@noy-db/hub 0.4.0 → 0.5.0

package/dist/{chunk-PTHKZWEH.js → chunk-PZRYKOKP.js}

@@ -1,6 +1,6 @@
 import {
   TierNotGrantedError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-party/team/tiers.ts
 function dekKey(collection, tier) {
@@ -19,4 +19,4 @@ export {
   dekKey,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-PTHKZWEH.js.map
+//# sourceMappingURL=chunk-PZRYKOKP.js.map

package/dist/{chunk-KD4HGBJV.js → chunk-Q6MXHDSE.js}

@@ -1,9 +1,9 @@
 import {
   openEnvelopeJson
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   encrypt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-77AEMXFA.js";
@@ -46,4 +46,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-KD4HGBJV.js.map
+//# sourceMappingURL=chunk-Q6MXHDSE.js.map

package/dist/{chunk-RQ4ZI4ZI.js → chunk-QITP2JGX.js}

@@ -1,11 +1,11 @@
 import {
   assertTierAccess,
   dekKey
-} from "./chunk-PTHKZWEH.js";
+} from "./chunk-PZRYKOKP.js";
 import {
   applyRewrappedBody,
   rewrapBodyToDek
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   isDeleteMarker,
   isTombstoneShape
@@ -14,7 +14,7 @@ import {
   decrypt,
   encrypt,
   unwrapCek
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-77AEMXFA.js";
@@ -23,7 +23,7 @@ import {
   TierDemoteDeniedError,
   TiersNotEnabledError,
   UnsupportedTierCompositionError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -378,4 +378,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-RQ4ZI4ZI.js.map
+//# sourceMappingURL=chunk-QITP2JGX.js.map

package/dist/{chunk-WBKZUO5V.js → chunk-QMCWYN6O.js}

@@ -1,6 +1,6 @@
 import {
   applyJoins
-} from "./chunk-V6UQZA2H.js";
+} from "./chunk-PKBONLCP.js";
 import {
   NO_REDUCE
 } from "./chunk-YMUFFJCO.js";
@@ -17,7 +17,7 @@ import {
   CrossJoinTooLargeError,
   DanglingReferenceError,
   FieldNotQueryableError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/kernel/query/live.ts
 function buildLiveQuery(recompute, upstreams) {
@@ -1517,4 +1517,4 @@ export {
   executePlan,
   ScanBuilder
 };
-//# sourceMappingURL=chunk-WBKZUO5V.js.map
+//# sourceMappingURL=chunk-QMCWYN6O.js.map

package/dist/{chunk-4ZKNC6A6.js → chunk-QQL6XPPG.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCycleError,
   MaterializedViewCycleError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/kernel/via/graph.ts
 var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
@@ -341,4 +341,4 @@ export {
   DEFAULT_POSTURE,
   ViaGraph
 };
-//# sourceMappingURL=chunk-4ZKNC6A6.js.map
+//# sourceMappingURL=chunk-QQL6XPPG.js.map

package/dist/{chunk-TG634KCO.js → chunk-QTMZDMJ6.js}

@@ -1,7 +1,7 @@
 import {
   CargoNotEnabledError,
   QuiesceTimeoutError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -60,4 +60,4 @@ export {
   isQuorum,
   runDrainBarrier
 };
-//# sourceMappingURL=chunk-TG634KCO.js.map
+//# sourceMappingURL=chunk-QTMZDMJ6.js.map

package/dist/{chunk-AT2JJEKJ.js → chunk-RM4FIXY2.js}

@@ -1,12 +1,12 @@
 import {
   ViaGraph
-} from "./chunk-4ZKNC6A6.js";
+} from "./chunk-QQL6XPPG.js";
 import {
   sha256Hex
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   DerivationCycleError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-formula/derivations/strategy-hash.ts
 async function computeStrategyHash(source, outputKeys, derive, sources) {
@@ -161,4 +161,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-AT2JJEKJ.js.map
+//# sourceMappingURL=chunk-RM4FIXY2.js.map

package/dist/{chunk-AKKRXT23.js → chunk-RPWMDIGK.js}

@@ -2,7 +2,7 @@ import {
   DecryptionError,
   InvalidKeyError,
   TamperedError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/kernel/enclave/crypto.ts
 var PBKDF2_ITERATIONS = 6e5;
@@ -401,4 +401,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-AKKRXT23.js.map
+//# sourceMappingURL=chunk-RPWMDIGK.js.map

