@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog — hub
 
+## 0.9.0-pre.0
+
+**The line moves to 0.9.0 on this pre-release: a new package, a milestone, three seam widenings, and fourteen fewer names.** Everything below is additive unless marked ⛔.
+
+**`@noy-db/ports`** — the six conformance kits are one package with one subpath per hub port: `@noy-db/ports/to`, `/as`, `/at`, `/on`, `/by`, `/capsule`. Bind `@noy-db/hub/<port>`, prove it with `@noy-db/ports/<port>`. **Not a break:** function names unchanged, peers unchanged, and the six `@noy-db/test-*-conformance` names keep resolving as re-export shims until the family's satellites have moved. This cut publishes seven conformance names where the last one published six.
+
+**Fourteen fewer names.** The `in-*` framework bindings left this repo for `noy-db/in`; they are no longer on this version line. Nothing about `@noy-db/hub` changed for them.
+
+**Hot replica** (milestone: core#75, core#73, core#81, core#82, core#83) — a `sync-peer` target is now a full replica.
+- The roster travels: push mirrors `_keyring` to every target, pull brings it back before any record, higher `roster_epoch` wins in both directions. `openVault` on an EMPTY local consults the sync-peer before deciding new-vs-existing — a device that lost its store re-opens with the same target and secret, and a granted member opens on its own device with only its secret. `revoke()` propagates.
+- Reserved-record replication is a DECLARED set: `_meta/invite-audit-*` (magic-link onboarding works on a fresh sync-peer device once the issuer pushed), `_users`, `_delegations` travel; `_history`, `_ledger`, `_sync` and every other `_meta` id do not, by decision. `Vault.revokeDelegation()` rides the dirty log.
+- A pulled change to your own keyring file takes effect in the open session — a widened re-grant is readable after the next `pull()`, no reopen.
+- **`sync:progress`** during pull and push (`{ direction, phase, records, bytes, total? }`, throttled), and optional `inFlight` on `syncStatus()` / `syncTargetStatus()`. Types `SyncProgress` and `RealignResult` on the root barrel.
+- **`db.realign(vault)`** — a corrupted LOCAL envelope is replaced from the target's healthy copy; an ordinary pull could not repair it because it wins on `_v`.
+- **Member-scoped broker credentials** (`@noy-db/hub/broker`): every role can mint its own cloud-store credentials. `grant()` mints a per-grantee `_broker_member` DEK and the kernel enrols the member with the host (`{ userId, role, proofKey }`); members prove with canonical v2 (`userId` + `role` inside the MAC); re-grant re-enrols, `revoke()` de-registers, peer recovery re-enrols. The admin path is byte-identical. `BrokerStrategy` gains `enrolMember` / `revokeMember` (the floor stub implements both as no-ops); `@noy-db/hub/broker` exports `BrokerMemberIdentity`; `VerifyBrokerProofArgs.member` selects v2 on the host. Existing members need a re-grant (or magic-link recovery) to be enrolled.
+
+**`/capsule`** (core#42) — ⛔ two published changes a compiler cannot tell you about: **`EnclaveNotSupportedError.group` is widened to `CapsuleGroup`** (it named three of ten groups and could not name `classify`; an exhaustive `switch` on `err.group` has more cases now), and **`capabilities()` reports one more group** — `CapsuleGroup` gains `per-record-keys` (`wrapCek` / `unwrapCek`), which the reference capsule genuinely implements and was under-reporting. Expect ten members, not nine.
+
+**Seams widened, all additive, all already on the root barrel:** `@noy-db/hub/on` gains the echo ceremony's player half (`beginEchoUnlock`, `EchoCeremony`, `BeginEchoUnlockOptions`, `EchoCeremonyRequiredError`, `WrongPromptError`, `WrongEchoError` — core#41); `@noy-db/hub/to` gains `StoreAuth` + `StoreAuthKind`, `@noy-db/hub/by` gains `Unsubscribe` (core#54); `CoverageEvent` and its four companions on `@noy-db/hub/coverage` lose a false `@internal` tag — they were always shipped, and are now a published seam (core#38): additive fields only, `source` stays `string`.
+
+**Refusals that were silent are now thrown, deliberately:** `query().groupBy()` refuses a `queryable: 'none'` field the way `where()`/`orderBy()`/`distinct()` did (#29) — grouping on a virtual computed field used to fold every row into one bucket keyed on `undefined`; a `via()`-spelled virtual computed field is refused on a late-attach call in either spelling (#33).
+
+**Erasure and reclaim, made legible:** `erasureCompleteness(result)` at `@noy-db/hub/forget` (#34) — default-deny over every residue channel; `ForgetResult.blobResidueRecords` at `collection:id` grain, and `blobResidueETags` documented for what it means (legacy chunks were deleted but could not be crypto-shredded — do not intersect with `reclaimedETags`); `compact({ reclaimLegacyBlobs })` returns `unreferencedLegacyBlobs.reclaimedETags` (#28); `Collection.delete()` documents what a `null` blob read proves.
+
+**Classified:** `classified.checksummed({ validate })` (#26), a preset for a checksummed institutional identifier, with `luhnCheck` exported; such a field cannot be uniquely indexed, and the doc says why. `Envelope` documents the two kinds of body: `hasSealedBody` tests `_iv`, not `_data`.
+
+**Prose and surfaces:** three shipped examples that named a symbol they never imported are fixed, and the gate now treats an un-imported published name as a finding; every one of hub's 55 subpaths has a frozen value surface (11 did). Conformance-kit READMEs import the reader's implementation from `'./my-backend.js'`-style paths.
+
 ## 0.8.0
 
