@noy-db/hub 0.4.0-pre.9 → 0.5.0

package/dist/seed-ALU3BHFS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/broker/seed.ts"],"sourcesContent":["/**\n * `_broker` reserved-collection seed lifecycle (#479, credential-broker\n * spec §2/§3). Modeled on `with-sync/credentials.ts`: a\n * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under\n * the collection's own DEK, `requireAdminAccess` role gate (owner/admin\n * only — custodian intentionally excluded, same rationale as\n * `_sync_credentials`: this is transport-auth material, not the\n * custodian's operational scope).\n *\n * Three operations, each a free function taking a {@link BrokerSeedCtx}\n * (the {@link BrokerCtx} threaded through `with-party/broker/active.ts`,\n * augmented there with the `config` its closure was built with):\n *\n *  - {@link enrollSeed} — two-phase commit (I9): create-if-absent CAS the\n *    seed (I4), then register its derived proof key with the broker host,\n *    then (only on a 2xx) mark the record `registered: true`. A seed\n *    persisted whose `/enroll` POST failed stays `registered: false` so a\n *    later `credentialSource()` fails fast instead of degrading into an\n *    opaque `BrokerProofError` (I9/V23).\n *  - {@link rotateSeed} — quiesce-then-swap (I5): mint a fresh seed,\n *    register-new-first, THEN overwrite the local record — closing the\n *    torn-proof window a naive local-overwrite-then-register order would\n *    open. The single-flight cache quiesce itself (await in-flight, bump\n *    epoch) is the caller's job (`with-party/broker/active.ts`) since the\n *    cache lives in that closure, not here.\n *  - {@link mintStoreCredentials} — the challenge/response round trip\n *    (`/challenge` then `/credentials`) that produces one `StoreCredentials`\n *    value; the single-flight cache wrapping it lives in `active.ts`.\n *\n * First-seed creation calls `ensureCollectionDEK`, which throws\n * (`ValidationError`) when the keyring's KEK is `null` (PIN quick-resume /\n * session-restore) — this module intercepts that and re-surfaces it as\n * {@link BrokerEnrolmentError} (R-B8/I3): *enrol* needs the KEK; *use* of an\n * already-enrolled seed needs only the DEK.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope, StoreCredentials } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { ensureCollectionDEK } from '../../with-party/team/keyring.js'\nimport { BROKER_COLLECTION } from '../../with-party/team/reserved-secret-collections.js'\nimport {\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  bufferToBase64,\n  base64ToBuffer,\n  deriveBrokerProofBits,\n  computeBrokerProof,\n} from '../../kernel/enclave/index.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  PermissionDeniedError,\n  ValidationError,\n  isConflictError,\n  NetworkError,\n  BrokerEnrolmentError,\n  BrokerProofError,\n} from '../../kernel/errors.js'\nimport type { BrokerSeedCtx, BrokerConfig } from '../../port/with/broker-strategy.js'\n\n/** The `_broker/<brokerId>` record payload (spec §3). */\nexport interface BrokerSeedRecord {\n  readonly brokerId: string\n  /** base64(32 random bytes). */\n  readonly seed: string\n  readonly endpoint: string\n  readonly createdAt: string\n  /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */\n  readonly registered: boolean\n}\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // Custodian is INTENTIONALLY excluded — the _broker seed is transport-auth\n  // material (mints cloud store credentials), not the custodian's\n  // operational data scope. Same rationale as _sync_credentials' FR-6 note.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Credential-broker operations require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// `ensureCollectionDEK` only dedupes concurrent first-time DEK creates WITHIN one\n// closure instance — since every call site here asks for a fresh closure, two\n// concurrent `enrollSeed()` calls sharing the same (store, vault, keyring) would\n// otherwise each mint a DIFFERENT `_broker` DEK and race `persistKeyring`, leaving\n// the seed record encrypted under a DEK the keyring no longer holds (TamperedError\n// on the next read). Dedupe across calls here, keyed by store identity + vault\n// (V20 — the CAS enrol vector actually exercises this).