@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/chunk-T7IR4N2S.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/sync-policy.ts","../src/with-sync/strategy.ts"],"sourcesContent":["/**\n * Sync scheduling policy.\n *\n * ## What it controls\n *\n * A {@link SyncPolicy} has two halves:\n * - **push** ({@link PushPolicy}) — when dirty local writes are sent to the remote.\n * - **pull** ({@link PullPolicy}) — when the remote is polled for new data.\n *\n * ## Choosing a policy\n *\n * The right policy depends on the backend's operational characteristics:\n *\n * | Backend type | Recommended policy |\n * |---|---|\n * | Per-record (DynamoDB, S3, IDB) | {@link INDEXED_STORE_POLICY} — `on-change` push, `manual` pull |\n * | Bundle (Drive, WebDAV, Git) | {@link POD_STORE_POLICY} — `debounce` push, `interval` pull |\n *\n * Consumers can override via `createNoydb({ syncPolicy: { ... } })`:\n *\n * ```ts\n * const db = await createNoydb({\n *   store: toFile({ dir: './data' }),\n *   syncPolicy: {\n *     push: { mode: 'debounce', debounceMs: 5_000 },\n *     pull: { mode: 'on-focus' },\n *   },\n * })\n * ```\n *\n * ## Scheduler lifecycle\n *\n * {@link SyncScheduler} owns all timers, debounce logic, and browser lifecycle\n * hooks (`visibilitychange`, `pagehide`, `beforeExit`). Call `scheduler.start()`\n * after opening a vault and `scheduler.stop()` when closing it. The scheduler\n * delegates actual push/pull work to {@link SyncSchedulerCallbacks} provided\n * by the {@link SyncEngine}.\n *\n * @module\n */\n\n// ─── Policy types ───────────────────────────────────────────────────────\n\n/**\n * When push operations are triggered automatically.\n *\n * - `'manual'` — only on explicit `sync.push()` calls.\n * - `'on-change'` — immediately after every local write (respecting `minIntervalMs`).\n * - `'debounce'` — after `debounceMs` of inactivity following a write.\n * - `'interval'` — on a fixed timer regardless of writes.\n */\nexport type PushMode = 'manual' | 'on-change' | 'debounce' | 'interval'\n\n/**\n * When pull operations are triggered automatically.\n *\n * - `'manual'` — only on explicit `sync.pull()` calls.\n * - `'interval'` — on a fixed `intervalMs` timer.\n * - `'on-focus'` — when the browser tab regains visibility.\n * - `'phased'` — pull the collections named in `sequence`, in order, one at a\n *   time, then settle into steady state. For thin clients that need their\n *   navigation-critical collections before bulk history.\n */\nexport type PullMode = 'manual' | 'interval' | 'on-focus' | 'phased'\n\n/**\n * Push half of a sync policy. Controls the trigger mode and timing guards\n * for outbound sync operations.\n */\nexport interface PushPolicy {\n  /** Push trigger mode. */\n  readonly mode: PushMode\n  /** Debounce delay in ms. Only used when `mode: 'debounce'`. Default: 30_000. */\n  readonly debounceMs?: number\n  /** Interval in ms between automatic pushes. Used by `'interval'` and as floor for `'debounce'`. */\n  readonly intervalMs?: number\n  /**\n   * Hard floor between pushes regardless of mode. Prevents burst writes\n   * from hammering the remote. Default: 0 (no floor).\n   */\n  readonly minIntervalMs?: number\n  /**\n   * Force a push on page unload (`pagehide` / `visibilitychange → hidden`)\n   * in browsers, `beforeExit` in Node. Default: true for non-manual modes.\n   */\n  readonly onUnload?: boolean\n}\n\n/**\n * Pull half of a sync policy. Controls when and how often inbound sync\n * operations are triggered.\n */\nexport interface PullPolicy {\n  /** Pull trigger mode. */\n  readonly mode: PullMode\n  /**\n   * Interval in ms between automatic pulls. Used by `'interval'` mode. Default: 60_000.\n   * Under `'phased'` it is the steady-state cadence adopted *after* the sequence\n   * completes; omit it to go idle instead.\n   */\n  readonly intervalMs?: number\n  /**\n   * Collection names to pull in order, one at a time. Required when\n   * `mode: 'phased'` and rejected otherwise. Entries must be non-empty and\n   * unique — without period narrowing a repeated collection can only be a\n   * mistake, so it is rejected rather than silently merged.\n   *\n   * Period-scoped phases (`collection@period`) are deferred to `partitions`;\n   * use `db.pull(vault, { periods })` explicitly meanwhile.\n   */\n  readonly sequence?: readonly string[]\n}\n\n/**\n * Combined push + pull sync scheduling policy for a vault.\n *\n * Pass via `createNoydb({ syncPolicy })` to override the default policy\n * derived from the active store type. Pre-built defaults are available\n * as `INDEXED_STORE_POLICY` and `POD_STORE_POLICY`.\n */\nexport interface SyncPolicy {\n  readonly push: PushPolicy\n  readonly pull: PullPolicy\n}\n\n// ─── Default policies by store category ─────────────────────────────────\n\n/** Default for per-record stores (DynamoDB, S3, file, IDB). */\nexport const INDEXED_STORE_POLICY: SyncPolicy = {\n  push: { mode: 'on-change', minIntervalMs: 0, onUnload: true },\n  pull: { mode: 'manual' },\n}\n\n/** Default for bundle stores (Drive, WebDAV, Git). */\nexport const POD_STORE_POLICY: SyncPolicy = {\n  push: { mode: 'debounce', debounceMs: 30_000, minIntervalMs: 120_000, onUnload: true },\n  pull: { mode: 'interval', intervalMs: 60_000 },\n}\n\n\n// ─── Sync scheduler ─────────────────────────────────────────────────────\n\n/**\n * Current operational state of the `SyncScheduler`.\n *\n * - `'idle'` — no pending or active sync operations.\n * - `'pending'` — local writes are queued, waiting for debounce/interval to fire.\n * - `'pushing'` — push in progress.\n * - `'pulling'` — pull in progress.\n * - `'error'` — last sync operation failed; `lastError` holds the cause.\n */\nexport type SyncSchedulerState = 'idle' | 'pending' | 'pushing' | 'pulling' | 'error'\n\n/**\n * How much of a collection a caller may rely on, under a `'phased'` pull.\n *\n * - `'cold'` — not pulled yet, or its phase did not complete cleanly. A miss\n *   from `get()` proves nothing.