ -7,28 +7,28 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-2IALOXZS.js";
+} from "./chunk-F4COUZLL.js";
 import {
   envelopeBodySize
-} from "./chunk-DVUZMT2W.js";
+} from "./chunk-PEY6ZTCF.js";
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-WEYZTLXN.js";
+} from "./chunk-QXPOEAKR.js";
 import {
   bufferToBase64,
   decrypt,
   derivePresenceKey,
   encrypt,
   generateIV
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/with-party/team/presence.ts
 var PresenceHandle = class {
@@ -1073,4 +1073,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-SMGEYW6G.js.map
+//# sourceMappingURL=chunk-QAFWRGVD.js.map

package/dist/{chunk-TOPYT5U5.js → chunk-QCUH2G77.js}

@@ -2,20 +2,20 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-G6EQYAL6.js";
+} from "./chunk-AFBJHD55.js";
 import {
   openEnvelopeJson
-} from "./chunk-DVUZMT2W.js";
+} from "./chunk-PEY6ZTCF.js";
 import {
   encrypt
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/with-audit/attestation/revoke.ts
 import { signRevocationList } from "@noy-db/attestation";
@@ -82,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-TOPYT5U5.js.map
+//# sourceMappingURL=chunk-QCUH2G77.js.map

package/dist/{chunk-CBSY2N76.js → chunk-QDNVHA2F.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 
 // src/with-party/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -39,4 +39,4 @@ export {
   loadVaultPolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=chunk-CBSY2N76.js.map
+//# sourceMappingURL=chunk-QDNVHA2F.js.map

package/dist/{chunk-FH52K7EG.js → chunk-QRHEAZ2Q.js}

@@ -37,14 +37,10 @@ function resolveSchema(schema) {
     maxCoverBytes: schema.maxCoverBytes ?? DEFAULT_COVER_SCHEMA.maxCoverBytes
   };
 }
-var PUBLIC_ENVELOPE_FIELDS = COVER_FIELDS;
-var DEFAULT_PUBLIC_ENVELOPE_SCHEMA = DEFAULT_COVER_SCHEMA;
 
 export {
   COVER_FIELDS,
   DEFAULT_COVER_SCHEMA,
-  resolveSchema,
-  PUBLIC_ENVELOPE_FIELDS,
-  DEFAULT_PUBLIC_ENVELOPE_SCHEMA
+  resolveSchema
 };
-//# sourceMappingURL=chunk-FH52K7EG.js.map
+//# sourceMappingURL=chunk-QRHEAZ2Q.js.map

