@noy-db/hub 0.6.0 → 0.7.0-pre.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog — hub
 
+## 0.7.0-pre.0
+
+### Minor Changes
+
+- **The port vocabulary, and the seams that make it navigable.**
+
+  A developer should be able to learn the available ports, then pick a package —
+  internal or family — that binds one. This line makes the subpath and the type
+  name say which port they belong to.
+
+  **BREAKING — the `Provider` suffix is retired.** A type a satellite implements
+  is now `Noydb<Stem>`, matching `NoydbStore`, which was already the pattern.
+  `Provider` marked some port instances and not others, so it distinguished
+  nothing. Every removed name is in the shipped codemod map
+  (`@noy-db/hub/codemods/0.7.0-pre.json`), with `safeGlobalReplace` per row —
+  bare-noun rows are flagged unsafe because they collide with ordinary prose.
+
+  **New published seams: `/at`, `/by`, `/on`, `/as`.** Each ships with a
+  conformance kit — `test-sealer-conformance`, `test-mesh-conformance`,
+  `test-ceremony-conformance`, `test-format-conformance` — and every one of them
+  found a real defect in a binding it was written against.
+
+  **`/as` is now a port, not a family convention.** Hub owns `export` and
+  `import`; a format supplies `encode`/`decode` and declares its own `id`. That
+  consolidates a six-copy `ImportPolicy` and lets a format ship outside this repo.
+
+  **`ExportFormat` is an open union.** A third-party format id can be granted in
+  an `exportCapability`, not merely checked — previously the only way to authorise
+  one was the `'*'` wildcard, which grants every format at once.
+
+  **`FenceState` names one type again.** `/by` and `/cargo` carried a duplicate
+  object under the same name as the root barrel's string union; they now re-export
+  `FenceDoc`.
+
+  Two decisions are recorded in `docs/adr/`: **0004** (the `as-*` inversion) and
+  **0005** (there is no `/ui` port — a UI is a driving adapter, and egress rather
+  than rendering is what `assertCanExport` gates).
+
+### Patch Changes
+
+- **Fix: a schema-fence transition no longer erases `schemaHash`.**
+
+  `StoreMesh.setFence` wrote the caller's document whole, and callers legitimately
+  construct a partial one — so every drain, migrate, complete and abort dropped
+  the field #946 added. "Which schema is generation N" was answerable from
+  `schemaFenceState()` only until the first cutover. Nothing reported it: the
+  fence still loaded, still validated, and still gated writes.
+
 ## 0.6.0
 
 ### Minor Changes

package/README.md

@@ -175,7 +175,7 @@ Core has zero `node:` imports — it runs unchanged in browsers, Node, Bun, Deno
 
 #### Other plaintext formats
 
-CSV, XML, xlsx, and the rest of the plaintext tier — plus encrypted `.noydb` bundles under the `as-noydb` encrypted tier — all live in the [`@noy-db/as-*`](https://www.npmjs.com/search?q=%40noy-db%2Fas-) family. Every invocation is gated by the two-tier authorization model (`canExportPlaintext` default off, `canExportBundle` default on for owner/admin) and lands in the audit ledger.
+CSV, XML, xlsx, and the rest of the plaintext tier — plus encrypted `.noydb` bundles under the `as-noydb` encrypted tier — all live in the [`@noy-db/as-*`](https://www.npmjs.com/search?q=%40noy-db%2Fas-) family. Every invocation is gated by the two-tier authorization model (`assertCanExport('plaintext')` default off, `canExportBundle` default on for owner/admin) and lands in the audit ledger.
 
