@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.20

package/dist/chunk-ZVAFJQZB.js

@@ -0,0 +1,66 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-3Y4OFWQJ.js";
+
+// src/kernel/enclave/record-envelope.ts
+function buildRecordEnvelope(identity, body) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: identity.version,
+    _ts: body.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: body.iv,
+    _data: body.data,
+    ...identity.by !== void 0 ? { _by: identity.by } : {},
+    ...identity.tier !== void 0 && identity.tier > 0 ? { _tier: identity.tier } : {},
+    ...body.cek !== void 0 ? { _cek: body.cek } : {},
+    ...body.provenance !== void 0 ? { _source: body.provenance.source, _sourceTs: body.provenance.sourceTs } : {},
+    ...body.extra ?? {}
+  };
+}
+async function buildSealedRecordEnvelope(identity, seal, body) {
+  const sealed = await seal(identity);
+  return buildRecordEnvelope(identity, {
+    ...body,
+    iv: sealed._iv,
+    data: sealed._data,
+    cek: sealed._cek
+  });
+}
+
+// src/kernel/enclave/record-keys/tombstone.ts
+function isTombstoneShape(envelope) {
+  return envelope._data === "" && envelope._cek === void 0 && envelope._del !== true;
+}
+function isTombstone(envelope, encrypted) {
+  if (!encrypted) return false;
+  return isTombstoneShape(envelope);
+}
+function buildTombstone(ref, version, actor) {
+  return buildRecordEnvelope(
+    { ...ref, version, ...actor ? { by: actor } : {} },
+    { iv: "", data: "" }
+  );
+}
+function isDeleteMarker(envelope) {
+  return envelope._del === true;
+}
+function buildDeleteMarker(ref, version, actor) {
+  return {
+    ...buildRecordEnvelope(
+      { ...ref, version, ...actor ? { by: actor } : {} },
+      { iv: "", data: "" }
+    ),
+    _del: true
+  };
+}
+
+export {
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  isTombstoneShape,
+  isTombstone,
+  buildTombstone,
+  isDeleteMarker,
+  buildDeleteMarker
+};
+//# sourceMappingURL=chunk-ZVAFJQZB.js.map

