@noy-db/hub 0.6.0-pre.22 → 0.6.0-pre.24

package/CHANGELOG.md

@@ -1,5 +1,89 @@
 # Changelog — hub
 
+## 0.6.0-pre.24
+
+### Minor Changes
+
+- The roster tag authenticates the DEK key set (#1115).
+
+  `revoke` derives its rotation scope from `Object.keys(target.deks)`. That set was not covered by the roster tag, so a store could strip entries from the target's keyring before a revocation and have those collections silently skipped by the rotation — a revoked member colluding with that store keeps live DEKs for exactly the collections it removed. That contradicted `SECURITY.md`'s _"the rotation cannot be skipped"_.
+
+  `rosterCanonical` now binds the key **names** of `deks` and `pending_deks`. Names only: the wrapped values are AES-KW and self-authenticating, so what was unprotected was the shape of the map, not its contents. `pending_deks` is included because stripping it makes an interrupted rotation mint a fresh DEK instead of resuming, orphaning every record already rewritten under the pending key.
+
+  **This is a keyring format change with no migration** — consistent with the position recorded for `0.6.0-pre.21`: an existing vault must be re-seeded. `NOYDB_KEYRING_VERSION` is bumped to `2`, and a tag that cannot verify against an older declared version now reports the new `format-superseded` reason, which names the format transition instead of accusing the store. Classification only — access is refused either way, so a store rewriting the plaintext version field changes the wording and nothing else.
+
+  Also fixes `adoptPartition`, which merged partition DEKs into a freshly-minted keyring without restamping. That was invisible while the tag ignored `deks`; it now restamps, as `liberateVault` already did.
+
+- The blob content address survives a key rotation (#1126).
+
+  A blob's eTag is an HMAC over the plaintext. It was keyed by the `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it, **permanently**. `decryptResponse()` checks that unconditionally, so the presigned-URL / external-object read path raised `TamperedError` on legitimate data forever; `verifyFlatETag` did the same on the flat-tier fallback; a resumed rehome mis-mapped; and dedup split, minting a second address for identical bytes.
+
+  Addresses now derive from `_blob_addr`, a **vault-lifetime keyring slot that rotation refuses to touch** — so a rotation re-keys chunk bodies while every stored address, chunk AAD and index row stays valid. The derivation stays **per tier**: the address is meant to be tier-scoped (`rehomeForTier` re-addresses on a tier move for exactly that reason); only the rotation coupling was ever wrong.
+
+  Reported by the same alarm as #1103, and this was the same cry-wolf class: a user who revoked a colleague was told their store may be attacking them.
+
+  **Format change, no migration** — consistent with the `0.6.0-pre.21` position: an existing vault must be re-seeded. **Residual:** a revoked member who kept the addressing root retains a confirmation oracle over content whose plaintext they already hold; they can read nothing, because bodies are sealed under DEKs that do rotate. See `SECURITY.md`.
+
+  Also restamps the roster tag on all three `recoverSecret` rebuild paths, which rewrote the keyring while carrying the previous tag.
+
+### Patch Changes
+
+- A narrowing re-grant rotates the collections it takes away (#1097, partial).
+
+  `writeKeyringFile` is a bare `put`, so a re-grant with a lower role or narrower permissions **overwrites in place** — and the file it replaces was legitimately minted by this vault. A store that kept a copy can re-serve it, and `loadKeyring` accepts it: the KEK unwraps, the canary checks out, the roster tag verifies. None of those is a claim about being _current_.
+
+  ADR 0003 bounded a suppressed keyring delete on the grounds that revocation rotates, so an old roster's DEKs cannot open post-rotation records. **A narrowing re-grant rotated nothing**, so a replayed file opened records written _after_ the narrowing — live access rather than stale access. Rotating the dropped collections restores that bound.
+
+  ⚠️ **This does not close the replay itself.** The old file also restores the old **role**, and role gates capabilities rather than keys, so rotation cannot touch it. That half needs an anchor the store cannot rewind, and #1097 stays open for it.
+
+  A widening re-grant and a first grant rotate nothing, so this is not a tax on every grant.
+
+- `rotateKeys` covers `collection#tier` DEK slots, in both directions (#1125).
+
+  Elevated records live in the same collection as their tier-0 siblings, distinguished by the envelope `_tier` field, and are sealed under `dekKey(collection, tier)`. Rotation keyed off the collection **name**, so it was broken twice over:
+
