@noy-db/hub 0.6.0-pre.19 → 0.6.0-pre.20

package/dist/{chunk-YEZW6UJA.js → chunk-RQY5UWEL.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-2IK6AC6A.js";
 import {
   createOwnerKeyring
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   diff
 } from "./chunk-SVLR4POP.js";
@@ -404,7 +404,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-VZIVPDXG.js");
+    const { createNoydb } = await import("./noydb-SS6EN7TK.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -460,4 +460,4 @@ export {
   withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-YEZW6UJA.js.map
+//# sourceMappingURL=chunk-RQY5UWEL.js.map

package/dist/{chunk-LBDTQM3R.js → chunk-VEX2BQVX.js}

@@ -8,7 +8,7 @@ import {
   rotateKeys,
   verifyPrompt,
   verifyTypedEcho
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   NoAccessError,
   NoydbError,
@@ -114,4 +114,4 @@ export {
   MemoryDeviceSealProvider,
   withTeam
 };
-//# sourceMappingURL=chunk-LBDTQM3R.js.map
+//# sourceMappingURL=chunk-VEX2BQVX.js.map

package/dist/{chunk-HUYNPLTT.js → chunk-XGQGWZ6D.js}

@@ -1,7 +1,7 @@
 import {
   grant,
   revoke
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   CustodyNotEnabledError
 } from "./chunk-P7L3OQLL.js";
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-7QY7TULB.js");
+      const { liberateVault } = await import("./liberate-I6AOLWXW.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-HUYNPLTT.js.map
+//# sourceMappingURL=chunk-XGQGWZ6D.js.map

package/dist/{chunk-I26TE27S.js → chunk-ZXW3X3DQ.js}

@@ -1,6 +1,6 @@
 import {
   createNoydb
-} from "./chunk-HGAR7H5M.js";
+} from "./chunk-6TXUVKPG.js";
 import {
   deriveSchemaManifest
 } from "./chunk-E6VDPBE3.js";
@@ -16,7 +16,7 @@ import {
 } from "./chunk-2IK6AC6A.js";
 import {
   loadKeyring
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-I26TE27S.js.map
+//# sourceMappingURL=chunk-ZXW3X3DQ.js.map

package/dist/custody/index.js

@@ -2,8 +2,8 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-HUYNPLTT.js";
-import "../chunk-E6WANBD6.js";
+} from "../chunk-XGQGWZ6D.js";
+import "../chunk-RKDH6L53.js";
 import "../chunk-JHO6FGZX.js";
 import "../chunk-D5UDZANO.js";
 import "../chunk-ZVAFJQZB.js";

package/dist/index.js

@@ -57,14 +57,14 @@ import {
   decryptExtractedPartition,
   diffVault,
   withCargo
-} from "./chunk-YEZW6UJA.js";
+} from "./chunk-RQY5UWEL.js";
 import "./chunk-CV7WXCZD.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "./chunk-37P5VB4N.js";
+} from "./chunk-PNAIDIP7.js";
 import {
   withdrawAccessibleData
 } from "./chunk-TC6MBEGH.js";
@@ -121,7 +121,7 @@ import {
   signRedirect,
   verifyRedirect,
   wrapPodStore
-} from "./chunk-I26TE27S.js";
+} from "./chunk-ZXW3X3DQ.js";
 import {
   Collection,
   ELEVATION_AUDIT_COLLECTION,
@@ -140,7 +140,7 @@ import {
   refArray,
   via,
   withArchive
-} from "./chunk-HGAR7H5M.js";
+} from "./chunk-6TXUVKPG.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName
@@ -201,7 +201,7 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "./chunk-HUYNPLTT.js";
+} from "./chunk-XGQGWZ6D.js";
 import "./chunk-RSFG7XHM.js";
 import {
   buildLookupSnapshot
@@ -366,7 +366,7 @@ import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "./chunk-LBDTQM3R.js";
+} from "./chunk-VEX2BQVX.js";
 import {
   MAGIC_LINK_GRANTS_COLLECTION,
   NO_TEAM,
@@ -395,7 +395,7 @@ import {
   unwrapDeksFromPaperEntry,
   unwrapMagicLinkGrant,
   writeMagicLinkGrant
-} from "./chunk-LAFP5H5U.js";
+} from "./chunk-F5AJZC3U.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
@@ -424,7 +424,7 @@ import {
   validateSecret,
   verifyPrompt,
   verifyTypedEcho
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   DIRECTORY_RECORD_ID,
   VISIBILITY_RECORD_PREFIX,

