@noy-db/hub 0.7.0-pre.10 → 0.7.0-pre.12

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog — hub
 
+## 0.7.0-pre.12
+
+### Minor Changes
+
+- `withDerivation`'s `triggerBy` accepts a multi-field `match` form (#1249):
+  `{ collection, match: [{ from, to }] }` fans a write out to every source
+  record where ALL pairs satisfy `String(source[to]) === String(written[from])`.
+  `from: 'id'` reads the written record's id, making the existing `on` form the
+  single-pair special case (it is unchanged and stays supported). This makes
+  shared-key ("reverse") relationships and composite keys like
+  `(clientId, cycle)` expressible without denormalising a synthetic key.
+
+  Also, for BOTH forms:
+
+  - a LOCAL UPDATE that changes any matched field fans out on old-match ∪
+    new-match, so records addressed by the previous value no longer go
+    silently stale; a sync-applied wave write or a tiers restore, which don't
+    thread the prior record, fan out on the new tuple only;
+  - a parent DELETE now fans out using the tombstoned record's values —
+    previously deletes fired no triggers at all, leaving matched sources
+    stale. The fan-out runs after the delete commits, so cap/strict errors
+    can surface from `delete()` (same as the existing rollup-on-delete
+    precedent);
+  - match fields are validated against the collections' enumerable field sets at
+    `vault.collection()` (the #1253 pattern): a provable typo throws instead of
+    silently matching nothing forever; TS-generic collections stay unguarded by
+    design.
+
+  `maxFanout` caps the unioned matched set per written event.
+
+### Patch Changes
+
+- `schemaFieldKeys` now unwraps Zod 3 `ZodEffects` created by object-level
+  `.refine()`/`.superRefine()` (reported by the pilot): the wrapper hides
+  `.shape`, so both field-typo guards — #1253's `fieldMeta` validation and
+  #1249's `triggerBy` match validation — were silent for exactly the schemas
+  most worth guarding. Unwrapping follows refinement effects only: a
+  `.transform()`/`.preprocess()` changes the output shape, so those stay
+  silent by design. Zod 4 keeps `.shape` through `.refine()` and is unaffected.
+
+## 0.7.0-pre.11
+
+### Patch Changes
+
+- `collection.describe()` now validates `fieldMeta` keys on the **sync** path when
+  the configured validator exposes its field names (#1253).
+
+  Previously the guard ran only on the async `describe(opts)` path, so a typo'd
+  `fieldMeta` key on the sync path produced a **phantom field carrying its declared
+  `sensitivity`** while the real field went undescribed — an inventory wrong in both
+  directions, silently, on the surface `sensitivity` exists to serve.
+
+  The sync path was thought unable to know the schema's fields because deriving them
+  is async. That is true of field **types** and false of field **keys**: a Zod object
+  exposes `.shape` directly, on v3 and v4, with no JSON-Schema derivation and no
+  `zod-to-json-schema` peer. The latter matters — on Zod 3 that peer is required for
+  the async path, so the sync path is the only one some consumers can reach.
+
+  Deliberately still silent in two cases, both of which would otherwise reject correct
+  code: a validator whose fields hub cannot read, and **no validator at all** — a
+  collection typed by a TypeScript generic alone has fields that are real and present
+  in the data but appear in no runtime config, and `fieldMeta` legitimately names them.
+
+- Document that `KeyringTamperedError` carries its reason at `err.details.reason`, not `err.reason`.
+
+  `TamperedError` has a **direct top-level** `reason`; `KeyringTamperedError` nests it under `details` alongside `userId` and the format transition. The classes genuinely differ, and the resemblance is a trap: a caller who copies the `TamperedError` shape reads `undefined`, falls through to the else-branch, and **renders a format transition as an attack** — the exact collapse these reason codes exist to prevent.
+
+  The class had no JSDoc saying where to read it. It now states the access shape, names the contrast, and carries a worked `catch` block, so the answer is in the shipped `.d.ts` where a caller meets it.
+
+  Documentation only — no type, value, or behaviour change.
+
+  Found by noy-db-docs, which had documented `err.reason` for this class **two lines below its own sentence warning that the resemblance to `TamperedError.reason` is "a trap worth naming"**. It identified the trap and fell into it one level earlier than it was looking.
+
+  Hub's own prose was swept and is clean: every `.reason` reference in the changelog is to `TamperedError.reason`, which is correct for that class.
+
+- Fix the getting-started example in hub's module JSDoc, which ships inside
+  `dist/index.d.ts`. It omitted the required `user` option and passed `secret` to
+  `openVault()`, where it is not accepted — `secret` is a `createNoydb()` option.
+  Compiled verbatim, the published snippet produced `TS2741` and `TS2353`.
+
+  `packages/hub/README.md` carried the same class of defect: it taught
+  `userId: 'alice'` (the option is `user`) and imported `memory` from
+  `@noy-db/to-memory` (renamed to `toMemory`). Both ship in the tarball.
+
+  Guarded going forward by `pnpm check:prose-examples`, which typechecks every
+  fenced `ts` block in shipped prose against the built `dist`. `check:prose-api`
+  verifies that a documented method _exists_; these defects all named methods that
+  do exist and passed arguments that do not, which only a compiler can see.
+
 ## 0.7.0-pre.10
 
