@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog — hub
 
+## 0.9.0-pre.1
+
+**A correctness release on the 0.9 line. The headline is a keyring race that surfaced as a tamper alarm on the user's own data** (core#132) — everything else is additive.
+
+⛔ **`_keyring` writes are now compare-and-swap.** Two sessions putting to a new collection each minted a DEK, one write silently lost, and a cold session then failed to authenticate **both** rows — reported as tampering, on data the user had just written themselves. A keyring write is now CAS'd against the version it was computed from, and a session that loses a mint **adopts the winner's DEK** instead of keeping its own. If you held data written by two concurrent first-writers on `0.9.0-pre.0`, this is the release that stops it recurring; it does not retroactively repair a pair of rows already minted under different DEKs.
+
+**Sync — three fixes pilot-1 witnessed against real DynamoDB** (core#107, core#108).
+- An arbiter now **replicates its admission refusals**, so the writer finds out at all. A refusal made on another device arrives as `origin: 'arbiter'` and is **report-only** — the local record is untouched, and `readmit()` is meaningless for it.
+- A dirty record **re-runs this device's own gates before pushing**, so a record refused on the way out (`origin: 'push-recheck'`) stays local and dirty and pushes itself once it passes again.
+- `RecordRejection` carries `recordAt` alongside `at`: an arbiter judges at **pull** time, so a record legitimately written while a period was open can be refused later. With both timestamps a UI can say *written then, refused now* rather than *your push was wrong*.
+
+**Backup and restore** (core#76, core#77, core#101, core#103, core#111, core#122). Reads can carry ids, the restore path is exported rather than inferred, and ⭐ **a restore now rewinds the ledger too** — previously the pod came back but the ledger did not, so the next pull reverted it. ⚠️ Delete markers persist across a restore; `vault.compact()` will not remove them, being blob compaction and cache-budget eviction that happens to share the word.
+
+**Presence binds the primary sync target, not `targets[0]`** (core#139). With `sync: [{cloud, role:'backup'}, {daemon, role:'sync-peer'}]` records synced with the daemon while presence published to a **push-only archive** target. The two selectors now agree.
+
+**`expectedVersion: 0` means "must not exist", and `@noy-db/ports/to` now asserts it** (core#134). The conformance kit holds the agreement instead of relying on it, and the adapter census found the divergence core#136 warned about is not present in this family.
+
+**Surface and docs.** The restore/pod types are exported with an invariant so it is the last time (core#101, core#54). `@internal` is not the surface — the golden is (core#128). The KEK gate that keeps the keyring inbox drain unreachable is pinned in a test (core#130), recorded as an accepted risk rather than a fix. `enrollWebAuthn`'s documented slot `meta` now records `rpId`, which the rotation ceremony falls back to (core#140).
+
+⚠️ **`@noy-db/ports` still carries `latest` on a prerelease**, because npm sets `latest` on a package's first publish regardless of `--tag`. Corrected at the `0.9.0` stable cut; there is no stable version to point it at yet.
+
+## 0.9.0-pre.0
+
+**The line moves to 0.9.0 on this pre-release: a new package, a milestone, three seam widenings, and fourteen fewer names.** Everything below is additive unless marked ⛔.
+
+**`@noy-db/ports`** — the six conformance kits are one package with one subpath per hub port: `@noy-db/ports/to`, `/as`, `/at`, `/on`, `/by`, `/capsule`. Bind `@noy-db/hub/<port>`, prove it with `@noy-db/ports/<port>`. **Not a break:** function names unchanged, peers unchanged, and the six `@noy-db/test-*-conformance` names keep resolving as re-export shims until the family's satellites have moved. This cut publishes seven conformance names where the last one published six.
+
+**Fourteen fewer names.** The `in-*` framework bindings left this repo for `noy-db/in`; they are no longer on this version line. Nothing about `@noy-db/hub` changed for them.
+
+**Hot replica** (milestone: core#75, core#73, core#81, core#82, core#83) — a `sync-peer` target is now a full replica.
+- The roster travels: push mirrors `_keyring` to every target, pull brings it back before any record, higher `roster_epoch` wins in both directions. `openVault` on an EMPTY local consults the sync-peer before deciding new-vs-existing — a device that lost its store re-opens with the same target and secret, and a granted member opens on its own device with only its secret. `revoke()` propagates.
+- Reserved-record replication is a DECLARED set: `_meta/invite-audit-*` (magic-link onboarding works on a fresh sync-peer device once the issuer pushed), `_users`, `_delegations` travel; `_history`, `_ledger`, `_sync` and every other `_meta` id do not, by decision. `Vault.revokeDelegation()` rides the dirty log.
+- A pulled change to your own keyring file takes effect in the open session — a widened re-grant is readable after the next `pull()`, no reopen.
+- **`sync:progress`** during pull and push (`{ direction, phase, records, bytes, total? }`, throttled), and optional `inFlight` on `syncStatus()` / `syncTargetStatus()`. Types `SyncProgress` and `RealignResult` on the root barrel.