\n * - `'pulling'` — its phase is in flight. Never terminal: a phase always ends\n *   in `'live'` or back in `'cold'`, because a stuck `'pulling'` would leave a\n *   permanent skeleton in the UI.\n * - `'live'` — its phase completed cleanly, so a miss is a real absence.\n */\nexport type ReadinessState = 'cold' | 'pulling' | 'live'\n\n/**\n * What a scheduler-initiated pull achieved, as reported by the callback.\n *\n * `'incomplete'` covers both a pull that reported errors (`PullResult.errors`\n * accumulates without throwing) and one that was skipped — e.g. role-gated on a\n * backup target. Either way nothing may be claimed about completeness.\n */\nexport type PullPhaseOutcome = 'complete' | 'incomplete'\n\n/**\n * Snapshot of the sync scheduler's state, returned by `SyncScheduler.status`.\n * Safe to expose in a reactive UI status indicator.\n */\nexport interface SyncSchedulerStatus {\n  readonly state: SyncSchedulerState\n  readonly lastPushAt: string | null\n  readonly lastPullAt: string | null\n  readonly lastError: Error | null\n  readonly pendingWrites: number\n  /**\n   * Per-collection readiness. Empty unless `pull.mode === 'phased'`.\n   *\n   * A collection the sequence never names is **absent** from the map, and\n   * `undefined` means *\"no claim made\"* — never a reason to gate a UI.\n   */\n  readonly readiness: ReadonlyMap<string, ReadinessState>\n  /** 1-based position in the sequence, or `null` outside a phased run. */\n  readonly phase: { readonly index: number; readonly total: number } | null\n}\n\n/**\n * Callbacks injected into `SyncScheduler` by the SyncEngine.\n *\n * The scheduler owns timers and lifecycle hooks; it delegates actual push/pull\n * work to these callbacks to stay decoupled from the sync implementation.\n */\nexport interface SyncSchedulerCallbacks {\n  push(): Promise<void>\n  /**\n   * @param collections - Narrow the pull to these collections. Passed by a\n   * `'phased'` sequence, one collection per phase; omitted for a whole-vault pull.\n   * @returns Whether the pull may be treated as complete. Returning `void` reads\n   * as `'complete'`, so callers with nothing to report need not opt in.\n   */\n  pull(collections?: readonly string[]): Promise<PullPhaseOutcome | void>\n  getDirtyCount(): number\n}\n\n/**\n * Reject a policy that cannot mean anything, at construction rather than on\n * the first tick. Module-private: `SyncScheduler` is the choke point every\n * policy that can actually schedule must pass through — primary and per-target\n * alike — so validating here needs no new public surface and costs the kernel\n * floor nothing.\n */\nfunction validatePullPolicy(pull: PullPolicy): void {\n  if (pull.mode !== 'phased') {\n    if (pull.sequence !== undefined) {\n      throw new Error(\n        `syncPolicy.pull.sequence is only meaningful with mode: 'phased' (got '${pull.mode}'). ` +\n          `Set mode: 'phased' to run the sequence, or drop the field.`,\n      )\n    }\n    return\n  }\n\n  const { sequence } = pull\n  if (!sequence || sequence.length === 0) {\n    throw new Error(\n      `syncPolicy.pull.mode: 'phased' requires a non-empty 'sequence' of collection names.`,\n    )\n  }\n  for (const name of sequence) {\n    if (typeof name !== 'string' || name.length === 0) {\n      throw new Error(\n        `syncPolicy.pull.sequence entries must be non-empty collection names (got ${JSON.stringify(name)}).`,\n      )\n    }\n  }\n  const duplicate = sequence.find((name, i) => sequence.indexOf(name) !== i)\n  if (duplicate !== undefined) {\n    throw new Error(\n      `syncPolicy.pull.sequence lists \"${duplicate}\" more than once. ` +\n        `Each collection is pulled whole, so a repeat does no additional work.`,\n    )\n  }\n}\n\n/**\n * Manages sync timing according to a `SyncPolicy`.\n *\n * The scheduler owns all timers and lifecycle hooks. It delegates actual\n * push/pull work to callbacks provided by the SyncEngine.\n */\nexport class SyncScheduler {\n  private readonly policy: SyncPolicy\n  private readonly callbacks: SyncSchedulerCallbacks\n\n  private _state: SyncSchedulerState = 'idle'\n  private _lastPushAt: string | null = null\n  private _lastPullAt: string | null = null\n  private _lastError: Error | null = null\n  private _lastPushTime = 0 // monotonic ms for minIntervalMs enforcement\n\n  // Phased-pull progress. Empty for every other mode, so non-adopters carry\n  // an empty Map and a null — no per-read cost, nothing to interpret.\n  private readonly _readiness = new Map<string, ReadinessState>()\n  private _phase: { readonly index: number; readonly total: number } | null = null\n\n  // Timers\n  private debounceTimer: ReturnType<typeof setTimeout> | null = null\n  private pushIntervalTimer: ReturnType<typeof setInterval> | null = null\n  private pullIntervalTimer: ReturnType<typeof setInterval> | null = null\n\n  // Bound handlers for cleanup\n  private readonly boundOnVisibilityChange: (() => void) | null = null\n  private readonly boundOnBeforeExit: (() => void) | null = null\n  private readonly boundOnPageHide: (() => void) | null = null\n\n  private started = false\n\n  constructor(policy: SyncPolicy, callbacks: SyncSchedulerCallbacks) {\n    validatePullPolicy(policy.pull)\n    this.policy = policy\n    this.callbacks = callbacks\n\n    // Pre-bind handlers\n    if (this.shouldRegisterUnload()) {\n      this.boundOnVisibilityChange = this.handleVisibilityChange.bind(this)\n      this.boundOnPageHide = this.handlePageHide.bind(this)\n      this.boundOnBeforeExit = this.handleBeforeExit.bind(this)\n    }\n  }\n\n  /** Current scheduler status snapshot. */\n  get status(): SyncSchedulerStatus {\n    return {\n      state: this._state,\n      lastPushAt: this._lastPushAt,\n      lastPullAt: this._lastPullAt,\n      lastError: this._lastError,\n      pendingWrites: this.callbacks.getDirtyCount(),\n      // Copied, not aliased — a status snapshot must not mutate under its reader.