@noy-db/hub 0.6.0-pre.21 → 0.6.0-pre.23

package/CHANGELOG.md

@@ -1,5 +1,243 @@
 # Changelog — hub
 
+## 0.6.0-pre.23
+
+### Minor Changes
+
+- Query-form materialized views can join a declared ref, and a late `refs` declaration is no longer silently discarded.
+
+  **#1141 — `refs` declared on an already-constructed collection were dropped.** The declaration fan-out ran only when `vault.collection()` missed its cache, so any earlier touch of the collection silently discarded a later `refs` declaration: strict FK enforcement never engaged (a dangling `put()` was accepted) and `.join()` kept reporting "no ref() declared". `refs` now late-attaches through the same reconcile ladder every other declaration already used. An identical redeclaration stays a no-op; a conflicting one still throws.
+
+  **#1139 — a query-form MV that joins a declared FK threw at `openVault()`, with no ordering that avoided it.** MV strategies register during `openVault()`, but a collection's refs can only be declared after it returns, so the plan was built before any ref could exist. Such a strategy is now parked and replanned on the first write dispatch or `vault.refreshView()`, matching the projection form's timing. Every other planning failure still throws out of `openVault()` immediately — only a not-yet-declared ref defers.
+
+  Adds `RefNotDeclaredError` to the root barrel: `.join()` now throws it instead of a bare `Error`, with an unchanged message, so the deferral condition is matched on a type rather than on text.
+
+- Report blob chunks that outlived their index row (#1133).
+
+  `vault.compact()` now returns `orphanBlobChunks` — a count of `_blob_chunks` rows whose eTag has no `_blob_index` entry, the distinct eTags involved, a small sample to inspect, and a separate count of ids that do not fit the `{eTag}_{index}` grammar at all. `reportOrphanBlobChunks(store, vault)` is exported from `@noy-db/hub/blobs` for callers that want it on its own.
+
+  This is the residue #1127 stopped producing: before that fix a crash between deleting a blob's index row and its chunks stranded bodies no reader and no key rotation can reach, which for a legacy blob leaves bytes openable under a retired `_blob` DEK.
+
+  **It reports and never reclaims, deliberately.** Deciding "orphaned" means trusting `store.list`, and the store is untrusted — one withheld index row would make a live blob's chunks look orphaned, so a reclaim pass would convert withholding, which is reversible, into permanent destruction. A lying store can only inflate this count.
+
+- Projection MV legs can attach to another leg's alias (#1140).
+
+  `ProjectionJoinLeg` gains `from`, naming a previously-declared FORWARD leg. A collect leg then matches against that leg's record id instead of the primary row's, and a forward leg reads its FK off that record — which makes a lookup two FKs away expressible for the first time:
+
+  ```ts
+  joins: [
+    { field: "entityId", as: "entity" },
+    { from: "entity", collect: "clients", on: "entityId", as: "clients" },
+  ];
+  ```
+
+  Every leg previously attached to the primary row, so `bill → entity → client` had no shape: the bill has no `clientId`, and `clients.entityId` refs `entities`, not `bills`. The two workarounds were denormalizing a redundant FK onto the source — reintroducing the duplicated relationship a projection MV exists to avoid — or dropping back to app code and forfeiting the dependency tracking.
+
+  `from` may only name a leg declared earlier, and only a forward one (a collect leg holds an array, not a record). Both are refused at `withMaterializedView()` construction, alongside the rest of the leg-shape checks. The backward-only rule is also why no depth cap is needed: a cycle cannot be spelled. `from` is folded into the plan summary, so two structurally different projections cannot share a `queryHash`.
+
+## 0.6.0-pre.22
+
+### Minor Changes
+
+- `.crossJoin()` gains a typed `outer` option (#1130).
+
+  `.crossJoin()` emits the left row once per matching right row, so an empty `on:`
+  subset dropped it entirely — no error, no warning, no count mismatch. It bites
+  hardest on a **reverse FK**, because `.join()` is forward-only on a declared
+  `ref()` and cannot express that direction, so `.crossJoin()` is the only tool
+  available. The reported case measured three rows in and one row out, with the
+  missing two vanishing silently from a list view.
+
+  ```ts
+  .crossJoin('clients', { as: 'client', outer: true, on: (b) => byEntity.get(b.entityId) ?? [] })
+  // every left row survives; `client` is `Client | null`
+  ```
+
+  `outer` applies to both call shapes: with `on:` the empty thing is that left
+  row's subset, and without it an empty TARGET collection is what would otherwise
+  drop every row — two separate branches in `applyCrossJoin`, both covered.
+
+  **The alias widens to `TTarget | null` only under `outer: true`**, via a third
+  type parameter rather than a plain boolean, so existing inner-mode callers are
+  untouched and are not made to null-check something that cannot occur. Both
+  directions are asserted at compile time in `cross-join-outer.test-d.ts`, because
+  neither mistake would show up in a runtime test.
+
+  The previously documented `?? [null]` idiom still works and is exactly what