 ## Money fields
 

package/codemods/0.4.0-pre.json

@@ -315,6 +315,22 @@
       "section": "§5",
       "note": "Split in two, so the target depends on what you imported: pod artifacts (write/read/header/cover) went to `/pod`, orchestration types went to `/cargo`. Resolve per import, not per file."
     },
+    {
+      "from": "@noy-db/hub/by",
+      "to": "@noy-db/hub/cargo",
+      "kind": "subpath",
+      "safeGlobalReplace": true,
+      "section": "\u00a77",
+      "note": "ADDED 2026-08-22, not in this map as originally written. The 0.4 prune removed SEVEN subpaths (`./with ./ui ./by ./on ./at ./in ./as`) and this map recorded five of them; `/by` and `/with` had no row, so a consumer importing either got no migration instruction at all. Found while re-introducing `/by` in the 0.7 line, because the un-retired guard refuses a path no earlier map says was retired \u2014 the guard was right and the map was short. Every one of its six exports (`NoydbMesh` \u2014 then `CoordinationProvider` \u2014 `WriterPresence`, `FenceState`, `DrainBarrierOptions`, `isQuorum`, `runDrainBarrier`) is reachable from `/cargo` today, verified against the built surface, so this is a clean single-target redirect."
+    },
+    {
+      "from": "@noy-db/hub/with",
+      "to": "@noy-db/hub/cargo",
+      "kind": "subpath",
+      "safeGlobalReplace": false,
+      "section": "\u00a77",
+      "note": "ADDED 2026-08-22 \u2014 the second of the two rows this map was missing; see the `/by` row for how they were found. UNLIKE every other subpath row here, this is NOT a clean redirect and that is why it is unsafe to apply blind: only `WriteEvent` and `WriteHook` landed on `/cargo`. `WriteHookRegistry`, `ServiceBus`/`SubsystemBus`, and `assertCanExport`/`assertCanImport`/`canExport`/`canImport` are reachable from NO declared subpath today \u2014 they became internal with no public replacement. A consumer using those has no target to move to, and this row must not pretend otherwise."
+    },
     {
       "from": "@noy-db/hub/as",
       "to": "@noy-db/hub",
@@ -431,6 +447,14 @@
       "safeGlobalReplace": true,
       "section": "§5"
     },
+    {
+      "from": "LiveAggregation",
+      "to": "LiveReduction",
+      "kind": "type",
+      "safeGlobalReplace": true,
+      "section": "\u00a75",
+      "note": "#1154. Missed when its siblings (AggregateResult, GroupedAggregation, AggregateSpec, withAggregate) were mapped. Verified against published tarballs: reachable in 0.3.0, absent from 0.4.0, and LiveReduction appears in exactly that transition \u2014 same module as ReduceResult/ReduceSpec, and it is the reactive primitive .live() returns."
+    },
     {
       "from": "GroupedAggregation",
       "to": "GroupedReduction",

package/codemods/0.6.0-pre.json

@@ -164,6 +164,24 @@
       "section": "#1058",
       "note": "The row missing from #1052's table (#1061). klum-db imported it from @noy-db/hub/pod and only the compiler caught it \u2014 TS2724, 'Did you mean hasNoydbPodMagic?'."
     },
+    {
+      "from": "encodeBundleHeader",
+      "to": "encodePodHeader",
+      "kind": "identifier",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "#1058",
+      "note": "Found by scripts/check-codemod-coverage.mjs rather than by review: reachable in published 0.5.0, absent from 0.6.0, successor present in the same /pod barrel."
+    },
+    {
+      "from": "validateBundleHeader",
+      "to": "validatePodHeaderFields",
+      "kind": "identifier",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "#1058",
+      "note": "Same transition and same barrel as encodeBundleHeader. The target is NOT a straight Bundle\u2192Pod substitution \u2014 the name gained `Fields` \u2014 which is why a blanket replace misses it and a map row is the only mechanical answer."
+    },
     {
       "from": "BundleIntegrityError",
       "to": "PodIntegrityError",