package/dist/{chunk-FH52K7EG.js.map → chunk-QRHEAZ2Q.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/directory/cover/types.ts"],"sourcesContent":["/**\n * Cover — owner-curated plaintext metadata, readable before vault\n * unlock or bundle decryption. Like a book's cover: title, cover\n * art, back-cover blurb — readable on the shelf without opening\n * the book, and never trusted as the book's contents.\n *\n * (Formerly \"public envelope\" — the wire keeps that name: the\n * record still lives at `_meta/public-envelope` and carries the\n * `_noydb_public: 1` discriminator.)\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md\n *\n * @module\n */\n\n/**\n * Either a single string (used when the developer's app is\n * single-locale) or a locale → string map for i18n. Mirrors the\n * shape `@noy-db/hub/i18n` already uses for record fields, so the\n * existing `resolveI18nText` resolver applies.\n */\nexport type CoverText = string | Record<string, string>\n\n/**\n * A JSON-serializable value — what a `custom` namespace payload may\n * hold. No functions, `undefined`, symbols, bigints, or cycles; the\n * validator additionally caps nesting depth at 8 levels.\n */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [key: string]: JsonValue }\n\n/**\n * Persisted shape — both `_meta/public-envelope` (the frozen wire\n * name) and the bundle header carry this. The version number is\n * monotonic per vault and helps cache invalidators detect change\n * without hashing the JSON.\n */\nexport interface Cover {\n  readonly _noydb_public: 1\n  readonly version: number\n  readonly name?: CoverText\n  readonly description?: CoverText\n  /** Inline `data:` URL (`data:image/png;base64,…` or `data:image/svg+xml;base64,…`). */\n  readonly icon?: string\n  /** ISO-8601 timestamp; auto-set on first cover write, immutable thereafter. */\n  readonly createdAt?: string\n  /** ISO-8601 timestamp; auto-updated on every `setCover` call. */\n  readonly updatedAt?: string\n  /** BCP-47 fallback locale for renderers when the user's locale isn't covered. */\n  readonly defaultLocale?: string\n  /**\n   * Namespaced integrator slot (#800) — e.g.\n   * `{ 'noydb.viewer': { defaultCollection: 'invoices' } }`. Keys must\n   * be reverse-DNS / package-style (`noydb.viewer`, `com.acme.registry`).\n   * Like everything on the cover it is plaintext, public, and\n   * unauthenticated — payloads are hints, never authority. Opt-in:\n   * excluded from `DEFAULT_COVER_SCHEMA.fields`, so `cover: true`\n   * does NOT enable it.\n   */\n  readonly custom?: Record<string, JsonValue>\n}\n\n/** Field names the developer can allow in `CoverSchema.fields`. */\nexport const COVER_FIELDS = [\n  'name',\n  'description',\n  'icon',\n  'createdAt',\n  'updatedAt',\n  'defaultLocale',\n  'custom',\n] as const\n\nexport type CoverField = (typeof COVER_FIELDS)[number]\n\n/**\n * Build-time schema. The developer enables the feature and bounds\n * what the owner can set. `true` is shorthand for \"all defaults\" —\n * gives the owner the full field set with the standard caps.\n */\nexport interface CoverSchema {\n  /**\n   * Allowed field names. Setting `name`/`description`/`icon`/`defaultLocale` is\n   * gated on the field being listed here. `createdAt` / `updatedAt` are managed\n   * by the hub; including them is a no-op (the owner cannot set them\n   * directly). Default: every field above.\n   */\n  readonly fields?: ReadonlyArray<CoverField>\n  /**\n   * Maximum icon size — measured as the length of the data-URL\n   * string. Default 256 KB.\n   */\n  readonly maxIconBytes?: number\n  /** Allowed icon MIME types. Default ['image/png', 'image/svg+xml']. */\n  readonly iconMimeTypes?: ReadonlyArray<string>\n  /** Maximum length of `name` / `description` per locale. Default 200. */\n  readonly maxStringChars?: number\n  /**\n   * Maximum serialized size (`JSON.stringify` length) of the whole\n   * would-be-persisted `custom` object, measured AFTER the namespace\n   * patch merge. Default 8 KB.