package/dist/{chunk-NBXFCQX4.js → chunk-RQILGK3N.js}

@@ -1,19 +1,19 @@
 import {
   openEnvelopeJson
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   encrypt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-77AEMXFA.js";
 import {
-  ConflictError,
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
-  ValidationError
-} from "./chunk-QZWTRENR.js";
+  ValidationError,
+  isConflictError
+} from "./chunk-AR5D76T2.js";
 
 // src/with-commit/sequence/active.ts
 function withSequence() {
@@ -154,7 +154,7 @@ var SequenceStore = class {
         await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
         return nextValue;
       } catch (err) {
-        if (err instanceof ConflictError) {
+        if (isConflictError(err)) {
           lastConflict = err;
           if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
           continue;
@@ -178,7 +178,7 @@ var SequenceStore = class {
         await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
         return;
       } catch (err) {
-        if (err instanceof ConflictError) {
+        if (isConflictError(err)) {
           lastConflict = err;
           if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
           continue;
@@ -199,4 +199,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-NBXFCQX4.js.map
+//# sourceMappingURL=chunk-RQILGK3N.js.map

package/dist/chunk-RQILGK3N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/sequence/active.ts","../src/with-commit/sequence/strategy.ts","../src/with-commit/sequence/index.ts"],"sourcesContent":["/**\n * Enable the atomic-sequence capability.\n * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make\n * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The\n * {@link SequenceStore} CAS engine is statically imported here, so it is pulled\n * into the bundle only when `withSequence()` is referenced (the floor never\n * imports it).\n */\nimport type { SequenceStrategy } from './strategy.js'\nimport { SequenceStore } from './index.js'\n\nexport function withSequence(): SequenceStrategy {\n  return {\n    createStore(opts) {\n      return new SequenceStore(opts)\n    },\n  }\n}\n","/**\n * Sequence capability strategy — the single on-demand factory the vault routes\n * `vault.sequence()` through to build its atomic-CAS {@link SequenceStore}. The\n * active engine ({@link withSequence}) constructs the real store (kept out of\n * the floor bundle — the store class is reached only via the opt-in\n * `active.ts` chunk); {@link NO_SEQUENCE} throws. The vault always assembles the\n * per-call {@link SequenceStoreOptions} and delegates here, so an un-opted-in\n * caller hits `NO_SEQUENCE`'s throw at `vault.sequence()`.\n *\n * Note: `vault.sequence()` is synchronous, so the factory is a plain (sync)\n * constructor — the engine is tree-shaken by reachability (only `withSequence()`\n * pulls `active.ts`, which statically imports the store), not by a dynamic\n * import. Deferred-numbering series (`withDeferredNumbering`) are a distinct\n * capability and are NOT routed through this strategy.\n * @internal\n */\nimport type { SequenceStore, SequenceStoreOptions } from './index.js'\nimport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SequenceStrategy {\n  createStore(opts: SequenceStoreOptions): SequenceStore\n}\n\n/**\n * No-op stub — the floor default. The capability factory throws\n * {@link SequenceNotEnabledError}; opt in with `sequenceStrategy: withSequence()`\n * in createNoydb. @internal\n */\nexport const NO_SEQUENCE: SequenceStrategy = {\n  createStore(): SequenceStore {\n    throw new SequenceNotEnabledError()\n  },\n}\n","/**\n * Atomic sequence primitive — online-coordinated gap-free numbering.\n *\n * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no\n * gaps and no duplicates, even under concurrent callers. Each named\n * sequence is an independent counter record at `_sequences/<name>`,\n * incremented with an optimistic compare-and-swap retry loop — the same\n * proven pattern as the ledger head (`history/ledger/store.ts`).\n *\n * **Explicitly online-only.** Gap-free numbering requires single-authority\n * serialization, which an offline / non-CAS store cannot provide. `next()`\n * throws {@link SequenceOfflineError} unless the backing store advertises\n * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline\n * writer cannot safely allocate a global sequence number.\n *\n * Note on \"gap-free\": the *sequence* is gap-free (each `next()` yields a\n * unique, +1 value). If a caller discards a value without using it, that\n * is a gap in *usage*, not in the sequence — assign each `next()` result\n * to its record in the same operation.