@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/sealed-record/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { recordAadFor, decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n *\n * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**\n * (#1041). They are plaintext metadata rather than secrets, but they are bound\n * into the record's AAD, so a host handed only `{_iv, _data}` cannot\n * reconstruct the identity the body was sealed against.\n *\n * That is a feature, not a tax: it means a host cannot be fed a body with its\n * tags stripped or rewritten — a re-tiered or re-authored envelope no longer\n * opens, even with a valid sealed CEK.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: {\n    readonly _iv: string\n    readonly _data: string\n    /** Bound into the AAD since #1093 — a rewound body no longer opens. */\n    readonly _v: number\n    readonly _tier?: number | undefined\n    readonly _by?: string | undefined\n  },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  // AAD from the binding's OWN collection/id — which step (3) has just proven\n  // match the caller's expectation. So a host cannot be handed record A's\n  // sealed CEK alongside record B's body and open it (#1041): the AAD would\n  // describe A while the ciphertext was sealed for B.\n  return decrypt(\n    recordEnvelope._iv,\n    recordEnvelope._data,\n    cek,\n    recordAadFor({ collection: expectedCollection, id: expectedId }, recordEnvelope),\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;AC6CA,eAAsB,iBACpB,mBACA,gBAQA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AAKvD,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf;AAAA,IACA,aAAa,EAAE,YAAY,oBAAoB,IAAI,WAAW,GAAG,cAAc;AAAA,EACjF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../capsule/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../capsule/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../capsule/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { recordAadFor, decrypt, base64ToBuffer, importCek } from '../../capsule/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\nimport { sealedBodyArgs } from '../../capsule/index.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n *\n * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**\n * (#1041). They are plaintext metadata rather than secrets, but they are bound\n * into the record's AAD, so a host handed only `{_iv, _data}` cannot\n * reconstruct the identity the body was sealed against.\n *\n * That is a feature, not a tax: it means a host cannot be fed a body with its\n * tags stripped or rewritten — a re-tiered or re-authored envelope no longer\n * opens, even with a valid sealed CEK.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: {\n    // #15: optional, matching the widened `Envelope` callers now hold. A\n    // sealed record with no body is not openable, so this refuses below\n    // rather than declaring a shape the store contract can no longer supply.\n    readonly _iv?: string\n    readonly _data?: string\n    /** Bound into the AAD since #1093 — a rewound body no longer opens. */\n    readonly _v: number\n    readonly _tier?: number | undefined\n    readonly _by?: string | undefined\n  },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  // AAD from the binding's OWN collection/id — which step (3) has just proven\n  // match the caller's expectation. So a host cannot be handed record A's\n  // sealed CEK alongside record B's body and open it (#1041): the AAD would\n  // describe A while the ciphertext was sealed for B.\n  return decrypt(\n    ...sealedBodyArgs(recordEnvelope, 'openSealedRecord'),\n    cek,\n    recordAadFor({ collection: expectedCollection, id: expectedId }, recordEnvelope),\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAAwB;AAClE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAAwB;AACpE,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAAwB;AACjE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;AC8CA,eAAsB,iBACpB,mBACA,gBAWA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AAKvD,SAAO;AAAA,IACL,GAAG,eAAe,gBAAgB,kBAAkB;AAAA,IACpD;AAAA,IACA,aAAa,EAAE,YAAY,oBAAoB,IAAI,WAAW,GAAG,cAAc;AAAA,EACjF;AACF;","names":[]}

package/dist/search/index.js

@@ -9,7 +9,7 @@ import {
   segmentTokens,
   tokenize,
   withSearch
-} from "../chunk-I3JDRCMW.js";
+} from "../chunk-RB4DOPGZ.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
@@ -17,11 +17,11 @@ import {
   DEFAULT_INDEX_MIN_VECTORS,
   withVectorIndex
 } from "../chunk-NYMLINRP.js";
-import "../chunk-GHLTDZRS.js";
-import "../chunk-Z5HTYMMQ.js";
+import "../chunk-OKSTSITU.js";
+import "../chunk-SYNY3VB5.js";
 import {
   SearchNotEnabledError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 export {
   DEFAULT_INDEX_MIN_VECTORS,
   InvertedIndex,

package/dist/{seed-4JS2RJ4A.js → seed-XNSE4U3S.js}

@@ -1,27 +1,24 @@
 import {
   BROKER_COLLECTION,
   ensureCollectionDEK
-} from "./chunk-M7NI3IWE.js";
-import "./chunk-7VCXZDA4.js";
-import "./chunk-JCN44NCY.js";
+} from "./chunk-XSPFDUDG.js";
+import "./chunk-LIOVX5TJ.js";
+import "./chunk-FLPCETP6.js";
 import {
+  base64ToBuffer,
+  bufferToBase64,
+  buildSealedRecordEnvelope,
   computeBrokerProof,
   deriveBrokerProofBits,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-KJFW62P4.js";
-import {
-  buildSealedRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import {
-  base64ToBuffer,
-  bufferToBase64
-} from "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
+} from "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -29,7 +26,7 @@ import {
   PermissionDeniedError,
   ValidationError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/broker/seed.ts
 function requireAdminAccess(keyring) {
@@ -225,4 +222,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-4JS2RJ4A.js.map
+//# sourceMappingURL=seed-XNSE4U3S.js.map