package/dist/chunk-ZVAFJQZB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/record-envelope.ts","../src/kernel/enclave/record-keys/tombstone.ts"],"sourcesContent":["/**\n * The one place an `EncryptedEnvelope` is constructed (#1051).\n *\n * ## Why this exists\n *\n * 49 files built envelopes with an object literal, bypassing\n * `RecordCodec.buildEnvelope` (which had 4 callers). That is **writer\n * fan-out**: N independent places each had to know the envelope contract, and\n * nothing checked that they agreed.\n *\n * It only became load-bearing with #1041. Binding a record's identity into the\n * AEAD requires every writer to supply that identity — and a writer that\n * doesn't produces data the reader rejects. Reader fan-out you fix by threading\n * an argument through call sites; **writer fan-out cannot be migrated\n * incrementally**, because the first migrated writer emits envelopes the\n * unmigrated readers refuse.\n *\n * ## Why adopting it is safe\n *\n * `identity` is **required but not yet used**. Output is byte-identical to the\n * literals it replaces, so every producer can migrate independently and the\n * existing suite verifies each step. The behaviour change happens **once**,\n * when AAD is switched on here — by which point every writer already supplies\n * identity, and the compiler proved it.\n *\n * That ordering is deliberate: a required-but-unused parameter converts \"did\n * we find every writer?\" from a question into a compile error, the same trick\n * that made the `NOYDB_FORMAT_VERSION` single-sourcing safe in #1048.\n *\n * @packageDocumentation\n */\nimport { NOYDB_FORMAT_VERSION } from '../types.js'\nimport type { EncryptedEnvelope } from '../types.js'\nimport type { RecordIdentity } from './record-aad.js'\n\n/** The body an envelope carries, independent of who is writing it. */\nexport interface RecordEnvelopeBody {\n  /** AES-GCM IV, base64. Empty string for a plaintext or tombstone envelope. */\n  readonly iv: string\n  /** Ciphertext (or plaintext JSON when the collection stores plaintext). */\n  readonly data: string\n  /** ISO timestamp. Defaults to now — pass it when the caller has a real one. */\n  readonly ts?: string | undefined\n  /** Wrapped per-record CEK, when the record has one. */\n  readonly cek?: string | undefined\n  readonly provenance?: { readonly source: string; readonly sourceTs: string } | undefined\n  /**\n   * Slots the envelope may additionally carry.\n   *\n   * `_tier`, `_by` and `_v` are deliberately NOT here — they come from\n   * `identity`, which is the single source for all three. See\n   * {@link buildRecordEnvelope}.\n   */\n  readonly extra?: Partial<Pick<EncryptedEnvelope, '_det' | '_sealed' | '_vdig' | '_bidx'>> | undefined\n}\n\n/**\n * Build an envelope for `identity`.\n *\n * ## `identity` is the SINGLE SOURCE for `_by`, `_tier` and `_v`\n *\n * All three are stamped from it, and `RecordEnvelopeBody` deliberately cannot\n * carry them. That is not tidiness — it is what makes the AAD binding safe.\n *\n * The caller encrypts the body under AAD derived from `{collection, id, tier,\n * by, version}`. A reader recomputes that AAD from the address it fetched from\n * plus `_tier`/`_by`/`_v` read back **off the envelope** (`recordAadFor`). So if the\n * identity a writer *declares* could differ from the fields it *stamps*, the\n * AAD would not reproduce and the record would be undecryptable — silently, at\n * write time, discoverable only on the next read, and invisible to every gate\n * because the envelope is perfectly well-formed.\n *\n * An earlier draft took both and asserted they agreed. The assertion fired 230\n * times on the existing tree, which is the argument against it: a rule that can\n * be violated is a rule someone must remember. Taking one source removes the\n * violation instead of reporting it.\n */\nexport function buildRecordEnvelope(\n  identity: RecordIdentity,\n  body: RecordEnvelopeBody,\n): EncryptedEnvelope {\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: identity.version,\n    _ts: body.ts ?? new Date().toISOString(),\n    _iv: body.iv,\n    _data: body.data,\n    ...(identity.by !== undefined ? { _by: identity.by } : {}),\n    ...(identity.tier !== undefined && identity.tier > 0 ? { _tier: identity.tier } : {}),\n    ...(body.cek !== undefined ? { _cek: body.cek } : {}),\n    ...(body.provenance !== undefined\n      ? { _source: body.provenance.source, _sourceTs: body.provenance.sourceTs }\n      : {}),\n    ...(body.extra ?? {}),\n  }\n}\n\n/**\n * Build an envelope from an already-sealed body — the output of\n * `writeEnvelopeBody` — **without the caller ever naming `_iv`/`_data`/`_cek`**.\n *\n * This exists because of a guard, and the guard was right. Migrating\n * `writeEnvelopeBody` callers to {@link buildRecordEnvelope} meant rewriting\n * `...body` (a spread, which names nothing) into `iv: body._iv, data:\n * body._data, cek: body._cek` — and `enclave-body-only` failed it: three new\n * protected-body accesses in files that previously had zero.\n *\n * That is the correct outcome rather than an obstacle. #1051 exists to move\n * knowledge of the envelope's shape *inward*; a migration that spreads the\n * protected field names outward to every caller would have defeated its own\n * purpose while looking like progress. The pairing belongs here.\n *\n * ## It takes a SEALER, not a sealed body — and that is load-bearing (#1041)\n *\n * The obvious shape is `(identity, alreadySealedBody, rest)`. That requires the\n * caller to name the identity TWICE — once for `writeEnvelopeBody` and once\n * here — and the two must agree byte for byte or the record is sealed under\n * AAD no reader can reproduce.\n *\n * They did not agree. `with-party/broker/seed.ts` sealed against\n * `{collection, id}` and stamped `{collection, id, by}`, so every broker seed\n * became unreadable the moment AAD switched on. Taking the sealer means the\n * identity is written once and handed to both — divergence stops being\n * possible rather than being something to remember.\n */\nexport async function buildSealedRecordEnvelope(\n  identity: RecordIdentity,\n  seal: (identity: RecordIdentity) => Promise<Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>>,\n  body: Omit<RecordEnvelopeBody, 'iv' | 'data' | 'cek'>,\n): Promise<EncryptedEnvelope> {\n  const sealed = await seal(identity)\n  return buildRecordEnvelope(identity, {\n    ...body,\n    iv: sealed._iv,\n    data: sealed._data,\n    cek: sealed._cek,\n  })\n}\n","/**\n * Tombstone shape + predicate for the per-record-key (CEK) layer.\n *\n * A *tombstone* is the residue a GDPR crypto-shred (`vault.forget()`)\n * leaves on disk: the live envelope rewritten to `{ _noydb, _v, _ts, _by,\n * _iv:'', _data:'' }`, dropping `_iv`/`_data`/`_cek`/`_det`. With the wrapped\n * per-record CEK gone, the body — and every history version under the same\n * CEK — is permanently undecryptable, while the record KEY survives so the\n * version counter and \"record existed and was erased\" persist for the audit\n * ledger.\n *\n * These two helpers are the pure, collection-independent core of that\n * contract: {@link buildTombstone} mints the shape, {@link isTombstone}\n * recognises it on the read path. The orchestration that *writes* a tombstone\n * (`_writeTombstone`) and drives `vault.forget()` lives with the collection /\n * vault; it calls into these.\n */\nimport { type EncryptedEnvelope } from '../../types.js'\nimport { buildRecordEnvelope } from '../record-envelope.js'\nimport type { RecordRef } from '../record-aad.js'\n\n/**\n * Shape-only tombstone recognition for layers that have no per-collection\n * context (the sync engine, #590): a tombstone carries an empty `_data` and\n * no wrapped CEK. No live envelope can match — record bodies never serialize\n * to the empty string (the `_sync` meta envelope carries non-empty `_data`,\n * and legacy migration envelopes carry non-empty `_iv`/`_data`).\n */\nexport function isTombstoneShape(envelope: EncryptedEnvelope): boolean {\n  return envelope._data === '' && envelope._cek === undefined && envelope._del !== true\n}\n\n/**\n * Is this envelope a crypto-shred tombstone?\n *\n * A tombstone carries no body (`_data` empty) and no wrapped CEK (`_cek`\n * absent) — decrypting it would call `decrypt('', '', dek)` → an AES-GCM\n * throw, so every read choke point must short-circuit to `null` instead.\n *\n * `encrypted` is the collection's encryption flag: on an unencrypted\n * collection there are no envelopes to shred, so nothing is ever a tombstone.\n * (Legacy migration envelopes carry non-empty `_iv`/`_data`, so they are not\n * tombstones and stay readable.)\n */\nexport function isTombstone(envelope: EncryptedEnvelope, encrypted: boolean): boolean {\n  if (!encrypted) return false\n  return isTombstoneShape(envelope)\n}\n\n/**\n * Mint a tombstone envelope from a record's live version + actor.\n *\n * Keeps `_v` (the displaced version) so the counter is monotonic across the\n * shred, stamps a fresh `_ts`, and records `_by` when an actor is supplied.\n * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the\n * erasure.\n */\nexport function buildTombstone(\n  ref: RecordRef,\n  version: number,\n  actor: string,\n): EncryptedEnvelope {\n  // `actor` rides on the IDENTITY, not the body — it is stamped as `_by` and\n  // bound into the AAD from that one source (#1041).\n  return buildRecordEnvelope(\n    { ...ref, version, ...(actor ? { by: actor } : {}) },\n    { iv: '', data: '' },\n  )\n}\n\n/** #589: is this envelope an ordinary-delete marker (version-ordered, reads as absent)? */\nexport function isDeleteMarker(envelope: EncryptedEnvelope): boolean {\n  return envelope._del === true\n}\n\n/**\n * Mint a delete marker from the deleted record's next version + actor (#589).\n * Minted at the NEXT version (`existing._v + 1`) — unlike `buildTombstone`, which\n * keeps the displaced `_v` — so it wins convergence over the pre-delete copy and a\n * re-create can still win over it at a higher version.\n */\nexport function buildDeleteMarker(\n  ref: RecordRef,\n  version: number,\n  actor: string,\n): EncryptedEnvelope {\n  // `_del` is not one of buildRecordEnvelope's declared slots — a delete marker\n  // is a distinct envelope class, not a record body — so it is stamped here.\n  return {\n    ...buildRecordEnvelope(\n      { ...ref, version, ...(actor ? { by: actor } : {}) },\n      { iv: '', data: '' },\n    ),\n    _del: true,\n  }\n}\n"],"mappings":";;;;;AA6EO,SAAS,oBACd,UACA,MACmB;AACnB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI,SAAS;AAAA,IACb,KAAK,KAAK,OAAM,oBAAI,KAAK,GAAE,YAAY;AAAA,IACvC,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,GAAI,SAAS,OAAO,SAAY,EAAE,KAAK,SAAS,GAAG,IAAI,CAAC;AAAA,IACxD,GAAI,SAAS,SAAS,UAAa,SAAS,OAAO,IAAI,EAAE,OAAO,SAAS,KAAK,IAAI,CAAC;AAAA,IACnF,GAAI,KAAK,QAAQ,SAAY,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC;AAAA,IACnD,GAAI,KAAK,eAAe,SACpB,EAAE,SAAS,KAAK,WAAW,QAAQ,WAAW,KAAK,WAAW,SAAS,IACvE,CAAC;AAAA,IACL,GAAI,KAAK,SAAS,CAAC;AAAA,EACrB;AACF;AA8BA,eAAsB,0BACpB,UACA,MACA,MAC4B;AAC5B,QAAM,SAAS,MAAM,KAAK,QAAQ;AAClC,SAAO,oBAAoB,UAAU;AAAA,IACnC,GAAG;AAAA,IACH,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,EACd,CAAC;AACH;;;AC7GO,SAAS,iBAAiB,UAAsC;AACrE,SAAO,SAAS,UAAU,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS;AACnF;AAcO,SAAS,YAAY,UAA6B,WAA6B;AACpF,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,iBAAiB,QAAQ;AAClC;AAUO,SAAS,eACd,KACA,SACA,OACmB;AAGnB,SAAO;AAAA,IACL,EAAE,GAAG,KAAK,SAAS,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC,EAAG;AAAA,IACnD,EAAE,IAAI,IAAI,MAAM,GAAG;AAAA,EACrB;AACF;AAGO,SAAS,eAAe,UAAsC;AACnE,SAAO,SAAS,SAAS;AAC3B;AAQO,SAAS,kBACd,KACA,SACA,OACmB;AAGnB,SAAO;AAAA,IACL,GAAG;AAAA,MACD,EAAE,GAAG,KAAK,SAAS,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC,EAAG;AAAA,MACnD,EAAE,IAAI,IAAI,MAAM,GAAG;AAAA,IACrB;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/{chunk-VJFMXYKP.js → chunk-ZWKF3CD3.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-VJFMXYKP.js.map
+//# sourceMappingURL=chunk-ZWKF3CD3.js.map

package/dist/{chunk-I4ZAO7F7.js → chunk-ZXW3X3DQ.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-PY7CI6L5.js";
+} from "./chunk-6TXUVKPG.js";
 import {
   deriveSchemaManifest
-} from "./chunk-G5APARUV.js";
+} from "./chunk-E6VDPBE3.js";
 import {
   loadFence
-} from "./chunk-TOAIYQJR.js";
+} from "./chunk-HJRTFXAA.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-VOQW5LAM.js";
+} from "./chunk-2IK6AC6A.js";
 import {
   loadKeyring
-} from "./chunk-ERB6NDDW.js";
+} from "./chunk-RKDH6L53.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -26,7 +26,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -192,8 +192,6 @@ function mergeSnapshots(remote, local) {
 function createPodStore(factory) {
   return factory;
 }
-var wrapBundleStore = wrapPodStore;
-var createBundleStore = createPodStore;
 