\n      readiness: new Map(this._readiness),\n      phase: this._phase,\n    }\n  }\n\n  /** Start the scheduler — registers timers, event listeners. */\n  start(): void {\n    if (this.started) return\n    this.started = true\n\n    // Push: interval mode\n    if (this.policy.push.mode === 'interval' && this.policy.push.intervalMs) {\n      this.pushIntervalTimer = setInterval(() => {\n        void this.executePush()\n      }, this.policy.push.intervalMs)\n    }\n\n    // Pull: interval mode\n    if (this.policy.pull.mode === 'interval') {\n      this.startPullInterval()\n    }\n\n    // Pull: phased mode — walk the sequence in order, then settle into steady\n    // state. Unawaited by design: start() is synchronous and the caller\n    // (vault open) must not block on a bootstrap pull.\n    if (this.policy.pull.mode === 'phased') {\n      const sequence = this.policy.pull.sequence ?? []\n      // Every named collection is 'cold' from the moment we start, so a reader\n      // that races the first phase sees \"not ready\", never a missing entry.\n      for (const collection of sequence) this._readiness.set(collection, 'cold')\n      void this.runSequence(sequence)\n    }\n\n    // Pull: on-focus mode\n    if (this.policy.pull.mode === 'on-focus' && typeof document !== 'undefined') {\n      document.addEventListener('visibilitychange', this.handleFocusPull)\n    }\n\n    // Unload hooks\n    if (this.shouldRegisterUnload()) {\n      if (typeof document !== 'undefined' && this.boundOnVisibilityChange) {\n        document.addEventListener('visibilitychange', this.boundOnVisibilityChange)\n      }\n      if (typeof globalThis.addEventListener === 'function' && this.boundOnPageHide) {\n        globalThis.addEventListener('pagehide', this.boundOnPageHide)\n      }\n      if (typeof process !== 'undefined' && this.boundOnBeforeExit) {\n        process.on('beforeExit', this.boundOnBeforeExit)\n      }\n    }\n  }\n\n  /** Stop the scheduler — clears timers, removes event listeners. */\n  stop(): void {\n    if (!this.started) return\n    this.started = false\n\n    // A sequence cut mid-phase must not leave that collection 'pulling' —\n    // a reader would show a skeleton that never resolves.\n    for (const [collection, state] of this._readiness) {\n      if (state === 'pulling') this._readiness.set(collection, 'cold')\n    }\n    this._phase = null\n\n    if (this.debounceTimer) {\n      clearTimeout(this.debounceTimer)\n      this.debounceTimer = null\n    }\n    if (this.pushIntervalTimer) {\n      clearInterval(this.pushIntervalTimer)\n      this.pushIntervalTimer = null\n    }\n    if (this.pullIntervalTimer) {\n      clearInterval(this.pullIntervalTimer)\n      this.pullIntervalTimer = null\n    }\n\n    // Focus pull\n    if (this.policy.pull.mode === 'on-focus' && typeof document !== 'undefined') {\n      document.removeEventListener('visibilitychange', this.handleFocusPull)\n    }\n\n    // Unload hooks\n    if (typeof document !== 'undefined' && this.boundOnVisibilityChange) {\n      document.removeEventListener('visibilitychange', this.boundOnVisibilityChange)\n    }\n    if (typeof globalThis.removeEventListener === 'function' && this.boundOnPageHide) {\n      globalThis.removeEventListener('pagehide', this.boundOnPageHide)\n    }\n    if (typeof process !== 'undefined' && this.boundOnBeforeExit) {\n      process.removeListener('beforeExit', this.boundOnBeforeExit)\n    }\n  }\n\n  /**\n   * Notify the scheduler that a local write occurred.\n   * For `on-change` mode: triggers immediate push (respecting minIntervalMs).\n   * For `debounce` mode: resets the debounce timer.\n   * For `manual` / `interval`: no-op.\n   */\n  notifyChange(): void {\n    if (!this.started) return\n\n    if (this.policy.push.mode === 'on-change') {\n      void this.executePush()\n    } else if (this.policy.push.mode === 'debounce') {\n      this.resetDebounce()\n    }\n  }\n\n  /** Force an immediate push, bypassing the scheduler. */\n  async forcePush(): Promise<void> {\n    await this.executePush()\n  }\n\n  /** Force an immediate pull, bypassing the scheduler. */\n  async forcePull(): Promise<void> {\n    await this.executePull()\n  }\n\n  // ─── Internal ─────────────────────────────────────────────────────\n\n  /**\n   * Arm the steady-state pull timer, if the policy specifies a cadence.\n   * Shared by `'interval'` mode and by `'phased'` once its sequence drains.\n   */\n  private startPullInterval(): void {\n    if (this.pullIntervalTimer || !this.policy.pull.intervalMs) return\n    this.pullIntervalTimer = setInterval(() => {\n      void this.executePull()\n    }, this.policy.pull.intervalMs)\n  }\n\n  /**\n   * Pull each collection in turn, then hand over to steady state.\n   *\n   * Strictly sequential — running phases concurrently would defeat the\n   * prioritisation that is the entire point of a sequence. Each phase is an\n   * ordinary scoped pull, so a phase that reports errors does not abort the\n   * ones behind it; `executePull` records the failure and the walk continues.\n   * `started` is re-checked between phases so `stop()` cuts a sequence short\n   * instead of letting it run on against a closed vault.\n   */\n  private async runSequence(sequence: readonly string[]): Promise<void> {\n    for (const [i, collection] of sequence.entries()) {\n      if (!this.started) return\n      this._readiness.set(collection, 'pulling')\n      this._phase = { index: i + 1, total: sequence.length }\n\n      const outcome = await this.executePull([collection])\n\n      // 'live' only on a clean phase. Anything else — reported errors, a\n      // role-gated skip, a throw — goes back to 'cold', because 'live' is a\n      // promise that a miss from get() is a real absence.\n      this._readiness.set(collection, outcome === 'complete' ? 'live' : 'cold')\n    }\n    this._phase = null\n    if (this.started) this.startPullInterval()\n  }\n\n  private async executePush(): Promise<void> {\n    if (this._state === 'pushing') return // already in progress\n\n    // minIntervalMs enforcement\n    const minInterval = this.policy.push.minIntervalMs ?? 