@noy-db/hub 0.7.0-pre.13 → 0.7.0-pre.15

package/dist/{registry-I6FP4677.js → registry-5MVJGPXW.js}

@@ -11,9 +11,8 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   MaterializedViewRegistry,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=registry-I6FP4677.js.map
+//# sourceMappingURL=registry-5MVJGPXW.js.map

package/dist/{registry-D2YXKRYC.js → registry-BOHIKFWG.js}

@@ -1,13 +1,13 @@
 import {
   DerivationRegistry
-} from "./chunk-AJQY44CE.js";
+} from "./chunk-ZXLZ62R5.js";
 import "./chunk-TPHAGLUH.js";
-import "./chunk-BWXGSSFX.js";
+import "./chunk-NJXX55QX.js";
 import "./chunk-TFMM5DBB.js";
 import "./chunk-RTBJ5IOO.js";
 import "./chunk-KCUIMITG.js";
 import "./chunk-VYYM3MEN.js";
-import "./chunk-URHRIAV6.js";
+import "./chunk-REDOOY2Q.js";
 import "./chunk-Y2NBBT6K.js";
 import "./chunk-WWNYSV7S.js";
 import "./chunk-YPXNAP72.js";
@@ -26,8 +26,7 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=registry-D2YXKRYC.js.map
+//# sourceMappingURL=registry-BOHIKFWG.js.map

package/dist/{request-withdrawal-6HJT4ODF.js → request-withdrawal-P5EQATZ7.js}

@@ -5,10 +5,10 @@ import {
   listWithdrawalRequests,
   rejectWithdrawal,
   requestWithdrawal
-} from "./chunk-B2ZSGYSF.js";
-import "./chunk-QHW35ZON.js";
-import "./chunk-ZR2YMODS.js";
-import "./chunk-PKJ43CMD.js";
+} from "./chunk-B2KCRDJM.js";
+import "./chunk-TGPST6FK.js";
+import "./chunk-EKZ6VZYF.js";
+import "./chunk-NLOLF6LD.js";
 import "./chunk-MLO75SFJ.js";
 import "./chunk-CIGAQBJR.js";
 import "./chunk-4RUFYGWG.js";
@@ -19,7 +19,6 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   WITHDRAWAL_REQUESTS_COLLECTION,
   WithdrawalRequestError,
@@ -28,4 +27,4 @@ export {
   rejectWithdrawal,
   requestWithdrawal
 };
-//# sourceMappingURL=request-withdrawal-6HJT4ODF.js.map
+//# sourceMappingURL=request-withdrawal-P5EQATZ7.js.map

package/dist/{reveal-DDQBDWPM.js → reveal-IMGQ2EE5.js}

@@ -9,7 +9,6 @@ import "./chunk-N4CHCXDL.js";
 import {
   ClassifiedRevealError
 } from "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/reveal.ts
 async function revealSealedField(ctx, id, field) {
@@ -35,4 +34,4 @@ async function revealSealedField(ctx, id, field) {
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-DDQBDWPM.js.map
+//# sourceMappingURL=reveal-IMGQ2EE5.js.map

package/dist/{reveal-DDQBDWPM.js.map → reveal-IMGQ2EE5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK,GAAG;AAC3E,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}
+{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK,GAAG;AAC3E,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}

package/dist/{revoke-U7U3FMXU.js → revoke-POHP4GPB.js}

@@ -14,11 +14,10 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
 };
-//# sourceMappingURL=revoke-U7U3FMXU.js.map
+//# sourceMappingURL=revoke-POHP4GPB.js.map

package/dist/satellites/index.js

@@ -1,7 +1,6 @@
 import {
   SatelliteConfigError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   SatelliteConfigError
 };

package/dist/schema-update/index.js

@@ -13,7 +13,6 @@ import {
 } from "../chunk-6LJY7X5A.js";
 import "../chunk-Y2NBBT6K.js";
 import "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   SchemaUpdateGate,
   additiveOnly,

package/dist/sealed-record/index.js

@@ -20,21 +20,20 @@ import {
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../enclave-4YBQK77G.js");
+      const { sealRecordToHost } = await import("../enclave-VM2YQONI.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../enclave-4YBQK77G.js");
+      const { revokeSealedRecord } = await import("../enclave-VM2YQONI.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../enclave-4YBQK77G.js");
+      const { rotateRecordCek } = await import("../enclave-VM2YQONI.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/sealed-record/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { recordAadFor, decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n *\n * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**\n * (#1041). They are plaintext metadata rather than secrets, but they are bound\n * into the record's AAD, so a host handed only `{_iv, _data}` cannot\n * reconstruct the identity the body was sealed against.\n *\n * That is a feature, not a tax: it means a host cannot be fed a body with its\n * tags stripped or rewritten — a re-tiered or re-authored envelope no longer\n * opens, even with a valid sealed CEK.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: {\n    readonly _iv: string\n    readonly _data: string\n    /** Bound into the AAD since #1093 — a rewound body no longer opens. */\n    readonly _v: number\n    readonly _tier?: number | undefined\n    readonly _by?: string | undefined\n  },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  // AAD from the binding's OWN collection/id — which step (3) has just proven\n  // match the caller's expectation. So a host cannot be handed record A's\n  // sealed CEK alongside record B's body and open it (#1041): the AAD would\n  // describe A while the ciphertext was sealed for B.\n  return decrypt(\n    recordEnvelope._iv,\n    recordEnvelope._data,\n    cek,\n    recordAadFor({ collection: expectedCollection, id: expectedId }, recordEnvelope),\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;AC6CA,eAAsB,iBACpB,mBACA,gBAQA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AAKvD,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf;AAAA,IACA,aAAa,EAAE,YAAY,oBAAoB,IAAI,WAAW,GAAG,cAAc;AAAA,EACjF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { recordAadFor, decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n *\n * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**\n * (#1041). They are plaintext metadata rather than secrets, but they are bound\n * into the record's AAD, so a host handed only `{_iv, _data}` cannot\n * reconstruct the identity the body was sealed against.\n *\n * That is a feature, not a tax: it means a host cannot be fed a body with its\n * tags stripped or rewritten — a re-tiered or re-authored envelope no longer\n * opens, even with a valid sealed CEK.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: {\n    readonly _iv: string\n    readonly _data: string\n    /** Bound into the AAD since #1093 — a rewound body no longer opens. */\n    readonly _v: number\n    readonly _tier?: number | undefined\n    readonly _by?: string | undefined\n  },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  // AAD from the binding's OWN collection/id — which step (3) has just proven\n  // match the caller's expectation. So a host cannot be handed record A's\n  // sealed CEK alongside record B's body and open it (#1041): the AAD would\n  // describe A while the ciphertext was sealed for B.\n  return decrypt(\n    recordEnvelope._iv,\n    recordEnvelope._data,\n    cek,\n    recordAadFor({ collection: expectedCollection, id: expectedId }, recordEnvelope),\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;AC6CA,eAAsB,iBACpB,mBACA,gBAQA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AAKvD,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf;AAAA,IACA,aAAa,EAAE,YAAY,oBAAoB,IAAI,WAAW,GAAG,cAAc;AAAA,EACjF;AACF;","names":[]}

package/dist/search/index.js

@@ -9,7 +9,7 @@ import {
   segmentTokens,
   tokenize,
   withSearch
-} from "../chunk-COTPDJR5.js";
+} from "../chunk-OMB2ZKIT.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
@@ -18,7 +18,6 @@ import "../chunk-UXVWEX5L.js";
 import {
   SearchNotEnabledError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   InvertedIndex,
   MemoryIndexStore,

package/dist/{seed-3RXT4VGN.js → seed-UYR6YG3V.js}

@@ -30,7 +30,6 @@ import {
   ValidationError,
   isConflictError
 } from "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 
 // src/with-party/broker/seed.ts
 function requireAdminAccess(keyring) {
@@ -226,4 +225,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-3RXT4VGN.js.map
+//# sourceMappingURL=seed-UYR6YG3V.js.map