+- **`db.realign(vault)`** — a corrupted LOCAL envelope is replaced from the target's healthy copy; an ordinary pull could not repair it because it wins on `_v`.
+- **Member-scoped broker credentials** (`@noy-db/hub/broker`): every role can mint its own cloud-store credentials. `grant()` mints a per-grantee `_broker_member` DEK and the kernel enrols the member with the host (`{ userId, role, proofKey }`); members prove with canonical v2 (`userId` + `role` inside the MAC); re-grant re-enrols, `revoke()` de-registers, peer recovery re-enrols. The admin path is byte-identical. `BrokerStrategy` gains `enrolMember` / `revokeMember` (the floor stub implements both as no-ops); `@noy-db/hub/broker` exports `BrokerMemberIdentity`; `VerifyBrokerProofArgs.member` selects v2 on the host. Existing members need a re-grant (or magic-link recovery) to be enrolled.
+
+**`/capsule`** (core#42) — ⛔ two published changes a compiler cannot tell you about: **`EnclaveNotSupportedError.group` is widened to `CapsuleGroup`** (it named three of ten groups and could not name `classify`; an exhaustive `switch` on `err.group` has more cases now), and **`capabilities()` reports one more group** — `CapsuleGroup` gains `per-record-keys` (`wrapCek` / `unwrapCek`), which the reference capsule genuinely implements and was under-reporting. Expect ten members, not nine.
+
+**Seams widened, all additive, all already on the root barrel:** `@noy-db/hub/on` gains the echo ceremony's player half (`beginEchoUnlock`, `EchoCeremony`, `BeginEchoUnlockOptions`, `EchoCeremonyRequiredError`, `WrongPromptError`, `WrongEchoError` — core#41); `@noy-db/hub/to` gains `StoreAuth` + `StoreAuthKind`, `@noy-db/hub/by` gains `Unsubscribe` (core#54); `CoverageEvent` and its four companions on `@noy-db/hub/coverage` lose a false `@internal` tag — they were always shipped, and are now a published seam (core#38): additive fields only, `source` stays `string`.
+
+**Refusals that were silent are now thrown, deliberately:** `query().groupBy()` refuses a `queryable: 'none'` field the way `where()`/`orderBy()`/`distinct()` did (#29) — grouping on a virtual computed field used to fold every row into one bucket keyed on `undefined`; a `via()`-spelled virtual computed field is refused on a late-attach call in either spelling (#33).
+
+**Erasure and reclaim, made legible:** `erasureCompleteness(result)` at `@noy-db/hub/forget` (#34) — default-deny over every residue channel; `ForgetResult.blobResidueRecords` at `collection:id` grain, and `blobResidueETags` documented for what it means (legacy chunks were deleted but could not be crypto-shredded — do not intersect with `reclaimedETags`); `compact({ reclaimLegacyBlobs })` returns `unreferencedLegacyBlobs.reclaimedETags` (#28); `Collection.delete()` documents what a `null` blob read proves.
+
+**Classified:** `classified.checksummed({ validate })` (#26), a preset for a checksummed institutional identifier, with `luhnCheck` exported; such a field cannot be uniquely indexed, and the doc says why. `Envelope` documents the two kinds of body: `hasSealedBody` tests `_iv`, not `_data`.
+
+**Prose and surfaces:** three shipped examples that named a symbol they never imported are fixed, and the gate now treats an un-imported published name as a finding; every one of hub's 55 subpaths has a frozen value surface (11 did). Conformance-kit READMEs import the reader's implementation from `'./my-backend.js'`-style paths.
+
 ## 0.8.0
 
 **The capsule seam** (#4). Hub's crypto interior is now one contract behind one door, and an application can replace it at build time without forking hub.

package/README.md

@@ -26,17 +26,18 @@ Part of [**noy-db**](https://github.com/noy-db/core) — *"None Of Your Damn Bus
 
 ## Install
 
-Every noy-db app needs `@noy-db/hub` plus at least one storage backend (`to-*`). Everything else is optional.
+`@noy-db/hub` ships an in-memory store, so it runs on its own with nothing else installed. Add a
+storage backend (`to-*`) when the data has to survive a restart. Everything else is optional.