0\n    if (minInterval > 0) {\n      const elapsed = Date.now() - this._lastPushTime\n      if (elapsed < minInterval) {\n        // Schedule for later if debounce mode\n        if (this.policy.push.mode === 'debounce') {\n          this.scheduleDebounce(minInterval - elapsed)\n        }\n        return\n      }\n    }\n\n    // Nothing to push\n    if (this.callbacks.getDirtyCount() === 0) {\n      this._state = 'idle'\n      return\n    }\n\n    this._state = 'pushing'\n    try {\n      await this.callbacks.push()\n      this._lastPushAt = new Date().toISOString()\n      this._lastPushTime = Date.now()\n      this._lastError = null\n      this._state = this.callbacks.getDirtyCount() > 0 ? 'pending' : 'idle'\n    } catch (err) {\n      this._lastError = err instanceof Error ? err : new Error(String(err))\n      this._state = 'error'\n    }\n  }\n\n  private async executePull(collections?: readonly string[]): Promise<PullPhaseOutcome> {\n    if (this._state === 'pulling') return 'incomplete'\n\n    const previousState = this._state\n    this._state = 'pulling'\n    try {\n      const outcome = await this.callbacks.pull(collections)\n      this._lastPullAt = new Date().toISOString()\n      this._lastError = null\n      this._state = previousState === 'pending' ? 'pending' : 'idle'\n      return outcome ?? 'complete'\n    } catch (err) {\n      this._lastError = err instanceof Error ? err : new Error(String(err))\n      this._state = 'error'\n      return 'incomplete'\n    }\n  }\n\n  private resetDebounce(): void {\n    if (this.debounceTimer) clearTimeout(this.debounceTimer)\n    const ms = this.policy.push.debounceMs ?? 30_000\n    this._state = 'pending'\n    this.scheduleDebounce(ms)\n  }\n\n  private scheduleDebounce(ms: number): void {\n    if (this.debounceTimer) clearTimeout(this.debounceTimer)\n    this.debounceTimer = setTimeout(() => {\n      this.debounceTimer = null\n      void this.executePush()\n    }, ms)\n  }\n\n  private shouldRegisterUnload(): boolean {\n    const onUnload = this.policy.push.onUnload\n    if (onUnload !== undefined) return onUnload\n    return this.policy.push.mode !== 'manual'\n  }\n\n  // ─── Event handlers ───────────────────────────────────────────────\n\n  private handleVisibilityChange(): void {\n    if (typeof document !== 'undefined' && document.visibilityState === 'hidden') {\n      this.fireUnloadPush()\n    }\n  }\n\n  private handlePageHide(): void {\n    this.fireUnloadPush()\n  }\n\n  private handleBeforeExit(): void {\n    this.fireUnloadPush()\n  }\n\n  private handleFocusPull = (): void => {\n    if (typeof document !== 'undefined' && document.visibilityState === 'visible') {\n      void this.executePull()\n    }\n  }\n\n  private fireUnloadPush(): void {\n    if (this.callbacks.getDirtyCount() === 0) return\n    // Best-effort synchronous-ish push on unload\n    void this.callbacks.push().catch(() => {})\n  }\n}\n","/**\n * Strategy seam for the optional sync engine + presence service.\n * Core imports `SyncStrategy` type-only + `NO_SYNC` stub; the real\n * `SyncEngine`, `SyncTransaction`, and `PresenceHandle` constructors\n * are only reachable via `withSync()` in `./sync-active.ts`.\n *\n * Solo apps that never configure `sync` and never call\n * `collection.presence()` ship none of the ~856 LOC behind this seam\n * (`sync.ts` + `sync-transaction.ts` + `presence.ts`).\n *\n * Note: `keyring.ts` (~746 LOC) stays in core because it's required\n * for any multi-user vault — even single-owner vaults use a keyring\n * to wrap the DEK. The team package's grant/revoke/magic-link/\n * delegation modules tree-shake naturally via direct named imports.\n *\n * Behavior under NO_SYNC:\n *\n * - **buildSyncEngine** — throws. Only fires when `createNoydb({ sync })`\n *   passes a remote target.\n * - **buildSyncTransaction** — throws. Only fires when `db.transaction(vault)`\n *   is called on a vault with sync configured.\n * - **buildPresence** — throws. Only fires when user code calls\n *   `collection.presence()`.\n *\n * @internal\n */\n\nimport type {\n  NoydbStore,\n  ConflictStrategy,\n  SyncTargetRole,\n} from '../kernel/types.js'\nimport type { MergeAuthority } from '../port/with/merge-authority.js'\nimport type { NoydbEventEmitter } from '../kernel/events.js'\nimport type { SyncPolicy } from '../kernel/sync-policy.js'\nimport type { SyncEngine } from './engine.js'\nimport type { SyncTransaction } from './transaction.js'\nimport type { PresenceHandle, PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\n\n/**\n * Options accepted by `SyncStrategy.buildSyncEngine`. Mirrors the\n * `SyncEngine` constructor verbatim — kept here so core code never\n * imports the sync module at runtime.\n *\n * @internal\n */\nexport interface BuildSyncEngineOptions {\n  local: NoydbStore\n  remote: NoydbStore\n  vault: string\n  strategy: ConflictStrategy\n  emitter: NoydbEventEmitter\n  syncPolicy?: SyncPolicy\n  role?: SyncTargetRole\n  label?: string\n  /** #1042 — the merge's verify/re-stamp capability, bound to the keys by the caller. */\n  mergeAuthority?: MergeAuthority\n}\n\n/**\n * @internal\n */\nexport interface SyncStrategy {\n  buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine\n  buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction\n  buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the sync strategy. Import ` +\n    '`{ withSync }` from \"@noy-db/hub/sync\" and pass it to ' +\n    '`createNoydb({ syncStrategy: withSync() })`.',\n  )\n}\n\n/**\n * No-sync stub. Every constructor throws with an actionable pointer\n * — there is no useful \"off\" mode for sync engine / presence /\n * sync-transaction; if the consumer reached one of these surfaces,\n * they intended to use it.