+  - **Rotating `docs` threw.** It met an elevated record it could not open under the tier-0 DEK and rethrew — and because `revoke` rotates as its final step, revoking anyone from a vault holding a single elevated record **failed after the keyring had already been deleted**. Part-applied.
+  - **Rotating `docs#1` was a silent no-op.** `store.list(vault, "docs#1")` is empty because the slot names a key, not a collection, so nothing was re-encrypted and a revoked member who retained the tier key kept opening elevated records.
+
+  Rotation now walks the base collection for every slot and classifies each envelope by **which key opens it** — never by the envelope's claimed `_tier`, which is unencrypted and store-written. Routing on `_tier` would let a store mark a tier-0 record `_tier: 5` and have the rotation skip real data.
+
+  Guarded by an output-domain invariant rather than a row per known defect: after a revocation, no retained key opens any envelope, and the owner can still read everything.
+
+## 0.6.0-pre.23
+
+### Minor Changes
+
+- Query-form materialized views can join a declared ref, and a late `refs` declaration is no longer silently discarded.
+
+  **#1141 — `refs` declared on an already-constructed collection were dropped.** The declaration fan-out ran only when `vault.collection()` missed its cache, so any earlier touch of the collection silently discarded a later `refs` declaration: strict FK enforcement never engaged (a dangling `put()` was accepted) and `.join()` kept reporting "no ref() declared". `refs` now late-attaches through the same reconcile ladder every other declaration already used. An identical redeclaration stays a no-op; a conflicting one still throws.
+
+  **#1139 — a query-form MV that joins a declared FK threw at `openVault()`, with no ordering that avoided it.** MV strategies register during `openVault()`, but a collection's refs can only be declared after it returns, so the plan was built before any ref could exist. Such a strategy is now parked and replanned on the first write dispatch or `vault.refreshView()`, matching the projection form's timing. Every other planning failure still throws out of `openVault()` immediately — only a not-yet-declared ref defers.
+
+  Adds `RefNotDeclaredError` to the root barrel: `.join()` now throws it instead of a bare `Error`, with an unchanged message, so the deferral condition is matched on a type rather than on text.
+
+- Report blob chunks that outlived their index row (#1133).
+
+  `vault.compact()` now returns `orphanBlobChunks` — a count of `_blob_chunks` rows whose eTag has no `_blob_index` entry, the distinct eTags involved, a small sample to inspect, and a separate count of ids that do not fit the `{eTag}_{index}` grammar at all. `reportOrphanBlobChunks(store, vault)` is exported from `@noy-db/hub/blobs` for callers that want it on its own.
+
+  This is the residue #1127 stopped producing: before that fix a crash between deleting a blob's index row and its chunks stranded bodies no reader and no key rotation can reach, which for a legacy blob leaves bytes openable under a retired `_blob` DEK.
+
+  **It reports and never reclaims, deliberately.** Deciding "orphaned" means trusting `store.list`, and the store is untrusted — one withheld index row would make a live blob's chunks look orphaned, so a reclaim pass would convert withholding, which is reversible, into permanent destruction. A lying store can only inflate this count.
+
+- Projection MV legs can attach to another leg's alias (#1140).
+
+  `ProjectionJoinLeg` gains `from`, naming a previously-declared FORWARD leg. A collect leg then matches against that leg's record id instead of the primary row's, and a forward leg reads its FK off that record — which makes a lookup two FKs away expressible for the first time:
+
+  ```ts
+  joins: [
+    { field: "entityId", as: "entity" },
+    { from: "entity", collect: "clients", on: "entityId", as: "clients" },
+  ];
+  ```
+
+  Every leg previously attached to the primary row, so `bill → entity → client` had no shape: the bill has no `clientId`, and `clients.entityId` refs `entities`, not `bills`. The two workarounds were denormalizing a redundant FK onto the source — reintroducing the duplicated relationship a projection MV exists to avoid — or dropping back to app code and forfeiting the dependency tracking.
+
+  `from` may only name a leg declared earlier, and only a forward one (a collect leg holds an array, not a record). Both are refused at `withMaterializedView()` construction, alongside the rest of the leg-shape checks. The backward-only rule is also why no depth cap is needed: a cycle cannot be spelled. `from` is folded into the plan summary, so two structurally different projections cannot share a `queryHash`.
+
 ## 0.6.0-pre.22
 