\nconst inFlightDekByStore = new WeakMap<NoydbStore, Map<string, Promise<EnclaveKey>>>()\n\nasync function brokerDek(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<EnclaveKey> {\n  const existing = keyring.deks.get(BROKER_COLLECTION)\n  if (existing) return existing\n\n  let perStore = inFlightDekByStore.get(store)\n  if (!perStore) { perStore = new Map(); inFlightDekByStore.set(store, perStore) }\n  const pending = perStore.get(vault)\n  if (pending) return pending\n\n  const promise = (async () => {\n    try {\n      const getDek = await ensureCollectionDEK(store, vault, keyring)\n      return await getDek(BROKER_COLLECTION)\n    } catch (err) {\n      if (err instanceof ValidationError) {\n        throw new BrokerEnrolmentError(\n          'enroll()/rotate() need the KEK to provision the _broker DEK on first use — ' +\n            're-authenticate at tier 1 (secret) before enrolling. Using an already-' +\n            'enrolled seed (credentialSource()) needs only the DEK.',\n        )\n      }\n      throw err\n    }\n  })()\n  perStore.set(vault, promise)\n  try {\n    return await promise\n  } finally {\n    perStore.delete(vault)\n  }\n}\n\nasync function readRecord(\n  store: NoydbStore,\n  vault: string,\n  brokerId: string,\n  dek: EnclaveKey,\n): Promise<{ envelope: EncryptedEnvelope; record: BrokerSeedRecord } | null> {\n  const envelope = await store.get(vault, BROKER_COLLECTION, brokerId)\n  if (!envelope) return null\n  const record = JSON.parse(await openEnvelopeJson(envelope, dek)) as BrokerSeedRecord\n  return { envelope, record }\n}\n\nasync function persistRecord(\n  store: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  dek: EnclaveKey,\n  record: BrokerSeedRecord,\n  expectedVersion: number,\n): Promise<void> {\n  const body = await writeEnvelopeBody(JSON.stringify(record), dek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: expectedVersion + 1,\n    _ts: new Date().toISOString(),\n    ...body,\n    _by: keyring.userId,\n  }\n  await store.put(vault, BROKER_COLLECTION, record.brokerId, envelope, expectedVersion)\n}\n\ninterface SeedState {\n  readonly seedBytes: Uint8Array\n  readonly record: BrokerSeedRecord\n  readonly dek: EnclaveKey\n  readonly version: number\n}\n\n/** Create-if-absent CAS (I4/V20): a concurrent enrol that loses the race\n *  re-reads the winner's seed instead of persisting a second one. */\nasync function ensureSeedRecord(store: NoydbStore, vault: string, keyring: UnlockedKeyring, config: BrokerConfig): Promise<SeedState> {\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (existing) {\n    return { seedBytes: base64ToBuffer(existing.record.seed), record: existing.record, dek, version: existing.envelope._v }\n  }\n\n  const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(seedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: false,\n  }\n  try {\n    await persistRecord(store, vault, keyring, dek, record, 0)\n    return { seedBytes, record, dek, version: 1 }\n  } catch (err) {\n    if (!(isConflictError(err))) throw err\n    const winner = await readRecord(store, vault, config.brokerId, dek)\n    if (!winner) throw err\n    return { seedBytes: base64ToBuffer(winner.record.seed), record: winner.record, dek, version: winner.envelope._v }\n  }\n}\n\nasync function postEnroll(config: BrokerConfig, vault: string, proofBits: Uint8Array): Promise<void> {\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const attestation = config.attestation ? await config.attestation() : undefined\n  let res: Response\n  try {\n    res = await fetchFn(`${config.endpoint}/enroll`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        ...(attestation !== undefined ? { authorization: `Bearer ${attestation}` } : {}),\n      },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, proofKey: bufferToBase64(proofBits) }),\n    })\n  } catch (err) {\n    throw new BrokerEnrolmentError(`broker /enroll request failed: ${(err as Error).message}`)\n  }\n  if (!res.ok) {\n    throw new BrokerEnrolmentError(`broker refused enrolment (status ${res.status}) — attestation likely missing or invalid`)\n  }\n}\n\n/**\n * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`\n * seed (I4), derive+register its proof key with the broker host, and only\n * on a 2xx mark the record `registered: true`. Requires owner/admin role\n * and (for first-seed creation only) the KEK.