 **The capsule seam** (#4). Hub's crypto interior is now one contract behind one door, and an application can replace it at build time without forking hub.

package/README.md

@@ -26,17 +26,18 @@ Part of [**noy-db**](https://github.com/noy-db/core) — *"None Of Your Damn Bus
 
 ## Install
 
-Every noy-db app needs `@noy-db/hub` plus at least one storage backend (`to-*`). Everything else is optional.
+`@noy-db/hub` ships an in-memory store, so it runs on its own with nothing else installed. Add a
+storage backend (`to-*`) when the data has to survive a restart. Everything else is optional.
 
 ```bash
-pnpm add @noy-db/hub @noy-db/to-memory
+pnpm add @noy-db/hub
 ```
 
 ### Pick a storage backend — [`@noy-db/to-*`](https://www.npmjs.com/search?q=%40noy-db%2Fto-)
 
 | Package | Use for |
 |---------|---------|
-| [`to-memory`](https://www.npmjs.com/package/@noy-db/to-memory) | Tests, prototypes, ephemeral data |
+| [`to-memory`](https://www.npmjs.com/package/@noy-db/to-memory) | Tests, prototypes, ephemeral data — *only if you need a store separate from the built-in `memoryStore()`; ships from [noy-db-to](https://github.com/noy-db/to)* |
 | [`to-file`](https://www.npmjs.com/package/@noy-db/to-file) | Local disk, USB stick |
 | [`to-browser-idb`](https://www.npmjs.com/package/@noy-db/to-browser-idb) | Browser IndexedDB (atomic CAS) |
 | [`to-browser-local`](https://www.npmjs.com/package/@noy-db/to-browser-local) | Browser localStorage |
@@ -68,13 +69,12 @@ pnpm add @noy-db/hub @noy-db/to-memory
 ## Quick start
 
 ```ts
-import { createNoydb } from '@noy-db/hub'
-import { toMemory } from '@noy-db/to-memory'
+import { createNoydb, memoryStore } from '@noy-db/hub'
 
 type Invoice = { id: string; amount: number; customer: string }
 
 const db = await createNoydb({
-  store: toMemory(),
+  store: memoryStore(),
   user: 'alice',
   secret: 'correct horse battery staple',
 })
@@ -329,7 +329,7 @@ const cur = await vault.sequence('invoice-2026').peek()  // read current value w
 **Pre-release** (`0.1.0-pre.1`). API may change before `1.0`. Install from the `next` dist-tag:
 