package/dist/seed-XNSE4U3S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/broker/seed.ts"],"sourcesContent":["/**\n * `_broker` reserved-collection seed lifecycle (#479, credential-broker\n * spec §2/§3). Modeled on `with-sync/credentials.ts`: a\n * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under\n * the collection's own DEK, `requireAdminAccess` role gate (owner/admin\n * only — custodian intentionally excluded, same rationale as\n * `_sync_credentials`: this is transport-auth material, not the\n * custodian's operational scope).\n *\n * Three operations, each a free function taking a {@link BrokerSeedCtx}\n * (the {@link BrokerCtx} threaded through `with-party/broker/active.ts`,\n * augmented there with the `config` its closure was built with):\n *\n *  - {@link enrollSeed} — two-phase commit (I9): create-if-absent CAS the\n *    seed (I4), then register its derived proof key with the broker host,\n *    then (only on a 2xx) mark the record `registered: true`. A seed\n *    persisted whose `/enroll` POST failed stays `registered: false` so a\n *    later `credentialSource()` fails fast instead of degrading into an\n *    opaque `BrokerProofError` (I9/V23).\n *  - {@link rotateSeed} — quiesce-then-swap (I5): mint a fresh seed,\n *    register-new-first, THEN overwrite the local record — closing the\n *    torn-proof window a naive local-overwrite-then-register order would\n *    open. The single-flight cache quiesce itself (await in-flight, bump\n *    epoch) is the caller's job (`with-party/broker/active.ts`) since the\n *    cache lives in that closure, not here.\n *  - {@link mintStoreCredentials} — the challenge/response round trip\n *    (`/challenge` then `/credentials`) that produces one `StoreCredentials`\n *    value; the single-flight cache wrapping it lives in `active.ts`.\n *\n * First-seed creation calls `ensureCollectionDEK`, which throws\n * (`ValidationError`) when the keyring's KEK is `null` (PIN quick-resume /\n * session-restore) — this module intercepts that and re-surfaces it as\n * {@link BrokerEnrolmentError} (R-B8/I3): *enrol* needs the KEK; *use* of an\n * already-enrolled seed needs only the DEK.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope, StoreCredentials } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { ensureCollectionDEK } from '../../with-party/team/keyring.js'\nimport { BROKER_COLLECTION } from '../../with-party/team/reserved-secret-collections.js'\nimport {\n  buildSealedRecordEnvelope,\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  bufferToBase64,\n  base64ToBuffer,\n  deriveBrokerProofBits,\n  computeBrokerProof,\n} from '../../capsule/index.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport {\n  PermissionDeniedError,\n  ValidationError,\n  isConflictError,\n  NetworkError,\n  BrokerEnrolmentError,\n  BrokerProofError,\n} from '../../kernel/errors.js'\nimport type { BrokerSeedCtx, BrokerConfig } from '../../port/with/broker-strategy.js'\n\n/** The `_broker/<brokerId>` record payload (spec §3). */\nexport interface BrokerSeedRecord {\n  readonly brokerId: string\n  /** base64(32 random bytes). */\n  readonly seed: string\n  readonly endpoint: string\n  readonly createdAt: string\n  /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */\n  readonly registered: boolean\n}\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // Custodian is INTENTIONALLY excluded — the _broker seed is transport-auth\n  // material (mints cloud store credentials), not the custodian's\n  // operational data scope. Same rationale as _sync_credentials' FR-6 note.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Credential-broker operations require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// `ensureCollectionDEK` only dedupes concurrent first-time DEK creates WITHIN one\n// closure instance — since every call site here asks for a fresh closure, two\n// concurrent `enrollSeed()` calls sharing the same (store, vault, keyring) would\n// otherwise each mint a DIFFERENT `_broker` DEK and race `persistKeyring`, leaving\n// the seed record encrypted under a DEK the keyring no longer holds (TamperedError\n// on the next read). Dedupe across calls here, keyed by store identity + vault\n// (V20 — the CAS enrol vector actually exercises this).\nconst inFlightDekByStore = new WeakMap<NoydbStore, Map<string, Promise<EnclaveKey>>>()\n\nasync function brokerDek(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<EnclaveKey> {\n  const existing = keyring.deks.get(BROKER_COLLECTION)\n  if (existing) return existing\n\n  let perStore = inFlightDekByStore.get(store)\n  if (!perStore) { perStore = new Map(); inFlightDekByStore.set(store, perStore) }\n  const pending = perStore.get(vault)\n  if (pending) return pending\n\n  const promise = (async () => {\n    try {\n      const getDek = await ensureCollectionDEK(store, vault, keyring)\n      return await getDek(BROKER_COLLECTION)\n    } catch (err) {\n      if (err instanceof ValidationError) {\n        throw new BrokerEnrolmentError(\n          'enroll()/rotate() need the KEK to provision the _broker DEK on first use — ' +\n            're-authenticate at tier 1 (secret) before enrolling. Using an already-' +\n            'enrolled seed (credentialSource()) needs only the DEK.',\n        )\n      }\n      throw err\n    }\n  })()\n  perStore.set(vault, promise)\n  try {\n    return await promise\n  } finally {\n    perStore.delete(vault)\n  }\n}\n\nasync function readRecord(\n  store: NoydbStore,\n  vault: string,\n  brokerId: string,\n  dek: EnclaveKey,\n): Promise<{ envelope: EncryptedEnvelope; record: BrokerSeedRecord } | null> {\n  const envelope = await store.get(vault, BROKER_COLLECTION, brokerId)\n  if (!envelope) return null\n  const record = JSON.parse(await openEnvelopeJson({ collection: BROKER_COLLECTION, id: brokerId }, envelope, dek)) as BrokerSeedRecord\n  return { envelope, record }\n}\n\nasync function persistRecord(\n  store: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  dek: EnclaveKey,\n  record: BrokerSeedRecord,\n  expectedVersion: number,\n): Promise<void> {\n  