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { ConflictError} from '../../kernel/errors.js';\nimport { isConflictError, SequenceContentionError, SequenceOfflineError, ValidationError } from '../../kernel/errors.js'\n\n// Capability opt-in seam (S4): `vault.sequence()` builds its CAS store through\n// the sequenceStrategy, so it throws SequenceNotEnabledError unless opted in.\nexport { withSequence } from './active.js'\nexport { NO_SEQUENCE, type SequenceStrategy } from './strategy.js'\nexport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport const SEQUENCE_COLLECTION = '_sequences'\n// A sequence is a single hot CAS row — higher contention than a ledger\n// append. A larger budget + jittered backoff absorbs moderate concurrency;\n// a genuine burst beyond this surfaces SequenceContentionError so the\n// caller can retry / queue (the honest online-only contract).\nconst MAX_NEXT_ATTEMPTS = 16\n\ninterface SequenceState {\n  value: number\n}\n\n/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */\nexport interface NextOptions {\n  /** Deferred mode: the record id to number. Ignored by the CAS counter. */\n  readonly for?: string\n  /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */\n  readonly timeoutMs?: number\n}\n\n/**\n * Partitioning for a CAS sequence. A partitioned sequence is an\n * independent counter scoped to one tuple of values — e.g.\n * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices\n * separately from `[2026, 'US']` and from the bare `invoice` series.\n *\n * Partition components are URI-encoded (so `/`, null bytes and other\n * separators in a value can never collide with the structural separators) and\n * `'/'`-joined, then appended to the series with a null-byte (`\\x00`)\n * separator. The null byte is illegal in a plain series name, which guarantees\n * a partitioned key is always disjoint from any unpartitioned series.\n */\nexport interface SequenceOptions {\n  /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */\n  readonly partition?: readonly (string | number)[]\n  /**\n   * Render template for the serial string. When set, `vault.sequence`\n   * returns a {@link FormattedSequenceHandle} whose `next()` resolves to\n   * `{ serial, formatted }`. Tokens:\n   * - `{seq}` — the allocated integer\n   * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)\n   * - `{partition.i}` — the i-th `partition` component (original value)\n   *\n   * Any other token, or a `{partition.i}` index beyond the supplied\n   * `partition`, throws `ValidationError` at `vault.sequence()` construction.\n   * Per-partition reset is inherent: a new partition tuple starts at 1.\n   */\n  readonly format?: string\n}\n\n/**\n * A formatted sequence handle. Identical to {@link SequenceHandle}\n * except `next()` also returns the rendered `formatted` string. `peek()` /\n * `seedTo()` operate on the underlying integer counter, unchanged.\n */\nexport interface FormattedSequenceHandle {\n  /** Allocate the next value and return it with its rendered serial string. */\n  next(opts?: NextOptions): Promise<{ serial: number; formatted: string }>\n  /** Read the current integer value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */\n  seedTo(n: number): Promise<void>\n}\n\n// Matches a single `{...}` token with no nested braces.\nconst SEQ_FORMAT_TOKEN = /\\{([^{}]*)\\}/g\nconst SEQ_PAD_TOKEN = /^seq:0(\\d+)$/\nconst SEQ_PARTITION_TOKEN = /^partition\\.(\\d+)$/\n\n/**\n * Validate a sequence `format` against the supplied partition and return a\n * pure `(serial) => string` renderer. Eager validation: every token is\n * checked now, so a bad pattern throws `ValidationError` at construction —\n * never at `next()` time.\n */\nexport function compileSequenceFormat(\n  format: string,\n  series: string,\n  partition: readonly (string | number)[] | undefined,\n): (serial: number) => string {\n  const parts = partition ?? []\n  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {\n    const token = m[1] ?? ''\n    if (token === 'seq') continue\n    if (SEQ_PAD_TOKEN.test(token)) continue\n    const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n    if (partMatch) {\n      const idx = Number(partMatch[1])\n      if (idx >= parts.length) {\n        throw new ValidationError(\n          `sequence(\"${series}\"): format token \"{${token}}\" references partition index ${idx}, ` +\n            `but only ${parts.length} partition component(s) were supplied.