 // src/with-pod/redirect.ts
 async function signRedirect(signer, fields) {
@@ -283,11 +281,9 @@ async function open(podFileOrBytes, opts) {
 export {
   wrapPodStore,
   createPodStore,
-  wrapBundleStore,
-  createBundleStore,
   signRedirect,
   verifyRedirect,
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-I4ZAO7F7.js.map
+//# sourceMappingURL=chunk-ZXW3X3DQ.js.map

package/dist/chunk-ZXW3X3DQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-pod/pod-store.ts","../src/with-pod/redirect.ts","../src/with-pod/open.ts"],"sourcesContent":["import type { NoydbStore, NoydbPodStore, VaultSnapshot, EncryptedEnvelope } from '../kernel/types.js'\nimport { ConflictError, PodVersionConflictError } from '../kernel/errors.js'\n\n// ─── Bundle format ─────────────────────────────────────────────────────\n\nconst BUNDLE_STORE_VERSION = 1 as const\n\n/**\n * Wire format written by `wrapPodStore`. A JSON-serialised object that\n * contains the entire `VaultSnapshot` (all encrypted envelopes) plus a small\n * header for integrity checking. The envelopes inside are already AES-GCM\n * encrypted by core — the bundle bytes themselves are not additionally\n * encrypted, but they are safe to store on untrusted blob hosts because\n * every record inside is already ciphertext.\n *\n * @internal\n */\ninterface BundleStoreData {\n  readonly _noydb_bundle_store: typeof BUNDLE_STORE_VERSION\n  readonly vault: string\n  readonly ts: string\n  readonly data: VaultSnapshot\n}\n\n// ─── Options ───────────────────────────────────────────────────────────\n\nexport interface WrapPodStoreOptions {\n  /**\n   * When `true` (default), every `put()` and `delete()` flushes the full\n   * vault snapshot to the bundle backend. Set to `false` for bulk operations\n   * and call `store.flush(vaultId)` manually.\n   */\n  autoFlush?: boolean\n}\n\n// ─── Extended NoydbStore with flush/batch ───────────────────────────────\n\nexport interface WrappedPodNoydbStore extends NoydbStore {\n  /** Manually flush the in-memory snapshot to the bundle backend. */\n  flush(vaultId: string): Promise<void>\n  /**\n   * Run a batch of mutations without flushing until the callback completes.\n   * A single flush is performed at the end.\n   */\n  batch(vaultId: string, fn: () => Promise<void>): Promise<void>\n}\n\n// ─── wrapPodStore ───────────────────────────────────────────────────\n\nconst MAX_CONFLICT_RETRIES = 3\n\n/**\n * Convert a `NoydbPodStore` (blob-oriented read/write with OCC) into the\n * standard six-method `NoydbStore` interface expected by `createNoydb({ store })`.\n *\n * Bundle stores operate on the entire vault as a single serialised unit —\n * ideal for backends like Google Drive, WebDAV, or iCloud Drive that work\n * best with whole-file I/O rather than per-record KV operations.\n *\n * ## Optimistic concurrency\n *\n * The wrapper tracks the `version` token from the last `readBundle` and\n * passes it as `expectedVersion` on every flush. On\n * `PodVersionConflictError`, it re-reads, merges the remote snapshot\n * (last-write-wins per record key), and retries (max 3 attempts).\n *\n * ## Flush modes\n *\n * By default, flushes on every mutation (O(vault size) per write). Options:\n * - `autoFlush: false` + explicit `store.flush(vaultId)` calls\n * - `store.batch(vaultId, async () => { ... })` — defers flush until end\n * - Pair with `syncPolicy: { push: { mode: 'debounce' } }` from \n */\nexport function wrapPodStore(\n  bundle: NoydbPodStore,\n  options?: WrapPodStoreOptions,\n): WrappedPodNoydbStore {\n  const autoFlush = options?.autoFlush !== false\n\n  // Per-vault state\n  const snapshots = new Map<string, VaultSnapshot>()\n  const versions = new Map<string, string | null>()\n  const loaded = new Set<string>()\n\n  // Batch mode: when > 0, suppress auto-flush\n  let batchDepth = 0\n\n  // #908 — in-flight loads, keyed by vault. Without this, every concurrent\n  // caller issued its own `readBundle` and then REPLACED `snapshots` with a\n  // freshly parsed object — orphaning the mutations earlier callers had\n  // already made to the object they were handed. 100 racing puts kept 1.\n  const loading = new Map<string, Promise<VaultSnapshot>>()\n\n  async function load(vault: string): Promise<VaultSnapshot> {\n    if (loaded.has(vault)) return snapshots.get(vault)!\n\n    const inFlight = loading.get(vault)\n    if (inFlight) return inFlight\n\n    const pending = (async () => {\n      const result = await bundle.readBundle(vault)\n      if (result) {\n        const text = new TextDecoder().decode(result.bytes)\n        const format = JSON.parse(text) as BundleStoreData\n        snapshots.set(vault, format.data)\n        versions.set(vault, result.version)\n      } else {\n        snapshots.set(vault, {})\n        versions.set(vault, null)\n      }\n\n      loaded.add(vault)\n      return snapshots.get(vault)!\n    })()\n\n    loading.set(vault, pending)\n    try {\n      return await pending\n    } finally {\n      // Clear on failure too, so a transient read error does not poison\n      // every later load of this vault with a rejected promise.\n      loading.delete(vault)\n    }\n  }\n\n  async function flush(vault: string): Promise<void> {\n    const snapshot = snapshots.get(vault) ?? {}\n    const format: BundleStoreData = {\n      _noydb_bundle_store: BUNDLE_STORE_VERSION,\n      vault,\n      ts: new Date().toISOString(),\n      data: snapshot,\n    }\n    const bytes = new TextEncoder().encode(JSON.stringify(format))\n    const expectedVersion = versions.get(vault) ?? null\n\n    for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {\n      try {\n        const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion)\n        versions.set(vault, newVersion)\n        return\n      } catch (err) {\n        if (err instanceof PodVersionConflictError && attempt < MAX_CONFLICT_RETRIES - 1) {\n          // Pull remote, merge (last-write-wins by record key), retry\n          const remote = await bundle.readBundle(vault)\n          if (remote) {\n            const remoteText = new TextDecoder().decode(remote.bytes)\n            const remoteFormat = JSON.parse(remoteText) as BundleStoreData\n            const localSnap = snapshots.get(vault) ?? {}\n            const mergedSnap = mergeSnapshots(remoteFormat.data, localSnap)\n            snapshots.set(vault, mergedSnap)\n            versions.set(vault, remote.version)\n          }\n          // Re-encode with merged data for the retry\n          continue\n        }\n        throw err\n      }\n    }\n  }\n\n  // #908 — one flush at a time per vault. `flush` reads and writes the vault's\n  // version token, so concurrent flushes race: each sends the same\n  // `expectedVersion`, the losers take the conflict/merge path, and with enough\n  // of them the retry budget is exhausted and the error surfaces to a caller\n  // whose write was perfectly valid. Serialising makes every flush see the\n  // token its predecessor produced.