\n */\nexport async function enrollSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  const { seedBytes, record, dek, version } = await ensureSeedRecord(store, vault, keyring, config)\n  if (record.registered) {\n    seedBytes.fill(0)\n    return\n  }\n\n  const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId)\n  seedBytes.fill(0)\n  try {\n    await postEnroll(config, vault, proofBits)\n  } finally {\n    proofBits.fill(0)\n  }\n\n  try {\n    await persistRecord(store, vault, keyring, dek, { ...record, registered: true }, version)\n  } catch (err) {\n    if (isConflictError(err)) {\n      const latest = await readRecord(store, vault, config.brokerId, dek)\n      if (latest?.record.registered) return // a concurrent enrol already committed the same outcome\n    }\n    throw err\n  }\n}\n\n/**\n * Rotate (quiesce-then-swap — I5): mint a fresh seed, register its proof\n * key with the broker host FIRST, then overwrite the local `_broker`\n * record. The broker host is expected to accept both the old and new\n * registration for a short grace window, so an in-flight proof computed\n * under the old key (from before rotation started) still verifies. Cache\n * quiescing (awaiting any in-flight round-trip, bumping the refresh-cache\n * epoch) is the caller's job — `with-party/broker/active.ts` — since the\n * cache lives in that closure, not here.\n */\nexport async function rotateSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (!existing) {\n    // Nothing to rotate yet — behaves like a first enrol.\n    await enrollSeed(ctx)\n    return\n  }\n\n  const newSeedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const newProofBits = await deriveBrokerProofBits(newSeedBytes, vault, config.brokerId)\n  try {\n    await postEnroll(config, vault, newProofBits)\n  } finally {\n    newProofBits.fill(0)\n  }\n\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(newSeedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: true,\n  }\n  newSeedBytes.fill(0)\n  await persistRecord(store, vault, keyring, dek, record, existing.envelope._v)\n}\n\n/**\n * The challenge/response round trip: `POST /challenge`, derive+sign the\n * proof from the decrypted seed, `POST /credentials`. One network round\n * trip per call — the single-flight/cache wrapping lives in `active.ts`.\n *\n * Fails fast with {@link BrokerEnrolmentError} if the seed hasn't completed\n * enrolment yet (`registered !== true` — I9/V23), never degrading into an\n * opaque {@link BrokerProofError}.\n */\nexport async function mintStoreCredentials(ctx: BrokerSeedCtx, profile?: string): Promise<StoreCredentials> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const found = await readRecord(store, vault, config.brokerId, dek)\n  if (!found) throw new BrokerEnrolmentError(`No _broker seed enrolled for brokerId \"${config.brokerId}\" — call enroll() first.`)\n  if (!found.record.registered) {\n    throw new BrokerEnrolmentError(\n      `The _broker seed for \"${config.brokerId}\" has not completed enrolment with the broker host — call enroll() again.`,\n    )\n  }\n\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const endpointOrigin = new URL(config.endpoint).origin\n\n  let challengeRes: Response\n  try {\n    challengeRes = await fetchFn(`${config.endpoint}/challenge`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /challenge request failed: ${(err as Error).message}`)\n  }\n  if (!challengeRes.ok) throw new NetworkError(`broker /challenge failed with status ${challengeRes.status}`)\n  const { challenge, expiresAt } = (await challengeRes.json()) as { challenge: string; expiresAt: string }\n\n  const seedBytes = base64ToBuffer(found.record.seed)\n  const proof = await computeBrokerProof(seedBytes, vault, config.brokerId, { endpointOrigin, profile, challenge, expiresAt })\n\n  let credsRes: Response\n  try {\n    credsRes = await fetchFn(`${config.endpoint}/credentials`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, challenge, proof, ...(profile !== undefined ? { profile } : {}) }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /credentials request failed: ${(err as Error).message}`)\n  }\n  if (credsRes.status === 401 || credsRes.status === 403) throw new BrokerProofError('broker rejected the challenge proof')\n  if (!credsRes.ok) throw new NetworkError(`broker /credentials failed with status ${credsRes.status}`)\n  return (await credsRes.json()) as