`,\n        )\n      }\n      continue\n    }\n    throw new ValidationError(\n      `sequence(\"${series}\"): format contains unknown token \"{${token}}\". ` +\n        `Accepted tokens: {seq}, {seq:0N}, {partition.i}.`,\n    )\n  }\n  return (serial: number): string =>\n    format.replace(SEQ_FORMAT_TOKEN, (full, token: string) => {\n      if (token === 'seq') return String(serial)\n      const padMatch = SEQ_PAD_TOKEN.exec(token)\n      if (padMatch) return String(serial).padStart(Number(padMatch[1]), '0')\n      const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n      if (partMatch) return String(parts[Number(partMatch[1])])\n      return full // unreachable — validated above\n    })\n}\n\n/**\n * Resolve the CAS storage key for a (series, partition) pair.\n *\n * With no partition the key is `series` verbatim. With a partition the key is\n * `${series}\\x00${parts}` where `parts` is each component passed through\n * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator\n * is illegal in a plain series name, so partitioned keys never collide with\n * unpartitioned ones; URI-encoding keeps any component containing `/` distinct\n * from a multi-component partition.\n *\n * @throws {ValidationError} if any partition component is empty after `String()`\n *   or is a non-finite number (`NaN`, `±Infinity`).\n */\nexport function resolveSequenceKey(series: string, opts?: SequenceOptions): string {\n  const partition = opts?.partition\n  if (!partition || partition.length === 0) return series\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('sequence partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${series}\\x00${parts.join('/')}`\n}\n\nexport interface SequenceHandle {\n  /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */\n  next(opts?: NextOptions): Promise<number>\n  /** Read the current value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /**\n   * Set-if-greater: advance the counter to at least `n`. A no-op if the\n   * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is\n   * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.\n   *\n   * Use after a bundle / CSV import to fast-forward the counter past the\n   * highest imported serial, so subsequent `next()` calls cannot re-use a\n   * number that is already on a record.\n   *\n   * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.\n   */\n  seedTo(n: number): Promise<void>\n}\n\nasync function sleepBackoff(attempt: number): Promise<void> {\n  // Exponential backoff with full jitter to break the thundering herd\n  // when many writers contend on the same counter row.\n  const ceil = Math.min(2 ** attempt, 32)\n  const ms = Math.floor(Math.random() * ceil)\n  await new Promise((r) => setTimeout(r, ms))\n}\n\n/** Per-call context the vault assembles to build a {@link SequenceStore}. */\nexport interface SequenceStoreOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\nexport class SequenceStore {\n  private readonly adapter: NoydbStore\n  private readonly vault: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly actor: string\n  /**\n   * Memoized DEK promise. The `_sequences` collection DEK is created on\n   * first access; without sharing one promise, a burst of concurrent\n   * `next()` calls would each trigger DEK creation and diverge (one\n   * writer's ciphertext unreadable by another). One shared promise → one\n   * DEK.\n   */\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(opts: SequenceStoreOptions) {\n    this.adapter = opts.adapter\n    this.vault = opts.vault\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.actor = opts.actor\n  }\n\n  /** A handle bound to one sequence name. */\n  handle(name: string): SequenceHandle {\n    return {\n      next: () => this.next(name),\n      peek: () => this.peek(name),\n      seedTo: (n) => this.seedTo(name, n),\n    }\n  }\n\n  private assertOnline(): void {\n    if (this.adapter.capabilities?.casAtomic !