 ### Patch Changes

package/README.md

@@ -52,13 +52,13 @@ pnpm add @noy-db/hub @noy-db/to-memory
 
 ```ts
 import { createNoydb } from '@noy-db/hub'
-import { memory } from '@noy-db/to-memory'
+import { toMemory } from '@noy-db/to-memory'
 
 type Invoice = { id: string; amount: number; customer: string }
 
 const db = await createNoydb({
   store: toMemory(),
-  userId: 'alice',
+  user: 'alice',
   secret: 'correct horse battery staple',
 })
 
@@ -281,7 +281,7 @@ const { evicted, held } = await vault.compact() // held = retained-by-hold count
 ```ts
 import { createNoydb, withArchive } from '@noy-db/hub'
 
-const db = await createNoydb({ store: primary, archiveStrategy: withArchive({ store: coldStore }) })
+const db = await createNoydb({ store: primary, user, secret, archiveStrategy: withArchive({ store: coldStore }) })
 vault.collection('invoices', {
   archive: { archiveWhen: (r) => r.fiscalYear <= thisYear - 1, legalHold: (r) => r.underHold },
 })

package/dist/api-UE2XQKDN.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-XGDYGUEH.js";
+import "./chunk-YQWBEJCS.js";
+import "./chunk-CIGAQBJR.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-7O3Y4PPD.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-UE2XQKDN.js.map

package/dist/as/index.js

@@ -1,23 +1,24 @@
 import "../chunk-UBSFPGVJ.js";
-import "../chunk-PCIBCL26.js";
+import "../chunk-VGICZPVE.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
-import "../chunk-KHKKD62N.js";
-import "../chunk-VT4DTCK5.js";
+import "../chunk-RXLYKVTF.js";
+import "../chunk-VYYM3MEN.js";
+import "../chunk-URHRIAV6.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-I5LSKXT6.js";
-import "../chunk-DOPZWTMJ.js";
+import "../chunk-WWNYSV7S.js";
+import "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
+import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
 import {
   ValidationError
-} from "../chunk-SW4TOSJL.js";
+} from "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/as/active.ts

package/dist/as/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/at/index.js

@@ -4,15 +4,15 @@ import {
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
 } from "../chunk-JUBWUJY5.js";
-import "../chunk-DOPZWTMJ.js";
+import "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
+import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
-import "../chunk-SW4TOSJL.js";
+import "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryRecipientSealer,

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-LUVGSKXE.js";
+} from "../chunk-EVKR67PQ.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-FPN5D4JX.js";
+} from "../chunk-Q4RWFV3G.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-GKOJR53Y.js";
+} from "../chunk-WSJG5L5C.js";
 import {
   NO_ATTESTATION
-} from "../chunk-FLRLZ4XZ.js";
+} from "../chunk-Q7HZX3IF.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-DOPZWTMJ.js";
+import "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
+import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-SW4TOSJL.js";
+} from "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-64N6OG7U.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-IOXM3RSJ.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-5TA7FUC3.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-7NK7TMWU.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-PUJKRYJF.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-U7U3FMXU.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-PUJKRYJF.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-U7U3FMXU.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-PUJKRYJF.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-U7U3FMXU.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-PUJKRYJF.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-U7U3FMXU.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-QZQEP5RO.js → backup-R6A4VZRX.js}

@@ -1,39 +1,39 @@
 import {
   MANIFEST_COLLECTION
 } from "./chunk-EPFF7LOX.js";
-import {
-  SCHEMAS_COLLECTION
-} from "./chunk-I5LSKXT6.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-H5GVPOB4.js";
+} from "./chunk-MMOZQTXV.js";
+import {
+  SCHEMAS_COLLECTION
+} from "./chunk-WWNYSV7S.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-Q2ZN5DWZ.js";
+} from "./chunk-FAHMLERK.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-DOPZWTMJ.js";
+import "./chunk-CIGAQBJR.js";
 import {
   buildRecordEnvelope
 } from "./chunk-4RUFYGWG.js";
-import "./chunk-XGXVPCYW.js";
-import "./chunk-CWFH36SI.js";
-import "./chunk-KZTPL7NL.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-USKHHOIV.js";
+import "./chunk-SL3JAAKN.js";
 import {
   NOYDB_BACKUP_VERSION
 } from "./chunk-N4CHCXDL.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-QZQEP5RO.js.map
+//# sourceMappingURL=backup-R6A4VZRX.js.map