\n *\n * @internal\n */\nexport const NO_SYNC: SyncStrategy = {\n  buildSyncEngine() { throw notEnabled('SyncEngine') },\n  buildSyncTransaction() { throw notEnabled('SyncTransaction') },\n  buildPresence() { throw notEnabled('collection.presence()') },\n}\n"],"mappings":";AAgIO,IAAM,uBAAmC;AAAA,EAC9C,MAAM,EAAE,MAAM,aAAa,eAAe,GAAG,UAAU,KAAK;AAAA,EAC5D,MAAM,EAAE,MAAM,SAAS;AACzB;AAGO,IAAM,mBAA+B;AAAA,EAC1C,MAAM,EAAE,MAAM,YAAY,YAAY,KAAQ,eAAe,MAAS,UAAU,KAAK;AAAA,EACrF,MAAM,EAAE,MAAM,YAAY,YAAY,IAAO;AAC/C;AAmFA,SAAS,mBAAmB,MAAwB;AAClD,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,KAAK,aAAa,QAAW;AAC/B,YAAM,IAAI;AAAA,QACR,yEAAyE,KAAK,IAAI;AAAA,MAEpF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,IAAI;AACrB,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,aAAW,QAAQ,UAAU;AAC3B,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,YAAM,IAAI;AAAA,QACR,4EAA4E,KAAK,UAAU,IAAI,CAAC;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,SAAS,KAAK,CAAC,MAAM,MAAM,SAAS,QAAQ,IAAI,MAAM,CAAC;AACzE,MAAI,cAAc,QAAW;AAC3B,UAAM,IAAI;AAAA,MACR,mCAAmC,SAAS;AAAA,IAE9C;AAAA,EACF;AACF;AAQO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EAET,SAA6B;AAAA,EAC7B,cAA6B;AAAA,EAC7B,cAA6B;AAAA,EAC7B,aAA2B;AAAA,EAC3B,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIP,aAAa,oBAAI,IAA4B;AAAA,EACtD,SAAoE;AAAA;AAAA,EAGpE,gBAAsD;AAAA,EACtD,oBAA2D;AAAA,EAC3D,oBAA2D;AAAA;AAAA,EAGlD,0BAA+C;AAAA,EAC/C,oBAAyC;AAAA,EACzC,kBAAuC;AAAA,EAEhD,UAAU;AAAA,EAElB,YAAY,QAAoB,WAAmC;AACjE,uBAAmB,OAAO,IAAI;AAC9B,SAAK,SAAS;AACd,SAAK,YAAY;AAGjB,QAAI,KAAK,qBAAqB,GAAG;AAC/B,WAAK,0BAA0B,KAAK,uBAAuB,KAAK,IAAI;AACpE,WAAK,kBAAkB,KAAK,eAAe,KAAK,IAAI;AACpD,WAAK,oBAAoB,KAAK,iBAAiB,KAAK,IAAI;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,SAA8B;AAChC,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK,UAAU,cAAc;AAAA;AAAA,MAE5C,WAAW,IAAI,IAAI,KAAK,UAAU;AAAA,MAClC,OAAO,KAAK;AAAA,IACd;AAAA,EACF;AAAA;AAAA,EAGA,QAAc;AACZ,QAAI,KAAK,QAAS;AAClB,SAAK,UAAU;AAGf,QAAI,KAAK,OAAO,KAAK,SAAS,cAAc,KAAK,OAAO,KAAK,YAAY;AACvE,WAAK,oBAAoB,YAAY,MAAM;AACzC,aAAK,KAAK,YAAY;AAAA,MACxB,GAAG,KAAK,OAAO,KAAK,UAAU;AAAA,IAChC;AAGA,QAAI,KAAK,OAAO,KAAK,SAAS,YAAY;AACxC,WAAK,kBAAkB;AAAA,IACzB;AAKA,QAAI,KAAK,OAAO,KAAK,SAAS,UAAU;AACtC,YAAM,WAAW,KAAK,OAAO,KAAK,YAAY,CAAC;AAG/C,iBAAW,cAAc,SAAU,MAAK,WAAW,IAAI,YAAY,MAAM;AACzE,WAAK,KAAK,YAAY,QAAQ;AAAA,IAChC;AAGA,QAAI,KAAK,OAAO,KAAK,SAAS,cAAc,OAAO,aAAa,aAAa;AAC3E,eAAS,iBAAiB,oBAAoB,KAAK,eAAe;AAAA,IACpE;AAGA,QAAI,KAAK,qBAAqB,GAAG;AAC/B,UAAI,OAAO,aAAa,eAAe,KAAK,yBAAyB;AACnE,iBAAS,iBAAiB,oBAAoB,KAAK,uBAAuB;AAAA,MAC5E;AACA,UAAI,OAAO,WAAW,qBAAqB,cAAc,KAAK,iBAAiB;AAC7E,mBAAW,iBAAiB,YAAY,KAAK,eAAe;AAAA,MAC9D;AACA,UAAI,OAAO,YAAY,eAAe,KAAK,mBAAmB;AAC5D,gBAAQ,GAAG,cAAc,KAAK,iBAAiB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,OAAa;AACX,QAAI,CAAC,KAAK,QAAS;AACnB,SAAK,UAAU;AAIf,eAAW,CAAC,YAAY,KAAK,KAAK,KAAK,YAAY;AACjD,UAAI,UAAU,UAAW,MAAK,WAAW,IAAI,YAAY,MAAM;AAAA,IACjE;AACA,SAAK,SAAS;AAEd,QAAI,KAAK,eAAe;AACtB,mBAAa,KAAK,aAAa;AAC/B,WAAK,gBAAgB;AAAA,IACvB;AACA,QAAI,KAAK,mBAAmB;AAC1B,oBAAc,KAAK,iBAAiB;AACpC,WAAK,oBAAoB;AAAA,IAC3B;AACA,QAAI,KAAK,mBAAmB;AAC1B,oBAAc,KAAK,iBAAiB;AACpC,WAAK,oBAAoB;AAAA,IAC3B;AAGA,QAAI,KAAK,OAAO,KAAK,SAAS,cAAc,OAAO,aAAa,aAAa;AAC3E,eAAS,oBAAoB,oBAAoB,KAAK,eAAe;AAAA,IACvE;AAGA,QAAI,OAAO,aAAa,eAAe,KAAK,yBAAyB;AACnE,eAAS,oBAAoB,oBAAoB,KAAK,uBAAuB;AAAA,IAC/E;AACA,QAAI,OAAO,WAAW,wBAAwB,cAAc,KAAK,iBAAiB;AAChF,iBAAW,oBAAoB,YAAY,KAAK,eAAe;AAAA,IACjE;AACA,QAAI,OAAO,YAAY,eAAe,KAAK,mBAAmB;AAC5D,cAAQ,eAAe,cAAc,KAAK,iBAAiB;AAAA,IAC7D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAqB;AACnB,QAAI,CAAC,KAAK,QAAS;AAEnB,QAAI,KAAK,OAAO,KAAK,SAAS,aAAa;AACzC,WAAK,KAAK,YAAY;AAAA,IACxB,WAAW,KAAK,OAAO,KAAK,SAAS,YAAY;AAC/C,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAA2B;AAC/B,UAAM,KAAK,YAAY;AAAA,EACzB;AAAA;AAAA,EAGA,MAAM,YAA2B;AAC/B,UAAM,KAAK,YAAY;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,oBAA0B;AAChC,QAAI,KAAK,qBAAqB,CAAC,KAAK,OAAO,KAAK,WAAY;AAC5D,SAAK,oBAAoB,YAAY,MAAM;AACzC,WAAK,KAAK,YAAY;AAAA,IACxB,GAAG,KAAK,OAAO,KAAK,UAAU;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,YAAY,UAA4C;AACpE,eAAW,CAAC,GAAG,UAAU,KAAK,SAAS,QAAQ,GAAG;AAChD,UAAI,CAAC,KAAK,QAAS;AACnB,WAAK,WAAW,IAAI,YAAY,SAAS;AACzC,WAAK,SAAS,EAAE,OAAO,IAAI,GAAG,OAAO,SAAS,OAAO;AAErD,YAAM,UAAU,MAAM,KAAK,YAAY,CAAC,UAAU,CAAC;AAKnD,WAAK,WAAW,IAAI,YAAY,YAAY,aAAa,SAAS,MAAM;AAAA,IAC1E;AACA,SAAK,SAAS;AACd,QAAI,KAAK,QAAS,MAAK,kBAAkB;AAAA,EAC3C;AAAA,EAEA,MAAc,cAA6B;AACzC,QAAI,KAAK,WAAW,UAAW;AAG/B,UAAM,cAAc,KAAK,OAAO,KAAK,iBAAiB;AACtD,QAAI,cAAc,GAAG;AACnB,YAAM,UAAU,KAAK,IAAI,IAAI,KAAK;AAClC,UAAI,UAAU,aAAa;AAEzB,YAAI,KAAK,OAAO,KAAK,SAAS,YAAY;AACxC,eAAK,iBAAiB,cAAc,OAAO;AAAA,QAC7C;AACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,KAAK,UAAU,cAAc,MAAM,GAAG;AACxC,WAAK,SAAS;AACd;AAAA,IACF;AAEA,SAAK,SAAS;AACd,QAAI;AACF,YAAM,KAAK,UAAU,KAAK;AAC1B,WAAK,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC1C,WAAK,gBAAgB,KAAK,IAAI;AAC9B,WAAK,aAAa;AAClB,WAAK,SAAS,KAAK,UAAU,cAAc,IAAI,IAAI,YAAY;AAAA,IACjE,SAAS,KAAK;AACZ,WAAK,aAAa,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AACpE,WAAK,SAAS;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,aAA4D;AACpF,QAAI,KAAK,WAAW,UAAW,QAAO;AAEtC,UAAM,gBAAgB,KAAK;AAC3B,SAAK,SAAS;AACd,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,UAAU,KAAK,WAAW;AACrD,WAAK,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC1C,WAAK,aAAa;AAClB,WAAK,SAAS,kBAAkB,YAAY,YAAY;AACxD,aAAO,WAAW;AAAA,IACpB,SAAS,KAAK;AACZ,WAAK,aAAa,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AACpE,WAAK,SAAS;AACd,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,gBAAsB;AAC5B,QAAI,KAAK,cAAe,cAAa,KAAK,aAAa;AACvD,UAAM,KAAK,KAAK,OAAO,KAAK,cAAc;AAC1C,SAAK,SAAS;AACd,SAAK,iBAAiB,EAAE;AAAA,EAC1B;AAAA,EAEQ,iBAAiB,IAAkB;AACzC,QAAI,KAAK,cAAe,cAAa,KAAK,aAAa;AACvD,SAAK,gBAAgB,WAAW,MAAM;AACpC,WAAK,gBAAgB;AACrB,WAAK,KAAK,YAAY;AAAA,IACxB,GAAG,EAAE;AAAA,EACP;AAAA,EAEQ,uBAAgC;AACtC,UAAM,WAAW,KAAK,OAAO,KAAK;AAClC,QAAI,aAAa,OAAW,QAAO;AACnC,WAAO,KAAK,OAAO,KAAK,SAAS;AAAA,EACnC;AAAA;AAAA,EAIQ,yBAA+B;AACrC,QAAI,OAAO,aAAa,eAAe,SAAS,oBAAoB,UAAU;AAC5E,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,iBAAuB;AAC7B,SAAK,eAAe;AAAA,EACtB;AAAA,EAEQ,mBAAyB;AAC/B,SAAK,eAAe;AAAA,EACtB;AAAA,EAEQ,kBAAkB,MAAY;AACpC,QAAI,OAAO,aAAa,eAAe,SAAS,oBAAoB,WAAW;AAC7E,WAAK,KAAK,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,iBAAuB;AAC7B,QAAI,KAAK,UAAU,cAAc,MAAM,EAAG;AAE1C,SAAK,KAAK,UAAU,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC3C;AACF;;;ACpfA,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAGP;AACF;AAUO,IAAM,UAAwB;AAAA,EACnC,kBAAkB;AAAE,UAAM,WAAW,YAAY;AAAA,EAAE;AAAA,EACnD,uBAAuB;AAAE,UAAM,WAAW,iBAAiB;AAAA,EAAE;AAAA,EAC7D,gBAAgB;AAAE,UAAM,WAAW,uBAAuB;AAAA,EAAE;AAC9D;","names":[]}