package/codemods/0.7.0-pre.json

@@ -0,0 +1,258 @@
+{
+  "$comment": "Machine-readable rename map for the noy-db 0.7.0-pre vocabulary change — the port-instance naming rule. A type a satellite IMPLEMENTS is now `Noydb<Stem>`, matching `NoydbStore`, which was already the pattern and is unchanged (689 references across five repos; the scheme accommodates the anchor rather than renaming it). The `Provider` suffix is retired: it marked some port instances and not others, so it distinguished nothing. Every `from` was REMOVED with no alias, per the project's no-legacy-aliases policy — `/kernel` and `/adapter` were both retired that way after consumers migrated. Rows are verified against the live surface by packages/hub/__tests__/codemod-map-0.7.test.ts. ABSENT BY MEASUREMENT, not by oversight: StoreCoordinationProvider and createDefaultCoordinationProvider were renamed in the same sweep but are reachable from NO declared subpath of the published 0.6.0 tarball, so no consumer could hold them — the same reason SubsystemBus is absent from the 0.6 map. Listing them would repeat #1052's over-count.",
+  "renames": [
+    {
+      "from": "SealingKeyProvider",
+      "to": "NoydbSealer",
+      "kind": "type",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The `at-*` port instance. Published from the root barrel AND @noy-db/hub/cargo in 0.6.0; both keep re-exporting it under the new name."
+    },
+    {
+      "from": "MemorySealingKeyProvider",
+      "to": "MemorySealer",
+      "kind": "identifier",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The in-memory double an at-* implementor tests against. Follows its interface rather than keeping a suffix the interface no longer has."
+    },
+    {
+      "from": "CoordinationProvider",
+      "to": "NoydbMesh",
+      "kind": "type",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "by-port",
+      "note": "The `by-*` port instance: who is live, and what generation are they on. Named for the participants rather than the wire — `PeerChannel` is the transport, and a mesh has no head, which the previous name's alternatives (Coordinator, Conductor) implied. Published from @noy-db/hub/cargo in 0.6.0; /cargo keeps re-exporting it under the new name."
+    },
+    {
+      "from": "DeviceSealProvider",
+      "to": "NoydbDeviceSeal",
+      "kind": "type",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "Sibling of NoydbSealer for device-bound sealing. Published from the root barrel and @noy-db/hub/team."
+    },
+    {
+      "from": "MemoryDeviceSealProvider",
+      "to": "MemoryDeviceSeal",
+      "kind": "identifier",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The in-memory double for NoydbDeviceSeal."
+    },
+    {
+      "from": "envSealingProvider",
+      "to": "atEnv",
+      "kind": "identifier",
+      "package": "@noy-db/at-env",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "Factory convention: (prefix)(package)() returns exactly one port instance, matching toMemory()/toFile(). The old name described the return type, which the type already does."
+    },
+    {
+      "from": "EnvSealingProviderOptions",
+      "to": "AtEnvOptions",
+      "kind": "type",
+      "package": "@noy-db/at-env",
+      "safeGlobalReplace": true,
+      "section": "at-port"
+    },
+    {
+      "from": "awsKmsSealingProvider",
+      "to": "atAwsKms",
+      "kind": "identifier",
+      "package": "@noy-db/at-aws-kms",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "awsKmsRecipientSealer is NOT renamed: it returns a RecipientSealer, a different contract from NoydbSealer, so the at<Package>() convention would misdescribe it."
+    },
+    {
+      "from": "gcpKmsSealingProvider",
+      "to": "atGcpKms",
+      "kind": "identifier",
+      "package": "@noy-db/at-gcp-kms",
+      "safeGlobalReplace": true,
+      "section": "at-port"
+    },
+    {
+      "from": "macosKeychainSealingProvider",
+      "to": "atMacosKeychain",
+      "kind": "identifier",
+      "package": "@noy-db/at-macos-keychain",
+      "safeGlobalReplace": true,
+      "section": "at-port"
+    },
+    {
+      "from": "azureKeyVaultSealingProvider",
+      "to": "atAzureKeyvault",
+      "kind": "identifier",
+      "package": "@noy-db/at-azure-keyvault",
+      "safeGlobalReplace": true,
+      "section": "at-port"
+    },
+    {
+      "from": "channelCoordination",
+      "to": "channelMesh",
+      "kind": "identifier",
+      "package": "@noy-db/by-peer",
+      "safeGlobalReplace": true,
+      "section": "by-port",
+      "note": "The transport-agnostic drain-barrier core over any PeerChannel. NOT renamed to byPeer: it is not the (prefix)(package)() factory, it is the shared implementation both by-peer and by-tabs delegate to, and by-tabs would otherwise import a factory named for a package it is not."