 ```bash
-pnpm add @noy-db/hub@next @noy-db/to-memory@next
+pnpm add @noy-db/hub@next
 ```
 
 ## Documentation
@@ -340,4 +340,4 @@ pnpm add @noy-db/hub@next @noy-db/to-memory@next
 
 ## License
 
-[MIT](./LICENSE) © vLannaAi
+[Apache-2.0](./LICENSE) © vLannaAi

package/codemods/0.4.0-pre.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Machine-readable rename map for the noy-db 0.4.0-pre breaking set (noy-db#994). Companion to the prose note at https://noy-db.dev/migration/2026-07-30-0.4.0-pre-breaking-set — `section` points back at it. safeGlobalReplace:true means a whole-word match of `from` cannot plausibly hit anything else in a consumer codebase, so a blanket replace is safe; false means anchor on the import specifier or call site instead and read `note` first. Rows are verified against the live surface by packages/hub/__tests__/codemod-map.test.ts. Not covered here because they are structural, not renames: §4 (23 credential methods moved onto db.team), §6 (collection generics take a named shape) and the two silent behaviour changes.",
+  "$comment": "Machine-readable rename map for the noy-db 0.4.0-pre breaking set (vLannaAi/noy-db#994). Companion to the prose note at https://noy-db.dev/migration/2026-07-30-0.4.0-pre-breaking-set — `section` points back at it. safeGlobalReplace:true means a whole-word match of `from` cannot plausibly hit anything else in a consumer codebase, so a blanket replace is safe; false means anchor on the import specifier or call site instead and read `note` first. Rows are verified against the live surface by packages/hub/__tests__/codemod-map.test.ts. Not covered here because they are structural, not renames: §4 (23 credential methods moved onto db.team), §6 (collection generics take a named shape) and the two silent behaviour changes.",
   "version": "0.4.0-pre",
   "renames": [
     {

package/codemods/0.8.0-pre.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Machine-readable migration map for noy-db#1458 — the QUERY TIERS split. The query DSL was one class in one subpath; it is now four groups. `@noy-db/hub/query` keeps Find (where/or/and/filter/wherePredicate/orderBy/limit/offset/page/after/first/toArray/count/exists/ids/toPlan) and is unchanged for consumers who only find records. Live, Reduce and Relate moved to `@noy-db/hub/query/{live,reduce,relate}`, which are SIDE-EFFECT imports: one line at the app's entry patches the methods onto Query.prototype and merges their types, so no call site changes. ⭐ WHO IS AFFECTED, precisely: only consumers who import from `@noy-db/hub/query` directly. A consumer on the root barrel `@noy-db/hub` needs NO row here — the root barrel imports all three groups, so every method and every re-export is exactly where it was. That is why the rows below are `import-move` rather than `subpath`: the SUBPATH `@noy-db/hub/query` still resolves and still exports Find; what moved is a set of symbols within it. ⚠️ THE COVERAGE CHECKER CANNOT SEE THIS BREAK. `scripts/check-codemod-coverage.mjs` measures the package's whole reachable surface as a union across subpaths, and every symbol below is still reachable — from a different subpath. It reports zero losses for this change, correctly by its own definition and uselessly for this one. These rows are hand-written for that reason; do not read the green checker as evidence the map is unnecessary.",
+  "$comment": "Machine-readable migration map for vLannaAi/noy-db#1458 — the QUERY TIERS split. The query DSL was one class in one subpath; it is now four groups. `@noy-db/hub/query` keeps Find (where/or/and/filter/wherePredicate/orderBy/limit/offset/page/after/first/toArray/count/exists/ids/toPlan) and is unchanged for consumers who only find records. Live, Reduce and Relate moved to `@noy-db/hub/query/{live,reduce,relate}`, which are SIDE-EFFECT imports: one line at the app's entry patches the methods onto Query.prototype and merges their types, so no call site changes. ⭐ WHO IS AFFECTED, precisely: only consumers who import from `@noy-db/hub/query` directly. A consumer on the root barrel `@noy-db/hub` needs NO row here — the root barrel imports all three groups, so every method and every re-export is exactly where it was. That is why the rows below are `import-move` rather than `subpath`: the SUBPATH `@noy-db/hub/query` still resolves and still exports Find; what moved is a set of symbols within it. ⚠️ THE COVERAGE CHECKER CANNOT SEE THIS BREAK. `scripts/check-codemod-coverage.mjs` measures the package's whole reachable surface as a union across subpaths, and every symbol below is still reachable — from a different subpath. It reports zero losses for this change, correctly by its own definition and uselessly for this one. These rows are hand-written for that reason; do not read the green checker as evidence the map is unnecessary.",
   "version": "0.8.0-pre",
   "renames": [
     {

package/dist/api-MSJXVYQG.js

@@ -0,0 +1,18 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-GCUMOKTN.js";
+import "./chunk-FZXRLNJO.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-MSJXVYQG.js.map

package/dist/as/index.js

@@ -1,23 +1,27 @@
-import "../chunk-UBSFPGVJ.js";
-import "../chunk-PP3K67AJ.js";
+import "../chunk-2DX4JCRI.js";
+import "../chunk-EMAWOGVH.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
+import {
+  FormatsNotEnabledError
+} from "../chunk-RWFQVNXR.js";
 import "../chunk-RXLYKVTF.js";
+import "../chunk-QJNAHPVT.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-747G6CT3.js";
