@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog — hub
 
+## 0.8.0
+
+**The capsule seam** (#4). Hub's crypto interior is now one contract behind one door, and an application can replace it at build time without forking hub.
+
+`enclave-aes` — PBKDF2 → AES-KW → AES-256-GCM, exactly what shipped before — stays inside hub and remains the default, so `npm install @noy-db/hub` is unchanged and needs no configuration. An alternative binds through hub's `imports` map with a build condition (`resolve.conditions` in Vite/esbuild/webpack, `--conditions` for Node). Deliberately not a runtime option: a `createNoydb({ capsule })` switch would be a hot-swap surface, whereas a build condition lives in build config and `npm ls` tells an auditor which capsule a build actually contains.
+
+`@noy-db/hub/capsule` is the published contract — `CapsuleKey`, `CapsuleGroup`, `CapsulePrimitives`, `capabilities()`, `makeCapsule()`, and `CapsuleNotSupportedError`. A service that needs a capability asserts it at `createNoydb()` and refuses there by name, never on first write: a capability discovered mid-write is a half-built vault.
+
+Three things made this real rather than nominal. Every `crypto.subtle` call outside the capsule is gone — 38 of them across 10 files — and the ratchet that tracked them is now a flat ban, so hub ships with no runtime dependencies at all. The shared envelope machinery (~3,000 lines of AAD construction, tombstones, sealed slots, the record codec, rekeying) lives once and is bound to a capsule's 15 primitives by `makeCapsule()`, so two capsules cannot drift into writing rows the other cannot read. And `@noy-db/test-capsule-conformance` is the suite both implementations run, asserting the `enclave-`/`exclave-` prefix rule **from the package name** — which is what makes the prefix a trust posture rather than a naming convention.
+
+`@noy-db/exclave-plain` is the first alternative: a plaintext capsule for the case the seam was built for — a table whose rows other tools read and write, where access control already lives in IAM.
+
+⛔ **It turns off encryption.** Rows are stored readable; noy-db stops being zero-knowledge and the security boundary moves out of the library and into your store. Its `_mac` integrity stamp detects corruption, foreign writes, and rows moved between collections — it is **not** a defence against a malicious store, because there is no secret in exclave mode and anyone who can write a row can compute a valid stamp for it. Read its README before installing it.
+
+**`EncryptedEnvelope` is now `Envelope`, with `_iv`/`_data` optional** (#15). The old name remains an exact alias for the whole 0.8 line, and both are exported from the root barrel and from `@noy-db/hub/to`.
+
+⚠️ **If you are already on `0.8.0-pre.0`, this reaches you as a breaking change.** That release declared `readonly _data: string` and exported no `Envelope`. Code that reads `envelope._data` as a `string` now sees `string | undefined` and stops compiling. There is no runtime behaviour change and no wire-format change — `NOYDB_FORMAT_VERSION` does not move and every envelope already written reads back identically — but the type genuinely narrowed under you, and a type error with no explanation is a poor way to learn that.
+
+The fields are optional because an **exclave** capsule stores a plaintext row and has no ciphertext body at all. Absence and `''` mean the same thing: no sealed body. That equivalence is not new — a tombstone, a `_del` marker and a plaintext collection have carried `_iv: ''` since the format's first version, and `hasSealedBody()` has always been the question to ask. Widening only lets a capsule omit the keys instead of emptying them.
+
+`EncryptedEnvelope` is an **alias, not a narrower subtype**. Declaring it as body-required was considered and rejected: every existing reader would have kept compiling untouched, which is precisely the bug — a store handing back an exclave row would then fail at runtime in code the compiler had just declared safe.
+