 
 ```bash
-pnpm add @noy-db/hub @noy-db/to-memory
+pnpm add @noy-db/hub
 ```
 
 ### Pick a storage backend — [`@noy-db/to-*`](https://www.npmjs.com/search?q=%40noy-db%2Fto-)
 
 | Package | Use for |
 |---------|---------|
-| [`to-memory`](https://www.npmjs.com/package/@noy-db/to-memory) | Tests, prototypes, ephemeral data |
+| [`to-memory`](https://www.npmjs.com/package/@noy-db/to-memory) | Tests, prototypes, ephemeral data — *only if you need a store separate from the built-in `memoryStore()`; ships from [noy-db-to](https://github.com/noy-db/to)* |
 | [`to-file`](https://www.npmjs.com/package/@noy-db/to-file) | Local disk, USB stick |
 | [`to-browser-idb`](https://www.npmjs.com/package/@noy-db/to-browser-idb) | Browser IndexedDB (atomic CAS) |
 | [`to-browser-local`](https://www.npmjs.com/package/@noy-db/to-browser-local) | Browser localStorage |
@@ -68,13 +69,12 @@ pnpm add @noy-db/hub @noy-db/to-memory
 ## Quick start
 
 ```ts
-import { createNoydb } from '@noy-db/hub'
-import { toMemory } from '@noy-db/to-memory'
+import { createNoydb, memoryStore } from '@noy-db/hub'
 
 type Invoice = { id: string; amount: number; customer: string }
 
 const db = await createNoydb({
-  store: toMemory(),
+  store: memoryStore(),
   user: 'alice',
   secret: 'correct horse battery staple',
 })
@@ -329,7 +329,7 @@ const cur = await vault.sequence('invoice-2026').peek()  // read current value w
 **Pre-release** (`0.1.0-pre.1`). API may change before `1.0`. Install from the `next` dist-tag:
 
 ```bash
-pnpm add @noy-db/hub@next @noy-db/to-memory@next
+pnpm add @noy-db/hub@next
 ```
 
 ## Documentation
@@ -340,4 +340,4 @@ pnpm add @noy-db/hub@next @noy-db/to-memory@next
 
 ## License
 
-[MIT](./LICENSE) © vLannaAi
+[Apache-2.0](./LICENSE) © vLannaAi

package/codemods/0.4.0-pre.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Machine-readable rename map for the noy-db 0.4.0-pre breaking set (noy-db#994). Companion to the prose note at https://noy-db.dev/migration/2026-07-30-0.4.0-pre-breaking-set — `section` points back at it. safeGlobalReplace:true means a whole-word match of `from` cannot plausibly hit anything else in a consumer codebase, so a blanket replace is safe; false means anchor on the import specifier or call site instead and read `note` first. Rows are verified against the live surface by packages/hub/__tests__/codemod-map.test.ts. Not covered here because they are structural, not renames: §4 (23 credential methods moved onto db.team), §6 (collection generics take a named shape) and the two silent behaviour changes.",
+  "$comment": "Machine-readable rename map for the noy-db 0.4.0-pre breaking set (vLannaAi/noy-db#994). Companion to the prose note at https://noy-db.dev/migration/2026-07-30-0.4.0-pre-breaking-set — `section` points back at it. safeGlobalReplace:true means a whole-word match of `from` cannot plausibly hit anything else in a consumer codebase, so a blanket replace is safe; false means anchor on the import specifier or call site instead and read `note` first. Rows are verified against the live surface by packages/hub/__tests__/codemod-map.test.ts. Not covered here because they are structural, not renames: §4 (23 credential methods moved onto db.team), §6 (collection generics take a named shape) and the two silent behaviour changes.",
   "version": "0.4.0-pre",
   "renames": [
     {

package/codemods/0.8.0-pre.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Machine-readable migration map for noy-db#1458 — the QUERY TIERS split. The query DSL was one class in one subpath; it is now four groups. `@noy-db/hub/query` keeps Find (where/or/and/filter/wherePredicate/orderBy/limit/offset/page/after/first/toArray/count/exists/ids/toPlan) and is unchanged for consumers who only find records. Live, Reduce and Relate moved to `@noy-db/hub/query/{live,reduce,relate}`, which are SIDE-EFFECT imports: one line at the app's entry patches the methods onto Query.prototype and merges their types, so no call site changes. ⭐ WHO IS AFFECTED, precisely: only consumers who import from `@noy-db/hub/query` directly. A consumer on the root barrel `@noy-db/hub` needs NO row here — the root barrel imports all three groups, so every method and every re-export is exactly where it was. That is why the rows below are `import-move` rather than `subpath`: the SUBPATH `@noy-db/hub/query` still resolves and still exports Find; what moved is a set of symbols within it. ⚠️ THE COVERAGE CHECKER CANNOT SEE THIS BREAK. `scripts/check-codemod-coverage.mjs` measures the package's whole reachable surface as a union across subpaths, and every symbol below is still reachable — from a different subpath. It reports zero losses for this change, correctly by its own definition and uselessly for this one. These rows are hand-written for that reason; do not read the green checker as evidence the map is unnecessary.",