const envelope = await buildSealedRecordEnvelope(\n    { collection: BROKER_COLLECTION, id: record.brokerId, by: keyring.userId, version: expectedVersion + 1 },\n    (identity) => writeEnvelopeBody(identity, JSON.stringify(record), dek),\n    {},\n  )\n  await store.put(vault, BROKER_COLLECTION, record.brokerId, envelope, expectedVersion)\n}\n\ninterface SeedState {\n  readonly seedBytes: Uint8Array\n  readonly record: BrokerSeedRecord\n  readonly dek: EnclaveKey\n  readonly version: number\n}\n\n/** Create-if-absent CAS (I4/V20): a concurrent enrol that loses the race\n *  re-reads the winner's seed instead of persisting a second one. */\nasync function ensureSeedRecord(store: NoydbStore, vault: string, keyring: UnlockedKeyring, config: BrokerConfig): Promise<SeedState> {\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (existing) {\n    return { seedBytes: base64ToBuffer(existing.record.seed), record: existing.record, dek, version: existing.envelope._v }\n  }\n\n  const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(seedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: false,\n  }\n  try {\n    await persistRecord(store, vault, keyring, dek, record, 0)\n    return { seedBytes, record, dek, version: 1 }\n  } catch (err) {\n    if (!(isConflictError(err))) throw err\n    const winner = await readRecord(store, vault, config.brokerId, dek)\n    if (!winner) throw err\n    return { seedBytes: base64ToBuffer(winner.record.seed), record: winner.record, dek, version: winner.envelope._v }\n  }\n}\n\nasync function postEnroll(config: BrokerConfig, vault: string, proofBits: Uint8Array): Promise<void> {\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const attestation = config.attestation ? await config.attestation() : undefined\n  let res: Response\n  try {\n    res = await fetchFn(`${config.endpoint}/enroll`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        ...(attestation !== undefined ? { authorization: `Bearer ${attestation}` } : {}),\n      },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, proofKey: bufferToBase64(proofBits) }),\n    })\n  } catch (err) {\n    throw new BrokerEnrolmentError(`broker /enroll request failed: ${(err as Error).message}`)\n  }\n  if (!res.ok) {\n    throw new BrokerEnrolmentError(`broker refused enrolment (status ${res.status}) — attestation likely missing or invalid`)\n  }\n}\n\n/**\n * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`\n * seed (I4), derive+register its proof key with the broker host, and only\n * on a 2xx mark the record `registered: true`. Requires owner/admin role\n * and (for first-seed creation only) the KEK.\n */\nexport async function enrollSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  const { seedBytes, record, dek, version } = await ensureSeedRecord(store, vault, keyring, config)\n  if (record.registered) {\n    seedBytes.fill(0)\n    return\n  }\n\n  const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId)\n  seedBytes.fill(0)\n  try {\n    await postEnroll(config, vault, proofBits)\n  } finally {\n    proofBits.fill(0)\n  }\n\n  try {\n    await persistRecord(store, vault, keyring, dek, { ...record, registered: true }, version)\n  } catch (err) {\n    if (isConflictError(err)) {\n      const latest = await readRecord(store, vault, config.brokerId, dek)\n      if (latest?.record.registered) return // a concurrent enrol already committed the same outcome\n    }\n    throw err\n  }\n}\n\n/**\n * Rotate (quiesce-then-swap — I5): mint a fresh seed, register its proof\n * key with the broker host FIRST, then overwrite the local `_broker`\n * record. The broker host is expected to accept both the old and new\n * registration for a short grace window, so an in-flight proof computed\n * under the old key (from before rotation started) still verifies. Cache\n * quiescing (awaiting any in-flight round-trip, bumping the refresh-cache\n * epoch) is the caller's job — `with-party/broker/active.ts` — since the\n * cache lives in that closure, not here.\n */\nexport async function rotateSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (!existing) {\n    // Nothing to rotate yet — behaves like a first enrol.\n    await enrollSeed(ctx)\n    return\n  }\n\n  const newSeedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const newProofBits = await deriveBrokerProofBits(newSeedBytes, vault, config.brokerId)\n  try {\n    await postEnroll(config, vault, newProofBits)\n  } finally {\n    newProofBits.fill(0)\n  }\n\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(newSeedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: true,\n  }\n  newSeedBytes.fill(0)\n  await persistRecord(store, vault, keyring, dek, record, existing.envelope._v)\n}\n\n/**\n * The challenge/response round trip: `POST /challenge`, derive+sign the\n * proof from the decrypted seed, `POST /credentials`. One network round\n * trip per call — the single-flight/cache wrapping lives in `active.ts`.\n *\n * Fails fast with {@link BrokerEnrolmentError} if the seed hasn't completed\n * enrolment yet (`registered !== true` — I9/V23), never degrading into an\n * opaque {@link BrokerProofError}.\n */\nexport async function mintStoreCredentials(ctx: BrokerSeedCtx, profile?: string): Promise<StoreCredentials> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const found = await readRecord(store, vault, config.brokerId, dek)\n  if (!found) throw new BrokerEnrolmentError(`No _broker seed enrolled for brokerId \"${config.brokerId}\" — call enroll() first.`)\n  if (!found.record.registered) {\n    throw new BrokerEnrolmentError(\n      `The _broker seed for \"${config.brokerId}\" has not completed enrolment with the broker host — call enroll() again.