package/dist/chunk-UA372JHH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-commit/tx/atomic-eligibility.ts","../src/kernel/best-effort-revert.ts","../src/kernel/tx-write-gate.ts","../src/with-commit/tx/transaction.ts"],"sourcesContent":["/**\n * #893/#906-prep — the atomic-commit eligibility gate.\n *\n * `runTransaction` (Task 5) consults `canCommitAtomically` right after the\n * body returns, to decide whether the whole staged batch can be prepared and\n * submitted as ONE `store.tx(ops)` call instead of the per-op abortable\n * path (Phase 1 pre-flight + Phase 2 Collection-layer execute + Phase 3\n * best-effort revert — see `transaction.ts`'s module doc).\n *\n * Pure decision logic: no side effects, no store reads. Every input is\n * already sitting on `db` / `ctx`.\n *\n * ALL of the following must hold. (Commit-time changeset invariants are NOT a\n * condition: that phase lives after Phase 2 in `runTransaction` and runs\n * unchanged on either path — a failing invariant reverts the atomic batch\n * through the same `ctx._executed` plan.)\n *\n *  1. The store declares `capabilities.txAtomic === true` AND implements\n *     `tx()`. Both — mirrors the pairing rule `bestEffortRevert` already\n *     enforces (`kernel/best-effort-revert.ts:78`): an undeclared `tx()` is\n *     never used, even if present.\n *  2. Not an amendment transaction (`ctx._amendment === false`) — amendments\n *     need the guard-registry change-set + invariant machinery the atomic\n *     path skips entirely.\n *  3. No `(vault, collection, id)` is touched twice in the batch. The\n *     abortable path's Phase 1 snapshots each key once and Phase 2 replays\n *     every op against that same snapshot in order; a single `store.tx()`\n *     write set can't express \"this key changes twice in sequence.\"\n *  4. Every touched collection reports `_txAtomicSafe(op.type)` — see that\n *     method's doc comment on `Collection` for what it excludes and why.\n *     #931: of the wrapper-level write signals, only a live `onBeforeWrite`\n *     hook still excludes — it may REFUSE a write, which only\n *     `Collection.put()`/`.delete()` honors. After-hooks and the\n *     `afterPut`/`afterDelete` observe bus are refusal-free observers, so\n *     the atomic path fires them itself per leg post-finalize\n *     (`Collection._fireAtomicAfterWrite`) instead of forfeiting the batch.\n *     Delete gates on the enforcer's `_deleteCascadesPossible(name)` (#922):\n *     `Vault.enforceRefsOnDelete` cascades from THREE sources (lookup-ref\n *     edges, classic inbound refs, managed-link `onDelete`), and the Vault\n *     predicate unions exactly those three — a `getInbound`-only check would\n *     be narrower and wrongly admit unsafe atomic deletes, because\n *     `_prepareDelete` runs the cascades DURING prepare (see\n *     `with-shape/links/vault-facade.ts` `enforceRefsOnDelete`).\n *\n * @internal\n */\n\nimport type { Noydb } from '../../kernel/noydb.js'\nimport type { TxContext } from './transaction.js'\nimport { keyOf } from './transaction.js'\n\nexport function canCommitAtomically(db: Noydb, ctx: TxContext): boolean {\n  const store = db._store\n  if (store.capabilities?.txAtomic !== true || typeof store.tx !== 'function') return false\n  if (ctx._amendment) return false\n\n  const seen = new Set<string>()\n  for (const op of ctx._ops) {\n    const key = keyOf(op)\n    if (seen.has(key)) return false\n    seen.add(key)\n  }\n\n  for (const op of ctx._ops) {\n    const coll = db.vault(op.vaultName).collection(op.collectionName)\n    if (!coll._txAtomicSafe(op.type)) return false\n  }\n\n  return true\n}\n","/**\n * Best-effort reverse-revert — the shape shared by two independent rollback\n * paths that used to duplicate it: satellite fan-out\n * (`with-shape/satellites/fanout.ts`'s `revertAndCompensate`) and\n * multi-record transactions (`with-commit/tx/transaction.ts`'s\n * `revertExecuted`). Both revert a list of already-executed writes on\n * failure by walking them in REVERSE order and, per leg, restoring the\n * captured prior envelope straight through the raw adapter — `put(prior)`\n * when one existed, `delete` when the leg was a fresh insert — bypassing\n * the Collection layer so the revert itself doesn't re-fire\n * encryption/ledger/change-event machinery. Each leg's raw-adapter revert\n * is best-effort: a throw is swallowed so a revert-path failure never masks\n * the original error that triggered the rollback, and the loop moves on to\n * the next leg.\n *\n * An optional per-leg `compensate` callback runs immediately after a\n * successful raw-adapter revert (still inside the same try, so a throwing\n * callback is swallowed the same way as a throwing raw revert). What the\n * callback does is entirely caller-defined — satellites' fan-out fires\n * `_compensateRevertedWrite` only for legs whose write actually landed\n * (#596); with-commit's transaction executor invalidates the Collection\n * cache. Neither concern belongs here: this helper only knows the generic\n * reverse/best-effort/raw-revert shape.\n *\n * Lives in `kernel/` — not a `with-*` service — so both consumers (one a\n * gated service, `with-commit`; one an always-on schema feature,\n * `with-shape/satellites`) can import it without creating a\n * `with-* → with-*` edge, which would force either family to always bundle\n * the other and defeat the opt-in tree-shaking both are built around.\n *\n * @internal — implementation-sharing only, not part of the public surface.\n */\nimport type { EncryptedEnvelope, StoreCapabilities, TxOp } from './types.js'\n\n/** One already-executed write a revert pass needs to unwind. */\nexport interface BestEffortRevertLeg {\n  readonly vaultName: string\n  readonly collectionName: string\n  readonly id: string\n  /** Envelope captured before the write, or `null` if the id didn't exist yet. */\n  readonly prior: EncryptedEnvelope | null\n}\n\n/** The subset of `NoydbStore` a raw-adapter revert needs. */\nexport interface BestEffortRevertAdapter {\n  put(vaultName: string, collectionName: string, id: string, envelope: EncryptedEnvelope): Promise<void>\n  delete(vaultName: string, collectionName: string, id: string): Promise<void>\n  /**\n   * Optional storage-layer transaction (#886). When the store declares\n   * `txAtomic`, the whole revert is submitted as ONE operation instead of a\n   * per-leg loop, so a crash mid-revert can no longer leave the vault\n   * half-unwound.