== true) {\n      throw new SequenceOfflineError()\n    }\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION)\n    return this.dekPromise\n  }\n\n  private async read(name: string): Promise<{ env: EncryptedEnvelope | null; value: number }> {\n    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name)\n    if (!env) return { env: null, value: 0 }\n    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data\n    const state = JSON.parse(json) as SequenceState\n    return { env, value: state.value }\n  }\n\n  private async encryptState(state: SequenceState, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(state)\n    if (!this.encrypted) {\n      return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: new Date().toISOString(), _iv: '', _data: json, _by: this.actor }\n    }\n    const { iv, data } = await encrypt(json, await this.dek())\n    return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: new Date().toISOString(), _iv: iv, _data: data, _by: this.actor }\n  }\n\n  async peek(name: string): Promise<number> {\n    return (await this.read(name)).value\n  }\n\n  async next(name: string): Promise<number> {\n    this.assertOnline()\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      const nextValue = value + 1\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return nextValue\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n\n  async seedTo(name: string, n: number): Promise<void> {\n    this.assertOnline()\n    if (n <= 0) return // set-if-greater: 0 (and any non-positive seed) is a no-op\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      if (value >= n) return // already at or past the floor — no write, idempotent\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState({ value: n }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,MAAM;AAChB,aAAO,IAAI,cAAc,IAAI;AAAA,IAC/B;AAAA,EACF;AACF;;;ACWO,IAAM,cAAgC;AAAA,EAC3C,cAA6B;AAC3B,UAAM,IAAI,wBAAwB;AAAA,EACpC;AACF;;;ACCO,IAAM,sBAAsB;AAKnC,IAAM,oBAAoB;AA2D1B,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAQrB,SAAS,sBACd,QACA,QACA,WAC4B;AAC5B,QAAM,QAAQ,aAAa,CAAC;AAC5B,aAAW,KAAK,OAAO,SAAS,gBAAgB,GAAG;AACjD,UAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,QAAI,UAAU,MAAO;AACrB,QAAI,cAAc,KAAK,KAAK,EAAG;AAC/B,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,WAAW;AACb,YAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAC/B,UAAI,OAAO,MAAM,QAAQ;AACvB,cAAM,IAAI;AAAA,UACR,aAAa,MAAM,sBAAsB,KAAK,iCAAiC,GAAG,cACpE,MAAM,MAAM;AAAA,QAC5B;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,aAAa,MAAM,uCAAuC,KAAK;AAAA,IAEjE;AAAA,EACF;AACA,SAAO,CAAC,WACN,OAAO,QAAQ,kBAAkB,CAAC,MAAM,UAAkB;AACxD,QAAI,UAAU,MAAO,QAAO,OAAO,MAAM;AACzC,UAAM,WAAW,cAAc,KAAK,KAAK;AACzC,QAAI,SAAU,QAAO,OAAO,MAAM,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG;AACrE,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,UAAW,QAAO,OAAO,MAAM,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,WAAO;AAAA,EACT,CAAC;AACL;AAeO,SAAS,mBAAmB,QAAgB,MAAgC;AACjF,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,6DAA6D,CAAC,EAAE;AAAA,IAC5F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,IAC5E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,MAAM,KAAO,MAAM,KAAK,GAAG,CAAC;AACxC;AAqBA,eAAe,aAAa,SAAgC;AAG1D,QAAM,OAAO,KAAK,IAAI,KAAK,SAAS,EAAE;AACtC,QAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI;AAC1C,QAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC5C;AAWO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,aAAyC;AAAA,EAEjD,YAAY,MAA4B;AACtC,SAAK,UAAU,KAAK;AACpB,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,OAAO,MAA8B;AACnC,WAAO;AAAA,MACL,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,QAAQ,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,cAAc,cAAc,MAAM;AACjD,YAAM,IAAI,qBAAqB;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,mBAAmB;AACvE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,KAAK,MAAyE;AAC1F,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,IAAI;AACxE,QAAI,CAAC,IAAK,QAAO,EAAE,KAAK,MAAM,OAAO,EAAE;AACvC,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AAClF,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAO,EAAE,KAAK,OAAO,MAAM,MAAM;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,OAAsB,SAA6C;AAC5F,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,EAAE,QAAQ,sBAAsB,IAAI,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,MAAM;AAAA,IAC3H;AACA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,CAAC;AACzD,WAAO,EAAE,QAAQ,sBAAsB,IAAI,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,MAAM;AAAA,EAC3H;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,YAAQ,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,SAAK,aAAa;AAClB,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,YAAM,YAAY,QAAQ;AAC1B,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,EAAE,OAAO,UAAU,GAAG,kBAAkB,CAAC;AAClF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AAAA,EAEA,MAAM,OAAO,MAAc,GAA0B;AACnD,SAAK,aAAa;AAClB,QAAI,KAAK,EAAG;AACZ,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,UAAI,SAAS,EAAG;AAChB,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;AAC1E,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AACF;","names":[]}