+import "../chunk-J4KAPKBJ.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-H3YM66EI.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   ValidationError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-VSUQI5Q6.js";
 
 // src/port/as/active.ts
 function redactChunk(chunk, ctx, redact) {
@@ -52,20 +56,25 @@ function contextFor(vault) {
       if (!format) throw new TypeError("assertCanImport('plaintext') requires a non-empty format id");
       vault.assertCanImport("plaintext", format);
     },
-    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`
-    // has no `collections` field, so the option I first passed was silently
-    // dropped and hub read every collection. Caught by an as-json test
-    // expecting ['invoices'] and getting ['invoices','payments'].
+    // ⭐ PASSED DOWN, not filtered here (core#45b). `ExportStreamOptions` now
+    // carries `collections` and narrows the read, so an excluded collection is
+    // neither fetched nor decrypted.
     //
-    // Post-read filtering is correct but not free: hub still DECRYPTS the
-    // collections the caller excluded. Pushing the filter down into
-    // exportStream is the real fix and is a hub change beyond this port.
+    // ⚠️ The history is worth keeping, because the obvious edit here is the
+    // wrong one twice over. The option was first passed to `exportStream`
+    // when that interface had no field for it — silently dropped, every
+    // collection read, caught only by an as-json test expecting ['invoices']
+    // and getting ['invoices','payments']. The fix then was to filter after
+    // the read, which was correct output and a full decrypt: for a
+    // zero-knowledge store, a caller scoping an export to limit exposure got
+    // no limit at all. Neither the compiler nor any chunk-level assertion can
+    // tell these three implementations apart — only a store observation can
+    // (`__tests__/45-export-scope-narrows-read.test.ts`).
     chunks: async function* (collections) {
-      const wanted = collections ? new Set(collections) : null;
-      for await (const chunk of vault.exportStream({ granularity: "collection" })) {
-        if (wanted && !wanted.has(chunk.collection)) continue;
-        yield chunk;
-      }
+      yield* vault.exportStream({
+        granularity: "collection",
+        ...collections ? { collections } : {}
+      });
     },
     // NOT swallowed. A caller who asked for redaction and silently got
     // unredacted output is the exact failure this port exists to remove — a
@@ -140,6 +149,7 @@ function withFormats() {
   };
 }
 export {
+  FormatsNotEnabledError,
   withFormats
 };
 //# sourceMappingURL=index.js.map

package/dist/as/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⭐ PASSED DOWN, not filtered here (core#45b). `ExportStreamOptions` now\n    // carries `collections` and narrows the read, so an excluded collection is\n    // neither fetched nor decrypted.\n    //\n    // ⚠️ The history is worth keeping, because the obvious edit here is the\n    // wrong one twice over. The option was first passed to `exportStream`\n    // when that interface had no field for it — silently dropped, every\n    // collection read, caught only by an as-json test expecting ['invoices']\n    // and getting ['invoices','payments']. The fix then was to filter after\n    // the read, which was correct output and a full decrypt: for a\n    // zero-knowledge store, a caller scoping an export to limit exposure got\n    // no limit at all. Neither the compiler nor any chunk-level assertion can\n    // tell these three implementations apart — only a store observation can\n    // (`__tests__/45-export-scope-narrows-read.test.ts`).\n    chunks: async function* (collections) {\n      yield* vault.exportStream({\n        granularity: 'collection',\n        ...(collections ? { collections } : {}),\n      })\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n *\n * ⭐ `collections` scopes the READ: an excluded collection is neither fetched\n * nor decrypted (core#45b, since 0.8 — through 0.7 it filtered output after a\n * full decrypt).\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeA,QAAQ,iBAAiB,aAAa;AACpC,aAAO,MAAM,aAAa;AAAA,QACxB,aAAa;AAAA,QACb,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACvC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAcO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/at/index.js

@@ -3,15 +3,15 @@ import {
   MemorySealer,
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
-} from "../chunk-3XJQBBZD.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-XKBTJGFP.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
-import "../chunk-37EPTBBR.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
+import "../chunk-VSUQI5Q6.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,

package/dist/attestation/index.js

@@ -1,19 +1,19 @@
 import {
   issueAttestationCore
-} from "../chunk-VMV5SBE4.js";
+} from "../chunk-QDHHHI5Q.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-5UMK7GRI.js";
-import "../chunk-JWWYRR4Q.js";
+} from "../chunk-K7RW7FI4.js";
+import "../chunk-5XONHAFD.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-DLD5LGDS.js";
+} from "../chunk-D5A3GCZ4.js";
 import {
   NO_ATTESTATION
-} from "../chunk-PD64727P.js";
+} from "../chunk-6QLCS7ET.js";
 import {
   decodeQr,
   isRevoked,
@@ -22,27 +22,27 @@ import {
   verifyRevocationList