package/dist/{liberate-7QY7TULB.js → liberate-I6AOLWXW.js}

@@ -1,12 +1,12 @@
 import {
   liberateVault
-} from "./chunk-37P5VB4N.js";
+} from "./chunk-PNAIDIP7.js";
 import "./chunk-TC6MBEGH.js";
 import "./chunk-ZPMXYPBR.js";
 import "./chunk-NRNTXBHT.js";
 import "./chunk-2IK6AC6A.js";
 import "./chunk-DYASJSKI.js";
-import "./chunk-E6WANBD6.js";
+import "./chunk-RKDH6L53.js";
 import "./chunk-JHO6FGZX.js";
 import "./chunk-D5UDZANO.js";
 import "./chunk-ZVAFJQZB.js";
@@ -21,4 +21,4 @@ import "./chunk-PZ5AY32C.js";
 export {
   liberateVault
 };
-//# sourceMappingURL=liberate-7QY7TULB.js.map
+//# sourceMappingURL=liberate-I6AOLWXW.js.map

package/dist/{noydb-VZIVPDXG.js → noydb-SS6EN7TK.js}

@@ -1,7 +1,7 @@
 import {
   Noydb,
   createNoydb
-} from "./chunk-HGAR7H5M.js";
+} from "./chunk-6TXUVKPG.js";
 import "./chunk-KBOPY6W2.js";
 import "./chunk-C7WJNVJG.js";
 import "./chunk-AQF7JSQR.js";
@@ -21,7 +21,7 @@ import "./chunk-A3NTKHDB.js";
 import "./chunk-NRNTXBHT.js";
 import "./chunk-YVTADFTC.js";
 import "./chunk-PZSS7MUM.js";
-import "./chunk-HUYNPLTT.js";
+import "./chunk-XGQGWZ6D.js";
 import "./chunk-RSFG7XHM.js";
 import "./chunk-ICCRAPWD.js";
 import "./chunk-W6NFONOV.js";
@@ -52,9 +52,9 @@ import "./chunk-PG6PFMDC.js";
 import "./chunk-GYUCRDAU.js";
 import "./chunk-437FDIHO.js";
 import "./chunk-KDX6VEYV.js";
-import "./chunk-LAFP5H5U.js";
+import "./chunk-F5AJZC3U.js";
 import "./chunk-DKYEVHZH.js";
-import "./chunk-E6WANBD6.js";
+import "./chunk-RKDH6L53.js";
 import "./chunk-JHO6FGZX.js";
 import "./chunk-HTMQBBF3.js";
 import "./chunk-KM6YR5XF.js";
@@ -81,4 +81,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=noydb-VZIVPDXG.js.map
+//# sourceMappingURL=noydb-SS6EN7TK.js.map

package/dist/pod/index.js

@@ -5,8 +5,8 @@ import {
   signRedirect,
   verifyRedirect,
   wrapPodStore
-} from "../chunk-I26TE27S.js";
-import "../chunk-HGAR7H5M.js";
+} from "../chunk-ZXW3X3DQ.js";
+import "../chunk-6TXUVKPG.js";
 import "../chunk-KBOPY6W2.js";
 import "../chunk-C7WJNVJG.js";
 import "../chunk-AQF7JSQR.js";
@@ -33,7 +33,7 @@ import "../chunk-A3NTKHDB.js";
 import "../chunk-NRNTXBHT.js";
 import "../chunk-YVTADFTC.js";
 import "../chunk-PZSS7MUM.js";
-import "../chunk-HUYNPLTT.js";
+import "../chunk-XGQGWZ6D.js";
 import "../chunk-RSFG7XHM.js";
 import "../chunk-ICCRAPWD.js";
 import "../chunk-W6NFONOV.js";
@@ -89,9 +89,9 @@ import "../chunk-PG6PFMDC.js";
 import "../chunk-GYUCRDAU.js";
 import "../chunk-437FDIHO.js";
 import "../chunk-KDX6VEYV.js";
-import "../chunk-LAFP5H5U.js";
+import "../chunk-F5AJZC3U.js";
 import "../chunk-DKYEVHZH.js";
-import "../chunk-E6WANBD6.js";
+import "../chunk-RKDH6L53.js";
 import "../chunk-JHO6FGZX.js";
 import "../chunk-HTMQBBF3.js";
 import "../chunk-KM6YR5XF.js";

package/dist/{seed-2KZDTFS4.js → seed-SGIF3EN4.js}

@@ -1,7 +1,7 @@
 import {
   BROKER_COLLECTION,
   ensureCollectionDEK
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import "./chunk-JHO6FGZX.js";
 import {
   computeBrokerProof,
@@ -225,4 +225,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-2KZDTFS4.js.map
+//# sourceMappingURL=seed-SGIF3EN4.js.map