+  "$comment": "Machine-readable migration map for vLannaAi/noy-db#1458 — the QUERY TIERS split. The query DSL was one class in one subpath; it is now four groups. `@noy-db/hub/query` keeps Find (where/or/and/filter/wherePredicate/orderBy/limit/offset/page/after/first/toArray/count/exists/ids/toPlan) and is unchanged for consumers who only find records. Live, Reduce and Relate moved to `@noy-db/hub/query/{live,reduce,relate}`, which are SIDE-EFFECT imports: one line at the app's entry patches the methods onto Query.prototype and merges their types, so no call site changes. ⭐ WHO IS AFFECTED, precisely: only consumers who import from `@noy-db/hub/query` directly. A consumer on the root barrel `@noy-db/hub` needs NO row here — the root barrel imports all three groups, so every method and every re-export is exactly where it was. That is why the rows below are `import-move` rather than `subpath`: the SUBPATH `@noy-db/hub/query` still resolves and still exports Find; what moved is a set of symbols within it. ⚠️ THE COVERAGE CHECKER CANNOT SEE THIS BREAK. `scripts/check-codemod-coverage.mjs` measures the package's whole reachable surface as a union across subpaths, and every symbol below is still reachable — from a different subpath. It reports zero losses for this change, correctly by its own definition and uselessly for this one. These rows are hand-written for that reason; do not read the green checker as evidence the map is unnecessary.",
   "version": "0.8.0-pre",
   "renames": [
     {

package/dist/api-6EFD43KN.js

@@ -0,0 +1,18 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-HE7EAHGS.js";
+import "./chunk-QT5ITL25.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-ZD7WFMV2.js";
+import "./chunk-RRTQAQ3N.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-ZF6JECDT.js";
+import "./chunk-THQ3BHLM.js";
+import "./chunk-XX4R7TUB.js";
+import "./chunk-IKPQ2GGB.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-6EFD43KN.js.map

package/dist/as/index.js

@@ -1,23 +1,27 @@
-import "../chunk-UBSFPGVJ.js";
-import "../chunk-PP3K67AJ.js";
+import "../chunk-2DX4JCRI.js";
+import "../chunk-654RE5YC.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
+import {
+  FormatsNotEnabledError
+} from "../chunk-RWFQVNXR.js";
 import "../chunk-RXLYKVTF.js";
+import "../chunk-QJNAHPVT.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-747G6CT3.js";
+import "../chunk-UORWAG7K.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-IF2M43G4.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
+import "../chunk-XX4R7TUB.js";
 import {
   ValidationError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-IKPQ2GGB.js";
 
 // src/port/as/active.ts
 function redactChunk(chunk, ctx, redact) {
@@ -52,20 +56,25 @@ function contextFor(vault) {
       if (!format) throw new TypeError("assertCanImport('plaintext') requires a non-empty format id");
       vault.assertCanImport("plaintext", format);
     },
-    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`
-    // has no `collections` field, so the option I first passed was silently
-    // dropped and hub read every collection. Caught by an as-json test
-    // expecting ['invoices'] and getting ['invoices','payments'].
+    // ⭐ PASSED DOWN, not filtered here (core#45b). `ExportStreamOptions` now
+    // carries `collections` and narrows the read, so an excluded collection is
+    // neither fetched nor decrypted.
     //
-    // Post-read filtering is correct but not free: hub still DECRYPTS the
-    // collections the caller excluded. Pushing the filter down into
-    // exportStream is the real fix and is a hub change beyond this port.
+    // ⚠️ The history is worth keeping, because the obvious edit here is the
+    // wrong one twice over. The option was first passed to `exportStream`
+    // when that interface had no field for it — silently dropped, every
+    // collection read, caught only by an as-json test expecting ['invoices']
+    // and getting ['invoices','payments']. The fix then was to filter after
+    // the read, which was correct output and a full decrypt: for a
+    // zero-knowledge store, a caller scoping an export to limit exposure got
+    // no limit at all. Neither the compiler nor any chunk-level assertion can
+    // tell these three implementations apart — only a store observation can
+    // (`__tests__/45-export-scope-narrows-read.test.ts`).
     chunks: async function* (collections) {
-      const wanted = collections ? new Set(collections) : null;
-      for await (const chunk of vault.exportStream({ granularity: "collection" })) {
-        if (wanted && !wanted.has(chunk.collection)) continue;
-        yield chunk;
-      }
+      yield* vault.exportStream({
+        granularity: "collection",
+        ...collections ? { collections } : {}
+      });
     },
     // NOT swallowed. A caller who asked for redaction and silently got
     // unredacted output is the exact failure this port exists to remove — a
@@ -140,6 +149,7 @@ function withFormats() {
   };
 }
 export {
+  FormatsNotEnabledError,
   withFormats
 };
 //# sourceMappingURL=index.js.map