StoreCredentials\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,SAAS,mBAAmB,SAAgC;AAI1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,4EAA4E,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AASA,IAAM,qBAAqB,oBAAI,QAAsD;AAErF,eAAe,UAAU,OAAmB,OAAe,SAA+C;AACxG,QAAM,WAAW,QAAQ,KAAK,IAAI,iBAAiB;AACnD,MAAI,SAAU,QAAO;AAErB,MAAI,WAAW,mBAAmB,IAAI,KAAK;AAC3C,MAAI,CAAC,UAAU;AAAE,eAAW,oBAAI,IAAI;AAAG,uBAAmB,IAAI,OAAO,QAAQ;AAAA,EAAE;AAC/E,QAAM,UAAU,SAAS,IAAI,KAAK;AAClC,MAAI,QAAS,QAAO;AAEpB,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,oBAAoB,OAAO,OAAO,OAAO;AAC9D,aAAO,MAAM,OAAO,iBAAiB;AAAA,IACvC,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB;AAClC,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,GAAG;AACH,WAAS,IAAI,OAAO,OAAO;AAC3B,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,aAAS,OAAO,KAAK;AAAA,EACvB;AACF;AAEA,eAAe,WACb,OACA,OACA,UACA,KAC2E;AAC3E,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,mBAAmB,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,UAAU,GAAG,CAAC;AAC/D,SAAO,EAAE,UAAU,OAAO;AAC5B;AAEA,eAAe,cACb,OACA,OACA,SACA,KACA,QACA,iBACe;AACf,QAAM,OAAO,MAAM,kBAAkB,KAAK,UAAU,MAAM,GAAG,GAAG;AAChE,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI,kBAAkB;AAAA,IACtB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,GAAG;AAAA,IACH,KAAK,QAAQ;AAAA,EACf;AACA,QAAM,MAAM,IAAI,OAAO,mBAAmB,OAAO,UAAU,UAAU,eAAe;AACtF;AAWA,eAAe,iBAAiB,OAAmB,OAAe,SAA0B,QAA0C;AACpI,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,UAAU;AACZ,WAAO,EAAE,WAAW,eAAe,SAAS,OAAO,IAAI,GAAG,QAAQ,SAAS,QAAQ,KAAK,SAAS,SAAS,SAAS,GAAG;AAAA,EACxH;AAEA,QAAM,YAAY,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACtE,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,SAAS;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC;AACzD,WAAO,EAAE,WAAW,QAAQ,KAAK,SAAS,EAAE;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAI,CAAE,gBAAgB,GAAG,EAAI,OAAM;AACnC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,EAAE,WAAW,eAAe,OAAO,OAAO,IAAI,GAAG,QAAQ,OAAO,QAAQ,KAAK,SAAS,OAAO,SAAS,GAAG;AAAA,EAClH;AACF;AAEA,eAAe,WAAW,QAAsB,OAAe,WAAsC;AACnG,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,cAAc,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI;AACtE,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,WAAW;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,gBAAgB,SAAY,EAAE,eAAe,UAAU,WAAW,GAAG,IAAI,CAAC;AAAA,MAChF;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,UAAU,eAAe,SAAS,EAAE,CAAC;AAAA,IACzG,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,qBAAqB,kCAAmC,IAAc,OAAO,EAAE;AAAA,EAC3F;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,qBAAqB,oCAAoC,IAAI,MAAM,gDAA2C;AAAA,EAC1H;AACF;AAQA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,QAAM,EAAE,WAAW,QAAQ,KAAK,QAAQ,IAAI,MAAM,iBAAiB,OAAO,OAAO,SAAS,MAAM;AAChG,MAAI,OAAO,YAAY;AACrB,cAAU,KAAK,CAAC;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,sBAAsB,WAAW,OAAO,OAAO,QAAQ;AAC/E,YAAU,KAAK,CAAC;AAChB,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,SAAS;AAAA,EAC3C,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,EAAE,GAAG,QAAQ,YAAY,KAAK,GAAG,OAAO;AAAA,EAC1F,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,UAAI,QAAQ,OAAO,WAAY;AAAA,IACjC;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,CAAC,UAAU;AAEb,UAAM,WAAW,GAAG;AACpB;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACzE,QAAM,eAAe,MAAM,sBAAsB,cAAc,OAAO,OAAO,QAAQ;AACrF,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,YAAY;AAAA,EAC9C,UAAE;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAEA,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,YAAY;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,eAAa,KAAK,CAAC;AACnB,QAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,SAAS,SAAS,EAAE;AAC9E;AAWA,eAAsB,qBAAqB,KAAoB,SAA6C;AAC1G,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,QAAQ,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACjE,MAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB,0CAA0C,OAAO,QAAQ,+BAA0B;AAC9H,MAAI,CAAC,MAAM,OAAO,YAAY;AAC5B,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,QAAQ;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,iBAAiB,IAAI,IAAI,OAAO,QAAQ,EAAE;AAEhD,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,QAAQ,GAAG,OAAO,QAAQ,cAAc;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,SAAS,CAAC;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,qCAAsC,IAAc,OAAO,EAAE;AAAA,EACtF;AACA,MAAI,CAAC,aAAa,GAAI,OAAM,IAAI,aAAa,wCAAwC,aAAa,MAAM,EAAE;AAC1G,QAAM,EAAE,WAAW,UAAU,IAAK,MAAM,aAAa,KAAK;AAE1D,QAAM,YAAY,eAAe,MAAM,OAAO,IAAI;AAClD,QAAM,QAAQ,MAAM,mBAAmB,WAAW,OAAO,OAAO,UAAU,EAAE,gBAAgB,SAAS,WAAW,UAAU,CAAC;AAE3H,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,OAAO,QAAQ,gBAAgB;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,WAAW,OAAO,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AAAA,IACrI,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,uCAAwC,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,OAAM,IAAI,iBAAiB,qCAAqC;AACxH,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,aAAa,0CAA0C,SAAS,MAAM,EAAE;AACpG,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}