\n   */\n  tx?(ops: readonly TxOp[]): Promise<void>\n  readonly capabilities?: StoreCapabilities\n}\n\n/**\n * Revert `executed` in reverse order via the raw adapter, best-effort.\n * `compensate`, when supplied, runs once per leg immediately after that\n * leg's own raw revert succeeds.\n */\nexport async function bestEffortRevert<T extends BestEffortRevertLeg>(\n  executed: readonly T[],\n  adapter: BestEffortRevertAdapter,\n  compensate?: (leg: T) => Promise<void> | void,\n): Promise<void> {\n  const legs = [...executed].reverse()\n\n  // #886 — atomic revert when the store can do it. The legs already carry RAW\n  // prior envelopes (captured pre-write), which is exactly the shape `tx()`\n  // wants, so this needs none of the Collection-layer machinery that makes\n  // delegating the FORWARD write path a much larger job.\n  //\n  // Failure stays best-effort: if the store rejects the batch we fall through\n  // to the per-leg loop rather than surfacing a revert-path error, because a\n  // revert failure must never mask the original error that triggered it.\n  if (adapter.capabilities?.txAtomic === true && typeof adapter.tx === 'function') {\n    const ops: TxOp[] = legs.map(leg =>\n      leg.prior !== null\n        ? { type: 'put', vault: leg.vaultName, collection: leg.collectionName, id: leg.id, envelope: leg.prior }\n        : { type: 'delete', vault: leg.vaultName, collection: leg.collectionName, id: leg.id },\n    )\n    try {\n      await adapter.tx(ops)\n      if (compensate) for (const leg of legs) { try { await compensate(leg) } catch { /* best-effort */ } }\n      return\n    } catch {\n      // fall through to the per-leg path below\n    }\n  }\n\n  for (const leg of legs) {\n    try {\n      if (leg.prior !== null) {\n        await adapter.put(leg.vaultName, leg.collectionName, leg.id, leg.prior)\n      } else {\n        await adapter.delete(leg.vaultName, leg.collectionName, leg.id)\n      }\n      if (compensate) await compensate(leg)\n    } catch {\n      // best-effort — a revert-path failure must not mask the original\n      // error that triggered the rollback (matches both callers' prior\n      // independent implementations).\n    }\n  }\n}\n","/**\n * #1420 — the in-flight-write gate.\n *\n * ## The defect this closes\n *\n * `runTransaction`'s commit opens with a **pre-flight**: it re-reads every\n * touched envelope and enforces the caller's `expectedVersion`. That check is\n * only as honest as the read, and the read could not see a plain\n * `Collection.put()` that had *started* but not yet reached the store. Such a\n * put is invisible to the pre-flight, so:\n *\n *   - it lands after the pre-flight and the transaction overwrites it from a\n *     stale snapshot (both writers report success, one write vanishes); or\n *   - it lands after the transaction's own write and clobbers it from a stale\n *     base (two writes, one version bump).\n *\n * Neither raised an error on either side, and the loss was **store-capability\n * dependent** — `to-memory` declares `txAtomic` and takes the atomic commit\n * path, `to-browser-idb` does not and takes the per-op replay — so an app\n * tested on a memory store could ship lossy on IndexedDB.\n *\n * ## The remedy: make the pre-flight's read honest\n *\n * Every logical `Collection.put()` / `.delete()` registers itself here for the\n * span of its read-modify-write, keyed by `(vault, collection, id)`. A commit\n * **drains** the writes already in flight on the keys it is about to touch,\n * BEFORE its pre-flight reads. The in-flight case then behaves exactly like\n * the fully-awaited one the pre-flight already handled correctly: the read\n * sees the new version and a mismatched `expectedVersion` refuses with\n * `ConflictError`. No silent loss, and no new refusal for writes that were\n * never in conflict.\n *\n * ## Why this is deadlock-free\n *\n * The wait is strictly one-directional and one-deep. A registered write never\n * waits on anything from this module — only a commit does, and only on writes\n * registered *before* it started draining ({@link drainKeyedWrites} takes a\n * snapshot and does not loop to a fixed point). So there is no cycle to close,\n * and the drain terminates as soon as the pre-existing writes settle,\n * whichever way they settle. A commit's own Phase-2 writes register *after*\n * the drain has returned, so a commit never waits on itself.\n *\n * ## Scope, deliberately\n *\n * Keyed on the STORE object, not the `Noydb` instance — two hub instances over\n * one store are the same race, and this keeps the always-on kernel files\n * (`noydb.ts`) untouched. Same-process only: it is a JS-object registry, and\n * makes no claim about a second tab or a second process. That is the same\n * boundary the reported defect has.\n *\n * ⛔ This does NOT serialize transaction against transaction. Two concurrent\n * commits touching one key can still interleave — a distinct case from the\n * reported one, and one whose fix (a commit barrier) has to solve reentrancy\n * for the commit's own replay writes first. Do not extend this module into\n * that without measuring the reentrancy path.\n *\n * @internal\n */\n\n/** store → key → the settle-promises of the writes currently in flight on it. */\nconst inFlight = new WeakMap<object, Map<string, Set<Promise<void>>>>()\n\n/** The shared `(vault, collection, id)` key shape. @internal */\nexport function writeGateKey(vault: string, collection: string, id: string): string {\n  return `${vault}\\x00${collection}\\x00${id}`\n}\n\n/**\n * Run one logical write registered against `(vault, collection, id)` so a\n * concurrent commit can drain it. Returns / throws exactly what `fn` does —\n * registration is invisible to the caller.