+    },
+    {
+      "from": "peerCoordination",
+      "to": "byPeer",
+      "kind": "identifier",
+      "package": "@noy-db/by-peer",
+      "safeGlobalReplace": true,
+      "section": "by-port",
+      "note": "Factory convention: (prefix)(package)() returns exactly one port instance. Still the SAME function object as channelMesh — the identity is asserted by a parity test, so a consumer who switched names has not switched behaviour."
+    },
+    {
+      "from": "tabsCoordination",
+      "to": "byTabs",
+      "kind": "identifier",
+      "package": "@noy-db/by-tabs",
+      "safeGlobalReplace": true,
+      "section": "by-port"
+    },
+    {
+      "from": "coordinationStrategy",
+      "to": "mesh",
+      "kind": "option-key",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": false,
+      "section": "by-port",
+      "where": "src/kernel/types.ts",
+      "note": "createNoydb({ mesh }) — the exact parallel of the store option, which is the other port instance in the same bag. Tagged @internal in 0.6.0 but reachable from NoydbOptions on the root barrel AND ./pod, and taught by name in noy-db-docs core/2.noydb/6.configuration.md, so it is public by every measure that matters. safeGlobalReplace is false: `mesh` is too short and too ordinary to replace blind."
+    },
+    {
+      "from": "coordination",
+      "to": "mesh",
+      "kind": "method",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": false,
+      "section": "by-port",
+      "where": "src/kernel/noydb.ts",
+      "note": "The `Noydb.coordination` getter — how an external orchestrator (@klum-db/lobby) drives the port through the handle. safeGlobalReplace is false: `coordination` is an ordinary English word and appears as such throughout the family's prose. Measured: zero property accesses in any sibling repo today."
+    },
+    {
+      "from": "ShamirRecoveryProvider",
+      "to": "NoydbShamir",
+      "kind": "type",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": true,
+      "section": "on-port",
+      "note": "The LAST `Provider`-suffixed port instance on the published surface, and the only `on-*` entry among hub's injected ports — `store`/`sealingKey`/`deviceSeal`/`mesh` are the others. Not renamed to `NoydbRecovery`: the contract is Shamir-specific (`splitToShares`/`combineShares`, k-of-n), so a generic name would over-claim what hub accepts. Its module moved with it: with-party/team/shamir-recovery-provider.ts → noydb-shamir.ts."
+    },
+    {
+      "from": "ShamirRecoveryProvider",
+      "to": "NoydbShamir",
+      "kind": "type",
+      "package": "@noy-db/on-shamir",
+      "safeGlobalReplace": true,
+      "section": "on-port",
+      "note": "on-shamir exports a structural MIRROR of hub's port under its own name, because hub devDepends on this package and a peer edge back is a build cycle — measured: turbo refuses `@noy-db/on-shamir#build, @noy-db/hub#build` outright. Renamed in lockstep and deliberately to the SAME name, so the duplication is legible rather than disguised; hub compiles the two against each other in noydb-shamir-satellite.test-d.ts."
+    },
+    {
+      "from": "toString",
+      "to": "asCsv",
+      "kind": "identifier",
+      "package": "@noy-db/as-csv",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "The as-* inversion (ADR 0004). `toString(vault, opts)` becomes `vault.export(asCsv(fmtOpts), { collections })` — hub gates, reads and redacts; the format only encodes. Options SPLIT: eol/columns/columnTypes go to asCsv(), collections/redact to vault.export(). Requires formatsStrategy: withFormats(). safeGlobalReplace is false: `toString` is Object.prototype's method name and appears on every value in the language."
+    },
+    {
+      "from": "fromString",
+      "to": "asCsv",
+      "kind": "identifier",
+      "package": "@noy-db/as-csv",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "`fromString(vault, csv, opts)` becomes `vault.import(asCsv(fmtOpts), csv, { collection, policy, idKey })`. The returned ImportPlan is now hub's — same shape, one definition. safeGlobalReplace is false: several as-* packages export a `fromString` and they migrate on their own schedule."
+    },
+    {
+      "from": "AsCSVImportOptions",
+      "to": "FormatImportOptions",
+      "kind": "type",
+      "package": "@noy-db/as-csv",
+      "toPackage": "@noy-db/hub/as",
+      "safeGlobalReplace": true,
+      "section": "as-port",
+      "note": "Split across the new boundary: collection/policy/idKey are hub's FormatImportOptions on `/as`; columnTypes is an asCsv() option. `toPackage` records that the target moved REPOSITORIES of ownership — the type is hub's now, not as-csv's, which no other row in either map has needed to say."
+    },
+    {
+      "from": "toString",
+      "to": "asSql",
+      "kind": "identifier",
+      "package": "@noy-db/as-sql",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "`toString(vault, opts)` becomes `vault.export(asSql(fmtOpts), { collections, redact })`. EXPORT-ONLY: as-sql declares no decode(), so `vault.import(asSql(), ...)` throws naming the format. ⚠️ Removing an export called `toString` fails SILENTLY at the call site: a bare `toString(x)` resolves to globalThis.toString and returns '[object Undefined]' instead of throwing ReferenceError. Grep for the call, do not rely on a red build."
+    },
+    {
+      "from": "toString",
+      "to": "asXml",
+      "kind": "identifier",
+      "package": "@noy-db/as-xml",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "`toString(vault, opts)` becomes `vault.export(asXml(fmtOpts), { collections, redact })`. Options SPLIT: rootElement/recordElement/fields/pretty/xmlDeclaration/namespace/fieldTypes are the format's; collection and redact are hub's. Same silent-removal hazard as as-sql: a bare `toString(x)` resolves to globalThis.toString rather than throwing."
+    },
+    {
+      "from": "fromString",
+      "to": "asXml",
+      "kind": "identifier",
+      "package": "@noy-db/as-xml",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "`fromString(vault, xml, opts)` becomes `vault.import(asXml(fmtOpts), xml, { collection, policy, idKey })`."
+    },
+    {
+      "from": "fromString",
+      "to": "asJson",
+      "kind": "identifier",
+      "package": "@noy-db/as-json",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "`fromString(vault, json, opts)` becomes `vault.import(asJson(), json, { policy, idKey })`. JSON carries collection names in the payload, so unlike as-csv and as-xml it needs no `{ collection }`. `toString` and `toObject` are NOT removed here — a document is not bytes, so NoydbFormat<string> cannot express toObject, and removing one while keeping the other would be a worse API than keeping both as thin wrappers over vault.export."
+    },
+    {
+      "from": "fromObject",
+      "to": "asJson",
+      "kind": "identifier",
+      "package": "@noy-db/as-json",
+      "safeGlobalReplace": false,
+      "section": "as-port",
+      "note": "`fromObject(vault, doc, opts)` becomes `vault.import(asJson(), JSON.stringify(doc), opts)` — the port takes bytes, so a caller holding a parsed document serialises it first."
+    },
+    {
+      "from": "FenceState",
+      "to": "FenceDoc",
+      "kind": "type",
+      "package": "@noy-db/hub",
+      "safeGlobalReplace": false,
+      "section": "by-port",
+      "note": "A DE-DUPLICATION, not a rename: `./by` declared its own two-field interface that was a hand-copy of the vault's `FenceDoc` (measured mutually assignable under --strict --exactOptionalPropertyTypes), and `./cargo` re-exported that duplicate. Both now name `FenceDoc`; the duplicate is gone. A DIFFERENT type of the same name — the `FenceState` string union on the ROOT barrel — is NOT renamed and must not be rewritten, which is why safeGlobalReplace is false (#1188). Judge by import source: `from '@noy-db/hub/by'` or `/cargo` renames; `from '@noy-db/hub'` does not.",
+      "subpaths": [
+        "./by",
+        "./cargo"
+      ]
+    }
+  ],
+  "unretired": [
+    "@noy-db/hub/as",
+    "@noy-db/hub/at",
+    "@noy-db/hub/on",
+    "@noy-db/hub/by"
+  ],
+  "$unretiredComment": "Subpaths this line RE-INTRODUCES after an earlier line retired them. `/by` is the second, on identical grounds: @noy-db/test-mesh-conformance publishes the NoydbMesh contract as an executable suite, and by-peer/by-tabs bind the seam. Re-introducing it also EXPOSED A GAP IN THE 0.4 MAP: that prune removed seven subpaths and recorded five, so `/by` and `/with` had no row until 2026-08-22 — the un-retired guard refuses a path no earlier map says was retired, and it was right. `/at` was removed in 0.4.0 (see codemods/0.4.0-pre.json, kind:'subpath') because it 'had zero importers' — it was a second place to find a type already on the root barrel. It returns now because something stands behind it: @noy-db/test-sealer-conformance publishes the NoydbSealer contract as an executable suite, and the five at-* packages bind the seam. Listing a subpath here is a CLAIM, and codemod-map.test.ts refuses it unless the subpath actually resolves — so this field cannot be used to silence the retired-subpath guard without shipping the seam. Purely additive: the root barrel and /cargo keep exporting everything they did, so a consumer who followed the 0.4 row onto the root barrel is untouched.",
+  "version": "0.7.0-pre"
+}

package/dist/api-EQYRTZO2.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-DBNYPLWY.js";
+import "./chunk-DFAUMLD7.js";
+import "./chunk-2LPVI4PX.js";
+import "./chunk-N4CNVSUF.js";
+import "./chunk-FOG7YEJP.js";
+import "./chunk-KDJGJR7F.js";
+import "./chunk-LKFKXS5K.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-W5LHQXZU.js";
+import "./chunk-RK7N4OQ5.js";
+import "./chunk-JBIV4FLR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-EQYRTZO2.js.map

package/dist/as/index.js

@@ -0,0 +1,146 @@
+import "../chunk-UBSFPGVJ.js";
+import "../chunk-HM4JSXX2.js";
+import {
+  applyListProjection
+} from "../chunk-VG2ZSFYD.js";
+import "../chunk-KHKKD62N.js";
+import "../chunk-P6ASQOZR.js";
+import "../chunk-Y2NBBT6K.js";
+import "../chunk-YXA2TCTZ.js";
+import "../chunk-2LPVI4PX.js";
+import "../chunk-N4CNVSUF.js";
+import "../chunk-FOG7YEJP.js";
+import "../chunk-KDJGJR7F.js";
+import "../chunk-LKFKXS5K.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-W5LHQXZU.js";
+import "../chunk-RK7N4OQ5.js";
+import {
+  ValidationError
+} from "../chunk-JBIV4FLR.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/port/as/active.ts
+function redactChunk(chunk, ctx, redact) {
+  if (redact === void 0) return chunk;
+  const described = ctx.describe(chunk.collection);
+  if (!described) {
+    throw new Error(
+      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. Open the collection with its classifiedFields / fieldMeta options first.`
+    );
+  }
+  const opts = redact === true ? void 0 : { sensitivity: redact.sensitivity };
+  const records = chunk.records.map(
+    (r) => applyListProjection(described, r, opts)
+  );
+  return { ...chunk, records };
+}
+function contextFor(vault) {
+  return {
+    // The empty-id guards are NOT defensive padding. The
+    // plaintext tier is gated per-format, so a missing id means the calling
+    // binding is broken — and without this it would reach the gate, miss the
+    // allowlist, and surface as `ExportCapabilityError`: "the owner did not
+    // grant this", which sends the reader to the keyring instead of to the
+    // format. A loud TypeError names the real fault.
+    assertCanExport: (tier, format) => {
+      if (tier === "bundle") return vault.assertCanExport("bundle");
+      if (!format) throw new TypeError("assertCanExport('plaintext') requires a non-empty format id");
+      vault.assertCanExport("plaintext", format);
+    },
+    assertCanImport: (tier, format) => {
+      if (tier === "bundle") return vault.assertCanImport("bundle");
+      if (!format) throw new TypeError("assertCanImport('plaintext') requires a non-empty format id");
+      vault.assertCanImport("plaintext", format);
+    },
+    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`
+    // has no `collections` field, so the option I first passed was silently
+    // dropped and hub read every collection. Caught by an as-json test
+    // expecting ['invoices'] and getting ['invoices','payments'].
+    //
+    // Post-read filtering is correct but not free: hub still DECRYPTS the
+    // collections the caller excluded. Pushing the filter down into
+    // exportStream is the real fix and is a hub change beyond this port.
+    chunks: async function* (collections) {
+      const wanted = collections ? new Set(collections) : null;
+      for await (const chunk of vault.exportStream({ granularity: "collection" })) {
+        if (wanted && !wanted.has(chunk.collection)) continue;
+        yield chunk;
+      }
+    },
+    // NOT swallowed. A caller who asked for redaction and silently got
+    // unredacted output is the exact failure this port exists to remove — a
+    // security duty that fails quiet. If the description cannot be read, the
+    // export fails instead.
+    describe: (collection) => vault.collection(collection).describe(),
+    plan: async (records, policy, formatId, idKey) => {
+      const { diffVault } = await import("../vault-diff-FE5J35NJ.js");
+      const plan = await diffVault(vault, records, idKey ? { idKey } : {});
+      return {
+        plan,
+        policy,
+        // The apply walk every as-* package had independently: added always,
+        // modified unless insert-only, deleted only on replace — in one
+        // transaction so a partial failure rolls back. Owned once, here.
+        apply: async () => {
+          await vault.noydb.transaction((tx) => {
+            const txVault = tx.vault(vault.name);
+            const reason = `import:${formatId}`;
+            for (const e of plan.added) {
+              txVault.collection(e.collection).put(e.id, e.record, { reason });
+            }
+            if (policy !== "insert-only") {
+              for (const e of plan.modified) {
+                txVault.collection(e.collection).put(e.id, e.record, { reason });
+              }
+            }
+            if (policy === "replace") {
+              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id);
+            }
+          });
+        }
+      };
+    }
+  };
+}
+function withFormats() {
+  return {
+    enabled: true,
+    async exportWith(vault, format, options = {}) {
+      const ctx = contextFor(vault);
+      if (format.tier === "bundle") ctx.assertCanExport("bundle");
+      else ctx.assertCanExport("plaintext", format.id);
+      const chunks = [];
+      for await (const chunk of ctx.chunks(options.collections)) {
+        chunks.push(redactChunk(chunk, ctx, options.redact));
+      }
+      return format.encode(chunks);
+    },
+    async importWith(vault, format, input, options = {}) {
+      const ctx = contextFor(vault);
+      if (format.tier === "bundle") ctx.assertCanImport("bundle");
+      else ctx.assertCanImport("plaintext", format.id);
+      if (!format.decode) {
+        throw new ValidationError(
+          `vault.import: the '${format.id}' format is export-only \u2014 it declares no decode(). Pick a format that round-trips, or write the records directly.`
+        );
+      }
+      const decoded = await format.decode(input);
+      const candidate = {};
+      for (const chunk of decoded) {
+        const target = chunk.collection || options.collection;
+        if (!target) {
+          throw new ValidationError(
+            `vault.import: the '${format.id}' input names no collection and none was supplied. Pass { collection } for formats whose payload is collection-less.`
+          );
+        }
+        candidate[target] = [...candidate[target] ?? [], ...chunk.records];
+      }
+      return ctx.plan(candidate, options.policy ?? "merge", format.id, options.idKey);
+    }
+  };
+}
+export {
+  withFormats
+};
+//# sourceMappingURL=index.js.map

package/dist/as/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/at/index.js

@@ -0,0 +1,23 @@
+import {
+  MemoryRecipientSealer,
+  MemorySealer,
+  SEALED_SECRET_RECORD_ID,
+  parseSealedEnvelope
+} from "../chunk-Z2WK53N6.js";
+import "../chunk-2LPVI4PX.js";
+import "../chunk-N4CNVSUF.js";
+import "../chunk-FOG7YEJP.js";
+import "../chunk-KDJGJR7F.js";
+import "../chunk-LKFKXS5K.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-W5LHQXZU.js";
+import "../chunk-RK7N4OQ5.js";
+import "../chunk-JBIV4FLR.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  MemoryRecipientSealer,
+  MemorySealer,
+  SEALED_SECRET_RECORD_ID,
+  parseSealedEnvelope
+};
+//# sourceMappingURL=index.js.map