 } from "../chunk-GMKGGY7V.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-VSUQI5Q6.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-YIVBZUTH.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-LPEEEMPP.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-MHGW3OIL.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-IUIYR3CX.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -52,19 +52,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-G2KXJQA5.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-G2KXJQA5.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-G2KXJQA5.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-G2KXJQA5.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-YE2VQ26S.js → backup-7RKNZMQO.js}

@@ -3,36 +3,36 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-3L2NBKDR.js";
+} from "./chunk-H3YM66EI.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-QBLT6POL.js";
+} from "./chunk-6WS35E6X.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-VFHCKG5M.js";
+} from "./chunk-BYHCKX73.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   buildRecordEnvelope
-} from "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-SV2PM2OY.js";
+} from "./chunk-2ELOCEXE.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-pod/backup.ts
 async function dumpVault(ctx) {
@@ -266,4 +266,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-YE2VQ26S.js.map
+//# sourceMappingURL=backup-7RKNZMQO.js.map

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-JSMTXZR3.js";
+} from "../chunk-G5EDYVSE.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,20 +25,20 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-G2MVBDFP.js";
-import "../chunk-SYNY3VB5.js";
-import "../chunk-7XMHMVTS.js";
-import "../chunk-FLPCETP6.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-QXJXG7DN.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-UHFGK6YA.js";
+import "../chunk-RIZTZJX6.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   BlobOfflineError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-VSUQI5Q6.js";
 
 // src/via/blob/active.ts
 function withBlobs(options = {}) {

package/dist/broker/index.js

@@ -1,21 +1,21 @@
 import {
   NO_BROKER
-} from "../chunk-GZT3NQRA.js";
+} from "../chunk-72XBVN4J.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-VSUQI5Q6.js";
 
 // src/with-party/broker/active.ts
 var DEFAULT_SKEW_MS = 6e4;
@@ -28,7 +28,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-XNSE4U3S.js");
+      const { enrollSeed } = await import("../seed-JMQTRKRE.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -37,9 +37,17 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-XNSE4U3S.js");
+      const { rotateSeed } = await import("../seed-JMQTRKRE.js");
       return rotateSeed({ ...ctx, config });
     },
+    async enrolMember(ctx, member) {
+      const { enrolMemberSeed } = await import("../seed-JMQTRKRE.js");
+      return enrolMemberSeed({ ...ctx, config }, member);
+    },
+    async revokeMember(ctx, userId) {
+      const { revokeMemberSeed } = await import("../seed-JMQTRKRE.js");
+      return revokeMemberSeed({ ...ctx, config }, userId);
+    },
     credentialSource(ctx, profile) {
       const key = `${ctx.vault}\0${profile ?? ""}`;
       return async () => {
@@ -54,7 +62,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-XNSE4U3S.js");
+          const { mintStoreCredentials } = await import("../seed-JMQTRKRE.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/broker/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../capsule/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../capsule/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `capsule/enclave-aes/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../capsule/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}
+{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    async enrolMember(ctx, member) {\n      const { enrolMemberSeed } = await import('./seed.js')\n      return enrolMemberSeed({ ...ctx, config }, member)\n    },\n    async revokeMember(ctx, userId) {\n      const { revokeMemberSeed } = await import('./seed.js')\n      return revokeMemberSeed({ ...ctx, config }, userId)\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../capsule/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `capsule/enclave-aes/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs, BrokerMemberIdentity }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../capsule/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,YAAY,KAAK,QAAQ;AAC7B,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,qBAAW;AACpD,aAAO,gBAAgB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACnD;AAAA,IACA,MAAM,aAAa,KAAK,QAAQ;AAC9B,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,qBAAW;AACrD,aAAO,iBAAiB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACpD;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACjEA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-DIZLQVAA.js";
-import "../chunk-37EPTBBR.js";
+} from "../chunk-UNSQZSZP.js";
+import "../chunk-VSUQI5Q6.js";
 export {
   isQuorum,
   runDrainBarrier

package/dist/capsule/contract.d.ts

@@ -29,7 +29,7 @@ export type CapsuleKeyPair = CryptoKeyPair;
  * suite from the package name, which is what makes the prefix a trust posture
  * rather than a naming convention.
  */
-export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign' | 'codec' | 'sealing' | 'deterministic' | 'classify';
+export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign' | 'codec' | 'sealing' | 'deterministic' | 'classify' | 'per-record-keys';
 /**
  * Thrown at `createNoydb()` when a service needs a group the bound capsule
  * does not support.