+If you implement `NoydbStore`, nothing is required of you: a store that honours "dumb ciphertext store" never reads these fields for meaning. If you *do* read them, treat absent exactly as empty.
+
+**A declaration that cannot resolve is now refused at registration, instead of silently doing nothing** (#19, #25).
+
+⛔ **The security fix first.** `classifiedFields` accepted a **dotted path** — `classifiedFields: { 'account.password': spec }` — and sealed nothing. Registration succeeded, the write succeeded, and the secret came back **in full plaintext** from `get()` and `list()`. The only signal was `reveal()` throwing, which a developer who believes the field is sealed has no reason to call, because they can already read the value.
+
+So "misconfigured" and "not classified at all" were observationally identical while the developer's belief was that the secret was protected. Nested paths are not supported by `classifiedFields` and a dotted key is now a `ClassifiedConfigError` naming the workaround (promote the field to the top level). **If you declared a nested classified field, values written under it are plaintext at rest and this fix does not reach them** — treat them as exposed and rotate.
+
+Found and reported by a consumer while validating a design, before shipping.
+
+Two further guards close the same class:
+
+- **A malformed field path is refused.** `i18nFields` and `lookupFields` resolve nested paths through a helper that validates nothing — by design, since "nothing is at this path" is a legitimate answer for an optional field. The consequence was that `'contacts[.name'` was indistinguishable from an absent value: the declaration did nothing, forever. Measured: an `i18nFields` declaration with `required: 'all'` and a malformed path accepted a record missing every required language, while the same spec on a well-formed path refused it. The guarantee was not weakened — it was never installed.
+- **An `i18nFields` declaration naming a field the collection does not have is refused** when the schema is readable. `titel` for `title` is valid syntax and equally inert.
+
+Both stay **silent when they cannot know**: a schema-less or TS-generic collection has real fields that simply are not enumerable, and refusing them would break working collections to fix a silent one. `lookupFields` is deliberately exempt from the existence check — its keys *declare* fields rather than referencing them.
+
+`moneyFields` already guarded its own grammar and explained why in its header. These are the same lesson reaching the families next door.
+
+**Two correctness fixes on the write path.**
+
+`writeQueue.pending` now covers the **pre-write gate phase** (#11). A write waits on the schema-update gate and the schema fence before it reaches the store, and that window was outside the queue's accounting — so `pending` read `0` and `onFlush()` resolved while a write was still in flight, gated but not yet committed. A caller using `onFlush()` to know "everything is written" could act on a vault that was not yet consistent. The queue now brackets the gate phase too, and a write refused by a gate — before it commits — still settles the queue without reporting a spurious error, because a refusal at the gate is a legitimate outcome rather than a failure to flush.
+
+**Pod flush retries now re-encode at the version they observed** (#12). On a conflict, the retry loop re-fetched the remote pod and merged, but the encoded bytes and the expected version were computed **once, before the loop** — so every retry re-sent the *original* bytes against the *original* version. The merge was performed and then discarded, and the retry could only fail the same way or, worse, overwrite the concurrent write it had just merged with. Encoding now happens inside the loop, so a retry sends the merged bytes at the version it actually read.
+
+The regression test records that the interleaving is load-bearing: it requires the remote to move between the read and the write, because a naively ordered test passes against the broken code.
+
+
 ## 0.8.0-pre.0
 