+  `outer` does internally — a test asserts the two produce identical rows. Prefer
+  the flag: the idiom types the alias as non-null while the row can hold null, and
+  a later "simplification" that removes the `[null]` silently reintroduces the row
+  loss.
+
+  `outer` is folded into the query-plan summary, so a materialized view built on
+  the inner form is not served for an outer query, and a substituted null row
+  counts toward `maxRows` like any other row.
+
+### Patch Changes
+
+- `@noy-db/in-vue` ships `useLiveQuery()`, and `in-pinia` now delegates to it (#1131).
+
+  `kernel/query/live.ts` described a Vue wrapper for `LiveQuery` as though it were
+  provided, plus React/Solid/Svelte adapters that have never existed. #1132
+  corrected the prose. This ships the thing.
+
+  **There was exactly one implementation in the family and it was unreachable.**
+  `@noy-db/in-pinia`'s `store.liveQuery()` already did this correctly — subscribe
+  once, mirror into a `ShallowRef`, re-read `error` on every notification, dispose
+  via `onScopeDispose` — but it is a **store method, not an export**, so an export
+  enumeration cannot find it, and a Vue consumer not using Pinia had no route at
+  all. A pilot consumer hand-rolled the glue instead.
+
+  So `useLiveQuery` lands in `@noy-db/in-vue` (the base binding, no Pinia
+  required) and `in-pinia` calls it, keeping the readiness check and the query
+  build and nothing else. One implementation rather than two that drift — and
+  only one of two copies ever gets an error-semantics fix. `NoydbLiveQuery<R>` is
+  now an alias of `UseLiveQueryReturn<R>`, so the type has one definition too.
+
+  ```ts
+  const { items, error } = useLiveQuery(
+    vault.collection("bills").query().join("entityId", { as: "entity" }).live()
+  );
+  ```
+
+  **A hub doc-comment correction came out of building it, and it was backwards in
+  both halves.** `LiveQuery.value` was documented as _"updated in place… the
+  reference returned is the same array"_, advising callers to copy for change
+  detection. `refresh()` assigns `this._value = this.recompute()`, so the array is
+  **replaced**: the reference changes on every re-run, reference identity IS a
+  valid change signal (which is what makes a `shallowRef` correct and a copy
+  unnecessary), and a consumer who caches `value` holds a snapshot that never
+  updates. Verified by running it, not by reading it — two reads across a
+  notification are not `===`, and the first array still holds the old contents.
+
+  ⚠️ **Consumer-visible:** `@noy-db/in-pinia` now declares `@noy-db/in-vue` as a
+  (non-optional) peer, matching how the family already wires satellite-to-satellite
+  deps — `in-nextjs` → `in-react`, `in-nuxt` → `in-pinia`/`in-vue`,
+  `in-devtools-tui` → `in-devtools`. A Nuxt consumer already has it, since
+  `in-nuxt` peers on both. A **plain Pinia** consumer must add one line to their
+  install; the two ship on the same lockstep version line. It is deliberately not
+  optional — `store.liveQuery()` does not work without it, and an optional peer
+  would turn that into a runtime resolution failure instead of an install-time one.
+
+  The test suite asserts through a `watch` inside an `effectScope` rather than by
+  reading `items.value`. Reading the ref passes even if Vue reactivity is entirely
+  broken, since the value is correct either way; only a watcher proves a component
+  would re-render.
+
+- `KeyringTamperedError` stops accusing the store when the cause is an upgrade (#1129).
+
+  `roster_tag` and the reserved `_roster` key ship for the first time in
+  `0.6.0-pre.21`, so **no keyring written by any earlier release carries either**.
+  Every existing vault therefore fails at unlock on upgrade — and was told _"The
+  store serving this vault may have altered the roster."_ Measured, not assumed: a
+  vault written by published `0.6.0-pre.20` and opened by `pre.21` reports
+  `roster-key-missing` (the roster-key check precedes the tag check).
+
+  The refusal is correct and unchanged — the format is replaced, not migrated
+  (#1100, ADR 0003 Decision 5), and the vault must be re-seeded. What changes is
+  what the user reads. The absence labels now lead with the format transition,
+  because that is the overwhelming base rate on upgrade day, while still naming the
+  attack reading and still refusing. `roster-tag-mismatch` keeps its unqualified
+  alert: no released version ever wrote a mismatched tag, so it is not reachable by
+  a format transition.
+
+  **No benign/attack discriminant was added, and none is possible.** #1103 could
+  build one for records because the benign case must produce a body that _decrypts
+  under the DEK_, which an untrusted store cannot fabricate — a successful retry is
+  positive evidence. A keyring's benign case is a _deleted field_, which a store
+  produces with no key at all. Verified by probe: stripping `_roster` and
+  `roster_tag` from a genuine `pre.21` file gives output byte-identical to opening a
+  real `pre.20` vault. "Absent means old and fine" would be a downgrade path.
+
+  A code comment claiming an absent canary "is not an old file" is corrected: the
+  policy it justified is right, the factual claim was wrong (`canary` was optional
+  through `pre.19`, and its own doc said older keyrings have none). `SECURITY.md`