\n  const flushChain = new Map<string, Promise<void>>()\n\n  function serialFlush(vault: string): Promise<void> {\n    const prev = flushChain.get(vault) ?? Promise.resolve()\n    // Chain past a rejection as well — one failed flush must not wedge every\n    // subsequent write to this vault.\n    const next = prev.then(() => flush(vault), () => flush(vault))\n    flushChain.set(vault, next)\n    return next\n  }\n\n  async function maybeFlush(vault: string): Promise<void> {\n    if (autoFlush && batchDepth === 0) {\n      await serialFlush(vault)\n    }\n  }\n\n  const store: WrappedPodNoydbStore = {\n    name: bundle.name ?? 'bundle',\n\n    async flush(vaultId: string): Promise<void> {\n      await serialFlush(vaultId)\n    },\n\n    async batch(vaultId: string, fn: () => Promise<void>): Promise<void> {\n      await load(vaultId) // ensure loaded before batch\n      batchDepth++\n      try {\n        await fn()\n      } finally {\n        batchDepth--\n      }\n      await serialFlush(vaultId)\n    },\n\n    async get(vault: string, collection: string, id: string): Promise<EncryptedEnvelope | null> {\n      const snap = await load(vault)\n      return snap[collection]?.[id] ?? null\n    },\n\n    async put(\n      vault: string,\n      collection: string,\n      id: string,\n      envelope: EncryptedEnvelope,\n      expectedVersion?: number,\n    ): Promise<void> {\n      const snap = await load(vault)\n\n      if (expectedVersion !== undefined) {\n        const current = snap[collection]?.[id]\n        const currentVersion = current?._v ?? 0\n        if (currentVersion !== expectedVersion) {\n          throw new ConflictError(\n            currentVersion,\n            `Expected version ${expectedVersion} but found ${currentVersion} on ${collection}/${id}`,\n          )\n        }\n      }\n\n      snap[collection] ??= {}\n      snap[collection][id] = envelope\n      await maybeFlush(vault)\n    },\n\n    async delete(vault: string, collection: string, id: string): Promise<void> {\n      const snap = await load(vault)\n      if (snap[collection]) {\n        delete snap[collection][id]\n        await maybeFlush(vault)\n      }\n    },\n\n    async list(vault: string, collection: string): Promise<string[]> {\n      const snap = await load(vault)\n      return Object.keys(snap[collection] ?? {})\n    },\n\n    async loadAll(vault: string): Promise<VaultSnapshot> {\n      const snap = await load(vault)\n      // #908 — two contract fixes in one place:\n      //  1. internal collections (`_keyring`, `_sync`) are the vault's own\n      //     bookkeeping and must not appear in a snapshot — `@noy-db/to-file`\n      //     sets the reference behaviour with this same `_`-prefix rule;\n      //  2. copy rather than hand out the live cache, which let a caller\n      //     mutating the result silently rewrite the wrapper's own state.\n      // `get()`/`list()` still serve internal collections; this is about what\n      // a *snapshot* claims, not about hiding data.\n      const out: VaultSnapshot = {}\n      for (const [collection, records] of Object.entries(snap)) {\n        if (collection.startsWith('_')) continue\n        out[collection] = { ...records }\n      }\n      return out\n    },\n\n    async saveAll(vault: string, data: VaultSnapshot): Promise<void> {\n      snapshots.set(vault, data)\n      loaded.add(vault)\n      await serialFlush(vault)\n    },\n  }\n\n  return store\n}\n\n// ─── Snapshot merge (last-write-wins per record) ────────────────────────\n\nfunction mergeSnapshots(remote: VaultSnapshot, local: VaultSnapshot): VaultSnapshot {\n  const merged: VaultSnapshot = {}\n\n  // Start with all remote collections\n  for (const [coll, records] of Object.entries(remote)) {\n    merged[coll] = { ...records }\n  }\n\n  // Overlay local collections — LWW by _ts per record\n  for (const [coll, records] of Object.entries(local)) {\n    if (!merged[coll]) {\n      merged[coll] = { ...records }\n      continue\n    }\n    for (const [id, envelope] of Object.entries(records)) {\n      const existing = merged[coll][id]\n      if (!existing || envelope._ts >= existing._ts) {\n        merged[coll][id] = envelope\n      }\n    }\n  }\n\n  return merged\n}\n\n// ─── Factory helper ─────────────────────────────────────────────────────\n\n/**\n * Type-safe factory helper for `NoydbPodStore` implementations,\n * analogous to `createStore` for KV stores.\n */\nexport function createPodStore<TOptions>(\n  factory: (options: TOptions) => NoydbPodStore,\n): (options: TOptions) => NoydbPodStore {\n  return factory\n}\n\n// ─── Deprecated aliases (pre-rename compatibility) ──────────────────────\n\n","/**\n * Redirect record (#944) — a signed \"this moved, go there\" pointer carried\n * in the pod's PLAINTEXT header (`NoydbPodHeader.redirect`, see\n * `format.ts`) so a dispatcher can follow it pre-auth: no secret, no\n * decompression.\n *\n * The record carries its OWN inner `sig` (via `signRecord`/`verifyRecord`\n * from `signature.ts`) — independent from, and in addition to, the #943\n * pod-header signature. A Redirect is REQUIRED to be signed: there is no\n * legacy unsigned install base for this new record type, so an absent or\n * invalid signature is invalid for following, not merely \"unverified\".\n *\n * Minimum-disclosure: the record is kept to exactly\n * `{ v, target, reason, issuedBy, sig }` — no timestamps, no identities\n * beyond the signer's `keyId` fingerprint.\n */\n\nimport type { DocSigner } from '../with-audit/attestation/signer.js'\nimport { signRecord, verifyRecord } from './signature.js'\nimport { readPodRedirect } from './pod.js'\nimport {\n  RedirectBadSignatureError,\n  RedirectDepthExceededError,\n  RedirectLoopError,\n  RedirectUnreachableError,\n} from '../kernel/errors.js'\n\n/**\n * A signed pointer to another pod. `target` is a locator string or URL —\n * the forthcoming #945 `Locator` type isn't built yet, so `target` stays a\n * plain string for now (forward-seam noted, not blurred: a Redirect says\n * \"go elsewhere once\"; a Locator will say \"where cargo lives\").\n */\nexport interface Redirect {\n  readonly v: 1\n  readonly target: string\n  readonly reason: 'moved' | 'release' | 'tombstone' | 'repoint'\n  readonly issuedBy: string\n  readonly sig: string\n}\n\n/**\n * Sign a new Redirect record with `signer`. Builds the record minus `sig`,\n * signs it via the #943 `signRecord` convention, and returns the complete\n * signed record.\n */\nexport async function signRedirect(\n  signer: DocSigner,\n  fields: { readonly target: string; readonly reason: Redirect['reason'] },\n): Promise<Redirect> {\n  const record = {\n    v: 1 as const,\n    target: fields.target,\n    reason: fields.reason,\n    issuedBy: signer.keyId,\n  }\n  const sig = await signRecord(signer.privateKeyPkcs8B64, record)\n  return { ...record, sig }\n}\n\n/**\n * Verify a Redirect record's signature against `trustedKeys`\n * (`keyId → publicKeyB64`). Fails closed: an `issuedBy` not present in\n * `trustedKeys` is untrusted/unverifiable and returns `false`, same as a\n * tampered or forged signature.