 Relicensed from MIT to Apache-2.0 from this version on. Earlier versions remain MIT.

package/dist/api-OS747DS4.js

@@ -0,0 +1,18 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-AEQGFRU4.js";
+import "./chunk-LIOVX5TJ.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-OS747DS4.js.map

package/dist/as/index.js

@@ -1,24 +1,23 @@
 import "../chunk-UBSFPGVJ.js";
-import "../chunk-BP6DARYA.js";
+import "../chunk-PP3K67AJ.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-RXLYKVTF.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-PSIV7CJV.js";
+import "../chunk-747G6CT3.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3H5KLDZN.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+import "../chunk-3L2NBKDR.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   ValidationError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/port/as/active.ts
 function redactChunk(chunk, ctx, redact) {

package/dist/as/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/at/index.js

@@ -3,16 +3,15 @@ import {
   MemorySealer,
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
-} from "../chunk-ENAG3IY7.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
-import "../chunk-244VXYPG.js";
+} from "../chunk-3XJQBBZD.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,

package/dist/attestation/index.js

@@ -1,41 +1,48 @@
+import {
+  issueAttestationCore
+} from "../chunk-VMV5SBE4.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-NNARWO72.js";
-import {
-  issueAttestationCore
-} from "../chunk-MTL7MXGR.js";
+} from "../chunk-5UMK7GRI.js";
+import "../chunk-JWWYRR4Q.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-QWFHIOD2.js";
+} from "../chunk-DLD5LGDS.js";
 import {
   NO_ATTESTATION
-} from "../chunk-X4773RBR.js";
+} from "../chunk-PD64727P.js";
+import {
+  decodeQr,
+  isRevoked,
+  signRevocationList,
+  verifyAttestation,
+  verifyRevocationList
+} from "../chunk-GMKGGY7V.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-IHARXWW5.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-YIVBZUTH.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-MBZZMXTC.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-MHGW3OIL.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -45,41 +52,45 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-ZL62WC2D.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-6DWIEOCV.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-ZL62WC2D.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-6DWIEOCV.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-ZL62WC2D.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-6DWIEOCV.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-ZL62WC2D.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-6DWIEOCV.js");
       return publishRevocationListCore2(ctx);
     }
   };
 }
 
-// src/with-audit/attestation/index.ts
-import { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList } from "@noy-db/attestation";
+// src/with-audit/attestation/verifier.ts
+var verifyAttestation2 = verifyAttestation;
+var decodeQr2 = decodeQr;
+var verifyRevocationList2 = verifyRevocationList;
+var isRevoked2 = isRevoked;
+var signRevocationList2 = signRevocationList;
 export {
   ATTESTATIONS_COLLECTION,
   AttestationError,
   AttestationNotEnabledError,
   NO_ATTESTATION,
-  decodeQr,
+  decodeQr2 as decodeQr,
   getRevokedDocIdsCore,
-  isRevoked,
+  isRevoked2 as isRevoked,
   issueAttestationCore,
   publishRevocationListCore,
   revokeDocCore,
-  signRevocationList,
+  signRevocationList2 as signRevocationList,
   unrevokeDocCore,
-  verifyAttestation,
-  verifyRevocationList,
+  verifyAttestation2 as verifyAttestation,
+  verifyRevocationList2 as verifyRevocationList,
   withAttestation
 };
 //# sourceMappingURL=index.js.map

package/dist/attestation/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/index.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See design-history/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { withAttestation } from './active.js'\nexport { NO_ATTESTATION, type AttestationStrategy } from './strategy.js'\nexport { AttestationNotEnabledError } from '../../kernel/errors.js'\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../../kernel/errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;AChCA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore"]}
+{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/verifier.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * The pure verifier surface, re-exported through hub-owned signatures.\n *\n * `export { … } from '@noy-db/attestation'` would compile fine and bundle\n * fine — but tsc emits that specifier verbatim into hub's `.d.ts`, so a\n * consumer would need `@noy-db/attestation` installed just to TYPECHECK\n * against a package that bundles it. Binding each value to a locally-typed\n * `const` makes the declaration name only `./types.js`.\n * `__tests__/no-runtime-dependencies.test.ts` asserts the emitted `dist`\n * never names the package, and pins these types assignable to attestation's.\n */\nimport {\n  verifyAttestation as _verifyAttestation,\n  decodeQr as _decodeQr,\n  verifyRevocationList as _verifyRevocationList,\n  isRevoked as _isRevoked,\n  signRevocationList as _signRevocationList,\n} from '@noy-db/attestation'\nimport type {\n  QrPayload,\n  RevocationList,\n  SignatureScheme,\n  VerifyInput,\n  VerifyResult,\n} from './types.js'\n\nexport const verifyAttestation: (\n  input: VerifyInput,\n  scheme?: SignatureScheme,\n) => Promise<VerifyResult> = _verifyAttestation\n\nexport const decodeQr: (s: string) => QrPayload = _decodeQr\n\nexport const verifyRevocationList: (\n  list: RevocationList,\n  publicKeyB64: string,\n  scheme?: SignatureScheme,\n) => Promise<boolean> = _verifyRevocationList\n\nexport const isRevoked: (docId: string, list: RevocationList) => boolean = _isRevoked\n\nexport const signRevocationList: (\n  revokedDocIds: readonly string[],\n  asOf: string,\n  keyId: string,\n  privateKeyPkcs8B64: string,\n  scheme?: SignatureScheme,\n) => Promise<RevocationList> = _signRevocationList\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;ACtBO,IAAMC,qBAGgB;AAEtB,IAAMC,YAAqC;AAE3C,IAAMC,wBAIW;AAEjB,IAAMC,aAA8D;AAEpE,IAAMC,sBAMkB;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore","verifyAttestation","decodeQr","verifyRevocationList","isRevoked","signRevocationList"]}