package/dist/{seed-3RXT4VGN.js.map → seed-UYR6YG3V.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/broker/seed.ts"],"sourcesContent":["/**\n * `_broker` reserved-collection seed lifecycle (#479, credential-broker\n * spec §2/§3). Modeled on `with-sync/credentials.ts`: a\n * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under\n * the collection's own DEK, `requireAdminAccess` role gate (owner/admin\n * only — custodian intentionally excluded, same rationale as\n * `_sync_credentials`: this is transport-auth material, not the\n * custodian's operational scope).\n *\n * Three operations, each a free function taking a {@link BrokerSeedCtx}\n * (the {@link BrokerCtx} threaded through `with-party/broker/active.ts`,\n * augmented there with the `config` its closure was built with):\n *\n *  - {@link enrollSeed} — two-phase commit (I9): create-if-absent CAS the\n *    seed (I4), then register its derived proof key with the broker host,\n *    then (only on a 2xx) mark the record `registered: true`. A seed\n *    persisted whose `/enroll` POST failed stays `registered: false` so a\n *    later `credentialSource()` fails fast instead of degrading into an\n *    opaque `BrokerProofError` (I9/V23).\n *  - {@link rotateSeed} — quiesce-then-swap (I5): mint a fresh seed,\n *    register-new-first, THEN overwrite the local record — closing the\n *    torn-proof window a naive local-overwrite-then-register order would\n *    open. The single-flight cache quiesce itself (await in-flight, bump\n *    epoch) is the caller's job (`with-party/broker/active.ts`) since the\n *    cache lives in that closure, not here.\n *  - {@link mintStoreCredentials} — the challenge/response round trip\n *    (`/challenge` then `/credentials`) that produces one `StoreCredentials`\n *    value; the single-flight cache wrapping it lives in `active.ts`.\n *\n * First-seed creation calls `ensureCollectionDEK`, which throws\n * (`ValidationError`) when the keyring's KEK is `null` (PIN quick-resume /\n * session-restore) — this module intercepts that and re-surfaces it as\n * {@link BrokerEnrolmentError} (R-B8/I3): *enrol* needs the KEK; *use* of an\n * already-enrolled seed needs only the DEK.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope, StoreCredentials } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { ensureCollectionDEK } from '../../with-party/team/keyring.js'\nimport { BROKER_COLLECTION } from '../../with-party/team/reserved-secret-collections.js'\nimport {\n  buildSealedRecordEnvelope,\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  bufferToBase64,\n  base64ToBuffer,\n  deriveBrokerProofBits,\n  computeBrokerProof,\n} from '../../kernel/enclave/index.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  PermissionDeniedError,\n  ValidationError,\n  isConflictError,\n  NetworkError,\n  BrokerEnrolmentError,\n  BrokerProofError,\n} from '../../kernel/errors.js'\nimport type { BrokerSeedCtx, BrokerConfig } from '../../port/with/broker-strategy.js'\n\n/** The `_broker/<brokerId>` record payload (spec §3). */\nexport interface BrokerSeedRecord {\n  readonly brokerId: string\n  /** base64(32 random bytes). */\n  readonly seed: string\n  readonly endpoint: string\n  readonly createdAt: string\n  /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */\n  readonly registered: boolean\n}\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // Custodian is INTENTIONALLY excluded — the _broker seed is transport-auth\n  // material (mints cloud store credentials), not the custodian's\n  // operational data scope. Same rationale as _sync_credentials' FR-6 note.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Credential-broker operations require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// `ensureCollectionDEK` only dedupes concurrent first-time DEK creates WITHIN one\n// closure instance — since every call site here asks for a fresh closure, two\n// concurrent `enrollSeed()` calls sharing the same (store, vault, keyring) would\n// otherwise each mint a DIFFERENT `_broker` DEK and race `persistKeyring`, leaving\n// the seed record encrypted under a DEK the keyring no longer holds (TamperedError\n// on the next read). Dedupe across calls here, keyed by store identity + vault\n// (V20 — the CAS enrol vector actually exercises this).\nconst inFlightDekByStore = new WeakMap<NoydbStore, Map<string, Promise<EnclaveKey>>>()\n\nasync function brokerDek(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<EnclaveKey> {\n  const existing = keyring.deks.get(BROKER_COLLECTION)\n  if (existing) return existing\n\n  let perStore = inFlightDekByStore.get(store)\n  if (!perStore) { perStore = new Map(); inFlightDekByStore.set(store, perStore) }\n  const pending = perStore.get(vault)\n  if (pending) return pending\n\n  const promise = (async () => {\n    try {\n      const getDek = await ensureCollectionDEK(store, vault, keyring)\n      return await getDek(BROKER_COLLECTION)\n    } catch (err) {\n      if (err instanceof ValidationError) {\n        throw new BrokerEnrolmentError(\n          'enroll()/rotate() need the KEK to provision the _broker DEK on first use — ' +\n            're-authenticate at tier 1 (secret) before enrolling. Using an already-' +\n            'enrolled seed (credentialSource()) needs only the DEK.',\n        )\n      }\n      throw err\n    }\n  })()\n  perStore.set(vault, promise)\n  try {\n    return await promise\n  } finally {\n    perStore.delete(vault)\n  }\n}\n\nasync function readRecord(\n  store: NoydbStore,\n  vault: string,\n  brokerId: string,\n  dek: EnclaveKey,\n): Promise<{ envelope: EncryptedEnvelope; record: BrokerSeedRecord } | null> {\n  const envelope = await store.get(vault, BROKER_COLLECTION, brokerId)\n  if (!envelope) return null\n  const record = JSON.parse(await openEnvelopeJson({ collection: BROKER_COLLECTION, id: brokerId }, envelope, dek)) as BrokerSeedRecord\n  return { envelope, record }\n}\n\nasync function persistRecord(\n  store: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  dek: EnclaveKey,\n  record: BrokerSeedRecord,\n  expectedVersion: number,\n): Promise<void> {\n  const envelope = await buildSealedRecordEnvelope(\n    { collection: BROKER_COLLECTION, id: record.brokerId, by: keyring.userId, version: expectedVersion + 1 },\n    (identity) => writeEnvelopeBody(identity, JSON.stringify(record), dek),\n    {},\n  )\n  await store.put(vault, BROKER_COLLECTION, record.brokerId, envelope, expectedVersion)\n}\n\ninterface SeedState {\n  readonly seedBytes: Uint8Array\n  readonly record: BrokerSeedRecord\n  readonly dek: EnclaveKey\n  readonly version: number\n}\n\n/** Create-if-absent CAS (I4/V20): a concurrent enrol that loses the race\n *  re-reads the winner's seed instead of persisting a second one. */\nasync function ensureSeedRecord(store: NoydbStore, vault: string, keyring: UnlockedKeyring, config: BrokerConfig): Promise<SeedState> {\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (existing) {\n    return { seedBytes: base64ToBuffer(existing.record.seed), record: existing.record, dek, version: existing.envelope._v }\n  }\n\n  const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(seedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: false,\n  }\n  try {\n    await persistRecord(store, vault, keyring, dek, record, 0)\n    return { seedBytes, record, dek, version: 1 }\n  } catch (err) {\n    if (!(isConflictError(err))) throw err\n    const winner = await readRecord(store, vault, config.brokerId, dek)\n    if (!winner) throw err\n    return { seedBytes: base64ToBuffer(winner.record.seed), record: winner.record, dek, version: winner.envelope._v }\n  }\n}\n\nasync function postEnroll(config: BrokerConfig, vault: string, proofBits: Uint8Array): Promise<void> {\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const attestation = config.attestation ? await config.attestation() : undefined\n  let res: Response\n  try {\n    res = await fetchFn(`${config.endpoint}/enroll`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        ...(attestation !== undefined ? { authorization: `Bearer ${attestation}` } : {}),\n      },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, proofKey: bufferToBase64(proofBits) }),\n    })\n  } catch (err) {\n    throw new BrokerEnrolmentError(`broker /enroll request failed: ${(err as Error).message}`)\n  }\n  if (!res.ok) {\n    throw new BrokerEnrolmentError(`broker refused enrolment (status ${res.status}) — attestation likely missing or invalid`)\n  }\n}\n\n/**\n * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`\n * seed (I4), derive+register its proof key with the broker host, and only\n * on a 2xx mark the record `registered: true`. Requires owner/admin role\n * and (for first-seed creation only) the KEK.\n */\nexport async function enrollSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  const { seedBytes, record, dek, version } = await ensureSeedRecord(store, vault, keyring, config)\n  if (record.registered) {\n    seedBytes.fill(0)\n    return\n  }\n\n  const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId)\n  seedBytes.fill(0)\n  try {\n    await postEnroll(config, vault, proofBits)\n  } finally {\n    proofBits.fill(0)\n  }\n\n  try {\n    await persistRecord(store, vault, keyring, dek, { ...record, registered: true }, version)\n  } catch (err) {\n    if (isConflictError(err)) {\n      const latest = await readRecord(store, vault, config.brokerId, dek)\n      if (latest?.record.registered) return // a concurrent enrol already committed the same outcome\n    }\n    throw err\n  }\n}\n\n/**\n * Rotate (quiesce-then-swap — I5): mint a fresh seed, register its proof\n * key with the broker host FIRST, then overwrite the local `_broker`\n * record. The broker host is expected to accept both the old and new\n * registration for a short grace window, so an in-flight proof computed\n * under the old key (from before rotation started) still verifies. Cache\n * quiescing (awaiting any in-flight round-trip, bumping the refresh-cache\n * epoch) is the caller's job — `with-party/broker/active.ts` — since the\n * cache lives in that closure, not here.\n */\nexport async function rotateSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (!existing) {\n    // Nothing to rotate yet — behaves like a first enrol.\n    await enrollSeed(ctx)\n    return\n  }\n\n  const newSeedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const newProofBits = await deriveBrokerProofBits(newSeedBytes, vault, config.brokerId)\n  try {\n    await postEnroll(config, vault, newProofBits)\n  } finally {\n    newProofBits.fill(0)\n  }\n\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(newSeedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: true,\n  }\n  newSeedBytes.fill(0)\n  await persistRecord(store, vault, keyring, dek, record, existing.envelope._v)\n}\n\n/**\n * The challenge/response round trip: `POST /challenge`, derive+sign the\n * proof from the decrypted seed, `POST /credentials`. One network round\n * trip per call — the single-flight/cache wrapping lives in `active.ts`.\n *\n * Fails fast with {@link BrokerEnrolmentError} if the seed hasn't completed\n * enrolment yet (`registered !== true` — I9/V23), never degrading into an\n * opaque {@link BrokerProofError}.\n */\nexport async function mintStoreCredentials(ctx: BrokerSeedCtx, profile?: string): Promise<StoreCredentials> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const found = await readRecord(store, vault, config.brokerId, dek)\n  if (!found) throw new BrokerEnrolmentError(`No _broker seed enrolled for brokerId \"${config.brokerId}\" — call enroll() first.`)\n  if (!found.record.registered) {\n    throw new BrokerEnrolmentError(\n      `The _broker seed for \"${config.brokerId}\" has not completed enrolment with the broker host — call enroll() again.`,\n    )\n  }\n\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const endpointOrigin = new URL(config.endpoint).origin\n\n  let challengeRes: Response\n  try {\n    challengeRes = await fetchFn(`${config.endpoint}/challenge`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /challenge request failed: ${(err as Error).message}`)\n  }\n  if (!challengeRes.ok) throw new NetworkError(`broker /challenge failed with status ${challengeRes.status}`)\n  const { challenge, expiresAt } = (await challengeRes.json()) as { challenge: string; expiresAt: string }\n\n  const seedBytes = base64ToBuffer(found.record.seed)\n  const proof = await computeBrokerProof(seedBytes, vault, config.brokerId, { endpointOrigin, profile, challenge, expiresAt })\n\n  let credsRes: Response\n  try {\n    credsRes = await fetchFn(`${config.endpoint}/credentials`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, challenge, proof, ...(profile !== undefined ? { profile } : {}) }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /credentials request failed: ${(err as Error).message}`)\n  }\n  if (credsRes.status === 401 || credsRes.status === 403) throw new BrokerProofError('broker rejected the challenge proof')\n  if (!credsRes.ok) throw new NetworkError(`broker /credentials failed with status ${credsRes.status}`)\n  return (await credsRes.json()) as StoreCredentials\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,SAAS,mBAAmB,SAAgC;AAI1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,4EAA4E,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AASA,IAAM,qBAAqB,oBAAI,QAAsD;AAErF,eAAe,UAAU,OAAmB,OAAe,SAA+C;AACxG,QAAM,WAAW,QAAQ,KAAK,IAAI,iBAAiB;AACnD,MAAI,SAAU,QAAO;AAErB,MAAI,WAAW,mBAAmB,IAAI,KAAK;AAC3C,MAAI,CAAC,UAAU;AAAE,eAAW,oBAAI,IAAI;AAAG,uBAAmB,IAAI,OAAO,QAAQ;AAAA,EAAE;AAC/E,QAAM,UAAU,SAAS,IAAI,KAAK;AAClC,MAAI,QAAS,QAAO;AAEpB,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,oBAAoB,OAAO,OAAO,OAAO;AAC9D,aAAO,MAAM,OAAO,iBAAiB;AAAA,IACvC,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB;AAClC,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,GAAG;AACH,WAAS,IAAI,OAAO,OAAO;AAC3B,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,aAAS,OAAO,KAAK;AAAA,EACvB;AACF;AAEA,eAAe,WACb,OACA,OACA,UACA,KAC2E;AAC3E,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,mBAAmB,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,mBAAmB,IAAI,SAAS,GAAG,UAAU,GAAG,CAAC;AAChH,SAAO,EAAE,UAAU,OAAO;AAC5B;AAEA,eAAe,cACb,OACA,OACA,SACA,KACA,QACA,iBACe;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,EAAE,YAAY,mBAAmB,IAAI,OAAO,UAAU,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,EAAE;AAAA,IACvG,CAAC,aAAa,kBAAkB,UAAU,KAAK,UAAU,MAAM,GAAG,GAAG;AAAA,IACrE,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,mBAAmB,OAAO,UAAU,UAAU,eAAe;AACtF;AAWA,eAAe,iBAAiB,OAAmB,OAAe,SAA0B,QAA0C;AACpI,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,UAAU;AACZ,WAAO,EAAE,WAAW,eAAe,SAAS,OAAO,IAAI,GAAG,QAAQ,SAAS,QAAQ,KAAK,SAAS,SAAS,SAAS,GAAG;AAAA,EACxH;AAEA,QAAM,YAAY,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACtE,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,SAAS;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC;AACzD,WAAO,EAAE,WAAW,QAAQ,KAAK,SAAS,EAAE;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAI,CAAE,gBAAgB,GAAG,EAAI,OAAM;AACnC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,EAAE,WAAW,eAAe,OAAO,OAAO,IAAI,GAAG,QAAQ,OAAO,QAAQ,KAAK,SAAS,OAAO,SAAS,GAAG;AAAA,EAClH;AACF;AAEA,eAAe,WAAW,QAAsB,OAAe,WAAsC;AACnG,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,cAAc,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI;AACtE,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,WAAW;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,gBAAgB,SAAY,EAAE,eAAe,UAAU,WAAW,GAAG,IAAI,CAAC;AAAA,MAChF;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,UAAU,eAAe,SAAS,EAAE,CAAC;AAAA,IACzG,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,qBAAqB,kCAAmC,IAAc,OAAO,EAAE;AAAA,EAC3F;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,qBAAqB,oCAAoC,IAAI,MAAM,gDAA2C;AAAA,EAC1H;AACF;AAQA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,QAAM,EAAE,WAAW,QAAQ,KAAK,QAAQ,IAAI,MAAM,iBAAiB,OAAO,OAAO,SAAS,MAAM;AAChG,MAAI,OAAO,YAAY;AACrB,cAAU,KAAK,CAAC;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,sBAAsB,WAAW,OAAO,OAAO,QAAQ;AAC/E,YAAU,KAAK,CAAC;AAChB,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,SAAS;AAAA,EAC3C,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,EAAE,GAAG,QAAQ,YAAY,KAAK,GAAG,OAAO;AAAA,EAC1F,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,UAAI,QAAQ,OAAO,WAAY;AAAA,IACjC;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,CAAC,UAAU;AAEb,UAAM,WAAW,GAAG;AACpB;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACzE,QAAM,eAAe,MAAM,sBAAsB,cAAc,OAAO,OAAO,QAAQ;AACrF,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,YAAY;AAAA,EAC9C,UAAE;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAEA,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,YAAY;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,eAAa,KAAK,CAAC;AACnB,QAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,SAAS,SAAS,EAAE;AAC9E;AAWA,eAAsB,qBAAqB,KAAoB,SAA6C;AAC1G,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,QAAQ,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACjE,MAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB,0CAA0C,OAAO,QAAQ,+BAA0B;AAC9H,MAAI,CAAC,MAAM,OAAO,YAAY;AAC5B,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,QAAQ;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,iBAAiB,IAAI,IAAI,OAAO,QAAQ,EAAE;AAEhD,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,QAAQ,GAAG,OAAO,QAAQ,cAAc;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,SAAS,CAAC;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,qCAAsC,IAAc,OAAO,EAAE;AAAA,EACtF;AACA,MAAI,CAAC,aAAa,GAAI,OAAM,IAAI,aAAa,wCAAwC,aAAa,MAAM,EAAE;AAC1G,QAAM,EAAE,WAAW,UAAU,IAAK,MAAM,aAAa,KAAK;AAE1D,QAAM,YAAY,eAAe,MAAM,OAAO,IAAI;AAClD,QAAM,QAAQ,MAAM,mBAAmB,WAAW,OAAO,OAAO,UAAU,EAAE,gBAAgB,SAAS,WAAW,UAAU,CAAC;AAE3H,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,OAAO,QAAQ,gBAAgB;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,WAAW,OAAO,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AAAA,IACrI,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,uCAAwC,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,OAAM,IAAI,iBAAiB,qCAAqC;AACxH,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,aAAa,0CAA0C,SAAS,MAAM,EAAE;AACpG,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}