package/dist/sequence/index.js

@@ -5,18 +5,18 @@ import {
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "../chunk-EBKCYQ2D.js";
-import "../chunk-RZPOZPZU.js";
-import "../chunk-VH6SOCXH.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+} from "../chunk-RQILGK3N.js";
+import "../chunk-623QEHDB.js";
+import "../chunk-EFJAAFBW.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
-import "../chunk-GZACYEOB.js";
+import "../chunk-RPWMDIGK.js";
+import "../chunk-77AEMXFA.js";
 import {
   SequenceNotEnabledError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_SEQUENCE,

package/dist/session/index.js

@@ -12,24 +12,24 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-X4MVWPHV.js";
+} from "../chunk-UC5Y7OEJ.js";
 import {
   NO_SESSION
 } from "../chunk-VKQCVU2Z.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-RZPOZPZU.js";
-import "../chunk-VH6SOCXH.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+import "../chunk-623QEHDB.js";
+import "../chunk-EFJAAFBW.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
-import "../chunk-GZACYEOB.js";
+import "../chunk-RPWMDIGK.js";
+import "../chunk-77AEMXFA.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/session/active.ts

package/dist/shadow/index.js

@@ -1,11 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-55LX6FSX.js";
+} from "../chunk-NJHQE4LT.js";
 import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
-import "../chunk-QZWTRENR.js";
+import "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/shadow/active.ts

package/dist/signer-XLUKCCH3.js

@@ -0,0 +1,25 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-NZEGQWQ5.js";
+import "./chunk-623QEHDB.js";
+import "./chunk-EFJAAFBW.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-RPWMDIGK.js";
+import "./chunk-77AEMXFA.js";
+import "./chunk-AR5D76T2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-XLUKCCH3.js.map

package/dist/snapshots/index.js

@@ -4,19 +4,19 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-SGQ4N5FS.js";
-import "../chunk-JIDLU57U.js";
-import "../chunk-RZPOZPZU.js";
-import "../chunk-VH6SOCXH.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+} from "../chunk-KDWBVCIX.js";
+import "../chunk-FHK6WWUE.js";
+import "../chunk-623QEHDB.js";
+import "../chunk-EFJAAFBW.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
-import "../chunk-GZACYEOB.js";
+import "../chunk-RPWMDIGK.js";
+import "../chunk-77AEMXFA.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts

package/dist/{stale-JOE7GBAE.js → stale-U3WO5MYN.js}

@@ -6,17 +6,17 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-IMRB2C4O.js";
+} from "./chunk-IQ423YMK.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-RZPOZPZU.js";
-import "./chunk-VH6SOCXH.js";
-import "./chunk-35NMVJ7I.js";
-import "./chunk-NFZGZ4AK.js";
-import "./chunk-QJNCB5SK.js";
+import "./chunk-623QEHDB.js";
+import "./chunk-EFJAAFBW.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-AKKRXT23.js";
-import "./chunk-GZACYEOB.js";
-import "./chunk-QZWTRENR.js";
+import "./chunk-RPWMDIGK.js";
+import "./chunk-77AEMXFA.js";
+import "./chunk-AR5D76T2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MV_STALE_COLLECTION,
@@ -27,4 +27,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-JOE7GBAE.js.map
+//# sourceMappingURL=stale-U3WO5MYN.js.map

package/dist/storage-IQONEOYY.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-Q6MXHDSE.js";
+import "./chunk-623QEHDB.js";
+import "./chunk-EFJAAFBW.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-RPWMDIGK.js";
+import "./chunk-77AEMXFA.js";
+import "./chunk-AR5D76T2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-IQONEOYY.js.map

package/dist/{store-coordination-provider-5LX2UFU2.js → store-coordination-provider-AHGFEMFA.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-6M2I3DKF.js";
+} from "./chunk-WK7ULBTP.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-GZACYEOB.js";
+} from "./chunk-77AEMXFA.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-5LX2UFU2.js.map
+//# sourceMappingURL=store-coordination-provider-AHGFEMFA.js.map

package/dist/sync/index.js

@@ -1,25 +1,24 @@
-import {
-  NO_SYNC
-} from "../chunk-EP5L47XV.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-BXHMZ2XW.js";
-import "../chunk-MTJLOC3Y.js";
-import "../chunk-EZNTORXE.js";
-import "../chunk-RZPOZPZU.js";
-import "../chunk-VH6SOCXH.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+} from "../chunk-WFYKIDCS.js";
+import {
+  NO_SYNC
+} from "../chunk-55LKVALY.js";
+import "../chunk-SBGXQK5I.js";
+import "../chunk-623QEHDB.js";
+import "../chunk-EFJAAFBW.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
-import "../chunk-GZACYEOB.js";
-import "../chunk-QZWTRENR.js";
+import "../chunk-RPWMDIGK.js";
+import "../chunk-77AEMXFA.js";
+import "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 
-// src/with-party/team/sync-active.ts
+// src/with-sync/active.ts
 function withSync() {
   return {
     buildSyncEngine(opts) {

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.js

@@ -1,11 +1,6 @@
 import {
-  credentialStatus,
-  deleteCredential,
-  getCredential,
-  listCredentials,
-  putCredential,
   withTeam
-} from "../chunk-SHYIA73K.js";
+} from "../chunk-US2AR4BI.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -34,17 +29,9 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-C25JXSOR.js";
-import "../chunk-56IIVAEO.js";
+} from "../chunk-IHYSIPEK.js";
+import "../chunk-Q2SEJMP2.js";
 import {
-  PresenceHandle,
-  SyncEngine,
-  SyncTransaction
-} from "../chunk-BXHMZ2XW.js";
-import "../chunk-MTJLOC3Y.js";
-import "../chunk-EZNTORXE.js";
-import {
-  SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
   changeSecret,
   createOwnerKeyring,
@@ -60,34 +47,28 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-KPXM4WO6.js";
-import "../chunk-WZ3NCMK6.js";
-import "../chunk-PTHKZWEH.js";
-import "../chunk-RZPOZPZU.js";
-import "../chunk-VH6SOCXH.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+} from "../chunk-FZAP4JNC.js";
+import "../chunk-6PFST3FC.js";
+import "../chunk-PZRYKOKP.js";
+import "../chunk-623QEHDB.js";
+import "../chunk-EFJAAFBW.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
-import "../chunk-GZACYEOB.js";
+import "../chunk-RPWMDIGK.js";
+import "../chunk-77AEMXFA.js";
 import {
   TeamNotEnabledError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,
-  PresenceHandle,
-  SYNC_CREDENTIALS_COLLECTION,
-  SyncEngine,
-  SyncTransaction,
   TeamNotEnabledError,
   buildRecipientKeyringFile,
   burnPaperRecoveryEntry,
   changeSecret,
   createOwnerKeyring,
-  credentialStatus,
-  deleteCredential,
   deriveMagicLinkContentKey,
   describeAllUsersAuth,
   describeAuthConfig,
@@ -98,12 +79,10 @@ export {
   evaluateExportCapability,
   evaluateImportCapability,
   findAuthenticator,
-  getCredential,
   grant,
   hasExportCapability,
   hasImportCapability,
   isMagicLinkGrantExpired,
-  listCredentials,
   listMagicLinkGrants,
   listUsers,
   listUsersWithEnvelopes,
@@ -113,7 +92,6 @@ export {
   mintPaperRecoveryEntry,
   mintWrappedDeksBlob,
   persistKeyring,
-  putCredential,
   readMagicLinkGrantRecord,
   recoverSecret,
   recoverUser,