\n   */\n  readonly maxCustomBytes?: number\n  /**\n   * Maximum serialized size of the ENTIRE would-be-persisted cover\n   * document. The consumer-protection cap — bounds what a pre-auth\n   * reader must fetch and parse, and closes the unbounded locale-map\n   * key-count hole for `name` / `description`. Default 300 KB\n   * (headroom over the 256 KB icon cap + text fields).\n   */\n  readonly maxCoverBytes?: number\n}\n\n/**\n * Default schema values; merged onto every developer-supplied schema.\n * NOTE: `fields` is the six display fields, deliberately NOT\n * {@link COVER_FIELDS} — the opt-in `'custom'` slot is excluded, so\n * the `cover: true` shorthand never exposes it by accident.\n */\nexport const DEFAULT_COVER_SCHEMA = {\n  fields: ['name', 'description', 'icon', 'createdAt', 'updatedAt', 'defaultLocale'],\n  maxIconBytes: 256 * 1024,\n  iconMimeTypes: ['image/png', 'image/svg+xml'] as const,\n  maxStringChars: 200,\n  maxCustomBytes: 8 * 1024,\n  maxCoverBytes: 300 * 1024,\n} as const satisfies Required<CoverSchema>\n\n/** Resolved schema after merging developer override onto defaults. */\nexport interface ResolvedCoverSchema {\n  readonly fields: ReadonlyArray<CoverField>\n  readonly maxIconBytes: number\n  readonly iconMimeTypes: ReadonlyArray<string>\n  readonly maxStringChars: number\n  readonly maxCustomBytes: number\n  readonly maxCoverBytes: number\n}\n\n/**\n * Merge developer schema onto the defaults. The shorthand `true`\n * resolves to the full default schema; an explicit object only\n * overrides the keys it provides.\n */\nexport function resolveSchema(\n  schema: true | CoverSchema | undefined,\n): ResolvedCoverSchema | undefined {\n  if (!schema) return undefined\n  if (schema === true) {\n    return {\n      fields: DEFAULT_COVER_SCHEMA.fields,\n      maxIconBytes: DEFAULT_COVER_SCHEMA.maxIconBytes,\n      iconMimeTypes: DEFAULT_COVER_SCHEMA.iconMimeTypes,\n      maxStringChars: DEFAULT_COVER_SCHEMA.maxStringChars,\n      maxCustomBytes: DEFAULT_COVER_SCHEMA.maxCustomBytes,\n      maxCoverBytes: DEFAULT_COVER_SCHEMA.maxCoverBytes,\n    }\n  }\n  return {\n    fields: schema.fields ?? DEFAULT_COVER_SCHEMA.fields,\n    maxIconBytes: schema.maxIconBytes ?? DEFAULT_COVER_SCHEMA.maxIconBytes,\n    iconMimeTypes: schema.iconMimeTypes ?? DEFAULT_COVER_SCHEMA.iconMimeTypes,\n    maxStringChars: schema.maxStringChars ?? DEFAULT_COVER_SCHEMA.maxStringChars,\n    maxCustomBytes: schema.maxCustomBytes ?? DEFAULT_COVER_SCHEMA.maxCustomBytes,\n    maxCoverBytes: schema.maxCoverBytes ?? DEFAULT_COVER_SCHEMA.maxCoverBytes,\n  }\n}\n\n// ─── Deprecated aliases (#799 public-envelope → cover; remove after one pre-release window) ───\n\n/** @deprecated Use {@link Cover}. */\nexport type PublicEnvelope = Cover\n/** @deprecated Use {@link CoverText}. */\nexport type PublicEnvelopeText = CoverText\n/** @deprecated Use {@link CoverField}. */\nexport type PublicEnvelopeField = CoverField\n/** @deprecated Use {@link CoverSchema}. */\nexport type PublicEnvelopeSchema = CoverSchema\n/** @deprecated Use {@link ResolvedCoverSchema}. */\nexport type ResolvedPublicEnvelopeSchema = ResolvedCoverSchema\n/** @deprecated Use {@link COVER_FIELDS}. */\nexport const PUBLIC_ENVELOPE_FIELDS = COVER_FIELDS\n/** @deprecated Use {@link DEFAULT_COVER_SCHEMA}. */\nexport const DEFAULT_PUBLIC_ENVELOPE_SCHEMA = DEFAULT_COVER_SCHEMA\n"],"mappings":";AAoEO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgDO,IAAM,uBAAuB;AAAA,EAClC,QAAQ,CAAC,QAAQ,eAAe,QAAQ,aAAa,aAAa,eAAe;AAAA,EACjF,cAAc,MAAM;AAAA,EACpB,eAAe,CAAC,aAAa,eAAe;AAAA,EAC5C,gBAAgB;AAAA,EAChB,gBAAgB,IAAI;AAAA,EACpB,eAAe,MAAM;AACvB;AAiBO,SAAS,cACd,QACiC;AACjC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL,QAAQ,qBAAqB;AAAA,MAC7B,cAAc,qBAAqB;AAAA,MACnC,eAAe,qBAAqB;AAAA,MACpC,gBAAgB,qBAAqB;AAAA,MACrC,gBAAgB,qBAAqB;AAAA,MACrC,eAAe,qBAAqB;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,OAAO,UAAU,qBAAqB;AAAA,IAC9C,cAAc,OAAO,gBAAgB,qBAAqB;AAAA,IAC1D,eAAe,OAAO,iBAAiB,qBAAqB;AAAA,IAC5D,gBAAgB,OAAO,kBAAkB,qBAAqB;AAAA,IAC9D,gBAAgB,OAAO,kBAAkB,qBAAqB;AAAA,IAC9D,eAAe,OAAO,iBAAiB,qBAAqB;AAAA,EAC9D;AACF;AAeO,IAAM,yBAAyB;AAE/B,IAAM,iCAAiC;","names":[]}