+{"version":3,"sources":["../src/with-party/broker/seed.ts"],"sourcesContent":["/**\n * `_broker` reserved-collection seed lifecycle (#479, credential-broker\n * spec §2/§3). Modeled on `with-sync/credentials.ts`: a\n * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under\n * the collection's own DEK, `requireAdminAccess` role gate (owner/admin\n * only — custodian intentionally excluded, same rationale as\n * `_sync_credentials`: this is transport-auth material, not the\n * custodian's operational scope).\n *\n * Three operations, each a free function taking a {@link BrokerSeedCtx}\n * (the {@link BrokerCtx} threaded through `with-party/broker/active.ts`,\n * augmented there with the `config` its closure was built with):\n *\n *  - {@link enrollSeed} — two-phase commit (I9): create-if-absent CAS the\n *    seed (I4), then register its derived proof key with the broker host,\n *    then (only on a 2xx) mark the record `registered: true`. A seed\n *    persisted whose `/enroll` POST failed stays `registered: false` so a\n *    later `credentialSource()` fails fast instead of degrading into an\n *    opaque `BrokerProofError` (I9/V23).\n *  - {@link rotateSeed} — quiesce-then-swap (I5): mint a fresh seed,\n *    register-new-first, THEN overwrite the local record — closing the\n *    torn-proof window a naive local-overwrite-then-register order would\n *    open. The single-flight cache quiesce itself (await in-flight, bump\n *    epoch) is the caller's job (`with-party/broker/active.ts`) since the\n *    cache lives in that closure, not here.\n *  - {@link mintStoreCredentials} — the challenge/response round trip\n *    (`/challenge` then `/credentials`) that produces one `StoreCredentials`\n *    value; the single-flight cache wrapping it lives in `active.ts`.\n *\n * First-seed creation calls `ensureCollectionDEK`, which throws\n * (`ValidationError`) when the keyring's KEK is `null` (PIN quick-resume /\n * session-restore) — this module intercepts that and re-surfaces it as\n * {@link BrokerEnrolmentError} (R-B8/I3): *enrol* needs the KEK; *use* of an\n * already-enrolled seed needs only the DEK.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope, StoreCredentials } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { ensureCollectionDEK } from '../../with-party/team/keyring.js'\nimport { BROKER_COLLECTION } from '../../with-party/team/reserved-secret-collections.js'\nimport {\n  buildSealedRecordEnvelope,\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  bufferToBase64,\n  base64ToBuffer,\n  deriveBrokerProofBits,\n  computeBrokerProof,\n} from '../../kernel/enclave/index.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  PermissionDeniedError,\n  ValidationError,\n  isConflictError,\n  NetworkError,\n  BrokerEnrolmentError,\n  BrokerProofError,\n} from '../../kernel/errors.js'\nimport type { BrokerSeedCtx, BrokerConfig } from '../../port/with/broker-strategy.js'\n\n/** The `_broker/<brokerId>` record payload (spec §3). */\nexport interface BrokerSeedRecord {\n  readonly brokerId: string\n  /** base64(32 random bytes). */\n  readonly seed: string\n  readonly endpoint: string\n  readonly createdAt: string\n  /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */\n  readonly registered: boolean\n}\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // Custodian is INTENTIONALLY excluded — the _broker seed is transport-auth\n  // material (mints cloud store credentials), not the custodian's\n  // operational data scope. Same rationale as _sync_credentials' FR-6 note.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Credential-broker operations require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// `ensureCollectionDEK` only dedupes concurrent first-time DEK creates WITHIN one\n// closure instance — since every call site here asks for a fresh closure, two\n// concurrent `enrollSeed()` calls sharing the same (store, vault, keyring) would\n// otherwise each mint a DIFFERENT `_broker` DEK and race `persistKeyring`, leaving\n// the seed record encrypted under a DEK the keyring no longer holds (TamperedError\n// on the next read). Dedupe across calls here, keyed by store identity + vault\n// (V20 — the CAS enrol vector actually exercises this).\nconst inFlightDekByStore = new WeakMap<NoydbStore, Map<string, Promise<EnclaveKey>>>()\n\nasync function brokerDek(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<EnclaveKey> {\n  const existing = keyring.deks.get(BROKER_COLLECTION)\n  if (existing) return existing\n\n  let perStore = inFlightDekByStore.get(store)\n  if (!perStore) { perStore = new Map(); inFlightDekByStore.set(store, perStore) }\n  const pending = perStore.get(vault)\n  if (pending) return pending\n\n  const promise = (async () => {\n    try {\n      const getDek = await ensureCollectionDEK(store, vault, keyring)\n      return await getDek(BROKER_COLLECTION)\n    } catch (err) {\n      if (err instanceof ValidationError) {\n        throw new BrokerEnrolmentError(\n          'enroll()/rotate() need the KEK to provision the _broker DEK on first use — ' +\n            're-authenticate at tier 1 (secret) before enrolling. Using an already-' +\n            'enrolled seed (credentialSource()) needs only the DEK.',\n        )\n      }\n      throw err\n    }\n  })()\n  perStore.set(vault, promise)\n  try {\n    return await promise\n  } finally {\n    perStore.delete(vault)\n  }\n}\n\nasync function readRecord(\n  store: NoydbStore,\n  vault: string,\n  brokerId: string,\n  dek: EnclaveKey,\n): Promise<{ envelope: EncryptedEnvelope; record: BrokerSeedRecord } | null> {\n  const envelope = await store.get(vault, BROKER_COLLECTION, brokerId)\n  if (!envelope) return null\n  const record = JSON.parse(await openEnvelopeJson({ collection: BROKER_COLLECTION, id: brokerId }, envelope, dek)) as BrokerSeedRecord\n  return { envelope, record }\n}\n\nasync function persistRecord(\n  store: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  dek: EnclaveKey,\n  record: BrokerSeedRecord,\n  expectedVersion: number,\n): Promise<void> {\n  const envelope = await buildSealedRecordEnvelope(\n    { collection: BROKER_COLLECTION, id: record.brokerId, by: keyring.userId, version: expectedVersion + 1 },\n    (identity) => writeEnvelopeBody(identity, JSON.stringify(record), dek),\n    {},\n  )\n  await store.put(vault, BROKER_COLLECTION, record.brokerId, envelope, expectedVersion)\n}\n\ninterface SeedState {\n  readonly seedBytes: Uint8Array\n  readonly record: BrokerSeedRecord\n  readonly dek: EnclaveKey\n  readonly version: number\n}\n\n/** Create-if-absent CAS (I4/V20): a concurrent enrol that loses the race\n *  re-reads the winner's seed instead of persisting a second one. */\nasync function ensureSeedRecord(store: NoydbStore, vault: string, keyring: UnlockedKeyring, config: BrokerConfig): Promise<SeedState> {\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (existing) {\n    return { seedBytes: base64ToBuffer(existing.record.seed), record: existing.record, dek, version: existing.envelope._v }\n  }\n\n  const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(seedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: false,\n  }\n  try {\n    await persistRecord(store, vault, keyring, dek, record, 0)\n    return { seedBytes, record, dek, version: 1 }\n  } catch (err) {\n    if (!(isConflictError(err))) throw err\n    const winner = await readRecord(store, vault, config.brokerId, dek)\n    if (!winner) throw err\n    return { seedBytes: base64ToBuffer(winner.record.seed), record: winner.record, dek, version: winner.envelope._v }\n  }\n}\n\nasync function postEnroll(config: BrokerConfig, vault: string, proofBits: Uint8Array): Promise<void> {\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const attestation = config.attestation ? await config.attestation() : undefined\n  let res: Response\n  try {\n    res = await fetchFn(`${config.endpoint}/enroll`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        ...(attestation !== undefined ? { authorization: `Bearer ${attestation}` } : {}),\n      },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, proofKey: bufferToBase64(proofBits) }),\n    })\n  } catch (err) {\n    throw new BrokerEnrolmentError(`broker /enroll request failed: ${(err as Error).message}`)\n  }\n  if (!res.ok) {\n    throw new BrokerEnrolmentError(`broker refused enrolment (status ${res.status}) — attestation likely missing or invalid`)\n  }\n}\n\n/**\n * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`\n * seed (I4), derive+register its proof key with the broker host, and only\n * on a 2xx mark the record `registered: true`. Requires owner/admin role\n * and (for first-seed creation only) the KEK.\n */\nexport async function enrollSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  const { seedBytes, record, dek, version } = await ensureSeedRecord(store, vault, keyring, config)\n  if (record.registered) {\n    seedBytes.fill(0)\n    return\n  }\n\n  const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId)\n  seedBytes.fill(0)\n  try {\n    await postEnroll(config, vault, proofBits)\n  } finally {\n    proofBits.fill(0)\n  }\n\n  try {\n    await persistRecord(store, vault, keyring, dek, { ...record, registered: true }, version)\n  } catch (err) {\n    if (isConflictError(err)) {\n      const latest = await readRecord(store, vault, config.brokerId, dek)\n      if (latest?.record.registered) return // a concurrent enrol already committed the same outcome\n    }\n    throw err\n  }\n}\n\n/**\n * Rotate (quiesce-then-swap — I5): mint a fresh seed, register its proof\n * key with the broker host FIRST, then overwrite the local `_broker`\n * record. The broker host is expected to accept both the old and new\n * registration for a short grace window, so an in-flight proof computed\n * under the old key (from before rotation started) still verifies. Cache\n * quiescing (awaiting any in-flight round-trip, bumping the refresh-cache\n * epoch) is the caller's job — `with-party/broker/active.ts` — since the\n * cache lives in that closure, not here.\n */\nexport async function rotateSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (!existing) {\n    // Nothing to rotate yet — behaves like a first enrol.\n    await enrollSeed(ctx)\n    return\n  }\n\n  const newSeedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const newProofBits = await deriveBrokerProofBits(newSeedBytes, vault, config.brokerId)\n  try {\n    await postEnroll(config, vault, newProofBits)\n  } finally {\n    newProofBits.fill(0)\n  }\n\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(newSeedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: true,\n  }\n  newSeedBytes.fill(0)\n  await persistRecord(store, vault, keyring, dek, record, existing.envelope._v)\n}\n\n/**\n * The challenge/response round trip: `POST /challenge`, derive+sign the\n * proof from the decrypted seed, `POST /credentials`. One network round\n * trip per call — the single-flight/cache wrapping lives in `active.ts`.\n *\n * Fails fast with {@link BrokerEnrolmentError} if the seed hasn't completed\n * enrolment yet (`registered !== true` — I9/V23), never degrading into an\n * opaque {@link BrokerProofError}.\n */\nexport async function mintStoreCredentials(ctx: BrokerSeedCtx, profile?: string): Promise<StoreCredentials> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const found = await readRecord(store, vault, config.brokerId, dek)\n  if (!found) throw new BrokerEnrolmentError(`No _broker seed enrolled for brokerId \"${config.brokerId}\" — call enroll() first.`)\n  if (!found.record.registered) {\n    throw new BrokerEnrolmentError(\n      `The _broker seed for \"${config.brokerId}\" has not completed enrolment with the broker host — call enroll() again.`,\n    )\n  }\n\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const endpointOrigin = new URL(config.endpoint).origin\n\n  let challengeRes: Response\n  try {\n    challengeRes = await fetchFn(`${config.endpoint}/challenge`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /challenge request failed: ${(err as Error).message}`)\n  }\n  if (!challengeRes.ok) throw new NetworkError(`broker /challenge failed with status ${challengeRes.status}`)\n  const { challenge, expiresAt } = (await challengeRes.json()) as { challenge: string; expiresAt: string }\n\n  const seedBytes = base64ToBuffer(found.record.seed)\n  const proof = await computeBrokerProof(seedBytes, vault, config.brokerId, { endpointOrigin, profile, challenge, expiresAt })\n\n  let credsRes: Response\n  try {\n    credsRes = await fetchFn(`${config.endpoint}/credentials`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, challenge, proof, ...(profile !== undefined ? { profile } : {}) }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /credentials request failed: ${(err as Error).message}`)\n  }\n  if (credsRes.status === 401 || credsRes.status === 403) throw new BrokerProofError('broker rejected the challenge proof')\n  if (!credsRes.ok) throw new NetworkError(`broker /credentials failed with status ${credsRes.status}`)\n  return (await credsRes.json()) as StoreCredentials\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,SAAS,mBAAmB,SAAgC;AAI1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,4EAA4E,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AASA,IAAM,qBAAqB,oBAAI,QAAsD;AAErF,eAAe,UAAU,OAAmB,OAAe,SAA+C;AACxG,QAAM,WAAW,QAAQ,KAAK,IAAI,iBAAiB;AACnD,MAAI,SAAU,QAAO;AAErB,MAAI,WAAW,mBAAmB,IAAI,KAAK;AAC3C,MAAI,CAAC,UAAU;AAAE,eAAW,oBAAI,IAAI;AAAG,uBAAmB,IAAI,OAAO,QAAQ;AAAA,EAAE;AAC/E,QAAM,UAAU,SAAS,IAAI,KAAK;AAClC,MAAI,QAAS,QAAO;AAEpB,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,oBAAoB,OAAO,OAAO,OAAO;AAC9D,aAAO,MAAM,OAAO,iBAAiB;AAAA,IACvC,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB;AAClC,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,GAAG;AACH,WAAS,IAAI,OAAO,OAAO;AAC3B,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,aAAS,OAAO,KAAK;AAAA,EACvB;AACF;AAEA,eAAe,WACb,OACA,OACA,UACA,KAC2E;AAC3E,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,mBAAmB,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,mBAAmB,IAAI,SAAS,GAAG,UAAU,GAAG,CAAC;AAChH,SAAO,EAAE,UAAU,OAAO;AAC5B;AAEA,eAAe,cACb,OACA,OACA,SACA,KACA,QACA,iBACe;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,EAAE,YAAY,mBAAmB,IAAI,OAAO,UAAU,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,EAAE;AAAA,IACvG,CAAC,aAAa,kBAAkB,UAAU,KAAK,UAAU,MAAM,GAAG,GAAG;AAAA,IACrE,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,mBAAmB,OAAO,UAAU,UAAU,eAAe;AACtF;AAWA,eAAe,iBAAiB,OAAmB,OAAe,SAA0B,QAA0C;AACpI,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,UAAU;AACZ,WAAO,EAAE,WAAW,eAAe,SAAS,OAAO,IAAI,GAAG,QAAQ,SAAS,QAAQ,KAAK,SAAS,SAAS,SAAS,GAAG;AAAA,EACxH;AAEA,QAAM,YAAY,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACtE,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,SAAS;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC;AACzD,WAAO,EAAE,WAAW,QAAQ,KAAK,SAAS,EAAE;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAI,CAAE,gBAAgB,GAAG,EAAI,OAAM;AACnC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,EAAE,WAAW,eAAe,OAAO,OAAO,IAAI,GAAG,QAAQ,OAAO,QAAQ,KAAK,SAAS,OAAO,SAAS,GAAG;AAAA,EAClH;AACF;AAEA,eAAe,WAAW,QAAsB,OAAe,WAAsC;AACnG,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,cAAc,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI;AACtE,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,WAAW;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,gBAAgB,SAAY,EAAE,eAAe,UAAU,WAAW,GAAG,IAAI,CAAC;AAAA,MAChF;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,UAAU,eAAe,SAAS,EAAE,CAAC;AAAA,IACzG,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,qBAAqB,kCAAmC,IAAc,OAAO,EAAE;AAAA,EAC3F;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,qBAAqB,oCAAoC,IAAI,MAAM,gDAA2C;AAAA,EAC1H;AACF;AAQA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,QAAM,EAAE,WAAW,QAAQ,KAAK,QAAQ,IAAI,MAAM,iBAAiB,OAAO,OAAO,SAAS,MAAM;AAChG,MAAI,OAAO,YAAY;AACrB,cAAU,KAAK,CAAC;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,sBAAsB,WAAW,OAAO,OAAO,QAAQ;AAC/E,YAAU,KAAK,CAAC;AAChB,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,SAAS;AAAA,EAC3C,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,EAAE,GAAG,QAAQ,YAAY,KAAK,GAAG,OAAO;AAAA,EAC1F,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,UAAI,QAAQ,OAAO,WAAY;AAAA,IACjC;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,CAAC,UAAU;AAEb,UAAM,WAAW,GAAG;AACpB;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACzE,QAAM,eAAe,MAAM,sBAAsB,cAAc,OAAO,OAAO,QAAQ;AACrF,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,YAAY;AAAA,EAC9C,UAAE;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAEA,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,YAAY;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,eAAa,KAAK,CAAC;AACnB,QAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,SAAS,SAAS,EAAE;AAC9E;AAWA,eAAsB,qBAAqB,KAAoB,SAA6C;AAC1G,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,QAAQ,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACjE,MAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB,0CAA0C,OAAO,QAAQ,+BAA0B;AAC9H,MAAI,CAAC,MAAM,OAAO,YAAY;AAC5B,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,QAAQ;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,iBAAiB,IAAI,IAAI,OAAO,QAAQ,EAAE;AAEhD,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,QAAQ,GAAG,OAAO,QAAQ,cAAc;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,SAAS,CAAC;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,qCAAsC,IAAc,OAAO,EAAE;AAAA,EACtF;AACA,MAAI,CAAC,aAAa,GAAI,OAAM,IAAI,aAAa,wCAAwC,aAAa,MAAM,EAAE;AAC1G,QAAM,EAAE,WAAW,UAAU,IAAK,MAAM,aAAa,KAAK;AAE1D,QAAM,YAAY,eAAe,MAAM,OAAO,IAAI;AAClD,QAAM,QAAQ,MAAM,mBAAmB,WAAW,OAAO,OAAO,UAAU,EAAE,gBAAgB,SAAS,WAAW,UAAU,CAAC;AAE3H,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,OAAO,QAAQ,gBAAgB;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,WAAW,OAAO,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AAAA,IACrI,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,uCAAwC,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,OAAM,IAAI,iBAAiB,qCAAqC;AACxH,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,aAAa,0CAA0C,SAAS,MAAM,EAAE;AACpG,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}