`,\n    )\n  }\n\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const endpointOrigin = new URL(config.endpoint).origin\n\n  let challengeRes: Response\n  try {\n    challengeRes = await fetchFn(`${config.endpoint}/challenge`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /challenge request failed: ${(err as Error).message}`)\n  }\n  if (!challengeRes.ok) throw new NetworkError(`broker /challenge failed with status ${challengeRes.status}`)\n  const { challenge, expiresAt } = (await challengeRes.json()) as { challenge: string; expiresAt: string }\n\n  const seedBytes = base64ToBuffer(found.record.seed)\n  const proof = await computeBrokerProof(seedBytes, vault, config.brokerId, { endpointOrigin, profile, challenge, expiresAt })\n\n  let credsRes: Response\n  try {\n    credsRes = await fetchFn(`${config.endpoint}/credentials`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, challenge, proof, ...(profile !== undefined ? { profile } : {}) }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /credentials request failed: ${(err as Error).message}`)\n  }\n  if (credsRes.status === 401 || credsRes.status === 403) throw new BrokerProofError('broker rejected the challenge proof')\n  if (!credsRes.ok) throw new NetworkError(`broker /credentials failed with status ${credsRes.status}`)\n  return (await credsRes.json()) as StoreCredentials\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,SAAS,mBAAmB,SAAgC;AAI1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,4EAA4E,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AASA,IAAM,qBAAqB,oBAAI,QAAsD;AAErF,eAAe,UAAU,OAAmB,OAAe,SAA+C;AACxG,QAAM,WAAW,QAAQ,KAAK,IAAI,iBAAiB;AACnD,MAAI,SAAU,QAAO;AAErB,MAAI,WAAW,mBAAmB,IAAI,KAAK;AAC3C,MAAI,CAAC,UAAU;AAAE,eAAW,oBAAI,IAAI;AAAG,uBAAmB,IAAI,OAAO,QAAQ;AAAA,EAAE;AAC/E,QAAM,UAAU,SAAS,IAAI,KAAK;AAClC,MAAI,QAAS,QAAO;AAEpB,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,oBAAoB,OAAO,OAAO,OAAO;AAC9D,aAAO,MAAM,OAAO,iBAAiB;AAAA,IACvC,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB;AAClC,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,GAAG;AACH,WAAS,IAAI,OAAO,OAAO;AAC3B,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,aAAS,OAAO,KAAK;AAAA,EACvB;AACF;AAEA,eAAe,WACb,OACA,OACA,UACA,KAC2E;AAC3E,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,mBAAmB,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,mBAAmB,IAAI,SAAS,GAAG,UAAU,GAAG,CAAC;AAChH,SAAO,EAAE,UAAU,OAAO;AAC5B;AAEA,eAAe,cACb,OACA,OACA,SACA,KACA,QACA,iBACe;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,EAAE,YAAY,mBAAmB,IAAI,OAAO,UAAU,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,EAAE;AAAA,IACvG,CAAC,aAAa,kBAAkB,UAAU,KAAK,UAAU,MAAM,GAAG,GAAG;AAAA,IACrE,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,mBAAmB,OAAO,UAAU,UAAU,eAAe;AACtF;AAWA,eAAe,iBAAiB,OAAmB,OAAe,SAA0B,QAA0C;AACpI,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,UAAU;AACZ,WAAO,EAAE,WAAW,eAAe,SAAS,OAAO,IAAI,GAAG,QAAQ,SAAS,QAAQ,KAAK,SAAS,SAAS,SAAS,GAAG;AAAA,EACxH;AAEA,QAAM,YAAY,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACtE,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,SAAS;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC;AACzD,WAAO,EAAE,WAAW,QAAQ,KAAK,SAAS,EAAE;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAI,CAAE,gBAAgB,GAAG,EAAI,OAAM;AACnC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,EAAE,WAAW,eAAe,OAAO,OAAO,IAAI,GAAG,QAAQ,OAAO,QAAQ,KAAK,SAAS,OAAO,SAAS,GAAG;AAAA,EAClH;AACF;AAEA,eAAe,WAAW,QAAsB,OAAe,WAAsC;AACnG,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,cAAc,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI;AACtE,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,WAAW;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,gBAAgB,SAAY,EAAE,eAAe,UAAU,WAAW,GAAG,IAAI,CAAC;AAAA,MAChF;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,UAAU,eAAe,SAAS,EAAE,CAAC;AAAA,IACzG,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,qBAAqB,kCAAmC,IAAc,OAAO,EAAE;AAAA,EAC3F;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,qBAAqB,oCAAoC,IAAI,MAAM,gDAA2C;AAAA,EAC1H;AACF;AAQA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,QAAM,EAAE,WAAW,QAAQ,KAAK,QAAQ,IAAI,MAAM,iBAAiB,OAAO,OAAO,SAAS,MAAM;AAChG,MAAI,OAAO,YAAY;AACrB,cAAU,KAAK,CAAC;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,sBAAsB,WAAW,OAAO,OAAO,QAAQ;AAC/E,YAAU,KAAK,CAAC;AAChB,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,SAAS;AAAA,EAC3C,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,EAAE,GAAG,QAAQ,YAAY,KAAK,GAAG,OAAO;AAAA,EAC1F,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,UAAI,QAAQ,OAAO,WAAY;AAAA,IACjC;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,CAAC,UAAU;AAEb,UAAM,WAAW,GAAG;AACpB;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACzE,QAAM,eAAe,MAAM,sBAAsB,cAAc,OAAO,OAAO,QAAQ;AACrF,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,YAAY;AAAA,EAC9C,UAAE;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAEA,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,YAAY;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,eAAa,KAAK,CAAC;AACnB,QAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,SAAS,SAAS,EAAE;AAC9E;AAWA,eAAsB,qBAAqB,KAAoB,SAA6C;AAC1G,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,QAAQ,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACjE,MAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB,0CAA0C,OAAO,QAAQ,+BAA0B;AAC9H,MAAI,CAAC,MAAM,OAAO,YAAY;AAC5B,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,QAAQ;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,iBAAiB,IAAI,IAAI,OAAO,QAAQ,EAAE;AAEhD,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,QAAQ,GAAG,OAAO,QAAQ,cAAc;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,SAAS,CAAC;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,qCAAsC,IAAc,OAAO,EAAE;AAAA,EACtF;AACA,MAAI,CAAC,aAAa,GAAI,OAAM,IAAI,aAAa,wCAAwC,aAAa,MAAM,EAAE;AAC1G,QAAM,EAAE,WAAW,UAAU,IAAK,MAAM,aAAa,KAAK;AAE1D,QAAM,YAAY,eAAe,MAAM,OAAO,IAAI;AAClD,QAAM,QAAQ,MAAM,mBAAmB,WAAW,OAAO,OAAO,UAAU,EAAE,gBAAgB,SAAS,WAAW,UAAU,CAAC;AAE3H,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,OAAO,QAAQ,gBAAgB;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,WAAW,OAAO,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AAAA,IACrI,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,uCAAwC,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,OAAM,IAAI,iBAAiB,qCAAqC;AACxH,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,aAAa,0CAA0C,SAAS,MAAM,EAAE;AACpG,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}