+  gains a _Reading a `KeyringTamperedError`_ section stating that, unlike
+  `TamperedError.reason`, these five values are mechanism labels and **not** a
+  benign-vs-attack verdict.
+
+- A crash mid-shred no longer strands blob chunks under a retired DEK (#1127).
+
+  `releaseRef` deleted a blob's index row BEFORE its chunks. A crash in between
+  left chunk bodies nothing can ever reach: `loadBlobObject` returns null so no
+  reader addresses them, and `rekeyBlobSet` derives chunk ids from each index
+  entry's `chunkCount`, so a rotation walks straight past. For a **legacy** blob —
+  bytes under the `_blob` DEK itself rather than a per-blob content CEK — those
+  bodies stayed openable under the retired `_blob` DEK, which is exactly the key a
+  revoked member walked away with. Crash during `forget()`, revoke later, and real
+  blob content sat readable indefinitely.
+
+  It was silent on every side: no error at crash time (the marked shred path
+  catches per-hold and files the eTag under `residue`), no error at rotation time,
+  and the rotation reported success.
+
+  **The fix is the deletion ORDER, not a cleanup pass.** Chunks are now deleted
+  before the index row, so every chunk that survives has an index row, is
+  therefore reachable by `rekeyBlobSet`, and is therefore re-keyed. There is no
+  orphan to sweep because none is produced. The residue this leaves instead — an
+  index row whose chunks are partly gone — is strictly better: it is reachable, so
+  re-running `releaseRef` completes idempotently; `rekeyBlobSet` already tolerates
+  it; and it cannot leak, because the bytes that survive are the ones rotation
+  still covers.
+
+  This also makes one ordering rule true across the blob subsystem instead of two
+  opposite ones — `rekey-blob.ts` already re-encrypts chunks before re-sealing
+  their index entry and documents that order as its resume property.
+
+  **Deliberately not bundled: a sweep that deletes pre-existing orphans.** Such a
+  sweep must decide "orphaned" from `store.list(_blob_index)`, and the store is
+  untrusted. A store withholding one index row could make a live blob's chunks
+  look orphaned and have us destroy them — converting withholding, which is
+  reversible, into permanent loss. That is #1133.
+
+  One reader path needed a matching correction, found by the full suite rather
+  than by reasoning: `resolveRehomedVersionETag` read the OLD blob's bytes while
+  resuming a rehome. Under the previous order a crashed delete had already removed
+  the index row, so that read happened to see "absent"; with chunks going first
+  the row can outlive its own bytes, and the read raised `BlobOfflineError` on
+  content that was deliberately destroyed. It now keys off the LOGICAL state —
+  `refCount <= 0` means the last hold is released and the row is an un-reaped
+  tombstone — and still completes the interrupted deletion, which is what a resume
+  owes there. That is more correct under either order than relying on the row's
+  physical absence.
+
+  Two regression rows reproduce the crash window by throwing on the first chunk
+  delete, which is the injection point that separates the two orderings (an index
+  delete would pass under both). Verified to fail before the fix, with three real
+  chunk bodies still opening under `_blob` after revocation.
+
+- Document two silent traps in the query DSL that no gate could see (#1130, #1131).
+
+  Both were found by a pilot consumer, and both cost real time because the
+  published prose described a world that did not exist. Neither is a behaviour
+  change — the code is unchanged.
+
+  **`.crossJoin()` is an INNER join and says so nowhere.** Each left row is
+  emitted once per matching right row (`builder.ts:1487`), so an empty `on:`
+  subset drops the row with no error, no warning and no count mismatch. This
+  bites hardest on a reverse FK, where `.join()` — forward-only, and already a
+  genuine LEFT outer join — does not apply, so `.crossJoin()` is the only tool
+  and the natural fixture always has both sides present. The method doc now
+  carries the warning and the `[null]` idiom that restores the row, with a note
+  that `[null]` is load-bearing rather than a redundant fallback. A typed
+  `outer:` option is #1130.
+
+  **`live()`'s doc comment described four framework adapters, none of which
+  existed.** It named "the Vue layer" plus React/Solid/Svelte. The only binding
+  in the repo that wraps a `LiveQuery` is `@noy-db/in-pinia`'s
+  `store.liveQuery()` — which does subscribe-once, mirror into a `ShallowRef`,
+  re-read `error` on every notification, and dispose via `onScopeDispose`. A
+  consumer followed the comment to `@noy-db/in-vue`, found nothing, and
+  hand-rolled the glue; the error semantics are the half a hand-rolled wrapper
+  usually gets wrong. The comment now names the package and states outright that
+  the other bindings have no wrapper.
+
+  That claim is now enforced by `scripts/__tests__/live-query-bindings.test.ts`,
+  which asserts on **which packages actually call `.live()`** rather than on the
+  comment's wording — so it fails both when a documented wrapper disappears and
+  when an undocumented one appears. Verified capable of failing, not merely
+  passing. Same defect class as #1063/#1072: prose no gate reads.
+
 ## 0.6.0-pre.21
 