\n */\nexport async function verifyRedirect(\n  record: Redirect,\n  trustedKeys: Readonly<Record<string, string>>,\n): Promise<boolean> {\n  const publicKeyB64 = trustedKeys[record.issuedBy]\n  if (publicKeyB64 === undefined) return false\n  const payload = { v: record.v, target: record.target, reason: record.reason, issuedBy: record.issuedBy }\n  return verifyRecord(publicKeyB64, record.sig, payload)\n}\n\n/** One followed hop's provenance — surfaced so a UI can show \"moved from X via Y\". */\nexport interface RedirectHop {\n  readonly target: string\n  readonly reason: Redirect['reason']\n  readonly issuedBy: string\n}\n\n/** Result of {@link followRedirects}: the terminal (non-redirect) pod's bytes, plus the ordered hop list that led there. */\nexport interface FollowRedirectsResult {\n  readonly terminal: Uint8Array\n  readonly hops: readonly RedirectHop[]\n}\n\n/**\n * Follow a chain of Redirect records starting from `start`'s pod bytes,\n * fetching each hop's target via `fetcher`, until a pod with no `redirect`\n * header field (the terminal) is reached.\n *\n * HTTP-redirect discipline: each hop's Redirect is verified against\n * `opts.trustedKeys` BEFORE it is followed (fail closed — an untrusted or\n * forged hop never advances the walk), loops are detected on the target\n * about to be followed, and the hop count is capped at `opts.maxDepth`\n * (default 8). `fetcher` throwing or returning `null` for a target means\n * that hop is unreachable.\n *\n * @throws {RedirectBadSignatureError} a hop's Redirect fails verification.\n * @throws {RedirectLoopError} a hop's target was already followed in this chain.\n * @throws {RedirectDepthExceededError} more than `maxDepth` hops were followed.\n * @throws {RedirectUnreachableError} `fetcher` threw or returned `null` for a target.\n */\nexport async function followRedirects(\n  start: Uint8Array,\n  fetcher: (target: string) => Promise<Uint8Array | null>,\n  opts: { readonly trustedKeys: Readonly<Record<string, string>>; readonly maxDepth?: number },\n): Promise<FollowRedirectsResult> {\n  const maxDepth = opts.maxDepth ?? 8\n  let current = start\n  const hops: RedirectHop[] = []\n  const visited = new Set<string>()\n\n  for (;;) {\n    const rec = readPodRedirect(current)\n    if (rec === undefined) return { terminal: current, hops }\n\n    if (!(await verifyRedirect(rec, opts.trustedKeys))) {\n      throw new RedirectBadSignatureError(rec.target)\n    }\n    if (visited.has(rec.target)) {\n      throw new RedirectLoopError(rec.target)\n    }\n    visited.add(rec.target)\n\n    hops.push({ target: rec.target, reason: rec.reason, issuedBy: rec.issuedBy })\n    if (hops.length > maxDepth) {\n      throw new RedirectDepthExceededError(maxDepth)\n    }\n\n    let next: Uint8Array | null\n    try {\n      next = await fetcher(rec.target)\n    } catch (cause) {\n      throw new RedirectUnreachableError(rec.target, cause)\n    }\n    if (next === null) {\n      throw new RedirectUnreachableError(rec.target)\n    }\n    current = next\n  }\n}\n","/**\n * `open(podBytesOrFile)` — the pod READ-path orchestrator (#941 Task 4).\n *\n * A free function (never a `Vault` method — `kernel/vault.ts` is at its\n * line ceiling and open() needs no vault-internal state that isn't already\n * reachable through published seams). Composes, in order:\n *\n *   1. `readPod` — parse + integrity-check the container (throws\n *      `PodIntegrityError` on a corrupted/truncated pod).\n *   2. `verifyPodHeader` — only when `opts.trustedKeys` is supplied.\n *      `'unsigned'` is benign (legacy pod, or `writePod({ sign: false })`)\n *      and open() proceeds; `'untrusted'` / `'tampered'` are fail-closed —\n *      `PodHeaderVerificationError` — mirroring `followRedirects`'s\n *      `RedirectBadSignatureError` posture: once a caller opts into\n *      verification, an unverifiable header is a hard stop.\n *   3. `createNoydb` + `openVault` + `vault.load(dumpJson)` — the exact\n *      unlock+restore sequence `bundle-roundtrip.test.ts` drives by hand.\n *      The pod header carries no vault name (minimum-disclosure —\n *      `format.ts`'s forbidden-fields list), so the caller names the\n *      target vault via `opts.vault`.\n *   4. Re-derive the `SchemaManifest` from the just-restored `_schemas/*`\n *      (the source of truth — Task 3's `deriveSchemaManifest`), via a\n *      NON-MINTING `LookupDEK` built from `loadKeyring`'s already-unwrapped\n *      `UnlockedKeyring.deks` map directly (`with-party/team/keyring.js`).\n *      **Not** `ensureCollectionDEK` (#941 review fix — Important 2): that\n *      helper mints+persists a fresh DEK into `_keyring/<user>` for any\n *      collection absent from the keyring, which is correct for a WRITE\n *      path but wrong here — `deriveSchemaManifest` only ever reads\n *      collections that already have a `_schemas` envelope, so an absent\n *      DEK means \"this principal can't decrypt this sibling\" (e.g. a\n *      collection-scoped grantee), never \"new collection.\" The old\n *      minting call polluted a scoped principal's freshly-restored keyring\n *      with garbage sibling DEKs on every `open()`. The returned\n *      `manifest` is that principal's own visible slice — see\n *      `derive.ts`'s `LookupDEK` doc and `sync.ts`'s module doc for the\n *      full rationale (the same distinction governs why the sync path\n *      must SKIP rather than write a partial manifest).\n *   5. Generation check (AC #4 coexistence): compare the HIGHEST\n *      per-collection generation stamp carried by the restored manifest\n *      against THIS store's schema-fence generation as it stood\n *      immediately before the restore (0 for a brand-new vault; whatever a\n *      coexisting local vault already had). If the pod is ahead and\n *      `!opts.allowGenerationAhead`, throw `MigrationRequiredError` (the\n *      same class `SchemaFenceController`'s write-path gate throws) — the\n *      reader hasn't reconciled schema changes that happened elsewhere.\n *      `allowGenerationAhead: true` is the documented dev override: open\n *      proceeds, with a console warning. Divergence in the OTHER direction\n *      (reader ahead of the pod) is non-fatal but also warned (#941\n *      review, Important 3 — AC #4 coexistence divergence must be\n *      observable in either direction, not just the bypass case).\n *\n *      NOTE: this deliberately reads per-collection entries, not\n *      `manifest.generation` itself. `_meta/schema-fence` is local\n *      session-coordination state and does NOT travel in a pod dump\n *      (`with-pod/backup.ts`'s reserved-collection list carries `_schemas`\n *      and `_manifest` but not `_meta`) — a fresh re-derive's top-level\n *      `generation` is always driven by the (untouched-by-restore) target\n *      store's own fence, not the pod's. Each `_schemas/<collection>`\n *      envelope's own `generation` field DOES travel (it's stamped at\n *      declare-time from the writer's real fence), so per-collection\n *      entries are the only signal that survives a restore intact.