package/dist/tiers/index.js

@@ -11,19 +11,19 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-6R6Q3MRN.js";
-import "../chunk-PTHKZWEH.js";
-import "../chunk-RZPOZPZU.js";
-import "../chunk-VH6SOCXH.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+} from "../chunk-QITP2JGX.js";
+import "../chunk-PZRYKOKP.js";
+import "../chunk-623QEHDB.js";
+import "../chunk-EFJAAFBW.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
-import "../chunk-GZACYEOB.js";
+import "../chunk-RPWMDIGK.js";
+import "../chunk-77AEMXFA.js";
 import {
   TiersNotEnabledError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/transactions/index.js

@@ -3,16 +3,16 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-NGSJZFGL.js";
+} from "../chunk-NWK6SVBM.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-QZWTRENR.js";
+import "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-RM7XWQDU.js"));
+var loadGuardExecutor = lazy(() => import("../executor-YBK3I2OT.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-QZWTRENR.js";
+} from "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-7XWHJWUN.js → verify-JEIXSK5U.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-35NMVJ7I.js";
+} from "./chunk-MYSNNMJ3.js";
 import {
   dualReadSealedSlot
-} from "./chunk-NFZGZ4AK.js";
+} from "./chunk-L67H6FAQ.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-7XWHJWUN.js.map
+//# sourceMappingURL=verify-JEIXSK5U.js.map

package/dist/walk-BF36V4SR.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-ECGDJU5R.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-3LYMOSY7.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-Q6MXHDSE.js";
+import "./chunk-623QEHDB.js";
+import "./chunk-EFJAAFBW.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-RPWMDIGK.js";
+import "./chunk-77AEMXFA.js";
+import "./chunk-AR5D76T2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-BF36V4SR.js.map

package/dist/with-commit/tx/atomic-eligibility.d.ts

@@ -0,0 +1,49 @@
+/**
+ * #893/#906-prep — the atomic-commit eligibility gate.
+ *
+ * `runTransaction` (Task 5) consults `canCommitAtomically` right after the
+ * body returns, to decide whether the whole staged batch can be prepared and
+ * submitted as ONE `store.tx(ops)` call instead of the per-op abortable
+ * path (Phase 1 pre-flight + Phase 2 Collection-layer execute + Phase 3
+ * best-effort revert — see `transaction.ts`'s module doc).
+ *
+ * Pure decision logic: no side effects, no store reads. Every input is
+ * already sitting on `db` / `ctx`.
+ *
+ * ALL of the following must hold. (Commit-time changeset invariants are NOT a
+ * condition: that phase lives after Phase 2 in `runTransaction` and runs
+ * unchanged on either path — a failing invariant reverts the atomic batch
+ * through the same `ctx._executed` plan.)
+ *
+ *  1. The store declares `capabilities.txAtomic === true` AND implements
+ *     `tx()`. Both — mirrors the pairing rule `bestEffortRevert` already
+ *     enforces (`kernel/best-effort-revert.ts:78`): an undeclared `tx()` is
+ *     never used, even if present.
+ *  2. Not an amendment transaction (`ctx._amendment === false`) — amendments
+ *     need the guard-registry change-set + invariant machinery the atomic
+ *     path skips entirely.
+ *  3. No `(vault, collection, id)` is touched twice in the batch. The
+ *     abortable path's Phase 1 snapshots each key once and Phase 2 replays
+ *     every op against that same snapshot in order; a single `store.tx()`
+ *     write set can't express "this key changes twice in sequence."
+ *  4. Every touched collection reports `_txAtomicSafe(op.type)` — see that
+ *     method's doc comment on `Collection` for what it excludes and why.
+ *     #931: of the wrapper-level write signals, only a live `onBeforeWrite`
+ *     hook still excludes — it may REFUSE a write, which only
+ *     `Collection.put()`/`.delete()` honors. After-hooks and the
+ *     `afterPut`/`afterDelete` observe bus are refusal-free observers, so
+ *     the atomic path fires them itself per leg post-finalize
+ *     (`Collection._fireAtomicAfterWrite`) instead of forfeiting the batch.
+ *     Delete gates on the enforcer's `_deleteCascadesPossible(name)` (#922):
+ *     `Vault.enforceRefsOnDelete` cascades from THREE sources (lookup-ref
+ *     edges, classic inbound refs, managed-link `onDelete`), and the Vault
+ *     predicate unions exactly those three — a `getInbound`-only check would
+ *     be narrower and wrongly admit unsafe atomic deletes, because
+ *     `_prepareDelete` runs the cascades DURING prepare (see
+ *     `with-shape/links/vault-facade.ts` `enforceRefsOnDelete`).
+ *
+ * @internal
+ */
+import type { Noydb } from '../../kernel/noydb.js';
+import type { TxContext } from './transaction.js';
+export declare function canCommitAtomically(db: Noydb, ctx: TxContext): boolean;