package/dist/sequence/index.js

@@ -17,7 +17,6 @@ import "../chunk-N4CHCXDL.js";
 import {
   SequenceNotEnabledError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,

package/dist/session/index.js

@@ -30,7 +30,6 @@ import {
   SessionNotFoundError,
   SessionPolicyError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/with-party/session/active.ts
 function withSession() {

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/shadow/index.js

@@ -6,7 +6,6 @@ import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
 import "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/shadow/active.ts
 function withShadow() {

package/dist/shadow/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-fork/shadow/active.ts"],"sourcesContent":["/**\n * Active shadow strategy — the only place `VaultFrame` is constructed.\n * Only reachable through `@noy-db/hub/shadow`.\n */\n\nimport { VaultFrame } from './vault-frame.js'\nimport type { ShadowStrategy } from './strategy.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport function withShadow(): ShadowStrategy {\n  return {\n    buildFrame(vault) { return new VaultFrame(vault as Vault) },\n  }\n}\n"],"mappings":";;;;;;;;;;;AASO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,WAAW,OAAO;AAAE,aAAO,IAAI,WAAW,KAAc;AAAA,IAAE;AAAA,EAC5D;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-fork/shadow/active.ts"],"sourcesContent":["/**\n * Active shadow strategy — the only place `VaultFrame` is constructed.\n * Only reachable through `@noy-db/hub/shadow`.\n */\n\nimport { VaultFrame } from './vault-frame.js'\nimport type { ShadowStrategy } from './strategy.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport function withShadow(): ShadowStrategy {\n  return {\n    buildFrame(vault) { return new VaultFrame(vault as Vault) },\n  }\n}\n"],"mappings":";;;;;;;;;;AASO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,WAAW,OAAO;AAAE,aAAO,IAAI,WAAW,KAAc;AAAA,IAAE;AAAA,EAC5D;AACF;","names":[]}

package/dist/share-link/index.js

@@ -1,7 +1,6 @@
 import {
   isULID
 } from "../chunk-4AOERLTV.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/share-link/share-link.ts
 var ShareLinkParseError = class extends Error {