package/dist/as/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⚠️ Filtered HERE, not passed to exportStream — `ExportStreamOptions`\n    // has no `collections` field, so the option I first passed was silently\n    // dropped and hub read every collection. Caught by an as-json test\n    // expecting ['invoices'] and getting ['invoices','payments'].\n    //\n    // Post-read filtering is correct but not free: hub still DECRYPTS the\n    // collections the caller excluded. Pushing the filter down into\n    // exportStream is the real fix and is a hub change beyond this port.\n    chunks: async function* (collections) {\n      const wanted = collections ? new Set(collections) : null\n      for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n        if (wanted && !wanted.has(chunk.collection)) continue\n        yield chunk\n      }\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,QAAQ,iBAAiB,aAAa;AACpC,YAAM,SAAS,cAAc,IAAI,IAAI,WAAW,IAAI;AACpD,uBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,YAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/as/active.ts"],"sourcesContent":["/**\n * `withFormats()` — the service that consumes the `as-*` port.\n *\n * Everything with a correctness or security consequence lives here rather\n * than in each format: the capability gate, the vault read, and redaction.\n * A {@link NoydbFormat} receives records and returns bytes.\n *\n * That is the whole point of the inversion (ADR 0004). The conformance kit it\n * replaces could only check implementors who ran it; a format that cannot\n * reach a vault is gated whether its author cooperated or not.\n *\n * @module\n */\nimport type { NoydbFormat, ImportPlan } from './types.js'\nimport type {\n  FormatsStrategy,\n  FormatsContext,\n  FormatExportOptions,\n  FormatImportOptions,\n} from '../with/formats-strategy.js'\nimport type { ExportChunk } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { ImportPolicy } from './types.js'\nimport { applyListProjection } from '../../with-shape/introspection/index.js'\nimport type { CollectionDescription, ListProjectionOptions } from '../../with-shape/introspection/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** Apply the redaction projection hub owns, so a format never asks for it. */\nfunction redactChunk(\n  chunk: ExportChunk,\n  ctx: FormatsContext,\n  redact: FormatExportOptions['redact'],\n): ExportChunk {\n  if (redact === undefined) return chunk\n  const described = ctx.describe(chunk.collection) as CollectionDescription | undefined\n  if (!described) {\n    throw new Error(\n      `vault.export: redaction was requested but '${chunk.collection}' has no description to redact against. ` +\n        'Open the collection with its classifiedFields / fieldMeta options first.',\n    )\n  }\n  const opts: ListProjectionOptions | undefined =\n    redact === true ? undefined : { sensitivity: redact.sensitivity as never }\n  const records = chunk.records.map((r) =>\n    applyListProjection(described, r as Record<string, unknown>, opts),\n  )\n  return { ...chunk, records: records as typeof chunk.records }\n}\n\n/**\n * Derive the narrow, format-facing capability from the vault.\n *\n * Lives here rather than on `Vault` because `kernel-surface` said so, and it\n * was right: this is service capability, not spine. The spine keeps two\n * delegating methods and nothing else.\n */\nfunction contextFor(vault: Vault): FormatsContext {\n  return {\n    // The empty-id guards are NOT defensive padding. The\n    // plaintext tier is gated per-format, so a missing id means the calling\n    // binding is broken — and without this it would reach the gate, miss the\n    // allowlist, and surface as `ExportCapabilityError`: \"the owner did not\n    // grant this\", which sends the reader to the keyring instead of to the\n    // format. A loud TypeError names the real fault.\n    assertCanExport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanExport('bundle')\n      if (!format) throw new TypeError(\"assertCanExport('plaintext') requires a non-empty format id\")\n      vault.assertCanExport('plaintext', format)\n    },\n    assertCanImport: (tier, format) => {\n      if (tier === 'bundle') return vault.assertCanImport('bundle')\n      if (!format) throw new TypeError(\"assertCanImport('plaintext') requires a non-empty format id\")\n      vault.assertCanImport('plaintext', format)\n    },\n    // ⭐ PASSED DOWN, not filtered here (core#45b). `ExportStreamOptions` now\n    // carries `collections` and narrows the read, so an excluded collection is\n    // neither fetched nor decrypted.\n    //\n    // ⚠️ The history is worth keeping, because the obvious edit here is the\n    // wrong one twice over. The option was first passed to `exportStream`\n    // when that interface had no field for it — silently dropped, every\n    // collection read, caught only by an as-json test expecting ['invoices']\n    // and getting ['invoices','payments']. The fix then was to filter after\n    // the read, which was correct output and a full decrypt: for a\n    // zero-knowledge store, a caller scoping an export to limit exposure got\n    // no limit at all. Neither the compiler nor any chunk-level assertion can\n    // tell these three implementations apart — only a store observation can\n    // (`__tests__/45-export-scope-narrows-read.test.ts`).\n    chunks: async function* (collections) {\n      yield* vault.exportStream({\n        granularity: 'collection',\n        ...(collections ? { collections } : {}),\n      })\n    },\n    // NOT swallowed. A caller who asked for redaction and silently got\n    // unredacted output is the exact failure this port exists to remove — a\n    // security duty that fails quiet. If the description cannot be read, the\n    // export fails instead.