package/dist/{backup-7TFRVFLH.js → backup-YE2VQ26S.js}

@@ -1,39 +1,38 @@
 import {
   MANIFEST_COLLECTION
 } from "./chunk-EPFF7LOX.js";
-import {
-  SEQUENCE_COLLECTION
-} from "./chunk-M522UYZ2.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-3H5KLDZN.js";
+} from "./chunk-3L2NBKDR.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-FW22ZCXT.js";
+} from "./chunk-QBLT6POL.js";
+import {
+  SEQUENCE_COLLECTION
+} from "./chunk-VFHCKG5M.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
+} from "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-ODVPTDPK.js";
+} from "./chunk-SV2PM2OY.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-pod/backup.ts
 async function dumpVault(ctx) {
@@ -43,7 +42,7 @@ async function dumpVault(ctx) {
   for (const keyringId of keyringIds) {
     const envelope = await ctx.adapter.get(ctx.vault, "_keyring", keyringId);
     if (envelope) {
-      keyrings[keyringId] = JSON.parse(envelope._data);
+      keyrings[keyringId] = JSON.parse(envelope._data ?? "");
     }
   }
   const internalSnapshot = {};
@@ -267,4 +266,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-7TFRVFLH.js.map
+//# sourceMappingURL=backup-YE2VQ26S.js.map