\n *\n * @module\n */\n\nimport { readPod, verifyPodHeader } from './pod.js'\nimport type { NoydbPodHeader } from './format.js'\nimport type { PodVerifyResult } from './pod.js'\nimport { createNoydb } from '../kernel/noydb.js'\nimport type { Noydb } from '../kernel/noydb.js'\nimport type { Vault } from '../kernel/vault.js'\nimport type { NoydbOptions, NoydbStore, EchoSecretParts } from '../kernel/types.js'\nimport { MigrationRequiredError, PodHeaderVerificationError } from '../kernel/errors.js'\nimport { loadKeyring } from '../with-party/team/keyring.js'\nimport { loadFence } from '../with-shape/schema-update/fence.js'\nimport { deriveSchemaManifest, type LookupDEK } from '../with-shape/manifest/derive.js'\nimport type { SchemaManifest } from '../with-shape/manifest/types.js'\n\nexport interface OpenPodOptions {\n  /** The ciphertext store to restore into (and where the opened `Vault` lives). */\n  readonly store: NoydbStore\n  /**\n   * The target vault name. The pod header deliberately carries no vault\n   * name (minimum-disclosure — `NoydbPodHeader`'s forbidden-fields list),\n   * so the caller names the vault to restore into/open.\n   */\n  readonly vault: string\n  /** User identifier — passed through to `createNoydb`. */\n  readonly user: string\n  /** That user's secret — passed through to `createNoydb` / `loadKeyring`. */\n  readonly secret: string | EchoSecretParts\n  /**\n   * Trusted signing keys (`keyId → publicKeyB64`). When supplied,\n   * `verifyPodHeader` runs and its result is returned as `verification`.\n   * Omitted → no verification attempted, `verification` is absent.\n   */\n  readonly trustedKeys?: Readonly<Record<string, string>>\n  /**\n   * Passthrough to `createNoydb` for every option beyond `store`/`user`/\n   * `secret` (history/indexing/blobs/… strategies, `secretMode`, etc.).\n   */\n  readonly noydbOptions?: Omit<NoydbOptions, 'store' | 'user' | 'secret'>\n  /**\n   * Dev override for the generation-ahead fence (AC #4). Default `false`:\n   * a pod whose schema manifest generation is ahead of this store's\n   * pre-restore fence generation throws `MigrationRequiredError`. `true`\n   * opens anyway, logging a console warning.\n   */\n  readonly allowGenerationAhead?: boolean\n}\n\nexport interface OpenPodResult {\n  readonly db: Noydb\n  readonly vault: Vault\n  readonly header: NoydbPodHeader\n  /** Present iff `opts.trustedKeys` was supplied. */\n  readonly verification?: PodVerifyResult\n  /** The pod's schema manifest, re-derived from the just-restored `_schemas/*`. */\n  readonly manifest?: SchemaManifest\n}\n\n/**\n * Open a `.noydb` pod: verify its integrity (and, opt-in, its signature),\n * unlock + restore it into `opts.vault`, and re-derive its schema manifest.\n * See the module doc for the full flow and the errors each step can throw.\n */\nexport async function open(podFileOrBytes: Uint8Array, opts: OpenPodOptions): Promise<OpenPodResult> {\n  const { header, dumpJson } = await readPod(podFileOrBytes)\n\n  let verification: PodVerifyResult | undefined\n  if (opts.trustedKeys !== undefined) {\n    verification = await verifyPodHeader(podFileOrBytes, opts.trustedKeys)\n    if (verification.status === 'untrusted' || verification.status === 'tampered') {\n      throw new PodHeaderVerificationError(verification.status, verification.keyId)\n    }\n  }\n\n  // Reader's pre-restore generation snapshot (see module doc, step 5) —\n  // must be read from the raw store BEFORE vault.load() overwrites it.\n  const readerGeneration = (await loadFence(opts.store, opts.vault)).currentSchemaVersion\n\n  const db = await createNoydb({ ...opts.noydbOptions, store: opts.store, user: opts.user, secret: opts.secret })\n  const vault = await db.openVault(opts.vault)\n  await vault.load(dumpJson)\n\n  // #941 review fix: a NON-MINTING lookup, not `ensureCollectionDEK` (which\n  // mints+persists a fresh DEK for any collection absent from the keyring).\n  // open() is a READ path — deriveSchemaManifest only ever iterates\n  // collections that already have a `_schemas` envelope, so an absent DEK\n  // here means \"this principal cannot decrypt this sibling,\" never \"new\n  // collection.\" The old minting call polluted a scoped principal's just-\n  // restored `_keyring/<user>` file with garbage sibling DEKs on every\n  // open(). See `derive.ts`'s `LookupDEK` doc for the full rationale.\n  const keyring = await loadKeyring(opts.store, opts.vault, { userId: opts.user, secret: opts.secret })\n  const lookupDEK: LookupDEK = async (name) => keyring.deks.get(name)\n  const { manifest, undecodableCollections } = await deriveSchemaManifest(opts.store, opts.vault, lookupDEK)\n\n  // A scoped principal's `manifest` is legitimately their own visible\n  // slice (see `sync.ts`'s module doc) — `open()` is a per-principal read,\n  // not an assertion of pod-wide completeness. `undecodableCollections` is\n  // intentionally not surfaced on `OpenPodResult` (out of this fix's\n  // scope); callers that need it can call `deriveSchemaManifest` directly.\n  void undecodableCollections\n\n  // See module doc, step 5 — the pod's generation signal is the highest\n  // per-collection stamp, not the (locally re-derived, fence-driven)\n  // top-level `manifest.generation`.\n  const podGeneration = Object.values(manifest.collections)\n    .reduce((max, entry) => Math.max(max, entry.generation), 0)\n\n  if (podGeneration > readerGeneration) {\n    if (!opts.allowGenerationAhead) {\n      throw new MigrationRequiredError(\n        `open(): pod's schema generation (${podGeneration}) is ahead of vault ` +\n          `\"${opts.vault}\"'s local generation (${readerGeneration}). Pass ` +\n          `\\`allowGenerationAhead: true\\` to open anyway, or reconcile the schema first.`,\n      )\n    }\n    console.warn(\n      `[noy-db] open(): vault \"${opts.vault}\" opened with allowGenerationAhead — pod schema ` +\n        `generation ${podGeneration} is ahead of the local generation ${readerGeneration}.`,\n    )\n  } else if (podGeneration < readerGeneration) {\n    // #941 review (Important 3, AC #4): divergence in EITHER direction\n    // should be observable, not just the ahead-bypass case above. The\n    // reader being ahead of the pod is non-fatal (the pod is simply older\n    // content) but silent coexistence divergence is exactly what AC #4\n    // asks to surface — same `[noy-db]`-prefixed console.warn facility as\n    // `sync.ts`'s cap-exhaustion warning.\n    console.warn(\n      `[noy-db] open(): vault \"${opts.vault}\"'s local schema generation (${readerGeneration}) is ` +\n        `ahead of the pod's (${podGeneration}) — the pod reflects an earlier schema than this reader.