package/dist/sequence/index.js

@@ -5,18 +5,17 @@ import {
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "../chunk-M522UYZ2.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-VFHCKG5M.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   SequenceNotEnabledError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 export {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,

package/dist/session/index.js

@@ -12,24 +12,23 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-YNIUIERI.js";
+} from "../chunk-MXKI4ABF.js";
 import {
   NO_SESSION
 } from "../chunk-VKQCVU2Z.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/with-party/session/active.ts
 function withSession() {

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/shadow/index.js

@@ -1,11 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-6OWXYZK2.js";
+} from "../chunk-2ODVB6LZ.js";
 import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-fork/shadow/active.ts
 function withShadow() {

package/dist/signer-MHGW3OIL.js

@@ -0,0 +1,23 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-DLD5LGDS.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-MHGW3OIL.js.map

package/dist/snapshots/index.js

@@ -4,19 +4,19 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-HBPPGWUM.js";
-import "../chunk-IUWCVHQ7.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-KZXDLBY6.js";
+import "../chunk-5A4345TG.js";
+import "../chunk-GMKGGY7V.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/with-fork/snapshots/engine.ts
 var SnapshotEngine = class {

package/dist/stale-6GCFMOOR.js

@@ -0,0 +1,28 @@
+import {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+} from "./chunk-VKI2EB3N.js";
+import "./chunk-5D2ALSM5.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+};
+//# sourceMappingURL=stale-6GCFMOOR.js.map

package/dist/storage-BYN5LO6Z.js

@@ -0,0 +1,21 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-3L2NBKDR.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-BYN5LO6Z.js.map

package/dist/store/index.js

@@ -7,7 +7,7 @@ import {
   withMetrics,
   withRetry,
   wrapStore
-} from "../chunk-EIPVYUEP.js";
+} from "../chunk-GQ4MF3CM.js";
 export {
   routeStore,
   withCache,

package/dist/{store-coordination-provider-2O2VUHKW.js → store-coordination-provider-C4BPT5XF.js}