\n    describe: (collection) => vault.collection(collection).describe() as never,\n    plan: async (records, policy: ImportPolicy, formatId: string, idKey?: string) => {\n      const { diffVault } = await import('../../with-cargo/vault-diff.js')\n      const plan = await diffVault(vault, records as never, idKey ? { idKey } : {})\n      return {\n        plan,\n        policy,\n        // The apply walk every as-* package had independently: added always,\n        // modified unless insert-only, deleted only on replace — in one\n        // transaction so a partial failure rolls back. Owned once, here.\n        apply: async () => {\n          await vault.noydb.transaction((tx) => {\n            const txVault = tx.vault(vault.name)\n            const reason = `import:${formatId}`\n            for (const e of plan.added) {\n              txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n            }\n            if (policy !== 'insert-only') {\n              for (const e of plan.modified) {\n                txVault.collection(e.collection).put(e.id, e.record as never, { reason })\n              }\n            }\n            if (policy === 'replace') {\n              for (const e of plan.deleted) txVault.collection(e.collection).delete(e.id)\n            }\n          })\n        },\n      }\n    },\n  }\n}\n\n/**\n * Enable `vault.export()` / `vault.import()`.\n *\n * ```ts\n * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })\n * const csv = await vault.export(asCsv(), { collections: ['invoices'] })\n * ```\n *\n * ⭐ `collections` scopes the READ: an excluded collection is neither fetched\n * nor decrypted (core#45b, since 0.8 — through 0.7 it filtered output after a\n * full decrypt).\n */\nexport function withFormats(): FormatsStrategy {\n  return {\n    enabled: true,\n\n    async exportWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      options: FormatExportOptions = {},\n    ): Promise<Out> {\n      const ctx = contextFor(vault)\n      // FIRST, and before a single record is read. The format is not in scope\n      // yet and could not reach the vault if it were.\n      if (format.tier === 'bundle') ctx.assertCanExport('bundle')\n      else ctx.assertCanExport('plaintext', format.id)\n\n      const chunks: ExportChunk[] = []\n      for await (const chunk of ctx.chunks(options.collections)) {\n        chunks.push(redactChunk(chunk, ctx, options.redact))\n      }\n      return format.encode(chunks)\n    },\n\n    async importWith<Out extends string | Uint8Array>(\n      vault: Vault,\n      format: NoydbFormat<Out>,\n      input: Out,\n      options: FormatImportOptions = {},\n    ): Promise<ImportPlan> {\n      const ctx = contextFor(vault)\n      // Mirrors the export side: the import gate is two-tier as well, and a\n      // bundle format importing under the plaintext tier would be a silent\n      // downgrade in the other direction.\n      if (format.tier === 'bundle') ctx.assertCanImport('bundle')\n      else ctx.assertCanImport('plaintext', format.id)\n      if (!format.decode) {\n        throw new ValidationError(\n          `vault.import: the '${format.id}' format is export-only — it declares no decode(). ` +\n            'Pick a format that round-trips, or write the records directly.',\n        )\n      }\n      const decoded = await format.decode(input)\n      const candidate: Record<string, readonly unknown[]> = {}\n      for (const chunk of decoded) {\n        const target = chunk.collection || options.collection\n        if (!target) {\n          throw new ValidationError(\n            `vault.import: the '${format.id}' input names no collection and none was supplied. ` +\n              'Pass { collection } for formats whose payload is collection-less.',\n          )\n        }\n        candidate[target] = [...(candidate[target] ?? []), ...chunk.records]\n      }\n      return ctx.plan(candidate, options.policy ?? 'merge', format.id, options.idKey)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YACP,OACA,KACA,QACa;AACb,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,IAAI,SAAS,MAAM,UAAU;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,MAAM,UAAU;AAAA,IAEhE;AAAA,EACF;AACA,QAAM,OACJ,WAAW,OAAO,SAAY,EAAE,aAAa,OAAO,YAAqB;AAC3E,QAAM,UAAU,MAAM,QAAQ;AAAA,IAAI,CAAC,MACjC,oBAAoB,WAAW,GAA8B,IAAI;AAAA,EACnE;AACA,SAAO,EAAE,GAAG,OAAO,QAAyC;AAC9D;AASA,SAAS,WAAW,OAA8B;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOL,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA,IACA,iBAAiB,CAAC,MAAM,WAAW;AACjC,UAAI,SAAS,SAAU,QAAO,MAAM,gBAAgB,QAAQ;AAC5D,UAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,6DAA6D;AAC9F,YAAM,gBAAgB,aAAa,MAAM;AAAA,IAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeA,QAAQ,iBAAiB,aAAa;AACpC,aAAO,MAAM,aAAa;AAAA,QACxB,aAAa;AAAA,QACb,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACvC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,CAAC,eAAe,MAAM,WAAW,UAAU,EAAE,SAAS;AAAA,IAChE,MAAM,OAAO,SAAS,QAAsB,UAAkB,UAAmB;AAC/E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAgC;AACnE,YAAM,OAAO,MAAM,UAAU,OAAO,SAAkB,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;AAC5E,aAAO;AAAA,QACL;