+{"version":3,"sources":["../src/with-party/directory/cover/types.ts"],"sourcesContent":["/**\n * Cover — owner-curated plaintext metadata, readable before vault\n * unlock or bundle decryption. Like a book's cover: title, cover\n * art, back-cover blurb — readable on the shelf without opening\n * the book, and never trusted as the book's contents.\n *\n * (Formerly \"public envelope\" — the wire keeps that name: the\n * record still lives at `_meta/public-envelope` and carries the\n * `_noydb_public: 1` discriminator.)\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md\n *\n * @module\n */\n\n/**\n * Either a single string (used when the developer's app is\n * single-locale) or a locale → string map for i18n. Mirrors the\n * shape `@noy-db/hub/i18n` already uses for record fields, so the\n * existing `resolveI18nText` resolver applies.\n */\nexport type CoverText = string | Record<string, string>\n\n/**\n * A JSON-serializable value — what a `custom` namespace payload may\n * hold. No functions, `undefined`, symbols, bigints, or cycles; the\n * validator additionally caps nesting depth at 8 levels.\n */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [key: string]: JsonValue }\n\n/**\n * Persisted shape — both `_meta/public-envelope` (the frozen wire\n * name) and the bundle header carry this. The version number is\n * monotonic per vault and helps cache invalidators detect change\n * without hashing the JSON.\n */\nexport interface Cover {\n  readonly _noydb_public: 1\n  readonly version: number\n  readonly name?: CoverText\n  readonly description?: CoverText\n  /** Inline `data:` URL (`data:image/png;base64,…` or `data:image/svg+xml;base64,…`). */\n  readonly icon?: string\n  /** ISO-8601 timestamp; auto-set on first cover write, immutable thereafter. */\n  readonly createdAt?: string\n  /** ISO-8601 timestamp; auto-updated on every `setCover` call. */\n  readonly updatedAt?: string\n  /** BCP-47 fallback locale for renderers when the user's locale isn't covered. */\n  readonly defaultLocale?: string\n  /**\n   * Namespaced integrator slot (#800) — e.g.\n   * `{ 'noydb.viewer': { defaultCollection: 'invoices' } }`. Keys must\n   * be reverse-DNS / package-style (`noydb.viewer`, `com.acme.registry`).\n   * Like everything on the cover it is plaintext, public, and\n   * unauthenticated — payloads are hints, never authority. Opt-in:\n   * excluded from `DEFAULT_COVER_SCHEMA.fields`, so `cover: true`\n   * does NOT enable it.\n   */\n  readonly custom?: Record<string, JsonValue>\n}\n\n/** Field names the developer can allow in `CoverSchema.fields`. */\nexport const COVER_FIELDS = [\n  'name',\n  'description',\n  'icon',\n  'createdAt',\n  'updatedAt',\n  'defaultLocale',\n  'custom',\n] as const\n\nexport type CoverField = (typeof COVER_FIELDS)[number]\n\n/**\n * Build-time schema. The developer enables the feature and bounds\n * what the owner can set. `true` is shorthand for \"all defaults\" —\n * gives the owner the full field set with the standard caps.\n */\nexport interface CoverSchema {\n  /**\n   * Allowed field names. Setting `name`/`description`/`icon`/`defaultLocale` is\n   * gated on the field being listed here. `createdAt` / `updatedAt` are managed\n   * by the hub; including them is a no-op (the owner cannot set them\n   * directly). Default: every field above.\n   */\n  readonly fields?: ReadonlyArray<CoverField>\n  /**\n   * Maximum icon size — measured as the length of the data-URL\n   * string. Default 256 KB.\n   */\n  readonly maxIconBytes?: number\n  /** Allowed icon MIME types. Default ['image/png', 'image/svg+xml']. */\n  readonly iconMimeTypes?: ReadonlyArray<string>\n  /** Maximum length of `name` / `description` per locale. Default 200. */\n  readonly maxStringChars?: number\n  /**\n   * Maximum serialized size (`JSON.stringify` length) of the whole\n   * would-be-persisted `custom` object, measured AFTER the namespace\n   * patch merge. Default 8 KB.\n   */\n  readonly maxCustomBytes?: number\n  /**\n   * Maximum serialized size of the ENTIRE would-be-persisted cover\n   * document. The consumer-protection cap — bounds what a pre-auth\n   * reader must fetch and parse, and closes the unbounded locale-map\n   * key-count hole for `name` / `description`. Default 300 KB\n   * (headroom over the 256 KB icon cap + text fields).\n   */\n  readonly maxCoverBytes?: number\n}\n\n/**\n * Default schema values; merged onto every developer-supplied schema.\n * NOTE: `fields` is the six display fields, deliberately NOT\n * {@link COVER_FIELDS} — the opt-in `'custom'` slot is excluded, so\n * the `cover: true` shorthand never exposes it by accident.\n */\nexport const DEFAULT_COVER_SCHEMA = {\n  fields: ['name', 'description', 'icon', 'createdAt', 'updatedAt', 'defaultLocale'],\n  maxIconBytes: 256 * 1024,\n  iconMimeTypes: ['image/png', 'image/svg+xml'] as const,\n  maxStringChars: 200,\n  maxCustomBytes: 8 * 1024,\n  maxCoverBytes: 300 * 1024,\n} as const satisfies Required<CoverSchema>\n\n/** Resolved schema after merging developer override onto defaults. */\nexport interface ResolvedCoverSchema {\n  readonly fields: ReadonlyArray<CoverField>\n  readonly maxIconBytes: number\n  readonly iconMimeTypes: ReadonlyArray<string>\n  readonly maxStringChars: number\n  readonly maxCustomBytes: number\n  readonly maxCoverBytes: number\n}\n\n/**\n * Merge developer schema onto the defaults. The shorthand `true`\n * resolves to the full default schema; an explicit object only\n * overrides the keys it provides.\n */\nexport function resolveSchema(\n  schema: true | CoverSchema | undefined,\n): ResolvedCoverSchema | undefined {\n  if (!schema) return undefined\n  if (schema === true) {\n    return {\n      fields: DEFAULT_COVER_SCHEMA.fields,\n      maxIconBytes: DEFAULT_COVER_SCHEMA.maxIconBytes,\n      iconMimeTypes: DEFAULT_COVER_SCHEMA.iconMimeTypes,\n      maxStringChars: DEFAULT_COVER_SCHEMA.maxStringChars,\n      maxCustomBytes: DEFAULT_COVER_SCHEMA.maxCustomBytes,\n      maxCoverBytes: DEFAULT_COVER_SCHEMA.maxCoverBytes,\n    }\n  }\n  return {\n    fields: schema.fields ?? DEFAULT_COVER_SCHEMA.fields,\n    maxIconBytes: schema.maxIconBytes ?? DEFAULT_COVER_SCHEMA.maxIconBytes,\n    iconMimeTypes: schema.iconMimeTypes ?? DEFAULT_COVER_SCHEMA.iconMimeTypes,\n    maxStringChars: schema.maxStringChars ?? DEFAULT_COVER_SCHEMA.maxStringChars,\n    maxCustomBytes: schema.maxCustomBytes ?? DEFAULT_COVER_SCHEMA.maxCustomBytes,\n    maxCoverBytes: schema.maxCoverBytes ?? DEFAULT_COVER_SCHEMA.maxCoverBytes,\n  }\n}\n"],"mappings":";AAoEO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgDO,IAAM,uBAAuB;AAAA,EAClC,QAAQ,CAAC,QAAQ,eAAe,QAAQ,aAAa,aAAa,eAAe;AAAA,EACjF,cAAc,MAAM;AAAA,EACpB,eAAe,CAAC,aAAa,eAAe;AAAA,EAC5C,gBAAgB;AAAA,EAChB,gBAAgB,IAAI;AAAA,EACpB,eAAe,MAAM;AACvB;AAiBO,SAAS,cACd,QACiC;AACjC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL,QAAQ,qBAAqB;AAAA,MAC7B,cAAc,qBAAqB;AAAA,MACnC,eAAe,qBAAqB;AAAA,MACpC,gBAAgB,qBAAqB;AAAA,MACrC,gBAAgB,qBAAqB;AAAA,MACrC,eAAe,qBAAqB;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,OAAO,UAAU,qBAAqB;AAAA,IAC9C,cAAc,OAAO,gBAAgB,qBAAqB;AAAA,IAC1D,eAAe,OAAO,iBAAiB,qBAAqB;AAAA,IAC5D,gBAAgB,OAAO,kBAAkB,qBAAqB;AAAA,IAC9D,gBAAgB,OAAO,kBAAkB,qBAAqB;AAAA,IAC9D,eAAe,OAAO,iBAAiB,qBAAqB;AAAA,EAC9D;AACF;","names":[]}

package/dist/{chunk-WEYZTLXN.js → chunk-QXPOEAKR.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 
 // src/kernel/enclave/record-keys/tombstone.ts
 function isTombstoneShape(envelope) {
@@ -42,4 +42,4 @@ export {
   isDeleteMarker,
   buildDeleteMarker
 };
-//# sourceMappingURL=chunk-WEYZTLXN.js.map
+//# sourceMappingURL=chunk-QXPOEAKR.js.map

package/dist/{chunk-PT37L5DV.js → chunk-RGL53NXZ.js}

@@ -1,11 +1,11 @@
 import {
   hasExportCapability,
   hasImportCapability
-} from "./chunk-3SV2EPMN.js";
+} from "./chunk-HVZT5T22.js";
 import {
   ExportCapabilityError,
   ImportCapabilityError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/port/with/capabilities.ts
 function assertCanExport(keyring, tier, format) {
@@ -252,4 +252,4 @@ export {
   ServiceBus,
   SubsystemBus
 };
-//# sourceMappingURL=chunk-PT37L5DV.js.map
+//# sourceMappingURL=chunk-RGL53NXZ.js.map

package/dist/{chunk-TAGR72IR.js → chunk-RI3OKC3Y.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-IGJCYUT5.js";
 import {
   applyI18nLocale
-} from "./chunk-GULTLPFB.js";
+} from "./chunk-XGVDLQJE.js";
 import {
   viaBinder
-} from "./chunk-JVBO4SZL.js";
+} from "./chunk-STR7WBOB.js";
 import {
   GroupCardinalityError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/with-lookup/aggregate/reducers.ts
 function count(opts) {
@@ -512,4 +512,4 @@ export {
   groupAndReduce,
   GroupedAggregation
 };
-//# sourceMappingURL=chunk-TAGR72IR.js.map
+//# sourceMappingURL=chunk-RI3OKC3Y.js.map

package/dist/{chunk-UNCOC7QH.js → chunk-S3OYXPSE.js}

@@ -1,21 +1,21 @@
-import {
-  freezeSnapshotOnly
-} from "./chunk-YJV2UZ7H.js";
 import {
   resolveManagedSecret
-} from "./chunk-LB6OH6K2.js";
+} from "./chunk-BCOKZC4B.js";
+import {
+  freezeSnapshotOnly
+} from "./chunk-XULHFSHO.js";
 import {
   createOwnerKeyring
-} from "./chunk-3SV2EPMN.js";
+} from "./chunk-HVZT5T22.js";
 import {
   wrapKey
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 import {
   PermissionDeniedError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -132,4 +132,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-UNCOC7QH.js.map
+//# sourceMappingURL=chunk-S3OYXPSE.js.map