package/dist/backup-YE2VQ26S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport { MANIFEST_COLLECTION } from '../with-shape/manifest/reserved-collections.js'\n// #1025 — imported from the dependency-light `window.ts`, not `periods.ts`: that\n// module exists precisely so a consumer can name the period collections without\n// dragging the ledger hash-chain machinery (`sha256Hex`/`canonicalJson`) into a\n// bundle that opted out of the periods service. Same reason the sync engine's\n// period-scoped pull imports it.\nimport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  PERIOD_REOPENS_COLLECTION,\n} from '../with-audit/periods/window.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { buildRecordEnvelope } from '../capsule/index.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data ?? '')\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    MANIFEST_COLLECTION, // #941: the pod's manifest-set record(s) travel in the bundle too\n    // #1025: the accounting-period close state + its companions. The bundle is\n    // the backup/restore path, so without these a restore discarded the\n    // hash-chained evidence that a month was ever closed — the artifact\n    // `closePeriod` exists to produce — and dropped the write gate with it, so\n    // the restored vault silently accepted back-dated writes into a sealed\n    // month. The companions matter as much as the close: a bounded reopen\n    // window (`reopenPeriod({ until })`) is state a restore must not lose.\n    PERIODS_COLLECTION,\n    PERIOD_REOPENS_COLLECTION,\n    PERIOD_FREEZES_COLLECTION,\n    PERIOD_ARCHIVES_COLLECTION,\n    PERIOD_TARGET_PURGES_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    // #753 spec §7 Q3: `_blob_intent` markers travel too — restoring mid-op\n    // state (a blob row without its marker) would reproduce the ambiguity\n    // the journal exists to prevent. Note: `_mv_stale` does NOT travel\n    // today (a pre-existing, separate gap) — observed here, tracked on\n    // #761, not fixed in this pass.\n    '_blob_intent',\n    // #769: `_blob_slots_<c>` envelopes travel verbatim (raw ciphertext,\n    // same DEK, same vault) — including any `SlotRecord.pendingRelease`\n    // resume breadcrumb they carry. This is INTENTIONALLY the opposite of\n    // `extract-partition`'s `reKeyBlobs`, which STRIPS `pendingRelease`:\n    // a full-vault backup restores into the SAME vault it was taken from,\n    // so a breadcrumb taken mid-rehome (together with its `_blob_intent`\n    // marker, carried above) is resumable on restore — carry-and-resume is\n    // correct here. A partition extraction crosses vaults: the breadcrumb's\n    // old eTag may not exist in the destination, so it must be stripped\n    // there instead. Asymmetry: backup = same-vault-resumable = carry;\n    // partition = cross-vault = strip-breadcrumb-carry-marker.\n    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\nexport async function loadVault(ctx: BackupContext, backupJson: string): Promise<void> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n\n  // 1. Restore data collections.\n  await ctx.adapter.saveAll(ctx.vault, backup.collections)\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    const envelope = buildRecordEnvelope({ collection: '_keyring', id: userId, version: 1 },\n      { iv: '', data: JSON.stringify(keyringFile) })\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`).\n  //    Required so verifyBackupIntegrity has the chain to walk.\n  if (backup._internal) {\n    for (const [internalName, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 5. Run the verification gate. A backup with no ledgerHead cannot be\n  //    integrity-checked, and skipping silently would collapse\n  //    *unverifiable* into *clean* — so it always warns. But the REMEDY\n  //    depends on the reader, not the pod (#1303): the pod cannot say\n  //    whether its exporter predates the ledger or never enabled it, and\n  //    the reader knows its own configuration.\n  //\n  //    - Reader HAS the ledger: the pod is behind it. \"Re-export\" is\n  //      actionable; keep the migration wording.\n  //    - Reader has NO ledger: nothing is stale and nothing is migrating —\n  //      the consumer priced the ledger (#1248 measured ~2.4x) and declined.\n  //      Prescribing a re-export is advice they should not take, and\n  //      repeating it on every read trains people to filter the one line\n  //      that also fires on a genuinely stale pod. State the consequence,\n  //      name the discriminator, prescribe nothing.\n  if (!backup.ledgerHead) {\n    if (ctx.getLedgerOrNull()) {\n      console.warn(\n        `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n        `verifiable-backup integrity check skipped. ` +\n        `Re-export with a ledger-aware build to get tamper detection.`,\n      )\n    } else {\n      console.warn(\n        `[noy-db] Loaded a backup with no ledgerHead — this pod is not integrity-checked. ` +\n        `This reader has no ledger enabled (withHistory() is not configured), so nothing is stale: ` +\n        `enable the ledger on both the exporter and this reader if tamper detection is wanted.`,\n      )\n    }\n    return\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+FA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,SAAS,EAAE;AAAA,IACvD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,GAAG,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EACrF;AACA,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAQA,eAAsB,UAAU,KAAoB,YAAmC;AACrF,QAAM,SAAS,KAAK,MAAM,UAAU;AAGpC,QAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAGvD,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AACnE,UAAM,WAAW;AAAA,MAAoB,EAAE,YAAY,YAAY,IAAI,QAAQ,SAAS,EAAE;AAAA,MACpF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,WAAW,EAAE;AAAA,IAAC;AAC/C,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAIA,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAiBrB,MAAI,CAAC,OAAO,YAAY;AACtB,QAAI,IAAI,gBAAgB,GAAG;AACzB,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-GF5BZ7D4.js";
+} from "../chunk-JSMTXZR3.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,21 +25,20 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-ANWPSTZU.js";
-import "../chunk-Z5HTYMMQ.js";
-import "../chunk-SOIQ4MM4.js";
-import "../chunk-JCN44NCY.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-G2MVBDFP.js";
+import "../chunk-SYNY3VB5.js";
+import "../chunk-7XMHMVTS.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   BlobOfflineError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/via/blob/active.ts
 function withBlobs(options = {}) {

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}

package/dist/broker/index.js

@@ -1,22 +1,21 @@
 import {
   NO_BROKER
-} from "../chunk-4AF3TUMP.js";
+} from "../chunk-GZT3NQRA.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/with-party/broker/active.ts
 var DEFAULT_SKEW_MS = 6e4;
@@ -29,7 +28,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-4JS2RJ4A.js");
+      const { enrollSeed } = await import("../seed-XNSE4U3S.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -38,7 +37,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-4JS2RJ4A.js");
+      const { rotateSeed } = await import("../seed-XNSE4U3S.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -55,7 +54,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-4JS2RJ4A.js");
+          const { mintStoreCredentials } = await import("../seed-XNSE4U3S.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;