package/dist/share-link/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/share-link/share-link.ts"],"sourcesContent":["/**\n * Portal share-link grammar + parse/build helper (#806).\n *\n * ONE canonical link grammar addresses `vault / period / collection /\n * record` across all three portal surfaces — the LIFF permalink path\n * (`https://liff.line.me/{liffId}/r/…`), the installed-PWA same-origin\n * path (`https://{portal-origin}/r/…`), and the vendor backend console.\n * The link SHAPE is identical everywhere; only the origin prefix\n * differs, and callers own the prefix.\n *\n * ## Grammar (frozen — see `__tests__/share-link-surface.golden.json`)\n *\n * ```\n * share-link = [ base ] \"/r/\" vault \"/\" collection \"/\" record\n *              [ \"?\" query ] [ \"#\" fragment ]\n * vault      = ULID                        ; 26 uppercase Crockford base32 chars\n * collection = segment                     ; opaque, non-empty after decode\n * record     = segment                     ; opaque, non-empty after decode\n * query      = pair *( \"&\" pair )          ; keys unique; ONLY these two keys\n * pair       = \"period=\" component         ; opaque period id\n *            / \"v=\" version                ; record version\n * version    = \"0\" / %x31-39 *DIGIT        ; base-10 integer, ≤ 2^53 − 1\n * fragment   = \"g=\" component              ; single-use grant token (opaque)\n * ```\n *\n * `segment` / `component` are strict-canonical `encodeURIComponent`\n * output: decoding then re-encoding MUST reproduce the raw text exactly\n * (uppercase-hex escapes, `+` is a literal plus never a space, `%2F`\n * inside a segment never creates an extra segment). Path segments\n * additionally may not decode to `.` or `..`. Links produced by\n * {@link buildShareLink} always satisfy this; hand-written links using\n * only unreserved characters (`inv-001`, ULIDs, …) do too.\n *\n * ## Transport rule for the grant token\n *\n * The optional single-use grant token travels ONLY in the URL fragment\n * (`#g={token}`) — never in the path or query — because fragments are\n * not sent to servers, so the token never reaches server logs, CDNs, or\n * LINE's infrastructure. Same rule `on-magic-link` follows. The token is\n * fully OPAQUE here: no validation beyond non-empty, no decoding of its\n * semantics — grant semantics live in `on-magic-link` (not imported).\n *\n * ## Fail closed\n *\n * {@link parseShareLink} throws a typed {@link ShareLinkParseError} for\n * ANYTHING that is not exactly the grammar above — unknown prefix,\n * missing/extra/empty/malformed segments, a non-ULID vault handle,\n * duplicate or unknown query keys, malformed fragments. There is never a\n * default-vault (or any other) fallback; the app maps the error to a 404.\n *\n * Zero dependencies on the hub floor: pure string/`URL` code, no crypto,\n * no store — LIFF shells, PWAs, and klum-db can import this subpath\n * without dragging anything else. (The one internal import is the pure,\n * leaf ULID shape check shared with the pod format.)\n */\n\nimport { isULID } from '../with-pod/ulid.js'\n\n/** Machine-readable {@link ShareLinkParseError} discriminant. */\nexport type ShareLinkErrorCode =\n  | 'MALFORMED_URL'\n  | 'UNKNOWN_PREFIX'\n  | 'MALFORMED_PATH'\n  | 'MALFORMED_SEGMENT'\n  | 'INVALID_VAULT_HANDLE'\n  | 'MALFORMED_QUERY'\n  | 'DUPLICATE_QUERY_KEY'\n  | 'UNKNOWN_QUERY_KEY'\n  | 'INVALID_VERSION'\n  | 'MALFORMED_FRAGMENT'\n  | 'INVALID_PARTS'\n\n/**\n * Typed failure for the share-link grammar. Thrown by\n * {@link parseShareLink} for any input outside the grammar (fail closed —\n * map to an app-level 404, never a default-vault fallback), and by\n * {@link buildShareLink} with code `'INVALID_PARTS'` when the caller\n * hands it parts that could not round-trip.\n *\n * Standalone (`extends Error`, not `NoydbError`) so this subpath stays\n * import-light; the `code` field follows the same machine-readable\n * convention as the kernel error classes.\n */\nexport class ShareLinkParseError extends Error {\n  /** Machine-readable error code. Stable across library versions. */\n  readonly code: ShareLinkErrorCode\n\n  constructor(code: ShareLinkErrorCode, message: string) {\n    super(message)\n    this.name = 'ShareLinkParseError'\n    this.code = code\n  }\n}\n\n/**\n * The logical address a share link carries. Input to\n * {@link buildShareLink}; {@link parseShareLink} returns the same shape\n * (as the readonly {@link ShareLink} alias) with optional fields OMITTED\n * (not `undefined`) when absent from the link.\n */\nexport interface ShareLinkParts {\n  /** Vault handle — a 26-character uppercase Crockford-base32 ULID. */\n  vaultHandle: string\n  /** Collection name — opaque, non-empty. */\n  collection: string\n  /** Record id — opaque, non-empty. */\n  recordId: string\n  /** Optional period id (`?period=`) — opaque, non-empty. */\n  period?: string\n  /** Optional record version (`?v=`) — non-negative safe integer. */\n  version?: number\n  /**\n   * Optional single-use grant token (`#g=`) — opaque, non-empty. Carried\n   * ONLY in the URL fragment; semantics belong to `on-magic-link`.\n   */\n  grantToken?: string\n}\n\n/** A successfully parsed share link. See {@link ShareLinkParts}. */\nexport type ShareLink = Readonly<ShareLinkParts>\n\n// Dummy base for parsing bare `/r/…` paths with the WHATWG URL parser.\n// `.invalid` is reserved (RFC 2606) — it can never collide with a real\n// origin, and the host is discarded anyway (only path/query/fragment\n// matter to the grammar).\nconst DUMMY_BASE = 'https://share-link.invalid'\n\n/**\n * Canonical encoding of a QUERY value. `encodeURIComponent`, plus `'`\n * → `%27`: the WHATWG URL parser percent-encodes the apostrophe inside\n * the query component of special (http/https) URLs — if we emitted a\n * raw `'`, any URL-object round-trip (browser address bar, `new URL`)\n * would rewrite the link into a form the strict parser then rejects.\n * Path and fragment components don't need this — every character the\n * URL parser escapes there is already escaped by `encodeURIComponent`.\n */\nfunction encodeQueryValue(value: string): string {\n  return encodeURIComponent(value).replace(/'/g, '%27')\n}\n\n/**\n * Strict-canonical decode: `raw` must be exactly what the given\n * canonical `encode` produces for the decoded text — no `+`-for-space,\n * no lowercase hex escapes, no unencoded reserved characters,\n * non-empty. `redact` keeps the raw text out of the error message\n * (grant tokens).\n */\nfunction decodeCanonical(\n  raw: string,\n  code: ShareLinkErrorCode,\n  what: string,\n  { redact = false, encode = encodeURIComponent }: {\n    redact?: boolean\n    encode?: (value: string) => string\n  } = {},\n): string {\n  const shown = redact ? '(redacted)' : `\"${raw}\"`\n  let decoded: string\n  try {\n    decoded = decodeURIComponent(raw)\n  } catch {\n    throw new ShareLinkParseError(code, `${what}: malformed percent-encoding in ${shown}`)\n  }\n  if (decoded === '') {\n    throw new ShareLinkParseError(code, `${what}: empty`)\n  }\n  if (encode(decoded) !== raw) {\n    throw new ShareLinkParseError(\n      code,\n      `${what}: ${shown} is not canonical encodeURIComponent output`,\n    )\n  }\n  return decoded\n}\n\n/** Path-segment decode — canonical, plus the dot-segment refusal. */\nfunction decodePathSegment(raw: string, what: string): string {\n  const decoded = decodeCanonical(raw, 'MALFORMED_SEGMENT', what)\n  if (decoded === '.' || decoded === '..') {\n    throw new ShareLinkParseError('MALFORMED_SEGMENT', `${what}: \"${decoded}\" is a dot segment`)\n  }\n  return decoded\n}\n\n/** `v=` value → non-negative safe integer. Canonical base-10 only. */\nfunction parseVersion(raw: string): number {\n  if (!/^(?:0|[1-9][0-9]*)$/.test(raw)) {\n    throw new ShareLinkParseError(\n      'INVALID_VERSION',\n      `version \"${raw}\" is not a canonical base-10 integer`,\n    )\n  }\n  const version = Number(raw)\n  if (!Number.isSafeInteger(version)) {\n    throw new ShareLinkParseError('INVALID_VERSION', `version \"${raw}\" exceeds 2^53 - 1`)\n  }\n  return version\n}\n\n/** Resolve string | URL input to a URL object, fail closed. */\nfunction toUrl(input: string | URL): URL {\n  if (input instanceof URL) {\n    if (input.protocol !== 'http:' && input.protocol !== 'https:') {\n      throw new ShareLinkParseError(\n        'UNKNOWN_PREFIX',\n        `unsupported protocol \"${input.protocol}\" — share links are http(s) URLs or bare /r/ paths`,\n      )\n    }\n    return input\n  }\n  if (input.startsWith('/')) {\n    try {\n      return new URL(input, DUMMY_BASE)\n    } catch {\n      throw new ShareLinkParseError('MALFORMED_URL', 'unparseable share path')\n    }\n  }\n  if (/^https?:\\/\\//i.test(input)) {\n    try {\n      return new URL(input)\n    } catch {\n      throw new ShareLinkParseError('MALFORMED_URL', 'unparseable share URL')\n    }\n  }\n  throw new ShareLinkParseError(\n    'UNKNOWN_PREFIX',\n    'input is neither a \"/\"-rooted share path nor an http(s) URL',\n  )\n}\n\n/**\n * Parse a share link — full URL, `URL` instance, or bare `/r/…` path.\n *\n * A LIFF permalink prefix is tolerated: when the path does not start\n * with `/r/` directly, the share path is taken from the FIRST `/r/`\n * segment boundary (`https://liff.line.me/{liffId}/r/…` → `/r/…`). No\n * fuzzy matching beyond that single rule.\n *\n * Fail closed: anything outside the grammar throws\n * {@link ShareLinkParseError}. Never a default-vault fallback.\n */\nexport function parseShareLink(input: string | URL): ShareLink {\n  const url = toUrl(input)\n\n  let pathname = url.pathname\n  if (!pathname.startsWith('/r/')) {\n    // LIFF permalink tolerance — only after the direct parse failed. An\n    // indexOf hit is always a whole `r` segment (the match is slash-\n    // delimited on both sides), so this cannot fire mid-segment.\n    const idx = pathname.indexOf('/r/')\n    if (idx === -1) {\n      throw new ShareLinkParseError(\n        'UNKNOWN_PREFIX',\n        `path \"${pathname}\" has no /r/ share prefix`,\n      )\n    }\n    pathname = pathname.slice(idx)\n  }\n\n  // \"/r/{vault}/{collection}/{record}\" splits into exactly 5 parts:\n  // ['', 'r', vault, collection, record].\n  const rawSegments = pathname.split('/')\n  if (rawSegments.length !== 5) {\n    throw new ShareLinkParseError(\n      'MALFORMED_PATH',\n      `expected /r/{vaultHandle}/{collection}/{recordId} — got ${rawSegments.length - 2} segment(s) after /r/`,\n    )\n  }\n\n  const vaultHandle = decodePathSegment(rawSegments[2]!, 'vault handle')\n  if (!isULID(vaultHandle)) {\n    throw new ShareLinkParseError(\n      'INVALID_VAULT_HANDLE',\n      `vault handle \"${vaultHandle}\" is not a ULID`,\n    )\n  }\n  const collection = decodePathSegment(rawSegments[3]!, 'collection')\n  const recordId = decodePathSegment(rawSegments[4]!, 'record id')\n\n  // Query — manual parse of url.search (NOT URLSearchParams, whose\n  // form-urlencoded rules decode \"+\" as a space and hide duplicates).\n  let period: string | undefined\n  let version: number | undefined\n  if (url.search !== '') {\n    const seen = new Set<string>()\n    for (const pair of url.search.slice(1).split('&')) {\n      const eq = pair.indexOf('=')\n      if (eq <= 0) {\n        throw new ShareLinkParseError('MALFORMED_QUERY', `query pair \"${pair}\" is not key=value`)\n      }\n      const key = pair.slice(0, eq)\n      const rawValue = pair.slice(eq + 1)\n      if (key !== 'period' && key !== 'v') {\n        throw new ShareLinkParseError('UNKNOWN_QUERY_KEY', `unknown query key \"${key}\"`)\n      }\n      if (seen.has(key)) {\n        throw new ShareLinkParseError('DUPLICATE_QUERY_KEY', `duplicate query key \"${key}\"`)\n      }\n      seen.add(key)\n      if (key === 'period') {\n        period = decodeCanonical(rawValue, 'MALFORMED_QUERY', 'period', {\n          encode: encodeQueryValue,\n        })\n      } else {\n        version = parseVersion(rawValue)\n      }\n    }\n  }\n\n  // Fragment — the ONLY place a grant token may appear.\n  let grantToken: string | undefined\n  if (url.hash !== '' && url.hash !== '#') {\n    const fragment = url.hash.slice(1)\n    if (!fragment.startsWith('g=')) {\n      throw new ShareLinkParseError(\n        'MALFORMED_FRAGMENT',\n        'fragment is not a g={token} grant carrier',\n      )\n    }\n    grantToken = decodeCanonical(fragment.slice(2), 'MALFORMED_FRAGMENT', 'grant token', {\n      redact: true,\n    })\n  }\n\n  return {\n    vaultHandle,\n    collection,\n    recordId,\n    ...(period !== undefined ? { period } : {}),\n    ...(version !== undefined ? { version } : {}),\n    ...(grantToken !== undefined ? { grantToken } : {}),\n  }\n}\n\n/** Build-side part validation. Returns the (narrowed) string value. */\nfunction requirePart(value: unknown, what: string, dotSegmentRefused = false): string {\n  if (typeof value !