`,\n    )\n  }\n\n  return { db, vault, header, manifest, ...(verification !== undefined ? { verification } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,IAAM,uBAAuB;AA4C7B,IAAM,uBAAuB;AAwBtB,SAAS,aACd,QACA,SACsB;AACtB,QAAM,YAAY,SAAS,cAAc;AAGzC,QAAM,YAAY,oBAAI,IAA2B;AACjD,QAAM,WAAW,oBAAI,IAA2B;AAChD,QAAM,SAAS,oBAAI,IAAY;AAG/B,MAAI,aAAa;AAMjB,QAAM,UAAU,oBAAI,IAAoC;AAExD,iBAAe,KAAK,OAAuC;AACzD,QAAI,OAAO,IAAI,KAAK,EAAG,QAAO,UAAU,IAAI,KAAK;AAEjD,UAAM,WAAW,QAAQ,IAAI,KAAK;AAClC,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AAC3B,YAAM,SAAS,MAAM,OAAO,WAAW,KAAK;AAC5C,UAAI,QAAQ;AACV,cAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,cAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,kBAAU,IAAI,OAAO,OAAO,IAAI;AAChC,iBAAS,IAAI,OAAO,OAAO,OAAO;AAAA,MACpC,OAAO;AACL,kBAAU,IAAI,OAAO,CAAC,CAAC;AACvB,iBAAS,IAAI,OAAO,IAAI;AAAA,MAC1B;AAEA,aAAO,IAAI,KAAK;AAChB,aAAO,UAAU,IAAI,KAAK;AAAA,IAC5B,GAAG;AAEH,YAAQ,IAAI,OAAO,OAAO;AAC1B,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AAGA,cAAQ,OAAO,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,MAAM,OAA8B;AACjD,UAAM,WAAW,UAAU,IAAI,KAAK,KAAK,CAAC;AAC1C,UAAM,SAA0B;AAAA,MAC9B,qBAAqB;AAAA,MACrB;AAAA,MACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC3B,MAAM;AAAA,IACR;AACA,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AAC7D,UAAM,kBAAkB,SAAS,IAAI,KAAK,KAAK;AAE/C,aAAS,UAAU,GAAG,UAAU,sBAAsB,WAAW;AAC/D,UAAI;AACF,cAAM,EAAE,SAAS,WAAW,IAAI,MAAM,OAAO,YAAY,OAAO,OAAO,eAAe;AACtF,iBAAS,IAAI,OAAO,UAAU;AAC9B;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,2BAA2B,UAAU,uBAAuB,GAAG;AAEhF,gBAAM,SAAS,MAAM,OAAO,WAAW,KAAK;AAC5C,cAAI,QAAQ;AACV,kBAAM,aAAa,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AACxD,kBAAM,eAAe,KAAK,MAAM,UAAU;AAC1C,kBAAM,YAAY,UAAU,IAAI,KAAK,KAAK,CAAC;AAC3C,kBAAM,aAAa,eAAe,aAAa,MAAM,SAAS;AAC9D,sBAAU,IAAI,OAAO,UAAU;AAC/B,qBAAS,IAAI,OAAO,OAAO,OAAO;AAAA,UACpC;AAEA;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAQA,QAAM,aAAa,oBAAI,IAA2B;AAElD,WAAS,YAAY,OAA8B;AACjD,UAAM,OAAO,WAAW,IAAI,KAAK,KAAK,QAAQ,QAAQ;AAGtD,UAAM,OAAO,KAAK,KAAK,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,KAAK,CAAC;AAC7D,eAAW,IAAI,OAAO,IAAI;AAC1B,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,OAA8B;AACtD,QAAI,aAAa,eAAe,GAAG;AACjC,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,QAA8B;AAAA,IAClC,MAAM,OAAO,QAAQ;AAAA,IAErB,MAAM,MAAM,SAAgC;AAC1C,YAAM,YAAY,OAAO;AAAA,IAC3B;AAAA,IAEA,MAAM,MAAM,SAAiB,IAAwC;AACnE,YAAM,KAAK,OAAO;AAClB;AACA,UAAI;AACF,cAAM,GAAG;AAAA,MACX,UAAE;AACA;AAAA,MACF;AACA,YAAM,YAAY,OAAO;AAAA,IAC3B;AAAA,IAEA,MAAM,IAAI,OAAe,YAAoB,IAA+C;AAC1F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,aAAO,KAAK,UAAU,IAAI,EAAE,KAAK;AAAA,IACnC;AAAA,IAEA,MAAM,IACJ,OACA,YACA,IACA,UACA,iBACe;AACf,YAAM,OAAO,MAAM,KAAK,KAAK;AAE7B,UAAI,oBAAoB,QAAW;AACjC,cAAM,UAAU,KAAK,UAAU,IAAI,EAAE;AACrC,cAAM,iBAAiB,SAAS,MAAM;AACtC,YAAI,mBAAmB,iBAAiB;AACtC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,oBAAoB,eAAe,cAAc,cAAc,OAAO,UAAU,IAAI,EAAE;AAAA,UACxF;AAAA,QACF;AAAA,MACF;AAEA,WAAK,UAAU,MAAM,CAAC;AACtB,WAAK,UAAU,EAAE,EAAE,IAAI;AACvB,YAAM,WAAW,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,OAAO,OAAe,YAAoB,IAA2B;AACzE,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,KAAK,UAAU,GAAG;AACpB,eAAO,KAAK,UAAU,EAAE,EAAE;AAC1B,cAAM,WAAW,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,OAAe,YAAuC;AAC/D,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,aAAO,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,QAAQ,OAAuC;AACnD,YAAM,OAAO,MAAM,KAAK,KAAK;AAS7B,YAAM,MAAqB,CAAC;AAC5B,iBAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,IAAI,GAAG;AACxD,YAAI,WAAW,WAAW,GAAG,EAAG;AAChC,YAAI,UAAU,IAAI,EAAE,GAAG,QAAQ;AAAA,MACjC;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAe,MAAoC;AAC/D,gBAAU,IAAI,OAAO,IAAI;AACzB,aAAO,IAAI,KAAK;AAChB,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;AAIA,SAAS,eAAe,QAAuB,OAAqC;AAClF,QAAM,SAAwB,CAAC;AAG/B,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,WAAO,IAAI,IAAI,EAAE,GAAG,QAAQ;AAAA,EAC9B;AAGA,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,QAAI,CAAC,OAAO,IAAI,GAAG;AACjB,aAAO,IAAI,IAAI,EAAE,GAAG,QAAQ;AAC5B;AAAA,IACF;AACA,eAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,YAAM,WAAW,OAAO,IAAI,EAAE,EAAE;AAChC,UAAI,CAAC,YAAY,SAAS,OAAO,SAAS,KAAK;AAC7C,eAAO,IAAI,EAAE,EAAE,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,eACd,SACsC;AACtC,SAAO;AACT;;;ACxQA,eAAsB,aACpB,QACA,QACmB;AACnB,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,EACnB;AACA,QAAM,MAAM,MAAM,WAAW,OAAO,oBAAoB,MAAM;AAC9D,SAAO,EAAE,GAAG,QAAQ,IAAI;AAC1B;AAQA,eAAsB,eACpB,QACA,aACkB;AAClB,QAAM,eAAe,YAAY,OAAO,QAAQ;AAChD,MAAI,iBAAiB,OAAW,QAAO;AACvC,QAAM,UAAU,EAAE,GAAG,OAAO,GAAG,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AACvG,SAAO,aAAa,cAAc,OAAO,KAAK,OAAO;AACvD;AAgCA,eAAsB,gBACpB,OACA,SACA,MACgC;AAChC,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,UAAU;AACd,QAAM,OAAsB,CAAC;AAC7B,QAAM,UAAU,oBAAI,IAAY;AAEhC,aAAS;AACP,UAAM,MAAM,gBAAgB,OAAO;AACnC,QAAI,QAAQ,OAAW,QAAO,EAAE,UAAU,SAAS,KAAK;AAExD,QAAI,CAAE,MAAM,eAAe,KAAK,KAAK,WAAW,GAAI;AAClD,YAAM,IAAI,0BAA0B,IAAI,MAAM;AAAA,IAChD;AACA,QAAI,QAAQ,IAAI,IAAI,MAAM,GAAG;AAC3B,YAAM,IAAI,kBAAkB,IAAI,MAAM;AAAA,IACxC;AACA,YAAQ,IAAI,IAAI,MAAM;AAEtB,SAAK,KAAK,EAAE,QAAQ,IAAI,QAAQ,QAAQ,IAAI,QAAQ,UAAU,IAAI,SAAS,CAAC;AAC5E,QAAI,KAAK,SAAS,UAAU;AAC1B,YAAM,IAAI,2BAA2B,QAAQ;AAAA,IAC/C;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAQ,IAAI,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,YAAM,IAAI,yBAAyB,IAAI,QAAQ,KAAK;AAAA,IACtD;AACA,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,yBAAyB,IAAI,MAAM;AAAA,IAC/C;AACA,cAAU;AAAA,EACZ;AACF;;;AClBA,eAAsB,KAAK,gBAA4B,MAA8C;AACnG,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,QAAQ,cAAc;AAEzD,MAAI;AACJ,MAAI,KAAK,gBAAgB,QAAW;AAClC,mBAAe,MAAM,gBAAgB,gBAAgB,KAAK,WAAW;AACrE,QAAI,aAAa,WAAW,eAAe,aAAa,WAAW,YAAY;AAC7E,YAAM,IAAI,2BAA2B,aAAa,QAAQ,aAAa,KAAK;AAAA,IAC9E;AAAA,EACF;AAIA,QAAM,oBAAoB,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK,GAAG;AAEnE,QAAM,KAAK,MAAM,YAAY,EAAE,GAAG,KAAK,cAAc,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,KAAK,OAAO,CAAC;AAC9G,QAAM,QAAQ,MAAM,GAAG,UAAU,KAAK,KAAK;AAC3C,QAAM,MAAM,KAAK,QAAQ;AAUzB,QAAM,UAAU,MAAM,YAAY,KAAK,OAAO,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,QAAQ,KAAK,OAAO,CAAC;AACpG,QAAM,YAAuB,OAAO,SAAS,QAAQ,KAAK,IAAI,IAAI;AAClE,QAAM,EAAE,UAAU,uBAAuB,IAAI,MAAM,qBAAqB,KAAK,OAAO,KAAK,OAAO,SAAS;AAOzG,OAAK;AAKL,QAAM,gBAAgB,OAAO,OAAO,SAAS,WAAW,EACrD,OAAO,CAAC,KAAK,UAAU,KAAK,IAAI,KAAK,MAAM,UAAU,GAAG,CAAC;AAE5D,MAAI,gBAAgB,kBAAkB;AACpC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR,oCAAoC,aAAa,wBAC3C,KAAK,KAAK,yBAAyB,gBAAgB;AAAA,MAE3D;AAAA,IACF;AACA,YAAQ;AAAA,MACN,2BAA2B,KAAK,KAAK,mEACrB,aAAa,qCAAqC,gBAAgB;AAAA,IACpF;AAAA,EACF,WAAW,gBAAgB,kBAAkB;AAO3C,YAAQ;AAAA,MACN,2BAA2B,KAAK,KAAK,gCAAgC,gBAAgB,4BAC5D,aAAa;AAAA,IACxC;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,OAAO,QAAQ,UAAU,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC,EAAG;AAChG;","names":[]}