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA,OAAO,YAAY;AACjB,gBAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,kBAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,kBAAM,SAAS,UAAU,QAAQ;AACjC,uBAAW,KAAK,KAAK,OAAO;AAC1B,sBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,YAC1E;AACA,gBAAI,WAAW,eAAe;AAC5B,yBAAW,KAAK,KAAK,UAAU;AAC7B,wBAAQ,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,CAAC;AAAA,cAC1E;AAAA,YACF;AACA,gBAAI,WAAW,WAAW;AACxB,yBAAW,KAAK,KAAK,QAAS,SAAQ,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;AAAA,YAC5E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAcO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,SAAS;AAAA,IAET,MAAM,WACJ,OACA,QACA,UAA+B,CAAC,GAClB;AACd,YAAM,MAAM,WAAW,KAAK;AAG5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAE/C,YAAM,SAAwB,CAAC;AAC/B,uBAAiB,SAAS,IAAI,OAAO,QAAQ,WAAW,GAAG;AACzD,eAAO,KAAK,YAAY,OAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,MACrD;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,WACJ,OACA,QACA,OACA,UAA+B,CAAC,GACX;AACrB,YAAM,MAAM,WAAW,KAAK;AAI5B,UAAI,OAAO,SAAS,SAAU,KAAI,gBAAgB,QAAQ;AAAA,UACrD,KAAI,gBAAgB,aAAa,OAAO,EAAE;AAC/C,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAI;AAAA,UACR,sBAAsB,OAAO,EAAE;AAAA,QAEjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,OAAO,OAAO,KAAK;AACzC,YAAM,YAAgD,CAAC;AACvD,iBAAW,SAAS,SAAS;AAC3B,cAAM,SAAS,MAAM,cAAc,QAAQ;AAC3C,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR,sBAAsB,OAAO,EAAE;AAAA,UAEjC;AAAA,QACF;AACA,kBAAU,MAAM,IAAI,CAAC,GAAI,UAAU,MAAM,KAAK,CAAC,GAAI,GAAG,MAAM,OAAO;AAAA,MACrE;AACA,aAAO,IAAI,KAAK,WAAW,QAAQ,UAAU,SAAS,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/at/index.js

@@ -3,15 +3,15 @@ import {
   MemorySealer,
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
-} from "../chunk-3XJQBBZD.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-NTVKHQ3L.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
-import "../chunk-37EPTBBR.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
+import "../chunk-XX4R7TUB.js";
+import "../chunk-IKPQ2GGB.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,

package/dist/attestation/index.js

@@ -1,19 +1,19 @@
 import {
   issueAttestationCore
-} from "../chunk-VMV5SBE4.js";
+} from "../chunk-OYEBSWLE.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-5UMK7GRI.js";
-import "../chunk-JWWYRR4Q.js";
+} from "../chunk-XPNJH7GN.js";
+import "../chunk-B6EWMGFX.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-DLD5LGDS.js";
+} from "../chunk-ZUTUNVFD.js";
 import {
   NO_ATTESTATION
-} from "../chunk-PD64727P.js";
+} from "../chunk-FMINS2B6.js";
 import {
   decodeQr,
   isRevoked,
@@ -22,27 +22,27 @@ import {
   verifyRevocationList
 } from "../chunk-GMKGGY7V.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
+import "../chunk-XX4R7TUB.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-IKPQ2GGB.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-YIVBZUTH.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-4ZPSY44M.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-MHGW3OIL.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-NYR4I3FO.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -52,19 +52,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-QUT7WWG3.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-QUT7WWG3.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-QUT7WWG3.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-6DWIEOCV.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-QUT7WWG3.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-YE2VQ26S.js → backup-RJBFQSHE.js}

@@ -3,50 +3,40 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-3L2NBKDR.js";
+} from "./chunk-IF2M43G4.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-QBLT6POL.js";
+} from "./chunk-FPF5HRBE.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-VFHCKG5M.js";
+} from "./chunk-BVRJYMFZ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   buildRecordEnvelope
-} from "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-WRLWEYHY.js";
+import "./chunk-ZD7WFMV2.js";
+import "./chunk-RRTQAQ3N.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
+import "./chunk-ZF6JECDT.js";
+import "./chunk-THQ3BHLM.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-SV2PM2OY.js";
+} from "./chunk-XX4R7TUB.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-pod/backup.ts
-async function dumpVault(ctx) {
-  const snapshot = await ctx.adapter.loadAll(ctx.vault);
-  const keyringIds = await ctx.adapter.list(ctx.vault, "_keyring");
-  const keyrings = {};
-  for (const keyringId of keyringIds) {
-    const envelope = await ctx.adapter.get(ctx.vault, "_keyring", keyringId);
-    if (envelope) {
-      keyrings[keyringId] = JSON.parse(envelope._data ?? "");
-    }
-  }
-  const internalSnapshot = {};
-  const internalNames = [
+function internalCollectionNames(dataCollections) {
+  return [
     LEDGER_COLLECTION,
     LEDGER_DELTAS_COLLECTION,
     SCHEMAS_COLLECTION,
@@ -87,8 +77,21 @@ async function dumpVault(ctx) {
     // old eTag may not exist in the destination, so it must be stripped
     // there instead. Asymmetry: backup = same-vault-resumable = carry;
     // partition = cross-vault = strip-breadcrumb-carry-marker.
-    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`])
+    ...dataCollections.flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`])
   ];
+}
+async function dumpVault(ctx) {
+  const snapshot = await ctx.adapter.loadAll(ctx.vault);
+  const keyringIds = await ctx.adapter.list(ctx.vault, "_keyring");
+  const keyrings = {};
+  for (const keyringId of keyringIds) {
+    const envelope = await ctx.adapter.get(ctx.vault, "_keyring", keyringId);
+    if (envelope) {
+      keyrings[keyringId] = JSON.parse(envelope._data ?? "");
+    }
+  }
+  const internalSnapshot = {};
+  const internalNames = internalCollectionNames(Object.keys(snapshot));
   for (const internalName of internalNames) {
     const ids = await ctx.adapter.list(ctx.vault, internalName);
     if (ids.length === 0) continue;
@@ -119,9 +122,52 @@ async function dumpVault(ctx) {
   };
   return JSON.stringify(backup);
 }
-async function loadVault(ctx, backupJson) {
+async function reconcileCollection(ctx, collection, podRows) {
+  let written = 0, skipped = 0, deleted = 0;
+  for (const [id, envelope] of Object.entries(podRows)) {
+    const local = await ctx.adapter.get(ctx.vault, collection, id);
+    if (local && local._v === envelope._v) {
+      skipped++;
+      continue;
+    }
+    await ctx.adapter.put(ctx.vault, collection, id, envelope);
+    written++;
+  }
+  for (const id of await ctx.adapter.list(ctx.vault, collection)) {
+    if (id in podRows) continue;
+    await ctx.adapter.delete(ctx.vault, collection, id);
+    deleted++;
+  }
+  return { written, skipped, deleted };
+}
+function podReport(mode, per) {
+  let written = 0, skipped = 0, deleted = 0;
+  for (const r of Object.values(per)) {
+    written += r.written;
+    skipped += r.skipped;
+    deleted += r.deleted;
+  }
+  return { mode, written, skipped, deleted, collections: per };
+}
+async function loadVault(ctx, backupJson, options) {
   const backup = JSON.parse(backupJson);
-  await ctx.adapter.saveAll(ctx.vault, backup.collections);
+  const mode = options?.mode ?? "replace";
+  const per = {};
+  if (mode === "incremental" && backup._compartment !== ctx.vault) {
+    throw new BackupLedgerError(
+      `Incremental load refused: this pod was taken from vault "${backup._compartment}" and is being loaded into "${ctx.vault}". Incremental mode reconciles a vault against its OWN pod; use mode: 'replace' to overwrite this vault with a foreign pod.`
+    );
+  }
+  if (mode === "incremental") {
+    const localData = await ctx.adapter.loadAll(ctx.vault);
+    const names = /* @__PURE__ */ new Set([...Object.keys(backup.collections), ...Object.keys(localData)]);
+    for (const name of names) {
+      const r = await reconcileCollection(ctx, name, backup.collections[name] ?? {});
+      if (r.written || r.skipped || r.deleted) per[name] = r;
+    }
+  } else {
+    await ctx.adapter.saveAll(ctx.vault, backup.collections);
+  }
   for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {
     const envelope = buildRecordEnvelope(
       { collection: "_keyring", id: userId, version: 1 },
@@ -129,16 +175,30 @@ async function loadVault(ctx, backupJson) {
     );
     await ctx.adapter.put(ctx.vault, "_keyring", userId, envelope);
   }
-  if (backup._internal) {
-    for (const [internalName, records] of Object.entries(backup._internal)) {
-      for (const [id, envelope] of Object.entries(records)) {
-        await ctx.adapter.put(ctx.vault, internalName, id, envelope);
+  const internalNamesToLoad = internalCollectionNames(Object.keys(backup.collections));
+  if (mode === "incremental") {
+    for (const internalName of internalNamesToLoad) {
+      const r = await reconcileCollection(ctx, internalName, backup._internal?.[internalName] ?? {});
+      if (r.written || r.skipped || r.deleted) per[internalName] = r;
+    }
+  } else {
+    for (const internalName of internalNamesToLoad) {
+      for (const id of await ctx.adapter.list(ctx.vault, internalName)) {
+        await ctx.adapter.delete(ctx.vault, internalName, id);
+      }
+    }
+    if (backup._internal) {
+      for (const [internalName, records] of Object.entries(backup._internal)) {
+        for (const [id, envelope] of Object.entries(records)) {
+          await ctx.adapter.put(ctx.vault, internalName, id, envelope);
+        }
       }
     }
   }
   await ctx.reloadKeyringAndRebuildDEK();
   ctx.clearCollectionCache();
   ctx.resetLedgerStore();
+  await ctx.resetSync?.();
   if (!backup.ledgerHead) {
     if (ctx.getLedgerOrNull()) {
       console.warn(
@@ -149,7 +209,7 @@ async function loadVault(ctx, backupJson) {
         `[noy-db] Loaded a backup with no ledgerHead \u2014 this pod is not integrity-checked. This reader has no ledger enabled (withHistory() is not configured), so nothing is stale: enable the ledger on both the exporter and this reader if tamper detection is wanted.`
       );
     }
-    return;
+    return podReport(mode, per);
   }
   const result = await verifyBackupIntegrity(ctx);
   if (!result.ok) {
@@ -167,6 +227,7 @@ async function loadVault(ctx, backupJson) {
       `Backup ledger head mismatch: embedded "${backup.ledgerHead.hash}" but reconstructed "${result.head}".`
     );
   }
+  return podReport(mode, per);
 }
 async function verifyBackupIntegrity(ctx) {
   const ledgerForVerify = ctx.getLedgerOrNull();
@@ -266,4 +327,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-YE2VQ26S.js.map
+//# sourceMappingURL=backup-RJBFQSHE.js.map