package/dist/{chunk-NM5UYF6Q.js → chunk-SBGXQK5I.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -21,4 +21,4 @@ export {
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-NM5UYF6Q.js.map
+//# sourceMappingURL=chunk-SBGXQK5I.js.map

package/dist/{chunk-SF2ZIRD6.js → chunk-SL3PLML2.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-2BET5QTS.js";
+} from "./chunk-6PFST3FC.js";
 import {
   PolicyDeniedError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-SF2ZIRD6.js.map
+//# sourceMappingURL=chunk-SL3PLML2.js.map

package/dist/{chunk-3ECU57YH.js → chunk-TJOUKMWF.js}

@@ -1,6 +1,6 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-KD4HGBJV.js";
+} from "./chunk-Q6MXHDSE.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -8,11 +8,11 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-WYUAEZSC.js";
+} from "./chunk-ELJOLQIG.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-JEI6JJNI.js";
+} from "./chunk-KDWBVCIX.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -23,11 +23,11 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-DQZXPGGZ.js";
+} from "./chunk-V3EGXDFN.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   bufferToBase64,
   decrypt,
@@ -37,14 +37,14 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
 } from "./chunk-77AEMXFA.js";
 import {
   PartitionExtractionError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -492,4 +492,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-3ECU57YH.js.map
+//# sourceMappingURL=chunk-TJOUKMWF.js.map

package/dist/{chunk-QD46HPZG.js → chunk-U2ID5A2I.js}

@@ -1,6 +1,6 @@
 import {
   SealedRecordNotEnabledError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-audit/sealed-record/strategy.ts
 var NO_SEALED_RECORD = {
@@ -18,4 +18,4 @@ var NO_SEALED_RECORD = {
 export {
   NO_SEALED_RECORD
 };
-//# sourceMappingURL=chunk-QD46HPZG.js.map
+//# sourceMappingURL=chunk-U2ID5A2I.js.map

package/dist/{chunk-X4MVWPHV.js → chunk-UC5Y7OEJ.js}

@@ -4,13 +4,13 @@ import {
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
   ValidationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-party/session/session.ts
 var subtle = globalThis.crypto.subtle;
@@ -364,4 +364,4 @@ export {
   clearDevUnlock,
   isDevUnlockActive
 };
-//# sourceMappingURL=chunk-X4MVWPHV.js.map
+//# sourceMappingURL=chunk-UC5Y7OEJ.js.map

package/dist/{chunk-SBHN6QUT.js → chunk-US2AR4BI.js}

@@ -2,7 +2,7 @@ import {
   grant,
   revoke,
   rotateKeys
-} from "./chunk-Q5YJCVJY.js";
+} from "./chunk-FZAP4JNC.js";
 
 // src/with-party/team/active.ts
 function withTeam() {
@@ -22,4 +22,4 @@ function withTeam() {
 export {
   withTeam
 };
-//# sourceMappingURL=chunk-SBHN6QUT.js.map
+//# sourceMappingURL=chunk-US2AR4BI.js.map

package/dist/{chunk-DQZXPGGZ.js → chunk-V3EGXDFN.js}

@@ -1,9 +1,9 @@
 import {
   envelopeBodyForHash
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   sha256Hex
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 
 // src/with-commit/history/ledger/entry.ts
 function canonicalJson(value) {
@@ -67,4 +67,4 @@ export {
   parseIndex,
   envelopePayloadHash
 };
-//# sourceMappingURL=chunk-DQZXPGGZ.js.map
+//# sourceMappingURL=chunk-V3EGXDFN.js.map

package/dist/{chunk-ZHDSUZQU.js → chunk-V4O6YZSP.js}

@@ -1,11 +1,11 @@
 import {
   openEnvelopeJson
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   encrypt,
   hmacSha256Hex,
   sha256Hex
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-77AEMXFA.js";
@@ -147,4 +147,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-ZHDSUZQU.js.map
+//# sourceMappingURL=chunk-V4O6YZSP.js.map