@@ -1,18 +1,17 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-L7DOS3TE.js";
-import "./chunk-KJFW62P4.js";
+} from "./chunk-VAORSCSU.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
+} from "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 
 // src/with-shape/schema-update/client-registry.ts
 var META_COLLECTION = "_meta";
@@ -33,7 +32,7 @@ async function listClientDocs(store, vault) {
     const env = await store.get(vault, META_COLLECTION, id);
     if (!env) continue;
     try {
-      const parsed = JSON.parse(env._data);
+      const parsed = JSON.parse(env._data ?? "");
       if (isClientDoc(parsed)) out.push(parsed);
     } catch {
     }
@@ -145,4 +144,4 @@ function unref(timer) {
 export {
   StoreMesh
 };
-//# sourceMappingURL=store-coordination-provider-2O2VUHKW.js.map
+//# sourceMappingURL=store-coordination-provider-C4BPT5XF.js.map

package/dist/store-coordination-provider-C4BPT5XF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/client-registry.ts","../src/with-shape/schema-update/store-coordination-provider.ts"],"sourcesContent":["/**\n * Schema-cutover client registry. Each client keeps a\n * heartbeat doc at `_meta/schema-fence:client:<clientId>` carrying its\n * liveness (`lastSeen`) and the fence generation it has quiesced for\n * (`quiescedAtVersion`). Plaintext envelope, like the fence doc.\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\n\nconst META_COLLECTION = '_meta'\nconst CLIENT_PREFIX = 'schema-fence:client:'\n\nexport interface ClientDoc {\n  readonly clientId: string\n  readonly lastSeen: number\n  readonly quiescedAtVersion: number | null\n  /**\n   * Session that owns this writer (one user's writers across vaults). Additive\n   * and optional so legacy client docs (written without it) keep parsing;\n   * readers default it.\n   */\n  readonly sessionId?: string\n}\n\nexport async function writeClientDoc(\n  store: NoydbStore,\n  vault: string,\n  clientId: string,\n  doc: { lastSeen: number; quiescedAtVersion: number | null; sessionId?: string },\n): Promise<void> {\n  const recordId = `${CLIENT_PREFIX}${clientId}`\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: recordId, version: 1 },\n    { iv: '', data: JSON.stringify({ clientId, ...doc }) },\n  )\n  await store.put(vault, META_COLLECTION, recordId, envelope)\n}\n\nexport async function listClientDocs(store: NoydbStore, vault: string): Promise<ClientDoc[]> {\n  const ids = await store.list(vault, META_COLLECTION)\n  const out: ClientDoc[] = []\n  for (const id of ids) {\n    if (!id.startsWith(CLIENT_PREFIX)) continue\n    const env = await store.get(vault, META_COLLECTION, id)\n    if (!env) continue\n    try {\n      const parsed = JSON.parse(env._data ?? '') as unknown\n      if (isClientDoc(parsed)) out.push(parsed)\n    } catch { /* skip corrupt */ }\n  }\n  return out\n}\n\n/**\n * True when every *active* client (lastSeen within staleMs of now) has\n * `quiescedAtVersion === generation`. Stale clients are ignored. An empty\n * active set is vacuously quiesced.\n */\nexport async function activeQuiesced(\n  store: NoydbStore,\n  vault: string,\n  opts: { generation: number; now: number; staleMs: number; excludeClientId?: string },\n): Promise<boolean> {\n  const docs = await listClientDocs(store, vault)\n  const active = docs.filter(\n    d => d.lastSeen >= opts.now - opts.staleMs && d.clientId !== opts.excludeClientId,\n  )\n  return active.every(d => d.quiescedAtVersion === opts.generation)\n}\n\nfunction isClientDoc(x: unknown): x is ClientDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  return typeof o['clientId'] === 'string'\n    && typeof o['lastSeen'] === 'number'\n    && (o['quiescedAtVersion'] === null || typeof o['quiescedAtVersion'] === 'number')\n    && (o['sessionId'] === undefined || typeof o['sessionId'] === 'string')\n}\n","/**\n * Store-backed default {@link NoydbMesh}.\n *\n * Maps the five coordination-port methods onto today's `_meta/schema-fence`\n * store ops so that, with no `by-*` provider injected, the fence service\n * reproduces its current store-polling behavior byte-for-byte. The `observe*`\n * methods are poll-emit (the legacy {@link FenceWatcher} model); `by-tabs` /\n * `by-peer` override them with real-time push.\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { Unsubscribe } from '../../port/with/write-hooks.js'\nimport { loadFence, saveFence, type FenceDoc } from './fence.js'\nimport { writeClientDoc, listClientDocs, type ClientDoc } from './client-registry.js'\nimport type { NoydbMesh, WriterPresence } from '../../port/by/types.js'\n\n/**\n * Default poll cadence for the `observe*` fallbacks (ms). Matches the\n * store-poll granularity the fence-controller uses while waiting for quorum\n * (`delay(50)`); the same value the migration cutover falls back to when no\n * real-time provider is injected.\n */\nconst DEFAULT_POLL_INTERVAL_MS = 50\n\n/** Map a stored {@link ClientDoc} to the port's {@link WriterPresence}. */\nfunction toPresence(doc: ClientDoc): WriterPresence {\n  return {\n    writerId: doc.clientId,\n    // Legacy docs written without a sessionId (and explicit empty) have no\n    // session — fall back to the writerId so every presence is session-addressable.\n    sessionId: doc.sessionId && doc.sessionId.length > 0 ? doc.sessionId : doc.clientId,\n    lastSeen: doc.lastSeen,\n    quiescedAtVersion: doc.quiescedAtVersion,\n  }\n}\n\nfunction fenceEqual(a: FenceDoc, b: FenceDoc): boolean {\n  return a.currentSchemaVersion === b.currentSchemaVersion && a.fenceState === b.fenceState\n}\n\nfunction presenceListEqual(a: readonly WriterPresence[], b: readonly WriterPresence[]): boolean {\n  if (a.length !== b.length) return false\n  const key = (w: WriterPresence) => `${w.writerId}\\u0000${w.sessionId}\\u0000${w.lastSeen}\\u0000${String(w.quiescedAtVersion)}`\n  const bk = new Set(b.map(key))\n  return a.every((w) => bk.has(key(w)))\n}\n\nexport class StoreMesh implements NoydbMesh {\n  readonly #store: NoydbStore\n  readonly #pollIntervalMs: number\n\n  constructor(store: NoydbStore, opts?: { pollIntervalMs?: number }) {\n    this.