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-IS5LFHV2.js";
+} from "../chunk-DMJZBQ7F.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,21 +25,21 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-HS3LEVT4.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-DZPMKY3J.js";
-import "../chunk-IZTU6RKH.js";
-import "../chunk-DOPZWTMJ.js";
+} from "../chunk-ZG4XLOKB.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-UGTBXF5U.js";
+import "../chunk-JMGDHKQF.js";
+import "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
+import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
 import {
   BlobOfflineError
-} from "../chunk-SW4TOSJL.js";
+} from "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-PV7XXAXK.js";
+} from "../chunk-JBDFMYKQ.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-DOPZWTMJ.js";
+} from "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-USKHHOIV.js";
+import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-SW4TOSJL.js";
+} from "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-MCCGVPRI.js");
+      const { enrollSeed } = await import("../seed-3RXT4VGN.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-MCCGVPRI.js");
+      const { rotateSeed } = await import("../seed-3RXT4VGN.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-MCCGVPRI.js");
+          const { mintStoreCredentials } = await import("../seed-3RXT4VGN.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-GHADG5QZ.js";
-import "../chunk-SW4TOSJL.js";
+} from "../chunk-VTFVLCUH.js";
+import "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 export {
   isQuorum,

package/dist/cargo/index.js

@@ -5,11 +5,11 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-NUXTUGAD.js";
+} from "../chunk-7NTBVFGD.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-7XT7KZTN.js";
+} from "../chunk-DJ3LNNZQ.js";
 import {
   diffVault
 } from "../chunk-LFUID7OW.js";
@@ -18,58 +18,58 @@ import {
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-OXZSMX2H.js";
-import "../chunk-5EC7X5QA.js";
-import "../chunk-P22XPNFW.js";
+} from "../chunk-YCXICMOY.js";
+import "../chunk-QHW35ZON.js";
+import "../chunk-ZR2YMODS.js";
 import {
   NO_CARGO
-} from "../chunk-FKQCC4C5.js";
+} from "../chunk-NQKIUNW5.js";
 import "../chunk-JUBWUJY5.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-GHADG5QZ.js";
-import "../chunk-I5LSKXT6.js";
+} from "../chunk-VTFVLCUH.js";
 import {
   CustodyApi
-} from "../chunk-Z277MC2O.js";
-import "../chunk-RCONOOVF.js";
-import "../chunk-NMDMSHBF.js";
+} from "../chunk-Y4MJQ2UG.js";
+import "../chunk-WWNYSV7S.js";
+import "../chunk-PKJ43CMD.js";
+import "../chunk-MLO75SFJ.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-HS3LEVT4.js";
+import "../chunk-ZG4XLOKB.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-4U52PMEL.js";
+} from "../chunk-ZN4FD4PE.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import {
   readPath
 } from "../chunk-NSITFOCJ.js";
-import "../chunk-DIVY2CJZ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-XJTGBHK6.js";
-import "../chunk-MV2OEK3K.js";
-import "../chunk-DZPMKY3J.js";
+import "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-VNR2SNVJ.js";
+import "../chunk-YQWBEJCS.js";
+import "../chunk-UGTBXF5U.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-OKCQNMO6.js";
+import "../chunk-U7VPHXXO.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-IZTU6RKH.js";
-import "../chunk-DOPZWTMJ.js";
+import "../chunk-IPFE6MVM.js";
+import "../chunk-JMGDHKQF.js";
+import "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-USKHHOIV.js";
+} from "../chunk-SL3JAAKN.js";
 import {
   NOYDB_ENVELOPE_GENERATION
 } from "../chunk-N4CHCXDL.js";
@@ -87,7 +87,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-SW4TOSJL.js";
+} from "../chunk-7O3Y4PPD.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AdoptionStateError,

package/dist/{chunk-AHIIBDNH.js → chunk-2Z47NMFK.js}

@@ -7,7 +7,7 @@ import {
   deriveSchemaManifest,
   loadSchemaManifestEntry,
   saveSchemaManifest
-} from "./chunk-5W5CEHLA.js";
+} from "./chunk-BBWVXF57.js";
 import {
   MANIFEST_COLLECTION
 } from "./chunk-EPFF7LOX.js";
@@ -17,18 +17,18 @@ import {
 } from "./chunk-GM4IM7TC.js";
 import {
   derivePersistedSchema
-} from "./chunk-VT4DTCK5.js";
+} from "./chunk-URHRIAV6.js";
 import {
   loadPersistedSchemaEntry,
   savePersistedSchema
-} from "./chunk-I5LSKXT6.js";
+} from "./chunk-WWNYSV7S.js";
 import {
   envelopePayloadHash
-} from "./chunk-JRWLUWDM.js";
+} from "./chunk-IPFE6MVM.js";
 import {
   ManifestConflictError,
   isConflictError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-shape/persisted-schemas/field-ids.ts
 var BASE32URL_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
@@ -257,4 +257,4 @@ export {
   persistClassifiedMarker,
   persistSatelliteMarker
 };
-//# sourceMappingURL=chunk-AHIIBDNH.js.map
+//# sourceMappingURL=chunk-2Z47NMFK.js.map