 ### Minor Changes

package/dist/api-56KUWV6E.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-CDHX3SRW.js";
+import "./chunk-SQWXF2HP.js";
+import "./chunk-43FOH2OK.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-NK7DO6A2.js";
+import "./chunk-AM6V36AG.js";
+import "./chunk-AU45F5FD.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-D7STIWJO.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-5OFC3QYL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-56KUWV6E.js.map

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-OZ5QBLEL.js";
+} from "../chunk-C3FCXXNI.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-D5EXZVQC.js";
+} from "../chunk-GDYDYUO7.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-GWJJ5CK3.js";
+} from "../chunk-Z45PK2H5.js";
 import {
   NO_ATTESTATION
-} from "../chunk-NB2CKJ27.js";
+} from "../chunk-ICGLT356.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-DIVPOJPV.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-IUQPNAGR.js";
-import "../chunk-AELW6OJZ.js";
-import "../chunk-DUUARUZI.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-O5QXH7U7.js";
-import "../chunk-IGNJOJEP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-PKUJ3JLQ.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-QTQYQJCB.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-LV2IWCKY.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-AFV6AXSN.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-AJ3MCSPI.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-JH4VQTJ3.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-6NSQWTED.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-JH4VQTJ3.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-6NSQWTED.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-JH4VQTJ3.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-6NSQWTED.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-JH4VQTJ3.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-6NSQWTED.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-4PZAH67W.js → backup-WLKPDY3V.js}

@@ -3,37 +3,37 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-JPVJTTHU.js";
+} from "./chunk-AKPIBKHK.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-DIYI32MG.js";
+} from "./chunk-2S6HROLU.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-NCAMIRFB.js";
+} from "./chunk-OQT3G55N.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-DIVPOJPV.js";
+import "./chunk-43FOH2OK.js";
 import {
   buildRecordEnvelope
-} from "./chunk-PENPHA45.js";
-import "./chunk-IUQPNAGR.js";
-import "./chunk-AELW6OJZ.js";
-import "./chunk-DUUARUZI.js";
+} from "./chunk-FX3UIDCS.js";
+import "./chunk-NK7DO6A2.js";
+import "./chunk-AM6V36AG.js";
+import "./chunk-AU45F5FD.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-O5QXH7U7.js";
+import "./chunk-D7STIWJO.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-IGNJOJEP.js";
+} from "./chunk-UJ4Z67UQ.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-PKUJ3JLQ.js";
+} from "./chunk-5OFC3QYL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-4PZAH67W.js.map
+//# sourceMappingURL=backup-WLKPDY3V.js.map

package/dist/blobs/index.js

@@ -2,6 +2,15 @@ import {
   importExternalObjects,
   memoryObjectProjection
 } from "../chunk-4Q6HSHHL.js";
+import {
+  BLOB_EVICTION_AUDIT_COLLECTION,
+  EXPORT_AUDIT_COLLECTION,
+  ExportBlobsAbortedError,
+  NO_BLOBS,
+  createExportBlobsHandle,
+  reportOrphanBlobChunks,
+  runCompaction
+} from "../chunk-FKLKAO2C.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -16,29 +25,21 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-PNXJV4OS.js";
-import {
-  BLOB_EVICTION_AUDIT_COLLECTION,
-  EXPORT_AUDIT_COLLECTION,
-  ExportBlobsAbortedError,
-  NO_BLOBS,
-  createExportBlobsHandle,
-  runCompaction
-} from "../chunk-OBPL43F3.js";
-import "../chunk-7JOXCSDU.js";
-import "../chunk-OCW3IM2F.js";
-import "../chunk-WUNRUSBJ.js";
-import "../chunk-DIVPOJPV.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-IUQPNAGR.js";
-import "../chunk-AELW6OJZ.js";
-import "../chunk-DUUARUZI.js";
+} from "../chunk-24ZDSTEQ.js";
+import "../chunk-6PLCNLBC.js";
+import "../chunk-57MEX4LL.js";
+import "../chunk-NSZGZYZL.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-O5QXH7U7.js";
-import "../chunk-IGNJOJEP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   BlobOfflineError
-} from "../chunk-PKUJ3JLQ.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts
@@ -74,6 +75,7 @@ export {
   isPreCompressed,
   memoryBlobPinStore,
   memoryObjectProjection,
+  reportOrphanBlobChunks,
   runCompaction,
   withBlobs
 };