package/dist/with-commit/tx/transaction.d.ts

@@ -32,15 +32,26 @@
  *    ledger is NOT rewritten — audit history preserves the partial
  *    commit and the revert.
  *
- * **Crash window.** Steps 2–3 are not a storage-layer transaction —
- * if the process dies between two executed ops, the on-disk state is
- * partial. True all-or-nothing atomicity requires a store that
- * implements `NoydbStore.tx()` (DynamoDB `TransactWriteItems`,
- * IndexedDB `readwrite` transaction, …). This executor declares
- * that future integration point via the `tx?()` method + the
- * `StoreCapabilities.txAtomic` bit, but does not yet delegate
- * to it — the cascade into `Fork · Stores` tracks the per-adapter
- * wire-up.
+ * **Atomic delegation (#906).** Steps 1–3 above describe the OCC
+ * fallback. When the store declares `StoreCapabilities.txAtomic` AND
+ * implements `tx()`, AND the staged batch is statically safe
+ * (`canCommitAtomically` — see `atomic-eligibility.ts`), the commit
+ * instead: prepares every op through `Collection._preparePut` /
+ * `_prepareDelete` (encrypt, resolve the prior version, mint the #589
+ * marker — no observable side effect), submits the whole write set as
+ * ONE `store.tx(ops)` call with a per-leg `expectedVersion`, then
+ * finalizes each op in staged order. The visible difference: history
+ * snapshots, ledger entries and change events all fire AFTER the bytes
+ * are durable, instead of interleaving per op.
+ *
+ * **Crash window.** On the OCC fallback, steps 2–3 are not a
+ * storage-layer transaction — if the process dies between two executed
+ * ops, the on-disk state is partial. The atomic path above closes that
+ * window for the write set itself (`to-memory` and the SQL stores in
+ * `noy-db-to` implement `tx()`); a crash between the batch landing and
+ * the finalize loop finishing still leaves per-op side effects (history,
+ * ledger, cache) incomplete. Stores that cannot commit a batch
+ * atomically (file, S3) omit `tx()` and keep the fallback.
  *
  * ## Not covered
  *
@@ -210,3 +221,5 @@ export declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Prom
  * combined list in reverse on rollback.
  */
 export declare function revertExecuted(executed: ReadonlyArray<ExecutedOp>, store: Noydb['_store'], db?: Noydb): Promise<void>;
+/** @internal — shared (vault, collection, id) key shape; also used by `atomic-eligibility.ts`'s duplicate-key scan. */
+export declare function keyOf(op: StagedOp): string;

package/dist/with-party/broker/seed.d.ts

@@ -1,6 +1,6 @@
 /**
  * `_broker` reserved-collection seed lifecycle (#479, credential-broker
- * spec §2/§3). Modeled on `with-party/team/sync-credentials.ts`: a
+ * spec §2/§3). Modeled on `with-sync/credentials.ts`: a
  * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under
  * the collection's own DEK, `requireAdminAccess` role gate (owner/admin
  * only — custodian intentionally excluded, same rationale as