 ### Patch Changes

package/dist/api-ETB5Y4DY.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-6W3BZCW6.js";
+import "./chunk-GJ5TMHKC.js";
+import "./chunk-FUE2KPKM.js";
+import "./chunk-PENPHA45.js";
+import "./chunk-OMXUQAZJ.js";
+import "./chunk-PUGHLCBW.js";
+import "./chunk-2LHPMFSR.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-RQQIB7CD.js";
+import "./chunk-IGNJOJEP.js";
+import "./chunk-HKANJAOP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-ETB5Y4DY.js.map

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-7LNE2N2V.js";
+} from "../chunk-Z7AHYSZF.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-DIZ6HM7Q.js";
+} from "../chunk-G6DAESDS.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-ESKIAXO2.js";
+} from "../chunk-23ODLABM.js";
 import {
   NO_ATTESTATION
-} from "../chunk-HR5R5JOM.js";
+} from "../chunk-D5DZ4R7X.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-OHOKBMTM.js";
+import "../chunk-FUE2KPKM.js";
 import "../chunk-PENPHA45.js";
-import "../chunk-GQXFOAYZ.js";
-import "../chunk-KV6JM2IA.js";
-import "../chunk-TMBSPLUG.js";
+import "../chunk-OMXUQAZJ.js";
+import "../chunk-PUGHLCBW.js";
+import "../chunk-2LHPMFSR.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AU3AUJIZ.js";
+import "../chunk-RQQIB7CD.js";
 import "../chunk-IGNJOJEP.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-CWM4GQD2.js";
+} from "../chunk-HKANJAOP.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-3JNJNPT3.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-NLJ3FCKL.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-Q7XQBMPA.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-N5TGVOTN.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-YXY6SHUH.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-XQ5STGT4.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-YXY6SHUH.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-XQ5STGT4.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-YXY6SHUH.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-XQ5STGT4.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-YXY6SHUH.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-XQ5STGT4.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-FSC36VWC.js → backup-UOLAXOJ4.js}