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-LLLSK7UQ.js";
+} from "../chunk-K7HPGV5K.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-DIVPOJPV.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-IUQPNAGR.js";
-import "../chunk-AELW6OJZ.js";
-import "../chunk-DUUARUZI.js";
+} from "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-O5QXH7U7.js";
-import "../chunk-IGNJOJEP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-PKUJ3JLQ.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-R2JK2YQK.js");
+      const { enrollSeed } = await import("../seed-ZLOK3Z4M.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-R2JK2YQK.js");
+      const { rotateSeed } = await import("../seed-ZLOK3Z4M.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-R2JK2YQK.js");
+          const { mintStoreCredentials } = await import("../seed-ZLOK3Z4M.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/cargo/index.js

@@ -6,67 +6,67 @@ import {
   diffVault,
   unsealDeks,
   withCargo
-} from "../chunk-QTWWZ25B.js";
+} from "../chunk-LU2HAOVP.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-M7VSXBUL.js";
+} from "../chunk-RTBCWDJ3.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-L3AM6EGU.js";
-import "../chunk-RJYPFCID.js";
-import "../chunk-BXHG26KN.js";
+} from "../chunk-PZEDIO72.js";
+import "../chunk-576CTQ77.js";
+import "../chunk-35K4VWMD.js";
 import {
   NO_CARGO,
   isQuorum,
   runDrainBarrier
-} from "../chunk-ZAZW5LLF.js";
-import "../chunk-OTHHO3KI.js";
-import "../chunk-JPVJTTHU.js";
+} from "../chunk-GCTZNHDO.js";
+import "../chunk-S2I5MYSA.js";
+import "../chunk-AKPIBKHK.js";
 import {
   CustodyApi
-} from "../chunk-HZIIDYJV.js";
-import "../chunk-2VMCJUK6.js";
-import "../chunk-HRSEAGLI.js";
+} from "../chunk-KEMD6B3W.js";
+import "../chunk-DM2BZDNV.js";
+import "../chunk-TTGZ6KGY.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-PNXJV4OS.js";
+import "../chunk-24ZDSTEQ.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-PWK3SSNB.js";
+} from "../chunk-264AKW4K.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import {
   readPath
 } from "../chunk-NSITFOCJ.js";
-import "../chunk-CW3VJARJ.js";
-import "../chunk-7JOXCSDU.js";
-import "../chunk-FFESJQ5A.js";
-import "../chunk-KMGAFLCK.js";
-import "../chunk-OCW3IM2F.js";
+import "../chunk-IYXP6OR5.js";
+import "../chunk-6PLCNLBC.js";
+import "../chunk-YEEV4ZXL.js";
+import "../chunk-SQWXF2HP.js";
+import "../chunk-57MEX4LL.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-H27DIXOV.js";
+import "../chunk-FJGNYSB3.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-47F6AI2K.js";
-import "../chunk-WUNRUSBJ.js";
-import "../chunk-DIVPOJPV.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-IUQPNAGR.js";
-import "../chunk-AELW6OJZ.js";
-import "../chunk-DUUARUZI.js";
+import "../chunk-GU5XWSH4.js";
+import "../chunk-NSZGZYZL.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-O5QXH7U7.js";
-import "../chunk-IGNJOJEP.js";
+} from "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -81,7 +81,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-PKUJ3JLQ.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AdoptionStateError,