#store = store\n    this.#pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS\n  }\n\n  async setFence(vault: string, fence: FenceDoc): Promise<void> {\n    // RE-READ AND SPREAD, never write the caller's doc whole (#1197).\n    //\n    // `saveFence` serialises what it is given and does a full `store.put` — no\n    // merge. Callers legitimately construct a PARTIAL doc: `FenceController`\n    // builds `{ currentSchemaVersion, fenceState }`, which is a valid `FenceDoc`\n    // because `schemaHash` is optional. Writing that whole silently erased the\n    // hash #946 added, so \"which schema is generation N is answerable from\n    // schemaFenceState() alone\" held only until the first drain.\n    //\n    // The type cannot see the loss: for an optional field, \"absent\" and\n    // \"deliberately cleared\" are the same value.\n    //\n    // Mirrors `persisted-schemas/register.ts:136`, which re-reads for the same\n    // reason and documents it — a stale snapshot would roll back a concurrent\n    // cutover's version. Re-reading NARROWS that window rather than closing it;\n    // fence transitions are orchestrator-driven and serialised, so the residual\n    // is the same one that path already accepts.\n    const current = await loadFence(this.#store, vault)\n    await saveFence(this.#store, vault, { ...current, ...fence })\n  }\n\n  async readFence(vault: string): Promise<FenceDoc> {\n    return loadFence(this.#store, vault)\n  }\n\n  observeFence(vault: string, onChange: (f: FenceDoc) => void): Unsubscribe {\n    let last: FenceDoc | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const fence = await loadFence(this.#store, vault)\n        if (last === null || !fenceEqual(last, fence)) {\n          last = fence\n          onChange(fence)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current state once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reportPresence(vault: string, p: WriterPresence): Promise<void> {\n    await writeClientDoc(this.#store, vault, p.writerId, {\n      lastSeen: p.lastSeen,\n      quiescedAtVersion: p.quiescedAtVersion,\n      sessionId: p.sessionId,\n    })\n  }\n\n  observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe {\n    let last: readonly WriterPresence[] | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const docs = await listClientDocs(this.#store, vault)\n        const writers = docs.map(toPresence)\n        if (last === null || !presenceListEqual(last, writers)) {\n          last = writers\n          onChange(writers)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current set once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reachableWriters(vault: string, o: { staleMs: number; now: number }): Promise<readonly WriterPresence[]> {\n    const docs = await listClientDocs(this.#store, vault)\n    return docs.map(toPresence).filter((w) => o.now - w.lastSeen <= o.staleMs)\n  }\n}\n\n/** Best-effort `unref` so a poll timer never holds the process open (Node only). */\nfunction unref(timer: ReturnType<typeof setInterval>): void {\n  const t = timer as unknown as { unref?: () => void }\n  if (typeof t.unref === 'function') t.unref()\n}\n"],"mappings":";;;;;;;;;;;;;;;;AASA,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AActB,eAAsB,eACpB,OACA,OACA,UACA,KACe;AACf,QAAM,WAAW,GAAG,aAAa,GAAG,QAAQ;AAC5C,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,UAAU,SAAS,EAAE;AAAA,IACxD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC,EAAE;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,UAAU,QAAQ;AAC5D;AAEA,eAAsB,eAAe,OAAmB,OAAqC;AAC3F,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AACnD,QAAM,MAAmB,CAAC;AAC1B,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAG,WAAW,aAAa,EAAG;AACnC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,iBAAiB,EAAE;AACtD,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI,SAAS,EAAE;AACzC,UAAI,YAAY,MAAM,EAAG,KAAI,KAAK,MAAM;AAAA,IAC1C,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AACA,SAAO;AACT;AAmBA,SAAS,YAAY,GAA4B;AAC/C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SAAO,OAAO,EAAE,UAAU,MAAM,YAC3B,OAAO,EAAE,UAAU,MAAM,aACxB,EAAE,mBAAmB,MAAM,QAAQ,OAAO,EAAE,mBAAmB,MAAM,cACrE,EAAE,WAAW,MAAM,UAAa,OAAO,EAAE,WAAW,MAAM;AAClE;;;ACrDA,IAAM,2BAA2B;AAGjC,SAAS,WAAW,KAAgC;AAClD,SAAO;AAAA,IACL,UAAU,IAAI;AAAA;AAAA;AAAA,IAGd,WAAW,IAAI,aAAa,IAAI,UAAU,SAAS,IAAI,IAAI,YAAY,IAAI;AAAA,IAC3E,UAAU,IAAI;AAAA,IACd,mBAAmB,IAAI;AAAA,EACzB;AACF;AAEA,SAAS,WAAW,GAAa,GAAsB;AACrD,SAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,eAAe,EAAE;AACjF;AAEA,SAAS,kBAAkB,GAA8B,GAAuC;AAC9F,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,MAAM,CAAC,MAAsB,GAAG,EAAE,QAAQ,KAAS,EAAE,SAAS,KAAS,EAAE,QAAQ,KAAS,OAAO,EAAE,iBAAiB,CAAC;AAC3H,QAAM,KAAK,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC;AAC7B,SAAO,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AACtC;AAEO,IAAM,YAAN,MAAqC;AAAA,EACjC;AAAA,EACA;AAAA,EAET,YAAY,OAAmB,MAAoC;AACjE,SAAK,SAAS;AACd,SAAK,kBAAkB,MAAM,kBAAkB;AAAA,EACjD;AAAA,EAEA,MAAM,SAAS,OAAe,OAAgC;AAkB5D,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ,KAAK;AAClD,UAAM,UAAU,KAAK,QAAQ,OAAO,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,UAAU,OAAkC;AAChD,WAAO,UAAU,KAAK,QAAQ,KAAK;AAAA,EACrC;AAAA,EAEA,aAAa,OAAe,UAA8C;AACxE,QAAI,OAAwB;AAC5B,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,KAAK,QAAQ,KAAK;AAChD,YAAI,SAAS,QAAQ,CAAC,WAAW,MAAM,KAAK,GAAG;AAC7C,iBAAO;AACP,mBAAS,KAAK;AAAA,QAChB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,eAAe,OAAe,GAAkC;AACpE,UAAM,eAAe,KAAK,QAAQ,OAAO,EAAE,UAAU;AAAA,MACnD,UAAU,EAAE;AAAA,MACZ,mBAAmB,EAAE;AAAA,MACrB,WAAW,EAAE;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,gBAAgB,OAAe,UAAqE;AAClG,QAAI,OAAyC;AAC7C,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,cAAM,UAAU,KAAK,IAAI,UAAU;AACnC,YAAI,SAAS,QAAQ,CAAC,kBAAkB,MAAM,OAAO,GAAG;AACtD,iBAAO;AACP,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,iBAAiB,OAAe,GAAyE;AAC7G,UAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,WAAO,KAAK,IAAI,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO;AAAA,EAC3E;AACF;AAGA,SAAS,MAAM,OAA6C;AAC1D,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAC7C;","names":[]}