@@ -3,37 +3,37 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-6WO62AJW.js";
+} from "./chunk-SZFNO7L4.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-YALD3SST.js";
+} from "./chunk-G4577GK7.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-A4TOGAUW.js";
+} from "./chunk-VXH5Z22C.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-OHOKBMTM.js";
+import "./chunk-FUE2KPKM.js";
 import {
   buildRecordEnvelope
 } from "./chunk-PENPHA45.js";
-import "./chunk-GQXFOAYZ.js";
-import "./chunk-KV6JM2IA.js";
-import "./chunk-TMBSPLUG.js";
+import "./chunk-OMXUQAZJ.js";
+import "./chunk-PUGHLCBW.js";
+import "./chunk-2LHPMFSR.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-AU3AUJIZ.js";
+import "./chunk-RQQIB7CD.js";
 import {
   NOYDB_BACKUP_VERSION
 } from "./chunk-IGNJOJEP.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-FSC36VWC.js.map
+//# sourceMappingURL=backup-UOLAXOJ4.js.map

package/dist/blobs/index.js

@@ -2,6 +2,15 @@ import {
   importExternalObjects,
   memoryObjectProjection
 } from "../chunk-4Q6HSHHL.js";
+import {
+  BLOB_EVICTION_AUDIT_COLLECTION,
+  EXPORT_AUDIT_COLLECTION,
+  ExportBlobsAbortedError,
+  NO_BLOBS,
+  createExportBlobsHandle,
+  reportOrphanBlobChunks,
+  runCompaction
+} from "../chunk-TA67ZQUH.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -16,29 +25,21 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-JLYQQNY4.js";
-import {
-  BLOB_EVICTION_AUDIT_COLLECTION,
-  EXPORT_AUDIT_COLLECTION,
-  ExportBlobsAbortedError,
-  NO_BLOBS,
-  createExportBlobsHandle,
-  runCompaction
-} from "../chunk-4OQZNXQG.js";
-import "../chunk-JNMTN5D5.js";
-import "../chunk-NW4TY6VC.js";
-import "../chunk-PPCOKVFA.js";
-import "../chunk-OHOKBMTM.js";
+} from "../chunk-BYX3AUXH.js";
+import "../chunk-LZHIYH32.js";
+import "../chunk-3UIS6O6N.js";
+import "../chunk-6ZTPSVY7.js";
+import "../chunk-FUE2KPKM.js";
 import "../chunk-PENPHA45.js";
-import "../chunk-GQXFOAYZ.js";
-import "../chunk-KV6JM2IA.js";
-import "../chunk-TMBSPLUG.js";
+import "../chunk-OMXUQAZJ.js";
+import "../chunk-PUGHLCBW.js";
+import "../chunk-2LHPMFSR.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AU3AUJIZ.js";
+import "../chunk-RQQIB7CD.js";
 import "../chunk-IGNJOJEP.js";
 import {
   BlobOfflineError
-} from "../chunk-CWM4GQD2.js";
+} from "../chunk-HKANJAOP.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts
@@ -74,6 +75,7 @@ export {
   isPreCompressed,
   memoryBlobPinStore,
   memoryObjectProjection,
+  reportOrphanBlobChunks,
   runCompaction,
   withBlobs
 };

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-OIBEJN5H.js";
+} from "../chunk-LYQUFIHL.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-OHOKBMTM.js";
+} from "../chunk-FUE2KPKM.js";
 import "../chunk-PENPHA45.js";
-import "../chunk-GQXFOAYZ.js";
-import "../chunk-KV6JM2IA.js";
-import "../chunk-TMBSPLUG.js";
+import "../chunk-OMXUQAZJ.js";
+import "../chunk-PUGHLCBW.js";
+import "../chunk-2LHPMFSR.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AU3AUJIZ.js";
+import "../chunk-RQQIB7CD.js";
 import "../chunk-IGNJOJEP.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-CWM4GQD2.js";
+} from "../chunk-HKANJAOP.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-DZ4ORU5N.js");
+      const { enrollSeed } = await import("../seed-WJWCFPZL.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-DZ4ORU5N.js");
+      const { rotateSeed } = await import("../seed-WJWCFPZL.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-DZ4ORU5N.js");
+          const { mintStoreCredentials } = await import("../seed-WJWCFPZL.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/cargo/index.js

@@ -6,66 +6,66 @@ import {
   diffVault,
   unsealDeks,
   withCargo
-} from "../chunk-E5SC6ENM.js";
+} from "../chunk-UWRVDBDC.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-BAHOV5I5.js";
+} from "../chunk-SIACMXFK.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-HQSPF5IY.js";
-import "../chunk-5Q7AJ7DN.js";
-import "../chunk-GBBDFE6C.js";
+} from "../chunk-ISRAQIYY.js";
+import "../chunk-I3D67XD7.js";
+import "../chunk-7LWBD3NO.js";
 import {
   NO_CARGO,
   isQuorum,
   runDrainBarrier
-} from "../chunk-FS7NTGCJ.js";
+} from "../chunk-WBFJZCDJ.js";
 import "../chunk-OTHHO3KI.js";
-import "../chunk-6WO62AJW.js";
+import "../chunk-SZFNO7L4.js";
 import {
   CustodyApi
-} from "../chunk-AUPSEJ7O.js";
-import "../chunk-QSIEL6TL.js";
-import "../chunk-S56VYR4Q.js";
+} from "../chunk-WG66ZPEV.js";
+import "../chunk-XXONVJWA.js";
+import "../chunk-5FRZ7YYU.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-JLYQQNY4.js";
+import "../chunk-BYX3AUXH.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-B6IYATME.js";
+} from "../chunk-DXJXVWWE.js";
 import "../chunk-XZHEOSQ2.js";
-import "../chunk-CADUYBQD.js";
+import "../chunk-ATL3ZVXT.js";
 import {
   readPath
-} from "../chunk-IGJCYUT5.js";
-import "../chunk-WVE6YKMX.js";
-import "../chunk-JNMTN5D5.js";
-import "../chunk-CAGI4LLJ.js";
-import "../chunk-LX46B56Q.js";
-import "../chunk-NW4TY6VC.js";
+} from "../chunk-NSITFOCJ.js";
+import "../chunk-U5ZDYJLQ.js";
+import "../chunk-LZHIYH32.js";
+import "../chunk-AK6EWGDO.js";
+import "../chunk-GJ5TMHKC.js";
+import "../chunk-3UIS6O6N.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-4A34KWOU.js";
+import "../chunk-OGB2UTBC.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-ZLHHE5XZ.js";
-import "../chunk-PPCOKVFA.js";
-import "../chunk-OHOKBMTM.js";
+import "../chunk-YLIGPHN4.js";
+import "../chunk-6ZTPSVY7.js";
+import "../chunk-FUE2KPKM.js";
 import "../chunk-PENPHA45.js";
-import "../chunk-GQXFOAYZ.js";
-import "../chunk-KV6JM2IA.js";
-import "../chunk-TMBSPLUG.js";
+import "../chunk-OMXUQAZJ.js";
+import "../chunk-PUGHLCBW.js";
+import "../chunk-2LHPMFSR.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-AU3AUJIZ.js";
+} from "../chunk-RQQIB7CD.js";
 import "../chunk-IGNJOJEP.js";
 import {
   AdoptionStateError,
@@ -81,7 +81,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-CWM4GQD2.js";
+} from "../chunk-HKANJAOP.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AdoptionStateError,

package/dist/{chunk-3B6S6RSI.js → chunk-22VRCUV2.js}

@@ -1,6 +1,6 @@
 import {
   linkI18nVia
-} from "./chunk-WVE6YKMX.js";
+} from "./chunk-U5ZDYJLQ.js";
 
 // src/via/i18n/dictionary.ts
 function dictKey(name, keysOrMap, opts) {
@@ -71,4 +71,4 @@ export {
   dictKey,
   staticDict
 };
-//# sourceMappingURL=chunk-3B6S6RSI.js.map
+//# sourceMappingURL=chunk-22VRCUV2.js.map