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-PVU7LW5L.js";
+} from "../chunk-EJIVFOOQ.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,15 +11,15 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-QD724WDJ.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-W5W6KHN2.js";
+} from "../chunk-N2HKBESK.js";
+import "../chunk-KDX6VEYV.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ClassifiedConfigError,

package/dist/{classified-marker-FTOX7Q5L.js → classified-marker-PMDG3O36.js}

@@ -13,11 +13,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-TMD6YRCX.js");
+  const { persistClassifiedMarker } = await import("./register-UPD4GKBC.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-N7LB275C.js");
+  const { loadPersistedSchema } = await import("./storage-MJHKNQRO.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -25,4 +25,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-FTOX7Q5L.js.map
+//# sourceMappingURL=classified-marker-PMDG3O36.js.map

package/dist/collection-facade-ZJK5EB33.js

@@ -0,0 +1,45 @@
+import {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+} from "./chunk-OWGEHDT2.js";
+import "./chunk-5JT4Y5UE.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-PG6PFMDC.js";
+import "./chunk-GYUCRDAU.js";
+import "./chunk-437FDIHO.js";
+import "./chunk-KDX6VEYV.js";
+import "./chunk-RNSC2ARR.js";
+import "./chunk-47ZFULEZ.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-ZJK5EB33.js.map

package/dist/{computed-6G5M3UPH.js → computed-UHCBRILW.js}

@@ -1,11 +1,11 @@
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-VMCCGUQB.js";
-import "./chunk-HNGSV2YC.js";
+} from "./chunk-GDGTIWB4.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-6G5M3UPH.js.map
+//# sourceMappingURL=computed-UHCBRILW.js.map

package/dist/consent/index.js

@@ -2,20 +2,20 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-I6SDX7WX.js";
+} from "../chunk-NYSD43OE.js";
 import {
   NO_CONSENT
 } from "../chunk-PEOZ34EM.js";
-import "../chunk-ZJADGNYF.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+import "../chunk-4AOERLTV.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/cover/index.js

@@ -14,9 +14,16 @@ import {
   saveCover,
   validateCoverInput,
   validateCoverSize
-} from "../chunk-SZ2K3MHL.js";
-import "../chunk-W5W6KHN2.js";
-import "../chunk-HNGSV2YC.js";
+} from "../chunk-DYASJSKI.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   COVER_FIELDS,

package/dist/custody/index.js

@@ -2,20 +2,20 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-NKH7GSIH.js";
-import "../chunk-ERB6NDDW.js";
-import "../chunk-UIBGXRDD.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-XGQGWZ6D.js";
+import "../chunk-RKDH6L53.js";
+import "../chunk-JHO6FGZX.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   CustodyNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   CustodyApi,

package/dist/{dead-filter-ENRIOQIE.js → dead-filter-777VWDER.js}

@@ -5,7 +5,7 @@ import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-N7LB275C.js");
+  const { loadPersistedSchema } = await import("./storage-MJHKNQRO.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -25,4 +25,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-ENRIOQIE.js.map
+//# sourceMappingURL=dead-filter-777VWDER.js.map

package/dist/debug/index.js

@@ -1,7 +1,7 @@
 import {
   DebugPlaintextError,
   DebugReservedFieldError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/debug.ts

package/dist/{delegation-SSEPLXXO.js → delegation-4R5DU23X.js}

@@ -1,26 +1,30 @@
-import {
-  dekKey
-} from "./chunk-AHLJSVRL.js";
+import "./chunk-HTMQBBF3.js";
 import {
   generateULID
-} from "./chunk-ZJADGNYF.js";
+} from "./chunk-4AOERLTV.js";
+import {
+  dekKey
+} from "./chunk-47ZFULEZ.js";
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-VN45YLWM.js";
-import "./chunk-NWCGDAV6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-D5UDZANO.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-VCETL77O.js";
-import "./chunk-W5W6KHN2.js";
+} from "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-party/team/delegation.ts
@@ -52,15 +56,12 @@ async function issueDelegation(store, vault, grantor, targetKek, delegationsDek,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   const plaintext = JSON.stringify(token);
-  const { iv, data } = await encrypt(plaintext, delegationsDek);
-  const envelope = {
-    _noydb: 1,
-    _v: 1,
-    _ts: token.createdAt,
-    _iv: iv,
-    _data: data,
-    _by: grantor.userId
-  };
+  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 };
+  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity));
+  const envelope = buildRecordEnvelope(
+    identity,
+    { ts: token.createdAt, iv, data }
+  );
   await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope);
   return token;
 }
@@ -73,7 +74,7 @@ async function loadActiveDelegations(store, vault, user, delegationsDek, now = /
     if (!env) continue;
     let token;
     try {
-      const plaintext = await openEnvelopeJson(env, delegationsDek);
+      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek);
       token = JSON.parse(plaintext);
     } catch {
       continue;
@@ -102,4 +103,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-SSEPLXXO.js.map
+//# sourceMappingURL=delegation-4R5DU23X.js.map

package/dist/delegation-4R5DU23X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 }\n  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts: token.createdAt, iv, data},\n  )\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,WAAW,EAAE,YAAY,wBAAwB,IAAI,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS,EAAE;AACpG,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,gBAAgB,eAAe,QAAQ,CAAC;AACtF,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,MAAM,WAAW,IAAI,KAAI;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,GAAG,GAAG,KAAK,cAAc;AACxG,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/derivations/index.js

@@ -1,29 +1,29 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-6HFM7EIT.js";
+} from "../chunk-MNMYHZVU.js";
 import {
   DerivationRegistry
-} from "../chunk-NJDQ4YSV.js";
+} from "../chunk-WBNXZU42.js";
 import {
   DerivationExecutor
-} from "../chunk-YAWK6AWF.js";
-import "../chunk-7TSYBD3E.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-JIF3IBRK.js";
+import "../chunk-RSFG7XHM.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-3WAS2G5T.js

@@ -0,0 +1,22 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-N7YAQKAO.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-3WAS2G5T.js.map