== 'string' || value === '') {\n    throw new ShareLinkParseError('INVALID_PARTS', `${what} must be a non-empty string`)\n  }\n  if (dotSegmentRefused && (value === '.' || value === '..')) {\n    throw new ShareLinkParseError('INVALID_PARTS', `${what}: \"${value}\" is a dot segment`)\n  }\n  return value\n}\n\n/**\n * Build a RELATIVE share link (`/r/…`) from typed parts. Callers prefix\n * their surface origin — the LIFF permalink base, the PWA origin, or the\n * vendor console — either themselves or via `base`, which is prepended\n * VERBATIM (no validation, no joining logic; pass it without a trailing\n * slash, e.g. `https://liff.line.me/{liffId}`).\n *\n * The grant token, when present, is emitted ONLY as the `#g=` fragment.\n * Invalid parts throw {@link ShareLinkParseError} with code\n * `'INVALID_PARTS'` — every built link is guaranteed to round-trip\n * through {@link parseShareLink}.\n */\nexport function buildShareLink(parts: ShareLinkParts, base?: string): string {\n  const { vaultHandle, collection, recordId, period, version, grantToken } = parts\n\n  if (typeof vaultHandle !== 'string' || !isULID(vaultHandle)) {\n    throw new ShareLinkParseError('INVALID_PARTS', 'vaultHandle is not a ULID')\n  }\n  const path = `/r/${vaultHandle}/${encodeURIComponent(\n    requirePart(collection, 'collection', true),\n  )}/${encodeURIComponent(requirePart(recordId, 'recordId', true))}`\n\n  const query: string[] = []\n  if (period !== undefined) {\n    query.push(`period=${encodeQueryValue(requirePart(period, 'period'))}`)\n  }\n  if (version !== undefined) {\n    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version < 0) {\n      throw new ShareLinkParseError('INVALID_PARTS', 'version must be a non-negative safe integer')\n    }\n    query.push(`v=${version}`)\n  }\n\n  const fragment =\n    grantToken !== undefined\n      ? `#g=${encodeURIComponent(requirePart(grantToken, 'grantToken'))}`\n      : ''\n\n  return (base ?? '') + path + (query.length > 0 ? `?${query.join('&')}` : '') + fragment\n}\n"],"mappings":";;;;;;AAmFO,IAAM,sBAAN,cAAkC,MAAM;AAAA;AAAA,EAEpC;AAAA,EAET,YAAY,MAA0B,SAAiB;AACrD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,IAAM,aAAa;AAWnB,SAAS,iBAAiB,OAAuB;AAC/C,SAAO,mBAAmB,KAAK,EAAE,QAAQ,MAAM,KAAK;AACtD;AASA,SAAS,gBACP,KACA,MACA,MACA,EAAE,SAAS,OAAO,SAAS,mBAAmB,IAG1C,CAAC,GACG;AACR,QAAM,QAAQ,SAAS,eAAe,IAAI,GAAG;AAC7C,MAAI;AACJ,MAAI;AACF,cAAU,mBAAmB,GAAG;AAAA,EAClC,QAAQ;AACN,UAAM,IAAI,oBAAoB,MAAM,GAAG,IAAI,mCAAmC,KAAK,EAAE;AAAA,EACvF;AACA,MAAI,YAAY,IAAI;AAClB,UAAM,IAAI,oBAAoB,MAAM,GAAG,IAAI,SAAS;AAAA,EACtD;AACA,MAAI,OAAO,OAAO,MAAM,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,KAAK;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,KAAa,MAAsB;AAC5D,QAAM,UAAU,gBAAgB,KAAK,qBAAqB,IAAI;AAC9D,MAAI,YAAY,OAAO,YAAY,MAAM;AACvC,UAAM,IAAI,oBAAoB,qBAAqB,GAAG,IAAI,MAAM,OAAO,oBAAoB;AAAA,EAC7F;AACA,SAAO;AACT;AAGA,SAAS,aAAa,KAAqB;AACzC,MAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,YAAY,GAAG;AAAA,IACjB;AAAA,EACF;AACA,QAAM,UAAU,OAAO,GAAG;AAC1B,MAAI,CAAC,OAAO,cAAc,OAAO,GAAG;AAClC,UAAM,IAAI,oBAAoB,mBAAmB,YAAY,GAAG,oBAAoB;AAAA,EACtF;AACA,SAAO;AACT;AAGA,SAAS,MAAM,OAA0B;AACvC,MAAI,iBAAiB,KAAK;AACxB,QAAI,MAAM,aAAa,WAAW,MAAM,aAAa,UAAU;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,QACA,yBAAyB,MAAM,QAAQ;AAAA,MACzC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,WAAW,GAAG,GAAG;AACzB,QAAI;AACF,aAAO,IAAI,IAAI,OAAO,UAAU;AAAA,IAClC,QAAQ;AACN,YAAM,IAAI,oBAAoB,iBAAiB,wBAAwB;AAAA,IACzE;AAAA,EACF;AACA,MAAI,gBAAgB,KAAK,KAAK,GAAG;AAC/B,QAAI;AACF,aAAO,IAAI,IAAI,KAAK;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,oBAAoB,iBAAiB,uBAAuB;AAAA,IACxE;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,eAAe,OAAgC;AAC7D,QAAM,MAAM,MAAM,KAAK;AAEvB,MAAI,WAAW,IAAI;AACnB,MAAI,CAAC,SAAS,WAAW,KAAK,GAAG;AAI/B,UAAM,MAAM,SAAS,QAAQ,KAAK;AAClC,QAAI,QAAQ,IAAI;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA,SAAS,QAAQ;AAAA,MACnB;AAAA,IACF;AACA,eAAW,SAAS,MAAM,GAAG;AAAA,EAC/B;AAIA,QAAM,cAAc,SAAS,MAAM,GAAG;AACtC,MAAI,YAAY,WAAW,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gEAA2D,YAAY,SAAS,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,cAAc,kBAAkB,YAAY,CAAC,GAAI,cAAc;AACrE,MAAI,CAAC,OAAO,WAAW,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,WAAW;AAAA,IAC9B;AAAA,EACF;AACA,QAAM,aAAa,kBAAkB,YAAY,CAAC,GAAI,YAAY;AAClE,QAAM,WAAW,kBAAkB,YAAY,CAAC,GAAI,WAAW;AAI/D,MAAI;AACJ,MAAI;AACJ,MAAI,IAAI,WAAW,IAAI;AACrB,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,QAAQ,IAAI,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AACjD,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,MAAM,GAAG;AACX,cAAM,IAAI,oBAAoB,mBAAmB,eAAe,IAAI,oBAAoB;AAAA,MAC1F;AACA,YAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAC5B,YAAM,WAAW,KAAK,MAAM,KAAK,CAAC;AAClC,UAAI,QAAQ,YAAY,QAAQ,KAAK;AACnC,cAAM,IAAI,oBAAoB,qBAAqB,sBAAsB,GAAG,GAAG;AAAA,MACjF;AACA,UAAI,KAAK,IAAI,GAAG,GAAG;AACjB,cAAM,IAAI,oBAAoB,uBAAuB,wBAAwB,GAAG,GAAG;AAAA,MACrF;AACA,WAAK,IAAI,GAAG;AACZ,UAAI,QAAQ,UAAU;AACpB,iBAAS,gBAAgB,UAAU,mBAAmB,UAAU;AAAA,UAC9D,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,OAAO;AACL,kBAAU,aAAa,QAAQ;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK;AACvC,UAAM,WAAW,IAAI,KAAK,MAAM,CAAC;AACjC,QAAI,CAAC,SAAS,WAAW,IAAI,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,iBAAa,gBAAgB,SAAS,MAAM,CAAC,GAAG,sBAAsB,eAAe;AAAA,MACnF,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnD;AACF;AAGA,SAAS,YAAY,OAAgB,MAAc,oBAAoB,OAAe;AACpF,MAAI,OAAO,UAAU,YAAY,UAAU,IAAI;AAC7C,UAAM,IAAI,oBAAoB,iBAAiB,GAAG,IAAI,6BAA6B;AAAA,EACrF;AACA,MAAI,sBAAsB,UAAU,OAAO,UAAU,OAAO;AAC1D,UAAM,IAAI,oBAAoB,iBAAiB,GAAG,IAAI,MAAM,KAAK,oBAAoB;AAAA,EACvF;AACA,SAAO;AACT;AAcO,SAAS,eAAe,OAAuB,MAAuB;AAC3E,QAAM,EAAE,aAAa,YAAY,UAAU,QAAQ,SAAS,WAAW,IAAI;AAE3E,MAAI,OAAO,gBAAgB,YAAY,CAAC,OAAO,WAAW,GAAG;AAC3D,UAAM,IAAI,oBAAoB,iBAAiB,2BAA2B;AAAA,EAC5E;AACA,QAAM,OAAO,MAAM,WAAW,IAAI;AAAA,IAChC,YAAY,YAAY,cAAc,IAAI;AAAA,EAC5C,CAAC,IAAI,mBAAmB,YAAY,UAAU,YAAY,IAAI,CAAC,CAAC;AAEhE,QAAM,QAAkB,CAAC;AACzB,MAAI,WAAW,QAAW;AACxB,UAAM,KAAK,UAAU,iBAAiB,YAAY,QAAQ,QAAQ,CAAC,CAAC,EAAE;AAAA,EACxE;AACA,MAAI,YAAY,QAAW;AACzB,QAAI,OAAO,YAAY,YAAY,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,GAAG;AAChF,YAAM,IAAI,oBAAoB,iBAAiB,6CAA6C;AAAA,IAC9F;AACA,UAAM,KAAK,KAAK,OAAO,EAAE;AAAA,EAC3B;AAEA,QAAM,WACJ,eAAe,SACX,MAAM,mBAAmB,YAAY,YAAY,YAAY,CAAC,CAAC,KAC/D;AAEN,UAAQ,QAAQ,MAAM,QAAQ,MAAM,SAAS,IAAI,IAAI,MAAM,KAAK,GAAG,CAAC,KAAK,MAAM;AACjF;","names":[]}
+{"version":3,"sources":["../../src/share-link/share-link.ts"],"sourcesContent":["/**\n * Portal share-link grammar + parse/build helper (#806).\n *\n * ONE canonical link grammar addresses `vault / period / collection /\n * record` across all three portal surfaces — the LIFF permalink path\n * (`https://liff.line.me/{liffId}/r/…`), the installed-PWA same-origin\n * path (`https://{portal-origin}/r/…`), and the vendor backend console.\n * The link SHAPE is identical everywhere; only the origin prefix\n * differs, and callers own the prefix.\n *\n * ## Grammar (frozen — see `__tests__/share-link-surface.golden.json`)\n *\n * ```\n * share-link = [ base ] \"/r/\" vault \"/\" collection \"/\" record\n *              [ \"?\" query ] [ \"#\" fragment ]\n * vault      = ULID                        ; 26 uppercase Crockford base32 chars\n * collection = segment                     ; opaque, non-empty after decode\n * record     = segment                     ; opaque, non-empty after decode\n * query      = pair *( \"&\" pair )          ; keys unique; ONLY these two keys\n * pair       = \"period=\" component         ; opaque period id\n *            / \"v=\" version                ; record version\n * version    = \"0\" / %x31-39 *DIGIT        ; base-10 integer, ≤ 2^53 − 1\n * fragment   = \"g=\" component              ; single-use grant token (opaque)\n * ```\n *\n * `segment` / `component` are strict-canonical `encodeURIComponent`\n * output: decoding then re-encoding MUST reproduce the raw text exactly\n * (uppercase-hex escapes, `+` is a literal plus never a space, `%2F`\n * inside a segment never creates an extra segment). Path segments\n * additionally may not decode to `.` or `..`. Links produced by\n * {@link buildShareLink} always satisfy this; hand-written links using\n * only unreserved characters (`inv-001`, ULIDs, …) do too.\n *\n * ## Transport rule for the grant token\n *\n * The optional single-use grant token travels ONLY in the URL fragment\n * (`#g={token}`) — never in the path or query — because fragments are\n * not sent to servers, so the token never reaches server logs, CDNs, or\n * LINE's infrastructure. Same rule `on-magic-link` follows. The token is\n * fully OPAQUE here: no validation beyond non-empty, no decoding of its\n * semantics — grant semantics live in `on-magic-link` (not imported).\n *\n * ## Fail closed\n *\n * {@link parseShareLink} throws a typed {@link ShareLinkParseError} for\n * ANYTHING that is not exactly the grammar above — unknown prefix,\n * missing/extra/empty/malformed segments, a non-ULID vault handle,\n * duplicate or unknown query keys, malformed fragments. There is never a\n * default-vault (or any other) fallback; the app maps the error to a 404.\n *\n * Zero dependencies on the hub floor: pure string/`URL` code, no crypto,\n * no store — LIFF shells, PWAs, and klum-db can import this subpath\n * without dragging anything else. (The one internal import is the pure,\n * leaf ULID shape check shared with the pod format.)\n */\n\nimport { isULID } from '../with-pod/ulid.js'\n\n/** Machine-readable {@link ShareLinkParseError} discriminant. */\nexport type ShareLinkErrorCode =\n  | 'MALFORMED_URL'\n  | 'UNKNOWN_PREFIX'\n  | 'MALFORMED_PATH'\n  | 'MALFORMED_SEGMENT'\n  | 'INVALID_VAULT_HANDLE'\n  | 'MALFORMED_QUERY'\n  | 'DUPLICATE_QUERY_KEY'\n  | 'UNKNOWN_QUERY_KEY'\n  | 'INVALID_VERSION'\n  | 'MALFORMED_FRAGMENT'\n  | 'INVALID_PARTS'\n\n/**\n * Typed failure for the share-link grammar. Thrown by\n * {@link parseShareLink} for any input outside the grammar (fail closed —\n * map to an app-level 404, never a default-vault fallback), and by\n * {@link buildShareLink} with code `'INVALID_PARTS'` when the caller\n * hands it parts that could not round-trip.\n *\n * Standalone (`extends Error`, not `NoydbError`) so this subpath stays\n * import-light; the `code` field follows the same machine-readable\n * convention as the kernel error classes.\n */\nexport class ShareLinkParseError extends Error {\n  /** Machine-readable error code. Stable across library versions. */\n  readonly code: ShareLinkErrorCode\n\n  constructor(code: ShareLinkErrorCode, message: string) {\n    super(message)\n    this.name = 'ShareLinkParseError'\n    this.code = code\n  }\n}\n\n/**\n * The logical address a share link carries. Input to\n * {@link buildShareLink}; {@link parseShareLink} returns the same shape\n * (as the readonly {@link ShareLink} alias) with optional fields OMITTED\n * (not `undefined`) when absent from the link.\n */\nexport interface ShareLinkParts {\n  /** Vault handle — a 26-character uppercase Crockford-base32 ULID. */\n  vaultHandle: string\n  /** Collection name — opaque, non-empty. */\n  collection: string\n  /** Record id — opaque, non-empty. */\n  recordId: string\n  /** Optional period id (`?period=`) — opaque, non-empty. */\n  period?: string\n  /** Optional record version (`?v=`) — non-negative safe integer. */\n  version?: number\n  /**\n   * Optional single-use grant token (`#g=`) — opaque, non-empty. Carried\n   * ONLY in the URL fragment; semantics belong to `on-magic-link`.\n   */\n  grantToken?: string\n}\n\n/** A successfully parsed share link. See {@link ShareLinkParts}. */\nexport type ShareLink = Readonly<ShareLinkParts>\n\n// Dummy base for parsing bare `/r/…` paths with the WHATWG URL parser.\n// `.invalid` is reserved (RFC 2606) — it can never collide with a real\n// origin, and the host is discarded anyway (only path/query/fragment\n// matter to the grammar).\nconst DUMMY_BASE = 'https://share-link.invalid'\n\n/**\n * Canonical encoding of a QUERY value. `encodeURIComponent`, plus `'`\n * → `%27`: the WHATWG URL parser percent-encodes the apostrophe inside\n * the query component of special (http/https) URLs — if we emitted a\n * raw `'`, any URL-object round-trip (browser address bar, `new URL`)\n * would rewrite the link into a form the strict parser then rejects.\n * Path and fragment components don't need this — every character the\n * URL parser escapes there is already escaped by `encodeURIComponent`.\n */\nfunction encodeQueryValue(value: string): string {\n  return encodeURIComponent(value).replace(/'/g, '%27')\n}\n\n/**\n * Strict-canonical decode: `raw` must be exactly what the given\n * canonical `encode` produces for the decoded text — no `+`-for-space,\n * no lowercase hex escapes, no unencoded reserved characters,\n * non-empty. `redact` keeps the raw text out of the error message\n * (grant tokens).