package/dist/sync/index.js

@@ -2,20 +2,19 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-N5DNADLQ.js";
+} from "../chunk-H23XHRTT.js";
 import {
   NO_SYNC
 } from "../chunk-T7IR4N2S.js";
-import "../chunk-FW22ZCXT.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-QBLT6POL.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-sync/active.ts
 function withSync() {

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSeal,
   beginEchoUnlock,
   withTeam
-} from "../chunk-IEX7NK2K.js";
+} from "../chunk-2RH777HH.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -32,8 +32,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-ZE4CHIED.js";
-import "../chunk-DC5QVPV7.js";
+} from "../chunk-DQESF6RP.js";
+import "../chunk-VHBKYN2J.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -54,21 +54,20 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-M7NI3IWE.js";
-import "../chunk-7VCXZDA4.js";
-import "../chunk-SOIQ4MM4.js";
-import "../chunk-JCN44NCY.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-XSPFDUDG.js";
+import "../chunk-LIOVX5TJ.js";
+import "../chunk-7XMHMVTS.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   TeamNotEnabledError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 export {
   MemoryDeviceSeal,
   NO_TEAM,

package/dist/tiers/index.js

@@ -12,20 +12,19 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-UPD5NWI5.js";
-import "../chunk-SOIQ4MM4.js";
-import "../chunk-JCN44NCY.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-DHHGL42E.js";
+import "../chunk-7XMHMVTS.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   TiersNotEnabledError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,

package/dist/to/index.js

@@ -1,6 +1,6 @@
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-ODVPTDPK.js";
+} from "../chunk-SV2PM2OY.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
@@ -9,7 +9,7 @@ import {
   StoreCapabilityError,
   UnknownStoreKindError,
   isConflictError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/port/to/locator.ts
 function isPodStore(store) {

package/dist/transactions/index.js

@@ -3,15 +3,15 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-5FDLC6G7.js";
+} from "../chunk-UA372JHH.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-BI5CHWRY.js"));
+var loadGuardExecutor = lazy(() => import("../executor-LBBBRTN5.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {