@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/with-pod/backup.d.ts

@@ -1,4 +1,4 @@
-import type { NoydbStore, EncryptedEnvelope, ExportStreamOptions, ExportChunk } from '../kernel/types.js';
+import type { NoydbStore, EncryptedEnvelope, LoadPodOptions, LoadPodResult, ExportStreamOptions, ExportChunk } from '../kernel/types.js';
 import type { LedgerStore } from '../with-commit/history/ledger/store.js';
 /** Everything the moving backup methods touched on the vault's `this.*`. */
 export interface BackupContext {
@@ -18,6 +18,13 @@ export interface BackupContext {
      * callback (plaintext vaults / test constructions).
      */
     reloadKeyringAndRebuildDEK(): Promise<void>;
+    /**
+     * core#71 — reset every sync engine attached to the vault after a restore:
+     * the dirty log, the watermarks, the adopted epoch. A restore is a new base;
+     * the pre-restore dirty entries refer to records the load just replaced.
+     * Absent on test constructions without sync.
+     */
+    resetSync?(): Promise<void>;
     /** Clear the vault's collection cache (post-load). */
     clearCollectionCache(): void;
     /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */
@@ -42,23 +49,8 @@ export type VerifyBackupResult = {
     readonly id: string;
     readonly message: string;
 };
-/**
- * Dump vault as a verifiable encrypted JSON backup string.
- *
- * backups embed the current ledger head and the full `_ledger` +
- * `_ledger_deltas` internal collections so the receiver can run
- * `verifyBackupIntegrity()` after `load()` and detect any tampering between
- * dump and restore. Backups produced without a ledger skip the integrity check
- * with a warning — both modes round-trip cleanly.
- */
 export declare function dumpVault(ctx: BackupContext): Promise<string>;
-/**
- * Restore a vault from a verifiable backup. After loading, runs
- * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and
- * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load
- * with a console warning and skip the integrity check.
- */
-export declare function loadVault(ctx: BackupContext, backupJson: string): Promise<void>;
+export declare function loadVault(ctx: BackupContext, backupJson: string, options?: LoadPodOptions): Promise<LoadPodResult>;
 /**
  * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data
  * envelope cross-check (every current record's `_data` hash must match the

package/dist/with-shape/blobs/blob-set.d.ts

@@ -608,6 +608,8 @@ export declare class BlobSet {
         shredded: string[];
         retainedShared: string[];
         residue: string[];
+        /** #28 — the eTag half of `residue` alone: the join key to `compact()`'s sweep. */
+        residueETags: string[];
     }>;
     /**
      * Resolve a SHRED `BlobIntent` for this record, or `null` when the entry
@@ -1294,6 +1296,27 @@ export declare class BlobSet {
      * and "its attachments are released" are one operation. Ungated: the record
      * delete itself already passed the gate bus. Ref-counted like any release —
      * content another record still holds survives.
+     *
+     * ⛔ RELEASE IS NOT ERASURE, AND THE API CANNOT TELL YOU WHICH YOU GOT
+     * (noy-db/core#28). Releasing the slot is unconditional; when the BYTES
+     * leave the store depends on the collection's key mode:
+     *
+     * - `perRecordKeys: true` — crypto-shredded on the spot at refCount 0.
+     * - legacy (shared DEK) — chunks RETAINED under the collection DEK until
+     *   `vault.compact({ reclaimLegacyBlobs: true })` runs (#1453).
+     *
+     * Both give the caller the same `null` from `blob(id).get(slot)`, and the
+     * record, the slot list and the store listing all agree it is gone — so
+     * every signal a consumer has says "erased" while the ciphertext is still
+     * on disk, recoverable by anyone holding the DEK. pilot-1 measured exactly
+     * this (chunks 2 → 2 on delete) and reasonably read the deferral as a
+     * broken cascade.
+     *
+     * ⭐ So: if a delete is meant to ERASE — a subject-access request, a
+     * retention policy — either put the blobs on a `perRecordKeys` collection
+     * or run the reclaim pass, and assert on `compact()`'s
+     * `unreferencedLegacyBlobs.reclaimed`, never on the null read. The seam is
+     * pinned in `__tests__/1451-delete-releases-blobs.test.ts`.
      */
     releaseAll(): Promise<void>;
     /** The body of {@link delete}, minus the owner gate. */

package/dist/with-shape/blobs/legacy-sweep.d.ts

@@ -26,6 +26,22 @@ export interface UnreferencedLegacyBlobReport {
     readonly chunks: number;
     /** How many of those blobs this run deleted (chunks first, then the index row). */
     readonly reclaimed: number;
+    /**
+     * #28 — the eTags this run actually deleted, so a deferred erasure set can be
+     * reconciled against the reclaim that finished it:
+     *
+     * ```ts
+     * const still = before.blobResidueETags.filter((e) => !report.reclaimedETags.includes(e))
+     * ```
+     *
+     * ⛔ DO NOT PERSIST. An eTag is a content hash — see
+     * `ForgetResult.blobResidueETags` for why a stored receipt of them is a
+     * re-identification oracle. Reconcile in memory, persist the verdict.
+     *
+     * Empty on a `dryRun` (nothing was deleted), even though `blobs`/`chunks`
+     * still count what WOULD be.
+     */
+    readonly reclaimedETags: readonly string[];
 }
 export declare function sweepUnreferencedLegacyBlobs(ctx: {
     adapter: NoydbStore;

package/dist/with-shape/introspection/describe.d.ts

@@ -11,7 +11,7 @@
  * @module
  */
 import type { FieldMeta } from './field-meta.js';
-import { FieldMetaUnknownFieldError, schemaFieldKeys } from './field-meta.js';
+import { schemaFieldKeys } from './field-meta.js';
 export { schemaFieldKeys };
 import type { CollectionMeta } from './meta.js';
 import type { ViaDescriptor, ViaPosture } from '../../kernel/via/index.js';
@@ -275,7 +275,6 @@ export interface BuildDescriptionInput {
      */
     readonly fieldIds?: Record<string, string> | undefined;
 }
-export { FieldMetaUnknownFieldError };
 /**
  * Pure assembler: no I/O, no side effects.
  * Builds a {@link CollectionDescription} from the collection's in-memory config.

package/dist/with-shape/introspection/index.d.ts

@@ -13,6 +13,7 @@ export type { VaultIntrospectState } from './walk.js';
 export { jsonSchemaToFields } from './fields.js';
 export type { SchemaIntrospection } from './types.js';
 export type { FieldMeta, SemanticType } from './field-meta.js';
+export { FieldMetaUnknownFieldError } from './field-meta.js';
 export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
 export type { StandardSchemaV1Issue } from '../../kernel/schema.js';
 export { applyListProjection } from './projection.js';

package/dist/with-shape/introspection/types.d.ts

@@ -174,7 +174,7 @@ export interface InternalCollectionStats {
  * documentation gate switching to the live report passes VACUOUSLY on a hub
  * too old to answer. Measured by a consumer attempting that adoption.
  */
-export type SnapshotReport = 'via' | 'stats';
+type SnapshotReport = 'via' | 'stats';
 export interface VaultSchemaSnapshot {
     readonly _noydb_snapshot: 2;
     /**
@@ -209,3 +209,4 @@ export interface DumpSchemaOptions {
     /** Sample N records per collection lacking a persisted/live schema. Default 50. `0` disables sampling. */
     readonly sampleSize?: number;
 }
+export {};

package/dist/with-shape/schema-update/fence.d.ts

@@ -18,6 +18,13 @@ export interface FenceDoc {
      */
     readonly schemaHash?: string;
 }
+/**
+ * `FENCE_RECORD_ID` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/cover. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export declare const FENCE_RECORD_ID = "schema-fence";
 export declare const DEFAULT_FENCE: FenceDoc;
 export declare function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc>;

package/dist/with-sync/active.d.ts

@@ -30,4 +30,31 @@
  * @public
  */
 import type { SyncStrategy } from './strategy.js';
-export declare function withSync(): SyncStrategy;
+/**
+ * core#107 — `arbiter: true` makes this device the vault's ARBITER: its
+ * admission refusals are replicated so the writer finds out, instead of
+ * staying local to the device that judged them.
+ *
+ * ⚠️ One arbiter, named by configuration on the device that is to be it
+ * (the admin host, or the daemon) — ruled over a quorum because the failure
+ * mode is legible: no arbiter configured means no replication, which is
+ * exactly the pre-core#107 behaviour. It is NOT an authority proof: nothing
+ * stops a member hand-writing `_sync_rejections`, and the reason that is
+ * tolerable is the report-only ruling — a replicated refusal never deletes,
+ * tombstones or retracts anything, so the worst a forged one does is show
+ * somebody a notice about their own record.
+ *
+ * ⚠️ THE CONDITION THAT WOULD MAKE THAT NON-BOUNDARY A REAL ONE, named by
+ * pilot-1 when they accepted it: every member is currently staff of the same
+ * firm, and a forged refusal is sealed under the refused record's own
+ * collection DEK — so a forger can only show a notice about a record they
+ * could already read. ⛔ If EXTERNAL `client`-role users ever hold
+ * collections of their own, "who may write `_sync_rejections`" stops being
+ * cosmetic and this needs an authority design, not a flag. Do not read the
+ * paragraph above as a general safety argument; it is an argument about one
+ * topology, and this is the trigger to re-open it.
+ */
+export interface WithSyncOptions {
+    readonly arbiter?: boolean;
+}
+export declare function withSync(options?: WithSyncOptions): SyncStrategy;

package/dist/with-sync/engine.d.ts

@@ -1,5 +1,9 @@
-import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole } from '../kernel/types.js';
+import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole, RealignResult, SyncRejectedApi, ReplaceRemoteResult } from '../kernel/types.js';
+/** core#74 — where a device parks the records its admission gate refused. Local-only: never mirrored, never full-pushed. */
+export declare const REJECTED_COLLECTION = "_sync_rejected";
 import type { MergeAuthority } from '../port/with/merge-authority.js';
+import type { AdmissionAuthority } from '../port/with/admission-authority.js';
+import type { RejectionCourier } from '../port/with/rejection-courier.js';
 import { type PeriodPullSource } from './period-scope.js';
 import type { NoydbEventEmitter } from '../kernel/events.js';
 import type { SyncPolicy } from '../kernel/sync-policy.js';
@@ -13,7 +17,14 @@ export interface ReservedLookupSource {
 }
 /** Sync engine: dirty tracking, push, pull, conflict resolution, scheduling. */
 export declare class SyncEngine {
+    #private;
     private readonly mergeAuthority;
+    /** core#74 — the vault's admission gate for incoming records; wired at open like the other vault seams. */
+    private admission;
+    /** core#107 — the vault's sealing capability for replicated refusals; wired at open like `admission`. */
+    private courier;
+    /** core#107 — this device's refusals replicate. Configuration, not an authority proof — see `withSync`. */
+    private readonly arbiter;
     private readonly local;
     private readonly remote;
     private readonly strategy;
@@ -29,6 +40,8 @@ export declare class SyncEngine {
     /** #1036 — last SUCCESSFUL push/pull. Never advanced by a failed attempt. */
     private lastPush;
     private lastPull;
+    /** core#72 — the target's restore epoch this device adopted; null before any. */
+    private epoch;
     /**
      * #1036 — the failure that ended the most recent attempt, cleared by the next
      * success. Live state only: deliberately NOT persisted in `_sync/meta`, since a
@@ -89,11 +102,55 @@ export declare class SyncEngine {
     private periodPullSource?;
     /** Wire the period-window source (#807). Same injection pattern as `setReservedLookupSource`. */
     setPeriodPullSource(source: PeriodPullSource): void;
+    /** core#81 — the collections this keyring names; the walk set for a paged pull. Wired by the vault at open. */
+    private collectionNames?;
+    /** Wire the paged-pull walk set (core#81). Same injection pattern as `setCacheInvalidator`. */
+    setCollectionNames(fn: () => readonly string[]): void;
+    /**
+     * core#81 — one chunk per page of one collection, for `pull({ paged: true })`.
+     * `listPage` when the store offers it (200 per page), else `list` + `get` in
+     * batches of the same size. Never more than one page in memory.
+     */
+    private pagedChunks;
+    /** core#82 — when a pull replaces the caller's OWN keyring file, the vault reloads it in place. */
+    private rosterReload?;
+    /** Wire the roster-reload seam (core#82). Same injection pattern as `setCacheInvalidator`. */
+    /** core#107 — wire the vault's rejection sealing capability. */
+    setRejectionCourier(c: RejectionCourier): void;
+    /** core#74 — wire the vault's admission gate. */
+    setAdmission(a: AdmissionAuthority): void;
+    /** core#71 — after `vault.load()`: a new base. Drops the dirty log, the watermarks and the adopted epoch. */
+    resetAfterRestore(): Promise<void>;
+    /**
+     * core#72 — make the LOCAL vault authoritative on this target. Every local
+     * record goes up unconditionally, re-sealed above the target's version where
+     * the target moved on (so every peer's copy is superseded); every id the
+     * target holds that the local vault lacks gets a delete marker at
+     * `remote._v + 1` (so every peer removes it); the reserved collections are
+     * mirrored; then a new epoch is written at `_sync/epoch`. The dirty log is
+     * cleared: the target IS the local state now.
+     */
+    replaceRemote(): Promise<ReplaceRemoteResult>;
+    /** core#74 — the parked refusals on this device, and their two fates. */
+    rejected(): SyncRejectedApi;
+    setRosterReload(seam: {
+        userId: string;
+        reload: () => Promise<void>;
+    }): void;
+    /** core#81 — the running sync's latest progress sample; `null` when idle. Read by `status()`. */
+    private inFlight;
+    private progressLastEmit;
+    private progressLastRecords;
+    /** Emit `sync:progress` no more than every 25 records or ~250 ms; `force` for the final sample. */
+    private progress;
+    private progressDone;
     /** #807: KPI accumulator `applyRemote` feeds during a period-scoped `pull()` — pointed at the
      *  active phase's counters (summaries → records) and cleared before pull returns. Approximate
      *  by design: a push interleaved mid-pull on the same engine would attribute its converge
      *  applies to the open phase; the counters are a download-budget KPI, not an audit source. */
     private pullByteSink;
+    /** core#81 — ciphertext bytes applied by the running pull, for `sync:progress`. */
+    private pullBytes;
     constructor(opts: {
         local: NoydbStore;
         remote: NoydbStore;
@@ -112,6 +169,8 @@ export declare class SyncEngine {
          * bound to the keys rather than the engine reaching for them.
          */
         mergeAuthority?: MergeAuthority;
+        /** core#107 — this device is the vault's arbiter: its refusals replicate. */
+        arbiter?: boolean;
     });
     /** Start the sync scheduler. Called after vault is fully opened. */
     startScheduler(): void;
@@ -147,9 +206,16 @@ export declare class SyncEngine {
      */
     remirrorPairResolvers(names: readonly string[]): void;
     /** Record a local change for later push. */
-    trackChange(collection: string, id: string, action: 'put' | 'delete', version: number): Promise<void>;
+    trackChange(collection: string, id: string, action: DirtyEntry['action'], version: number): Promise<void>;
     /** Remove a dirty entry (satellite fan-out revert cleanup — spec #591). */
     removeDirty(collection: string, id: string): Promise<void>;
+    /**
+     * core#92 — mark every user-collection record in the local store dirty at its
+     * current version, so the next push sends it (CAS against `_v - 1`, so a
+     * remote that already holds a newer copy resolves through the conflict path
+     * instead of being overwritten). Records already dirty keep their entry.
+     */
+    markAllDirty(): Promise<void>;
     /** Push dirty records to remote adapter. Accepts optional `PushOptions` for partial sync. */
     push(options?: PushOptions): Promise<PushResult>;
     /** Pull remote records to local adapter. Accepts optional `PullOptions` for partial sync. */
@@ -181,6 +247,26 @@ export declare class SyncEngine {
      */
     private recordOutcome;
     /** Get current sync status. */
+    /**
+     * core#82 — re-align a CORRUPTED local from the target. An ordinary pull
+     * cannot repair a damaged local envelope: it keeps its `_v`, so it wins
+     * (or ties) against the target's healthy copy. Here every local
+     * user-collection envelope is verified with the same `MergeAuthority`
+     * check pull runs on remote envelopes; one that fails is replaced by the
+     * target's copy when THAT verifies, and the dirty log is dropped (a dirty
+     * entry over a damaged record would push the damage). Records at a tier
+     * the caller holds no key for pass unverified, as in pull — this repairs
+     * what the caller can read. Requires a `MergeAuthority` (a vault-attached
+     * engine on an encrypted vault).
+     */
+    /**
+     * core#96 (pilot-1, finding B) — bring one member's keyring file down from
+     * this target if the target's copy supersedes ours. Called by the kernel
+     * before an authority edit; reloads the caller's own keyring in place when
+     * it is the one refreshed (core#82).
+     */
+    refreshKeyring(userId: string): Promise<boolean>;
+    realign(): Promise<RealignResult>;
     status(): SyncStatus;
     /** Start auto-sync: listen for online/offline events, optional periodic sync. */
     startAutoSync(intervalMs?: number): void;

package/dist/with-sync/index.d.ts

@@ -28,6 +28,7 @@
  * directly. This subpath is the clean LTS factory entry point.
  */
 export { withSync } from './active.js';
+export type { WithSyncOptions } from './active.js';
 export type { SyncStrategy } from './strategy.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_SYNC } from './strategy.js';

package/dist/with-sync/reserved-mirror.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Reserved-record replication between two stores (core#75, core#83, core#82).
+ *
+ * `loadAll()` skips every `_`-prefixed collection, so nothing reserved
+ * travels through a sync target unless it is named here. `_keyring` was the
+ * first (core#75): a target was never a full replica — a device that lost
+ * its local store re-opened by MINTING a new owner keyring whose DEKs open
+ * nothing, and a granted member could not open on their own device at all.
+ * The invite audit doc was the second (core#83): `acceptInvite` refuses
+ * without it, by design, so magic-link onboarding onto a fresh sync-peer
+ * device was closed.
+ *
+ * ## Declared, never blanket
+ *
+ * `_meta` mixes VAULT state (deed, adoption, recovery docs, invite audit
+ * docs) with DEVICE/SESSION state (`schema-fence`, the pod `handle`) that
+ * must never reach another device — a replicated fence would break every
+ * other device's cutover. So replication is a declared set of
+ * `(collection, id prefix)` rules, each with its own ordering, and a
+ * reserved record travels only when a rule names it. The decision per
+ * collection, written down (core#82):
+ *
+ * | collection | rule | why |
+ * |---|---|---|
+ * | `_keyring` | higher `roster_epoch` wins | the roster; replay-anchored by #1097 |
+ * | `_meta/invite-audit-*` | higher `_v` wins | single-use evidence for magic links (core#83) |
+ * | `_users` | higher `_v` wins | the directory's user envelopes; a member app renders these |
+ * | `_delegations` | higher `_v` wins | delegation tokens; revocation is a delete |
+ * | `_broker`, `_broker_member` | higher `_v` wins | broker seeds (core#91) — sealed under DEKs only their holder has; a fresh device mints from them |
+ * | `_history`, `_ledger` | NOT replicated | per-device evidence: the ledger is a hash chain per writer, two devices appending would fork it; `vault.at(T)` runs where history lives |
+ * | `_sync_rejections` | higher `_v` wins | core#107 — the arbiter's refusals, sealed under the refused record's own collection DEK |
+ * | `_sync` | NOT replicated | this device's dirty log and watermarks |
+ * | `_meta/schema-fence`, `_meta/handle`, other `_meta` | NOT replicated | session and instance state; the rest of `_meta` is decided one id at a time |
+ *
+ * DEK-free by construction: every rule compares a field the mover can read
+ * without a key — `roster_epoch` (plaintext JSON on purpose, #1097, read
+ * through `team/keyring.ts`'s parser) or the envelope's `_v`.
+ *
+ * ## The one rule, both directions
+ *
+ * **The candidate wins when it supersedes; the absent side receives; equal
+ * is a no-op.** For `_keyring`, a file with no epoch (pre-#1097) never
+ * overwrites one that has an epoch. Why an ordering and not bytes: a device
+ * holding a STALE copy (epoch 3, or `_v` 1) must not push it over the newer
+ * one (epoch 4, `_v` 2) — byte-difference alone would re-introduce exactly
+ * the replay the ordering exists to anchor.
+ *
+ * ## Deletion
+ *
+ * A revocation (keyring, delegation, user envelope) deletes the record on
+ * the acting device and is pushed through the dirty log as
+ * `(collection, id, 'delete')`. On PULL, a record the remote lacks and the
+ * local holds is deleted locally only when (a) the remote carries at least
+ * one KEYRING file — a target never pushed to is not evidence of revocation,
+ * but a collection that emptied by revocation is exactly what must propagate
+ * (core#91) — and (b) no dirty entry protects it (a grant made offline, not
+ * yet pushed). Invite audit docs are never deleted; revocation is a
+ * field update, which the `_v` rule carries.
+ */
+import type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js';
+export interface ReservedMirrorResult {
+    /** Records written to `to`. */
+    readonly copied: number;
+    /** Records deleted from `to` (pull-side revocation propagation only). */
+    readonly deleted: number;
+    /** Ids of `_keyring` files copied — the roster reload seam reads this for the caller's own file. */
+    readonly keyringsCopied: readonly string[];
+    /**
+     * core#96 (pilot-1, finding B) — push only: local `_keyring` files the epoch
+     * rule did not write and whose content differs from the remote's (the remote
+     * is ahead, or the two diverged at one epoch). The local edit LOST; the
+     * engine reports each as a `Conflict` so an authority edit made on a stale
+     * copy is never silently dropped.
+     */
+    readonly staleKeyrings?: readonly {
+        readonly id: string;
+        readonly local: EncryptedEnvelope;
+        readonly remote: EncryptedEnvelope;
+    }[];
+}
+/** The push half: mirror every declared rule from `local` to `remote`. Never deletes. */
+export declare function pushReserved(local: NoydbStore, remote: NoydbStore, vault: string): Promise<ReservedMirrorResult>;
+/**
+ * core#96 (pilot-1, finding B) — bring ONE member's keyring file down from the
+ * target if the target's copy supersedes the local one. The kernel calls it
+ * before every authority edit (`grant` on an existing user, `updateUser`,
+ * `revoke`, `recoverUser`), so the edit is made on the current file and its
+ * push wins instead of being discarded by the epoch rule. One GET.
+ */
+export declare function pullKeyringFile(remote: NoydbStore, local: NoydbStore, vault: string, userId: string): Promise<boolean>;
+/**
+ * The pull half: mirror every declared rule from `remote` into `local`, then
+ * propagate revocations under the two guards in the module doc.
+ * `protectedIds` maps a collection to the ids a pending local dirty entry
+ * protects.
+ *
+ * Costs one `list()` per rule per pull, and nothing at all for a vault with
+ * no local keyring: an encrypted vault always holds the caller's own file
+ * after open (bootstrapped or minted), so "no local keyring" means
+ * `encrypt: false` — nothing reserved to mirror, nothing to ask.
+ */
+export declare function pullReserved(remote: NoydbStore, local: NoydbStore, vault: string, protectedIds: ReadonlyMap<string, ReadonlySet<string>>): Promise<ReservedMirrorResult>;
+/**
+ * Open-path bootstrap: an EMPTY local store is not evidence of a new vault
+ * when a `sync-peer` already carries the roster. Mirror its keyring files in
+ * first; `assertKeyringOpenAllowed` then decides — own file → open, other
+ * principals only → refuse, still nothing → genuinely new. Backups are
+ * never consulted (never pulled from, #616). No-op when the local already
+ * holds any keyring. Only the roster: the rest of the declared set arrives
+ * on the first `pull()`.
+ */
+export declare function bootstrapKeyrings(local: NoydbStore, peer: NoydbStore | undefined, vault: string): Promise<void>;

package/dist/with-sync/strategy.d.ts

@@ -50,12 +50,21 @@ export interface BuildSyncEngineOptions {
     label?: string;
     /** #1042 — the merge's verify/re-stamp capability, bound to the keys by the caller. */
     mergeAuthority?: MergeAuthority;
+    /** core#107 — this device is the vault's arbiter: its admission refusals replicate. */
+    arbiter?: boolean;
 }
 /**
  * @internal
  */
 export interface SyncStrategy {
     buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine;
+    /**
+     * core#75 — open-path roster bootstrap: an EMPTY local store is not a new
+     * vault when a `sync-peer` already carries the roster. Runs inside keyring
+     * resolution, BEFORE any engine exists; the un-opted-in stub is a no-op
+     * (no sync ⇒ no target to bootstrap from).
+     */
+    bootstrapKeyrings(local: NoydbStore, peer: NoydbStore | undefined, vault: string): Promise<void>;
     buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction;
     buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P>;
 }

package/dist/with-sync/tab-write-relay.d.ts

@@ -7,16 +7,6 @@
  */
 import type { TabChannel, Unsubscribe } from './tab-coordination.js';
 import type { WriteEvent } from '../port/with/write-hooks.js';
-export interface TabWriteMsg {
-    readonly kind: 'tab-write';
-    readonly writerId: string;
-    readonly vault: string;
-    readonly collection: string;
-    readonly docId: string;
-    readonly action: 'put' | 'delete';
-    readonly baseV: number;
-    readonly v: number;
-}
 export interface CrossTabWriteRelayOptions {
     /** The broadcast channel (its own — distinct from the presence channel). */
     readonly channel: TabChannel;

package/dist/withdraw-accessible-MTFP7OIB.js

@@ -0,0 +1,25 @@
+import {
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-R2ZULFXU.js";
+import "./chunk-KN4LUMH6.js";
+import "./chunk-XPW7T2GN.js";
+import "./chunk-DMIEKD24.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-ZD7WFMV2.js";
+import "./chunk-RRTQAQ3N.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-ZF6JECDT.js";
+import "./chunk-THQ3BHLM.js";
+import "./chunk-XX4R7TUB.js";
+import "./chunk-IKPQ2GGB.js";
+export {
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-MTFP7OIB.js.map

package/dist/withdraw-accessible-MTFP7OIB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.8.0",
+  "version": "0.9.0-pre.1",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "Apache-2.0",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -276,8 +276,8 @@
     "happy-dom": "^18.0.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/attestation": "0.8.0",
-    "@noy-db/shamir": "0.8.0"
+    "@noy-db/attestation": "0.9.0-pre.1",
+    "@noy-db/shamir": "0.9.0-pre.1"
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0",

package/dist/api-OS747DS4.js

@@ -1,18 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-AEQGFRU4.js";
-import "./chunk-LIOVX5TJ.js";
-import "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-OS747DS4.js.map

package/dist/backup-YE2VQ26S.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport { MANIFEST_COLLECTION } from '../with-shape/manifest/reserved-collections.js'\n// #1025 — imported from the dependency-light `window.ts`, not `periods.ts`: that\n// module exists precisely so a consumer can name the period collections without\n// dragging the ledger hash-chain machinery (`sha256Hex`/`canonicalJson`) into a\n// bundle that opted out of the periods service. Same reason the sync engine's\n// period-scoped pull imports it.\nimport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  PERIOD_REOPENS_COLLECTION,\n} from '../with-audit/periods/window.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { buildRecordEnvelope } from '../capsule/index.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data ?? '')\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    MANIFEST_COLLECTION, // #941: the pod's manifest-set record(s) travel in the bundle too\n    // #1025: the accounting-period close state + its companions. The bundle is\n    // the backup/restore path, so without these a restore discarded the\n    // hash-chained evidence that a month was ever closed — the artifact\n    // `closePeriod` exists to produce — and dropped the write gate with it, so\n    // the restored vault silently accepted back-dated writes into a sealed\n    // month. The companions matter as much as the close: a bounded reopen\n    // window (`reopenPeriod({ until })`) is state a restore must not lose.\n    PERIODS_COLLECTION,\n    PERIOD_REOPENS_COLLECTION,\n    PERIOD_FREEZES_COLLECTION,\n    PERIOD_ARCHIVES_COLLECTION,\n    PERIOD_TARGET_PURGES_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    // #753 spec §7 Q3: `_blob_intent` markers travel too — restoring mid-op\n    // state (a blob row without its marker) would reproduce the ambiguity\n    // the journal exists to prevent. Note: `_mv_stale` does NOT travel\n    // today (a pre-existing, separate gap) — observed here, tracked on\n    // #761, not fixed in this pass.\n    '_blob_intent',\n    // #769: `_blob_slots_<c>` envelopes travel verbatim (raw ciphertext,\n    // same DEK, same vault) — including any `SlotRecord.pendingRelease`\n    // resume breadcrumb they carry. This is INTENTIONALLY the opposite of\n    // `extract-partition`'s `reKeyBlobs`, which STRIPS `pendingRelease`:\n    // a full-vault backup restores into the SAME vault it was taken from,\n    // so a breadcrumb taken mid-rehome (together with its `_blob_intent`\n    // marker, carried above) is resumable on restore — carry-and-resume is\n    // correct here. A partition extraction crosses vaults: the breadcrumb's\n    // old eTag may not exist in the destination, so it must be stripped\n    // there instead. Asymmetry: backup = same-vault-resumable = carry;\n    // partition = cross-vault = strip-breadcrumb-carry-marker.\n    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\nexport async function loadVault(ctx: BackupContext, backupJson: string): Promise<void> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n\n  // 1. Restore data collections.\n  await ctx.adapter.saveAll(ctx.vault, backup.collections)\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    const envelope = buildRecordEnvelope({ collection: '_keyring', id: userId, version: 1 },\n      { iv: '', data: JSON.stringify(keyringFile) })\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`).\n  //    Required so verifyBackupIntegrity has the chain to walk.\n  if (backup._internal) {\n    for (const [internalName, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 5. Run the verification gate. A backup with no ledgerHead cannot be\n  //    integrity-checked, and skipping silently would collapse\n  //    *unverifiable* into *clean* — so it always warns. But the REMEDY\n  //    depends on the reader, not the pod (#1303): the pod cannot say\n  //    whether its exporter predates the ledger or never enabled it, and\n  //    the reader knows its own configuration.\n  //\n  //    - Reader HAS the ledger: the pod is behind it. \"Re-export\" is\n  //      actionable; keep the migration wording.\n  //    - Reader has NO ledger: nothing is stale and nothing is migrating —\n  //      the consumer priced the ledger (#1248 measured ~2.4x) and declined.\n  //      Prescribing a re-export is advice they should not take, and\n  //      repeating it on every read trains people to filter the one line\n  //      that also fires on a genuinely stale pod. State the consequence,\n  //      name the discriminator, prescribe nothing.\n  if (!backup.ledgerHead) {\n    if (ctx.getLedgerOrNull()) {\n      console.warn(\n        `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n        `verifiable-backup integrity check skipped. ` +\n        `Re-export with a ledger-aware build to get tamper detection.`,\n      )\n    } else {\n      console.warn(\n        `[noy-db] Loaded a backup with no ledgerHead — this pod is not integrity-checked. ` +\n        `This reader has no ledger enabled (withHistory() is not configured), so nothing is stale: ` +\n        `enable the ledger on both the exporter and this reader if tamper detection is wanted.`,\n      )\n    }\n    return\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+FA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,SAAS,EAAE;AAAA,IACvD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,GAAG,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EACrF;AACA,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAQA,eAAsB,UAAU,KAAoB,YAAmC;AACrF,QAAM,SAAS,KAAK,MAAM,UAAU;AAGpC,QAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAGvD,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AACnE,UAAM,WAAW;AAAA,MAAoB,EAAE,YAAY,YAAY,IAAI,QAAQ,SAAS,EAAE;AAAA,MACpF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,WAAW,EAAE;AAAA,IAAC;AAC/C,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAIA,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAiBrB,MAAI,CAAC,OAAO,YAAY;AACtB,QAAI,IAAI,gBAAgB,GAAG;AACzB,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}