\n */\nfunction decodeCanonical(\n  raw: string,\n  code: ShareLinkErrorCode,\n  what: string,\n  { redact = false, encode = encodeURIComponent }: {\n    redact?: boolean\n    encode?: (value: string) => string\n  } = {},\n): string {\n  const shown = redact ? '(redacted)' : `\"${raw}\"`\n  let decoded: string\n  try {\n    decoded = decodeURIComponent(raw)\n  } catch {\n    throw new ShareLinkParseError(code, `${what}: malformed percent-encoding in ${shown}`)\n  }\n  if (decoded === '') {\n    throw new ShareLinkParseError(code, `${what}: empty`)\n  }\n  if (encode(decoded) !== raw) {\n    throw new ShareLinkParseError(\n      code,\n      `${what}: ${shown} is not canonical encodeURIComponent output`,\n    )\n  }\n  return decoded\n}\n\n/** Path-segment decode — canonical, plus the dot-segment refusal. */\nfunction decodePathSegment(raw: string, what: string): string {\n  const decoded = decodeCanonical(raw, 'MALFORMED_SEGMENT', what)\n  if (decoded === '.' || decoded === '..') {\n    throw new ShareLinkParseError('MALFORMED_SEGMENT', `${what}: \"${decoded}\" is a dot segment`)\n  }\n  return decoded\n}\n\n/** `v=` value → non-negative safe integer. Canonical base-10 only. */\nfunction parseVersion(raw: string): number {\n  if (!/^(?:0|[1-9][0-9]*)$/.test(raw)) {\n    throw new ShareLinkParseError(\n      'INVALID_VERSION',\n      `version \"${raw}\" is not a canonical base-10 integer`,\n    )\n  }\n  const version = Number(raw)\n  if (!Number.isSafeInteger(version)) {\n    throw new ShareLinkParseError('INVALID_VERSION', `version \"${raw}\" exceeds 2^53 - 1`)\n  }\n  return version\n}\n\n/** Resolve string | URL input to a URL object, fail closed. */\nfunction toUrl(input: string | URL): URL {\n  if (input instanceof URL) {\n    if (input.protocol !== 'http:' && input.protocol !== 'https:') {\n      throw new ShareLinkParseError(\n        'UNKNOWN_PREFIX',\n        `unsupported protocol \"${input.protocol}\" — share links are http(s) URLs or bare /r/ paths`,\n      )\n    }\n    return input\n  }\n  if (input.startsWith('/')) {\n    try {\n      return new URL(input, DUMMY_BASE)\n    } catch {\n      throw new ShareLinkParseError('MALFORMED_URL', 'unparseable share path')\n    }\n  }\n  if (/^https?:\\/\\//i.test(input)) {\n    try {\n      return new URL(input)\n    } catch {\n      throw new ShareLinkParseError('MALFORMED_URL', 'unparseable share URL')\n    }\n  }\n  throw new ShareLinkParseError(\n    'UNKNOWN_PREFIX',\n    'input is neither a \"/\"-rooted share path nor an http(s) URL',\n  )\n}\n\n/**\n * Parse a share link — full URL, `URL` instance, or bare `/r/…` path.\n *\n * A LIFF permalink prefix is tolerated: when the path does not start\n * with `/r/` directly, the share path is taken from the FIRST `/r/`\n * segment boundary (`https://liff.line.me/{liffId}/r/…` → `/r/…`). No\n * fuzzy matching beyond that single rule.\n *\n * Fail closed: anything outside the grammar throws\n * {@link ShareLinkParseError}. Never a default-vault fallback.\n */\nexport function parseShareLink(input: string | URL): ShareLink {\n  const url = toUrl(input)\n\n  let pathname = url.pathname\n  if (!pathname.startsWith('/r/')) {\n    // LIFF permalink tolerance — only after the direct parse failed. An\n    // indexOf hit is always a whole `r` segment (the match is slash-\n    // delimited on both sides), so this cannot fire mid-segment.\n    const idx = pathname.indexOf('/r/')\n    if (idx === -1) {\n      throw new ShareLinkParseError(\n        'UNKNOWN_PREFIX',\n        `path \"${pathname}\" has no /r/ share prefix`,\n      )\n    }\n    pathname = pathname.slice(idx)\n  }\n\n  // \"/r/{vault}/{collection}/{record}\" splits into exactly 5 parts:\n  // ['', 'r', vault, collection, record].\n  const rawSegments = pathname.split('/')\n  if (rawSegments.length !== 5) {\n    throw new ShareLinkParseError(\n      'MALFORMED_PATH',\n      `expected /r/{vaultHandle}/{collection}/{recordId} — got ${rawSegments.length - 2} segment(s) after /r/`,\n    )\n  }\n\n  const vaultHandle = decodePathSegment(rawSegments[2]!, 'vault handle')\n  if (!isULID(vaultHandle)) {\n    throw new ShareLinkParseError(\n      'INVALID_VAULT_HANDLE',\n      `vault handle \"${vaultHandle}\" is not a ULID`,\n    )\n  }\n  const collection = decodePathSegment(rawSegments[3]!, 'collection')\n  const recordId = decodePathSegment(rawSegments[4]!, 'record id')\n\n  // Query — manual parse of url.search (NOT URLSearchParams, whose\n  // form-urlencoded rules decode \"+\" as a space and hide duplicates).\n  let period: string | undefined\n  let version: number | undefined\n  if (url.search !== '') {\n    const seen = new Set<string>()\n    for (const pair of url.search.slice(1).split('&')) {\n      const eq = pair.indexOf('=')\n      if (eq <= 0) {\n        throw new ShareLinkParseError('MALFORMED_QUERY', `query pair \"${pair}\" is not key=value`)\n      }\n      const key = pair.slice(0, eq)\n      const rawValue = pair.slice(eq + 1)\n      if (key !== 'period' && key !== 'v') {\n        throw new ShareLinkParseError('UNKNOWN_QUERY_KEY', `unknown query key \"${key}\"`)\n      }\n      if (seen.has(key)) {\n        throw new ShareLinkParseError('DUPLICATE_QUERY_KEY', `duplicate query key \"${key}\"`)\n      }\n      seen.add(key)\n      if (key === 'period') {\n        period = decodeCanonical(rawValue, 'MALFORMED_QUERY', 'period', {\n          encode: encodeQueryValue,\n        })\n      } else {\n        version = parseVersion(rawValue)\n      }\n    }\n  }\n\n  // Fragment — the ONLY place a grant token may appear.\n  let grantToken: string | undefined\n  if (url.hash !== '' && url.hash !== '#') {\n    const fragment = url.hash.slice(1)\n    if (!fragment.startsWith('g=')) {\n      throw new ShareLinkParseError(\n        'MALFORMED_FRAGMENT',\n        'fragment is not a g={token} grant carrier',\n      )\n    }\n    grantToken = decodeCanonical(fragment.slice(2), 'MALFORMED_FRAGMENT', 'grant token', {\n      redact: true,\n    })\n  }\n\n  return {\n    vaultHandle,\n    collection,\n    recordId,\n    ...(period !== undefined ? { period } : {}),\n    ...(version !== undefined ? { version } : {}),\n    ...(grantToken !== undefined ? { grantToken } : {}),\n  }\n}\n\n/** Build-side part validation. Returns the (narrowed) string value. */\nfunction requirePart(value: unknown, what: string, dotSegmentRefused = false): string {\n  if (typeof value !== 'string' || value === '') {\n    throw new ShareLinkParseError('INVALID_PARTS', `${what} must be a non-empty string`)\n  }\n  if (dotSegmentRefused && (value === '.' || value === '..')) {\n    throw new ShareLinkParseError('INVALID_PARTS', `${what}: \"${value}\" is a dot segment`)\n  }\n  return value\n}\n\n/**\n * Build a RELATIVE share link (`/r/…`) from typed parts. Callers prefix\n * their surface origin — the LIFF permalink base, the PWA origin, or the\n * vendor console — either themselves or via `base`, which is prepended\n * VERBATIM (no validation, no joining logic; pass it without a trailing\n * slash, e.g. `https://liff.line.me/{liffId}`).\n *\n * The grant token, when present, is emitted ONLY as the `#g=` fragment.\n * Invalid parts throw {@link ShareLinkParseError} with code\n * `'INVALID_PARTS'` — every built link is guaranteed to round-trip\n * through {@link parseShareLink}.\n */\nexport function buildShareLink(parts: ShareLinkParts, base?: string): string {\n  const { vaultHandle, collection, recordId, period, version, grantToken } = parts\n\n  if (typeof vaultHandle !== 'string' || !isULID(vaultHandle)) {\n    throw new ShareLinkParseError('INVALID_PARTS', 'vaultHandle is not a ULID')\n  }\n  const path = `/r/${vaultHandle}/${encodeURIComponent(\n    requirePart(collection, 'collection', true),\n  )}/${encodeURIComponent(requirePart(recordId, 'recordId', true))}`\n\n  const query: string[] = []\n  if (period !== undefined) {\n    query.push(`period=${encodeQueryValue(requirePart(period, 'period'))}`)\n  }\n  if (version !== undefined) {\n    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version < 0) {\n      throw new ShareLinkParseError('INVALID_PARTS', 'version must be a non-negative safe integer')\n    }\n    query.push(`v=${version}`)\n  }\n\n  const fragment =\n    grantToken !== undefined\n      ? `#g=${encodeURIComponent(requirePart(grantToken, 'grantToken'))}`\n      : ''\n\n  return (base ?? '') + path + (query.length > 0 ? `?${query.join('&')}` : '') + fragment\n}\n"],"mappings":";;;;;AAmFO,IAAM,sBAAN,cAAkC,MAAM;AAAA;AAAA,EAEpC;AAAA,EAET,YAAY,MAA0B,SAAiB;AACrD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,IAAM,aAAa;AAWnB,SAAS,iBAAiB,OAAuB;AAC/C,SAAO,mBAAmB,KAAK,EAAE,QAAQ,MAAM,KAAK;AACtD;AASA,SAAS,gBACP,KACA,MACA,MACA,EAAE,SAAS,OAAO,SAAS,mBAAmB,IAG1C,CAAC,GACG;AACR,QAAM,QAAQ,SAAS,eAAe,IAAI,GAAG;AAC7C,MAAI;AACJ,MAAI;AACF,cAAU,mBAAmB,GAAG;AAAA,EAClC,QAAQ;AACN,UAAM,IAAI,oBAAoB,MAAM,GAAG,IAAI,mCAAmC,KAAK,EAAE;AAAA,EACvF;AACA,MAAI,YAAY,IAAI;AAClB,UAAM,IAAI,oBAAoB,MAAM,GAAG,IAAI,SAAS;AAAA,EACtD;AACA,MAAI,OAAO,OAAO,MAAM,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,KAAK;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,KAAa,MAAsB;AAC5D,QAAM,UAAU,gBAAgB,KAAK,qBAAqB,IAAI;AAC9D,MAAI,YAAY,OAAO,YAAY,MAAM;AACvC,UAAM,IAAI,oBAAoB,qBAAqB,GAAG,IAAI,MAAM,OAAO,oBAAoB;AAAA,EAC7F;AACA,SAAO;AACT;AAGA,SAAS,aAAa,KAAqB;AACzC,MAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,YAAY,GAAG;AAAA,IACjB;AAAA,EACF;AACA,QAAM,UAAU,OAAO,GAAG;AAC1B,MAAI,CAAC,OAAO,cAAc,OAAO,GAAG;AAClC,UAAM,IAAI,oBAAoB,mBAAmB,YAAY,GAAG,oBAAoB;AAAA,EACtF;AACA,SAAO;AACT;AAGA,SAAS,MAAM,OAA0B;AACvC,MAAI,iBAAiB,KAAK;AACxB,QAAI,MAAM,aAAa,WAAW,MAAM,aAAa,UAAU;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,QACA,yBAAyB,MAAM,QAAQ;AAAA,MACzC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,WAAW,GAAG,GAAG;AACzB,QAAI;AACF,aAAO,IAAI,IAAI,OAAO,UAAU;AAAA,IAClC,QAAQ;AACN,YAAM,IAAI,oBAAoB,iBAAiB,wBAAwB;AAAA,IACzE;AAAA,EACF;AACA,MAAI,gBAAgB,KAAK,KAAK,GAAG;AAC/B,QAAI;AACF,aAAO,IAAI,IAAI,KAAK;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,oBAAoB,iBAAiB,uBAAuB;AAAA,IACxE;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,eAAe,OAAgC;AAC7D,QAAM,MAAM,MAAM,KAAK;AAEvB,MAAI,WAAW,IAAI;AACnB,MAAI,CAAC,SAAS,WAAW,KAAK,GAAG;AAI/B,UAAM,MAAM,SAAS,QAAQ,KAAK;AAClC,QAAI,QAAQ,IAAI;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA,SAAS,QAAQ;AAAA,MACnB;AAAA,IACF;AACA,eAAW,SAAS,MAAM,GAAG;AAAA,EAC/B;AAIA,QAAM,cAAc,SAAS,MAAM,GAAG;AACtC,MAAI,YAAY,WAAW,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gEAA2D,YAAY,SAAS,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,cAAc,kBAAkB,YAAY,CAAC,GAAI,cAAc;AACrE,MAAI,CAAC,OAAO,WAAW,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,WAAW;AAAA,IAC9B;AAAA,EACF;AACA,QAAM,aAAa,kBAAkB,YAAY,CAAC,GAAI,YAAY;AAClE,QAAM,WAAW,kBAAkB,YAAY,CAAC,GAAI,WAAW;AAI/D,MAAI;AACJ,MAAI;AACJ,MAAI,IAAI,WAAW,IAAI;AACrB,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,QAAQ,IAAI,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AACjD,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,MAAM,GAAG;AACX,cAAM,IAAI,oBAAoB,mBAAmB,eAAe,IAAI,oBAAoB;AAAA,MAC1F;AACA,YAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAC5B,YAAM,WAAW,KAAK,MAAM,KAAK,CAAC;AAClC,UAAI,QAAQ,YAAY,QAAQ,KAAK;AACnC,cAAM,IAAI,oBAAoB,qBAAqB,sBAAsB,GAAG,GAAG;AAAA,MACjF;AACA,UAAI,KAAK,IAAI,GAAG,GAAG;AACjB,cAAM,IAAI,oBAAoB,uBAAuB,wBAAwB,GAAG,GAAG;AAAA,MACrF;AACA,WAAK,IAAI,GAAG;AACZ,UAAI,QAAQ,UAAU;AACpB,iBAAS,gBAAgB,UAAU,mBAAmB,UAAU;AAAA,UAC9D,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,OAAO;AACL,kBAAU,aAAa,QAAQ;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK;AACvC,UAAM,WAAW,IAAI,KAAK,MAAM,CAAC;AACjC,QAAI,CAAC,SAAS,WAAW,IAAI,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,iBAAa,gBAAgB,SAAS,MAAM,CAAC,GAAG,sBAAsB,eAAe;AAAA,MACnF,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnD;AACF;AAGA,SAAS,YAAY,OAAgB,MAAc,oBAAoB,OAAe;AACpF,MAAI,OAAO,UAAU,YAAY,UAAU,IAAI;AAC7C,UAAM,IAAI,oBAAoB,iBAAiB,GAAG,IAAI,6BAA6B;AAAA,EACrF;AACA,MAAI,sBAAsB,UAAU,OAAO,UAAU,OAAO;AAC1D,UAAM,IAAI,oBAAoB,iBAAiB,GAAG,IAAI,MAAM,KAAK,oBAAoB;AAAA,EACvF;AACA,SAAO;AACT;AAcO,SAAS,eAAe,OAAuB,MAAuB;AAC3E,QAAM,EAAE,aAAa,YAAY,UAAU,QAAQ,SAAS,WAAW,IAAI;AAE3E,MAAI,OAAO,gBAAgB,YAAY,CAAC,OAAO,WAAW,GAAG;AAC3D,UAAM,IAAI,oBAAoB,iBAAiB,2BAA2B;AAAA,EAC5E;AACA,QAAM,OAAO,MAAM,WAAW,IAAI;AAAA,IAChC,YAAY,YAAY,cAAc,IAAI;AAAA,EAC5C,CAAC,IAAI,mBAAmB,YAAY,UAAU,YAAY,IAAI,CAAC,CAAC;AAEhE,QAAM,QAAkB,CAAC;AACzB,MAAI,WAAW,QAAW;AACxB,UAAM,KAAK,UAAU,iBAAiB,YAAY,QAAQ,QAAQ,CAAC,CAAC,EAAE;AAAA,EACxE;AACA,MAAI,YAAY,QAAW;AACzB,QAAI,OAAO,YAAY,YAAY,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,GAAG;AAChF,YAAM,IAAI,oBAAoB,iBAAiB,6CAA6C;AAAA,IAC9F;AACA,UAAM,KAAK,KAAK,OAAO,EAAE;AAAA,EAC3B;AAEA,QAAM,WACJ,eAAe,SACX,MAAM,mBAAmB,YAAY,YAAY,YAAY,CAAC,CAAC,KAC/D;AAEN,UAAQ,QAAQ,MAAM,QAAQ,MAAM,SAAS,IAAI,IAAI,MAAM,KAAK,GAAG,CAAC,KAAK,MAAM;AACjF;","names":[]}