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "../chunk-LBDTQM3R.js";
+} from "../chunk-VEX2BQVX.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -31,7 +31,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-LAFP5H5U.js";
+} from "../chunk-F5AJZC3U.js";
 import "../chunk-DKYEVHZH.js";
 import {
   buildEchoBlock,
@@ -53,7 +53,7 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-E6WANBD6.js";
+} from "../chunk-RKDH6L53.js";
 import "../chunk-JHO6FGZX.js";
 import "../chunk-HTMQBBF3.js";
 import "../chunk-47ZFULEZ.js";

package/dist/vault-head/index.js

@@ -89,6 +89,9 @@ function withVaultHead(opts = {}) {
 async function verifyVaultHead(head, store, vault, getDEK, collection) {
   const known = await head.knownIn(store, vault, getDEK, collection);
   const discrepancies = [];
+  const because = [];
+  if (known.size === 0) because.push("no-expectations");
+  if (store.capabilities?.casAtomic !== true) because.push("store-cannot-cas");
   for (const [id, expected] of known) {
     const env = await store.get(vault, collection, id);
     if (env === null) {
@@ -99,7 +102,8 @@ async function verifyVaultHead(head, store, vault, getDEK, collection) {
       discrepancies.push({ collection, id, expected, actual: env._v, kind: "rolled-back" });
     }
   }
-  return { checked: known.size, discrepancies, clean: discrepancies.length === 0 };
+  const verdict = discrepancies.length > 0 ? "tampered" : because.length > 0 ? "unverifiable" : "verified";
+  return { verdict, checked: known.size, discrepancies, because };
 }
 export {
   DEFAULT_HEAD_BUCKETS,

package/dist/vault-head/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\nexport interface HeadVerifyResult {\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /** `true` when every record the head knows about is served at or above its expected version. */\n  readonly clean: boolean\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  return { checked: known.size, discrepancies, clean: discrepancies.length === 0 }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACRA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM,MAAM,eAAe,OAAO,cAAc,WAAW,EAAE;AACjF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}

package/dist/with-commit/vault-head/index.d.ts

@@ -4,7 +4,7 @@
  * @packageDocumentation
  */
 export { withVaultHead } from './active.js';
-export { verifyVaultHead, type HeadDiscrepancy, type HeadVerifyResult } from './verify.js';
+export { verifyVaultHead, type HeadDiscrepancy, type HeadVerifyResult, type HeadVerdict, type HeadUnverifiableReason } from './verify.js';
 export { NO_VAULT_HEAD, VAULT_HEAD_COLLECTION, DEFAULT_HEAD_BUCKETS, type VaultHeadStrategy, type WithVaultHeadOptions, type HeadEntry, } from './strategy.js';
 export type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 export type { EnclaveKey } from '../../kernel/enclave/index.js';

package/dist/with-commit/vault-head/verify.d.ts

@@ -28,11 +28,51 @@ export interface HeadDiscrepancy {
     readonly actual: number | null;
     readonly kind: 'withheld' | 'rolled-back';
 }
+/**
+ * Why a sweep could not reach a conclusion.
+ *
+ * - `'no-expectations'` — the head holds nothing for this collection. A fresh
+ *   vault, a head switched on after the fact, or a **restore from a snapshot**:
+ *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has
+ *   no head to compare against.
+ * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,
+ *   so two writers racing on one bucket can silently lose an entry. A lost entry
+ *   is a record the sweep stops expecting, which is a false clean.
+ */
+export type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas';
+/**
+ * ## Three-way, deliberately (#1101)
+ *
+ * - `'verified'` — the head held expectations, every one was met, and the store
+ *   can serialize head writes.
+ * - `'unverifiable'` — the sweep could not conclude. See `because`.
+ * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over
+ *   any `unverifiable` reason present at the same time.
+ *
+ * **The middle value is the point, and collapsing it is wrong in a different
+ * direction each way:** folded into "clean" it hides withholding, which is the
+ * one thing this service exists to catch; folded into "tampered" it cries wolf
+ * on a vault that is merely unexamined.
+ *
+ * That is not hypothetical. #1044's own first bug was a head that recorded
+ * nothing and swept **perfectly clean** — the degraded state rendered
+ * identically to a healthy one, which is why its test asserts `checked` before
+ * anything else. A two-way verdict makes that state a supported outcome.
+ */
+export type HeadVerdict = 'verified' | 'unverifiable' | 'tampered';
 export interface HeadVerifyResult {
+    readonly verdict: HeadVerdict;
     readonly checked: number;
     readonly discrepancies: readonly HeadDiscrepancy[];
-    /** `true` when every record the head knows about is served at or above its expected version. */
-    readonly clean: boolean;
+    /**
+     * Non-empty only when `verdict === 'unverifiable'`.
+     *
+     * There is deliberately no `clean: boolean`. It could not distinguish "no
+     * expectations" from "all expectations met" — both rendered `true` — and that
+     * indistinguishability *was* the defect. Replacing it rather than keeping it
+     * alongside forces every caller to face the three-way.
+     */
+    readonly because: readonly HeadUnverifiableReason[];
 }
 /**
  * Sweep one collection.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.6.0-pre.19",
+  "version": "0.6.0-pre.20",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -215,14 +215,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.6.0-pre.19"
+    "@noy-db/attestation": "0.6.0-pre.20"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.6.0-pre.19"
+    "@noy-db/on-shamir": "0.6.0-pre.20"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"