package/dist/{chunk-3HUYRN24.js → chunk-W7C7MMIS.js}

@@ -1,9 +1,9 @@
 import {
   sha256Hex
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   MaterializedViewSourceUnknownError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-AR5D76T2.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -366,4 +366,4 @@ export {
   MaterializedViewRegistry,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-3HUYRN24.js.map
+//# sourceMappingURL=chunk-W7C7MMIS.js.map

package/dist/{chunk-NLYALJMY.js → chunk-WFYKIDCS.js}

@@ -7,10 +7,10 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-NM5UYF6Q.js";
+} from "./chunk-SBGXQK5I.js";
 import {
   envelopeBodySize
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   isDeleteMarker,
   isTombstoneShape
@@ -21,14 +21,14 @@ import {
   derivePresenceKey,
   encrypt,
   generateIV
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_SYNC_VERSION
 } from "./chunk-77AEMXFA.js";
 import {
-  ConflictError,
-  ValidationError
-} from "./chunk-QZWTRENR.js";
+  ValidationError,
+  isConflictError
+} from "./chunk-AR5D76T2.js";
 
 // src/with-sync/presence.ts
 var PresenceHandle = class {
@@ -502,7 +502,7 @@ var SyncEngine = class {
             completed.push(i);
             pushed++;
           } catch (err) {
-            if (err instanceof ConflictError) {
+            if (isConflictError(err)) {
               const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id);
               if (remoteEnvelope) {
                 if (isTombstoneShape(remoteEnvelope)) {
@@ -528,7 +528,9 @@ var SyncEngine = class {
                   );
                   conflicts.push(conflict);
                   if (handled === "local") {
-                    await this.remote.put(this.vault, entry.collection, entry.id, conflict.local);
+                    const winner = this.advancePastRemote(conflict.local, remoteEnvelope);
+                    await this.remote.put(this.vault, entry.collection, entry.id, winner);
+                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner);
                     completed.push(i);
                     pushed++;
                   } else if (handled === "remote") {
@@ -787,7 +789,7 @@ var SyncEngine = class {
             completed.push(i);
             pushed++;
           } catch (err) {
-            if (err instanceof ConflictError) {
+            if (isConflictError(err)) {
               const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id);
               if (remoteEnvelope) {
                 if (isTombstoneShape(remoteEnvelope)) {
@@ -813,7 +815,9 @@ var SyncEngine = class {
                   );
                   conflicts.push(conflict);
                   if (handled === "local") {
-                    await this.remote.put(this.vault, entry.collection, entry.id, conflict.local);
+                    const winner = this.advancePastRemote(conflict.local, remoteEnvelope);
+                    await this.remote.put(this.vault, entry.collection, entry.id, winner);
+                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner);
                     completed.push(i);
                     pushed++;
                   } else if (handled === "remote") {
@@ -899,6 +903,21 @@ var SyncEngine = class {
    *  ordinary put. `isTombstoneShape` covers a forgotten-elsewhere record arriving as a shred;
    *  `isDeleteMarker` covers an ordinary (#589) delete — both route to the SAME 'delete' action
    *  (sync delete ≠ forget: freshness only, no shred/residue channel on the receiving side). */
+  /**
+   * #936 — a local-wins resolution write must SUPERSEDE the remote, never
+   * overwrite it in place: when the winner's `_v` does not already exceed
+   * the remote's (the same-`_v` push tie), re-stamp it at `remote._v + 1`.
+   * Without this the loser's next pull sees no delta (`_v`-based
+   * detection) and the peers stay silently diverged at the same version.
+   * `_v` is envelope metadata — AEAD-unbound, and `_vdig` is deliberately
+   * `_v`-independent — so the engine may restamp ciphertext. Callers must
+   * mirror the advanced envelope locally (`applyRemote`) so both sides
+   * agree. The 'merged' branch needs none of this: resolver output is
+   * already stamped `max(local, remote) + 1`.
+   */
+  advancePastRemote(winner, remote) {
+    return winner._v > remote._v ? winner : { ...winner, _v: remote._v + 1 };
+  }
   async applyRemote(collection, id, envelope) {
     await this.local.put(this.vault, collection, id, envelope);
     if (this.pullByteSink !== null) {
@@ -1083,4 +1102,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-NLYALJMY.js.map
+//# sourceMappingURL=chunk-WFYKIDCS.js.map