package/dist/{signer-7NK7TMWU.js → signer-5K3WDHOC.js}

@@ -14,7 +14,6 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
@@ -22,4 +21,4 @@ export {
   loadOrCreateSigner,
   loadSigner
 };
-//# sourceMappingURL=signer-7NK7TMWU.js.map
+//# sourceMappingURL=signer-5K3WDHOC.js.map

package/dist/snapshots/index.js

@@ -4,7 +4,7 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-PKJ43CMD.js";
+} from "../chunk-NLOLF6LD.js";
 import "../chunk-MLO75SFJ.js";
 import "../chunk-CIGAQBJR.js";
 import "../chunk-4RUFYGWG.js";
@@ -17,7 +17,6 @@ import "../chunk-N4CHCXDL.js";
 import {
   SnapshotNotFoundError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts
 var SnapshotEngine = class {

package/dist/snapshots/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-fork/snapshots/engine.ts","../../src/with-fork/snapshots/active.ts"],"sourcesContent":["import { writePod, readPod } from '../../with-pod/pod.js'\nimport { SnapshotNotFoundError } from '../../kernel/errors.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { SnapshotMeta, RetentionPolicy, SnapshotIndex } from './strategy.js'\n\nexport class SnapshotEngine {\n  constructor(\n    private readonly store: NoydbPodStore,\n    private readonly retention: RetentionPolicy,\n  ) {}\n\n  private indexKey(vaultName: string): string {\n    return `${vaultName}__index`\n  }\n\n  private snapKey(vaultName: string, n: number): string {\n    return `${vaultName}__snap_${n.toString().padStart(6, '0')}`\n  }\n\n  private autoKey(vaultName: string): string {\n    return `${vaultName}__auto`\n  }\n\n  private async readIndex(\n    vaultName: string,\n  ): Promise<{ index: SnapshotIndex; indexVersion: string | null }> {\n    const result = await this.store.readBundle(this.indexKey(vaultName))\n    if (!result) return { index: { snapshots: [], nextCounter: 1 }, indexVersion: null }\n    const text = new TextDecoder().decode(result.bytes)\n    return { index: JSON.parse(text) as SnapshotIndex, indexVersion: result.version }\n  }\n\n  private async writeIndex(\n    vaultName: string,\n    index: SnapshotIndex,\n    expectedVersion: string | null,\n  ): Promise<void> {\n    const bytes = new TextEncoder().encode(JSON.stringify(index))\n    await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion)\n  }\n\n  async snapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.snapKey(vault.name, index.nextCounter)\n\n    // Write blob first. If the subsequent index write fails, the next snapshot()\n    // call will re-derive the same key (counter not persisted) and overwrite this blob.\n    // This is an accepted v1 trade-off: failure window is narrow and requires a store\n    // error between the two writes. A retry produces a fresh snapshot at the same key.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      ...(opts?.label !== undefined ? { label: opts.label } : {}),\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n    }\n\n    const newIndex: SnapshotIndex = {\n      snapshots: [...index.snapshots, meta],\n      nextCounter: index.nextCounter + 1,\n      // Preserve the rolling auto slot — on-demand snapshots never touch it.\n      ...(index.auto ? { auto: index.auto } : {}),\n    }\n    const toDelete = this.applyRetention(newIndex)\n    await this.writeIndex(vault.name, newIndex, indexVersion)\n\n    for (const k of toDelete) {\n      await this.store.deleteBundle(k)\n    }\n\n    return meta\n  }\n\n  /**\n   * Rolling auto-snapshot. Overwrites the single fixed `<vault>__auto` key and\n   * stores its meta in `index.auto`, separate from the immutable `snapshots`\n   * pool — retention never prunes it. Used by the cadence scheduler.\n   */\n  async autoSnapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.autoKey(vault.name)\n\n    // Unconditional overwrite of the rolling slot.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      label: opts?.label ?? 'auto',\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n      auto: true,\n    }\n\n    index.auto = meta\n    await this.writeIndex(vault.name, index, indexVersion)\n    return meta\n  }\n\n  async listSnapshots(vaultId: string): Promise<SnapshotMeta[]> {\n    const { index } = await this.readIndex(vaultId)\n    const immutable = [...index.snapshots].reverse()\n    return index.auto ? [index.auto, ...immutable] : immutable\n  }\n\n  async restoreSnapshot(vault: Vault, version: string): Promise<void> {\n    if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version)\n    const result = await this.store.readBundle(version)\n    if (!result) throw new SnapshotNotFoundError(version)\n    const { dumpJson } = await readPod(result.bytes)\n    await vault.load(dumpJson)\n  }\n\n  /**\n   * Applies the configured retention policy to `index`, mutating `index.snapshots`\n   * in place and returning the blob keys that should be deleted from the store.\n   * Called by `snapshot()` before the index is written.\n   *\n   * @internal — public for direct testing only\n   */\n  applyRetention(index: SnapshotIndex): string[] {\n    const prune = this.retention.prune ?? true\n    if (!prune) return []\n\n    const toDelete: string[] = []\n    let remaining = index.snapshots.slice()\n\n    if (this.retention.keepLast !== undefined && remaining.length > this.retention.keepLast) {\n      const excess = remaining.splice(0, remaining.length - this.retention.keepLast)\n      toDelete.push(...excess.map(m => m.version))\n    }\n\n    if (this.retention.maxAgeDays !== undefined) {\n      const cutoffMs = this.retention.maxAgeDays * 86_400_000\n      const now = Date.now()\n      const fresh = remaining.filter(m => now - new Date(m.exportedAt).getTime() <= cutoffMs)\n      toDelete.push(...remaining.filter(m => !fresh.includes(m)).map(m => m.version))\n      remaining = fresh\n    }\n\n    index.snapshots = remaining\n    return toDelete\n  }\n}\n","import { SnapshotEngine } from './engine.js'\nimport type { SnapshotsStrategy, RetentionPolicy } from './strategy.js'\nimport type { SnapshotPolicy } from './policy.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport interface WithSnapshotsOptions {\n  /** Bundle store where snapshot blobs and the sidecar index are written. */\n  store: NoydbPodStore\n  /**\n   * Declarative retention policy. Enforced eagerly after each on-demand `snapshot()`.\n   * Defaults to no retention (all on-demand snapshots kept forever). Never affects\n   * the rolling auto-snapshot.\n   */\n  retention?: RetentionPolicy\n  /**\n   * Automatic-snapshot cadence. Default `mode:'manual'` ⇒ no timers; snapshots\n   * stay on-demand. Set `mode:'debounce'`/`'interval'` to enable auto-snapshots\n   * to the rolling `<vault>__auto` key.\n   */\n  snapshotPolicy?: SnapshotPolicy\n}\n\nexport function withSnapshots(opts: WithSnapshotsOptions): SnapshotsStrategy {\n  const engine = new SnapshotEngine(opts.store, opts.retention ?? {})\n  return {\n    snapshot(vault, by, snapOpts) {\n      return engine.snapshot(vault as Vault, by, snapOpts)\n    },\n    listSnapshots(vaultId) {\n      return engine.listSnapshots(vaultId)\n    },\n    restoreSnapshot(vault, version) {\n      return engine.restoreSnapshot(vault as Vault, version)\n    },\n    autoSnapshot(vault, by, snapOpts) {\n      return engine.autoSnapshot(vault as Vault, by, snapOpts)\n    },\n    ...(opts.snapshotPolicy ? { policy: opts.snapshotPolicy } : {}),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YACmB,OACA,WACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGX,SAAS,WAA2B;AAC1C,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEQ,QAAQ,WAAmB,GAAmB;AACpD,WAAO,GAAG,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AAAA,EAEQ,QAAQ,WAA2B;AACzC,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEA,MAAc,UACZ,WACgE;AAChE,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,KAAK,SAAS,SAAS,CAAC;AACnE,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,KAAK;AACnF,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,WAAO,EAAE,OAAO,KAAK,MAAM,IAAI,GAAoB,cAAc,OAAO,QAAQ;AAAA,EAClF;AAAA,EAEA,MAAc,WACZ,WACA,OACA,iBACe;AACf,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,UAAM,KAAK,MAAM,YAAY,KAAK,SAAS,SAAS,GAAG,OAAO,eAAe;AAAA,EAC/E;AAAA,EAEA,MAAM,SACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,MAAM,WAAW;AAMtD,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACzD,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,IACb;AAEA,UAAM,WAA0B;AAAA,MAC9B,WAAW,CAAC,GAAG,MAAM,WAAW,IAAI;AAAA,MACpC,aAAa,MAAM,cAAc;AAAA;AAAA,MAEjC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IAC3C;AACA,UAAM,WAAW,KAAK,eAAe,QAAQ;AAC7C,UAAM,KAAK,WAAW,MAAM,MAAM,UAAU,YAAY;AAExD,eAAW,KAAK,UAAU;AACxB,YAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,IAAI;AAGnC,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,OAAO,MAAM,SAAS;AAAA,MACtB,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAEA,UAAM,OAAO;AACb,UAAM,KAAK,WAAW,MAAM,MAAM,OAAO,YAAY;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA0C;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU,OAAO;AAC9C,UAAM,YAAY,CAAC,GAAG,MAAM,SAAS,EAAE,QAAQ;AAC/C,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,GAAG,SAAS,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAgB,OAAc,SAAgC;AAClE,QAAI,CAAC,QAAQ,WAAW,GAAG,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,sBAAsB,OAAO;AACnF,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,OAAO;AAClD,QAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,OAAO;AACpD,UAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,MAAM,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAe,OAAgC;AAC7C,UAAM,QAAQ,KAAK,UAAU,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO,CAAC;AAEpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,YAAY,MAAM,UAAU,MAAM;AAEtC,QAAI,KAAK,UAAU,aAAa,UAAa,UAAU,SAAS,KAAK,UAAU,UAAU;AACvF,YAAM,SAAS,UAAU,OAAO,GAAG,UAAU,SAAS,KAAK,UAAU,QAAQ;AAC7E,eAAS,KAAK,GAAG,OAAO,IAAI,OAAK,EAAE,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,KAAK,UAAU,eAAe,QAAW;AAC3C,YAAM,WAAW,KAAK,UAAU,aAAa;AAC7C,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,UAAU,OAAO,OAAK,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,KAAK,QAAQ;AACtF,eAAS,KAAK,GAAG,UAAU,OAAO,OAAK,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,OAAK,EAAE,OAAO,CAAC;AAC9E,kBAAY;AAAA,IACd;AAEA,UAAM,YAAY;AAClB,WAAO;AAAA,EACT;AACF;;;ACzIO,SAAS,cAAc,MAA+C;AAC3E,QAAM,SAAS,IAAI,eAAe,KAAK,OAAO,KAAK,aAAa,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,IAAI,UAAU;AAC5B,aAAO,OAAO,SAAS,OAAgB,IAAI,QAAQ;AAAA,IACrD;AAAA,IACA,cAAc,SAAS;AACrB,aAAO,OAAO,cAAc,OAAO;AAAA,IACrC;AAAA,IACA,gBAAgB,OAAO,SAAS;AAC9B,aAAO,OAAO,gBAAgB,OAAgB,OAAO;AAAA,IACvD;AAAA,IACA,aAAa,OAAO,IAAI,UAAU;AAChC,aAAO,OAAO,aAAa,OAAgB,IAAI,QAAQ;AAAA,IACzD;AAAA,IACA,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;AAAA,EAC/D;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-fork/snapshots/engine.ts","../../src/with-fork/snapshots/active.ts"],"sourcesContent":["import { writePod, readPod } from '../../with-pod/pod.js'\nimport { SnapshotNotFoundError } from '../../kernel/errors.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { SnapshotMeta, RetentionPolicy, SnapshotIndex } from './strategy.js'\n\nexport class SnapshotEngine {\n  constructor(\n    private readonly store: NoydbPodStore,\n    private readonly retention: RetentionPolicy,\n  ) {}\n\n  private indexKey(vaultName: string): string {\n    return `${vaultName}__index`\n  }\n\n  private snapKey(vaultName: string, n: number): string {\n    return `${vaultName}__snap_${n.toString().padStart(6, '0')}`\n  }\n\n  private autoKey(vaultName: string): string {\n    return `${vaultName}__auto`\n  }\n\n  private async readIndex(\n    vaultName: string,\n  ): Promise<{ index: SnapshotIndex; indexVersion: string | null }> {\n    const result = await this.store.readBundle(this.indexKey(vaultName))\n    if (!result) return { index: { snapshots: [], nextCounter: 1 }, indexVersion: null }\n    const text = new TextDecoder().decode(result.bytes)\n    return { index: JSON.parse(text) as SnapshotIndex, indexVersion: result.version }\n  }\n\n  private async writeIndex(\n    vaultName: string,\n    index: SnapshotIndex,\n    expectedVersion: string | null,\n  ): Promise<void> {\n    const bytes = new TextEncoder().encode(JSON.stringify(index))\n    await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion)\n  }\n\n  async snapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.snapKey(vault.name, index.nextCounter)\n\n    // Write blob first. If the subsequent index write fails, the next snapshot()\n    // call will re-derive the same key (counter not persisted) and overwrite this blob.\n    // This is an accepted v1 trade-off: failure window is narrow and requires a store\n    // error between the two writes. A retry produces a fresh snapshot at the same key.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      ...(opts?.label !== undefined ? { label: opts.label } : {}),\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n    }\n\n    const newIndex: SnapshotIndex = {\n      snapshots: [...index.snapshots, meta],\n      nextCounter: index.nextCounter + 1,\n      // Preserve the rolling auto slot — on-demand snapshots never touch it.\n      ...(index.auto ? { auto: index.auto } : {}),\n    }\n    const toDelete = this.applyRetention(newIndex)\n    await this.writeIndex(vault.name, newIndex, indexVersion)\n\n    for (const k of toDelete) {\n      await this.store.deleteBundle(k)\n    }\n\n    return meta\n  }\n\n  /**\n   * Rolling auto-snapshot. Overwrites the single fixed `<vault>__auto` key and\n   * stores its meta in `index.auto`, separate from the immutable `snapshots`\n   * pool — retention never prunes it. Used by the cadence scheduler.\n   */\n  async autoSnapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.autoKey(vault.name)\n\n    // Unconditional overwrite of the rolling slot.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      label: opts?.label ?? 'auto',\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n      auto: true,\n    }\n\n    index.auto = meta\n    await this.writeIndex(vault.name, index, indexVersion)\n    return meta\n  }\n\n  async listSnapshots(vaultId: string): Promise<SnapshotMeta[]> {\n    const { index } = await this.readIndex(vaultId)\n    const immutable = [...index.snapshots].reverse()\n    return index.auto ? [index.auto, ...immutable] : immutable\n  }\n\n  async restoreSnapshot(vault: Vault, version: string): Promise<void> {\n    if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version)\n    const result = await this.store.readBundle(version)\n    if (!result) throw new SnapshotNotFoundError(version)\n    const { dumpJson } = await readPod(result.bytes)\n    await vault.load(dumpJson)\n  }\n\n  /**\n   * Applies the configured retention policy to `index`, mutating `index.snapshots`\n   * in place and returning the blob keys that should be deleted from the store.\n   * Called by `snapshot()` before the index is written.\n   *\n   * @internal — public for direct testing only\n   */\n  applyRetention(index: SnapshotIndex): string[] {\n    const prune = this.retention.prune ?? true\n    if (!prune) return []\n\n    const toDelete: string[] = []\n    let remaining = index.snapshots.slice()\n\n    if (this.retention.keepLast !== undefined && remaining.length > this.retention.keepLast) {\n      const excess = remaining.splice(0, remaining.length - this.retention.keepLast)\n      toDelete.push(...excess.map(m => m.version))\n    }\n\n    if (this.retention.maxAgeDays !== undefined) {\n      const cutoffMs = this.retention.maxAgeDays * 86_400_000\n      const now = Date.now()\n      const fresh = remaining.filter(m => now - new Date(m.exportedAt).getTime() <= cutoffMs)\n      toDelete.push(...remaining.filter(m => !fresh.includes(m)).map(m => m.version))\n      remaining = fresh\n    }\n\n    index.snapshots = remaining\n    return toDelete\n  }\n}\n","import { SnapshotEngine } from './engine.js'\nimport type { SnapshotsStrategy, RetentionPolicy } from './strategy.js'\nimport type { SnapshotPolicy } from './policy.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport interface WithSnapshotsOptions {\n  /** Bundle store where snapshot blobs and the sidecar index are written. */\n  store: NoydbPodStore\n  /**\n   * Declarative retention policy. Enforced eagerly after each on-demand `snapshot()`.\n   * Defaults to no retention (all on-demand snapshots kept forever). Never affects\n   * the rolling auto-snapshot.\n   */\n  retention?: RetentionPolicy\n  /**\n   * Automatic-snapshot cadence. Default `mode:'manual'` ⇒ no timers; snapshots\n   * stay on-demand. Set `mode:'debounce'`/`'interval'` to enable auto-snapshots\n   * to the rolling `<vault>__auto` key.\n   */\n  snapshotPolicy?: SnapshotPolicy\n}\n\nexport function withSnapshots(opts: WithSnapshotsOptions): SnapshotsStrategy {\n  const engine = new SnapshotEngine(opts.store, opts.retention ?? {})\n  return {\n    snapshot(vault, by, snapOpts) {\n      return engine.snapshot(vault as Vault, by, snapOpts)\n    },\n    listSnapshots(vaultId) {\n      return engine.listSnapshots(vaultId)\n    },\n    restoreSnapshot(vault, version) {\n      return engine.restoreSnapshot(vault as Vault, version)\n    },\n    autoSnapshot(vault, by, snapOpts) {\n      return engine.autoSnapshot(vault as Vault, by, snapOpts)\n    },\n    ...(opts.snapshotPolicy ? { policy: opts.snapshotPolicy } : {}),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YACmB,OACA,WACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGX,SAAS,WAA2B;AAC1C,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEQ,QAAQ,WAAmB,GAAmB;AACpD,WAAO,GAAG,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AAAA,EAEQ,QAAQ,WAA2B;AACzC,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEA,MAAc,UACZ,WACgE;AAChE,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,KAAK,SAAS,SAAS,CAAC;AACnE,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,KAAK;AACnF,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,WAAO,EAAE,OAAO,KAAK,MAAM,IAAI,GAAoB,cAAc,OAAO,QAAQ;AAAA,EAClF;AAAA,EAEA,MAAc,WACZ,WACA,OACA,iBACe;AACf,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,UAAM,KAAK,MAAM,YAAY,KAAK,SAAS,SAAS,GAAG,OAAO,eAAe;AAAA,EAC/E;AAAA,EAEA,MAAM,SACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,MAAM,WAAW;AAMtD,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACzD,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,IACb;AAEA,UAAM,WAA0B;AAAA,MAC9B,WAAW,CAAC,GAAG,MAAM,WAAW,IAAI;AAAA,MACpC,aAAa,MAAM,cAAc;AAAA;AAAA,MAEjC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IAC3C;AACA,UAAM,WAAW,KAAK,eAAe,QAAQ;AAC7C,UAAM,KAAK,WAAW,MAAM,MAAM,UAAU,YAAY;AAExD,eAAW,KAAK,UAAU;AACxB,YAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,IAAI;AAGnC,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,OAAO,MAAM,SAAS;AAAA,MACtB,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAEA,UAAM,OAAO;AACb,UAAM,KAAK,WAAW,MAAM,MAAM,OAAO,YAAY;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA0C;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU,OAAO;AAC9C,UAAM,YAAY,CAAC,GAAG,MAAM,SAAS,EAAE,QAAQ;AAC/C,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,GAAG,SAAS,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAgB,OAAc,SAAgC;AAClE,QAAI,CAAC,QAAQ,WAAW,GAAG,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,sBAAsB,OAAO;AACnF,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,OAAO;AAClD,QAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,OAAO;AACpD,UAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,MAAM,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAe,OAAgC;AAC7C,UAAM,QAAQ,KAAK,UAAU,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO,CAAC;AAEpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,YAAY,MAAM,UAAU,MAAM;AAEtC,QAAI,KAAK,UAAU,aAAa,UAAa,UAAU,SAAS,KAAK,UAAU,UAAU;AACvF,YAAM,SAAS,UAAU,OAAO,GAAG,UAAU,SAAS,KAAK,UAAU,QAAQ;AAC7E,eAAS,KAAK,GAAG,OAAO,IAAI,OAAK,EAAE,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,KAAK,UAAU,eAAe,QAAW;AAC3C,YAAM,WAAW,KAAK,UAAU,aAAa;AAC7C,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,UAAU,OAAO,OAAK,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,KAAK,QAAQ;AACtF,eAAS,KAAK,GAAG,UAAU,OAAO,OAAK,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,OAAK,EAAE,OAAO,CAAC;AAC9E,kBAAY;AAAA,IACd;AAEA,UAAM,YAAY;AAClB,WAAO;AAAA,EACT;AACF;;;ACzIO,SAAS,cAAc,MAA+C;AAC3E,QAAM,SAAS,IAAI,eAAe,KAAK,OAAO,KAAK,aAAa,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,IAAI,UAAU;AAC5B,aAAO,OAAO,SAAS,OAAgB,IAAI,QAAQ;AAAA,IACrD;AAAA,IACA,cAAc,SAAS;AACrB,aAAO,OAAO,cAAc,OAAO;AAAA,IACrC;AAAA,IACA,gBAAgB,OAAO,SAAS;AAC9B,aAAO,OAAO,gBAAgB,OAAgB,OAAO;AAAA,IACvD;AAAA,IACA,aAAa,OAAO,IAAI,UAAU;AAChC,aAAO,OAAO,aAAa,OAAgB,IAAI,QAAQ;AAAA,IACzD;AAAA,IACA,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;AAAA,EAC/D;AACF;","names":[]}

package/dist/{stale-2CHKZTMK.js → stale-AU74OPUW.js}

@@ -6,7 +6,7 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-E2MYJGSG.js";
+} from "./chunk-AMODH7AU.js";
 import "./chunk-5D2ALSM5.js";
 import "./chunk-CIGAQBJR.js";
 import "./chunk-4RUFYGWG.js";
@@ -17,7 +17,6 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   MV_STALE_COLLECTION,
   clearMVStale,
@@ -27,4 +26,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-2CHKZTMK.js.map
+//# sourceMappingURL=stale-AU74OPUW.js.map