\n *\n * @internal\n */\nexport async function trackKeyedWrite<R>(\n  store: object,\n  vault: string,\n  collection: string,\n  id: string,\n  fn: () => Promise<R>,\n): Promise<R> {\n  let byKey = inFlight.get(store)\n  if (byKey === undefined) {\n    byKey = new Map()\n    inFlight.set(store, byKey)\n  }\n  const key = writeGateKey(vault, collection, id)\n  let waiters = byKey.get(key)\n  if (waiters === undefined) {\n    waiters = new Set()\n    byKey.set(key, waiters)\n  }\n  const running = fn()\n  // A drainer must never inherit this write's rejection: it is waiting for the\n  // write to STOP being in flight, not for it to succeed. The original promise\n  // is what the caller gets, unswallowed.\n  const settled = running.then(() => undefined, () => undefined)\n  waiters.add(settled)\n  try {\n    return await running\n  } finally {\n    waiters.delete(settled)\n    if (waiters.size === 0) byKey.delete(key)\n  }\n}\n\n/**\n * Wait for every write already in flight on `keys` to settle. Snapshot-based\n * and single-pass — see the deadlock note in the module doc. A no-op (and no\n * microtask) when nothing is in flight, which is the overwhelmingly common\n * case for a commit.\n *\n * @internal\n */\nexport async function drainKeyedWrites(store: object, keys: Iterable<string>): Promise<void> {\n  const byKey = inFlight.get(store)\n  if (byKey === undefined || byKey.size === 0) return\n  let waits: Promise<void>[] | undefined\n  for (const key of keys) {\n    const waiters = byKey.get(key)\n    if (waiters === undefined) continue\n    for (const w of waiters) (waits ??= []).push(w)\n  }\n  if (waits !== undefined) await Promise.all(waits)\n}\n","/**\n * Multi-record atomic transactions.\n *\n * Lets an application stage writes across two or more collections (or\n * vaults) and commit them all-or-nothing.\n *\n * ```ts\n * await db.transaction(async (tx) => {\n *   const inv = tx.vault('acme').collection<Invoice>('invoices')\n *   const pay = tx.vault('acme').collection<Payment>('payments')\n *   await inv.put(invoiceId, { ...invoice, status: 'paid' })\n *   await pay.put(paymentId, { invoiceId, amount, paidAt })\n * })\n * // If the body throws before returning: nothing persisted.\n * // If the body returns: all puts committed; any CAS mismatch rolls\n * // the batch back and surfaces as ConflictError.\n * ```\n *\n * ## Atomicity semantics\n *\n * Ops are buffered during the body. On body-return the hub:\n *\n * 0. **Drain (#1420)** — waits out any plain `Collection.put()` /\n *    `.delete()` already in flight on a key this commit touches, so\n *    the pre-flight below reads a version that includes it. Without\n *    this the pre-flight cannot see a write that has STARTED but not\n *    yet reached the store, and one of the two writes vanishes with\n *    both reporting success.\n * 1. **Pre-flight** — re-reads every touched envelope and enforces\n *    any caller-supplied `expectedVersion`. A mismatch throws\n *    `ConflictError` with *no* writes performed.\n * 2. **Execute** — re-validates each op's `expectedVersion` against\n *    the CURRENT stored version (#1420 — the pre-flight's verdict is\n *    otherwise unchecked all the way to the write, and this path\n *    carries no store-level CAS the way the atomic one does), then\n *    calls `Collection.put()` / `.delete()` for each staged op in\n *    declaration order. History snapshots, ledger appends, and change\n *    events fire as normal per op.\n * 3. **Unwind on failure** — if step 2 throws mid-batch, each\n *    already-committed op is reverted via the raw store (restoring\n *    the captured prior envelope, or deleting if none existed). The\n *    ledger is NOT rewritten — audit history preserves the partial\n *    commit and the revert.\n *\n * **Atomic delegation (#906).** Steps 1–3 above describe the OCC\n * fallback. When the store declares `StoreCapabilities.txAtomic` AND\n * implements `tx()`, AND the staged batch is statically safe\n * (`canCommitAtomically` — see `atomic-eligibility.ts`), the commit\n * instead: prepares every op through `Collection._preparePut` /\n * `_prepareDelete` (encrypt, resolve the prior version, mint the #589\n * marker — no observable side effect), submits the whole write set as\n * ONE `store.tx(ops)` call with a per-leg `expectedVersion`, then\n * finalizes each op in staged order. The visible difference: history\n * snapshots, ledger entries and change events all fire AFTER the bytes\n * are durable, instead of interleaving per op.\n *\n * **Crash window.** On the OCC fallback, steps 2–3 are not a\n * storage-layer transaction — if the process dies between two executed\n * ops, the on-disk state is partial. The atomic path above closes that\n * window for the write set itself (`to-memory` and the SQL stores in\n * `noy-db-to` implement `tx()`); a crash between the batch landing and\n * the finalize loop finishing still leaves per-op side effects (history,\n * ledger, cache) incomplete. Stores that cannot commit a batch\n * atomically (file, S3) omit `tx()` and keep the fallback.\n *\n * ## Not covered\n *\n * - Cross-sync-peer atomicity. Transactions commit against the\n *   primary store only; the sync engine pushes on its normal\n *   schedule. For cross-peer two-phase commit use `SyncTransaction`\n * via `db.transaction(vaultName)`.\n * - Read-your-writes within the body. `tx.collection().get(id)`\n *   returns the most-recently-staged value for that id when one\n *   exists; if no staged op has touched the id, it reads the current\n *   committed state. Version numbers returned by `get` reflect the\n *   pre-transaction state (staged puts have no version yet).\n *\n * @module\n */\n\nimport type { Noydb } from '../../kernel/noydb.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EncryptedEnvelope, TxOp } from '../../kernel/types.js'\nimport type { PreparedPut, PreparedDelete } from '../../kernel/prepared-write.js'\nimport { canCommitAtomically } from './atomic-eligibility.js'\nimport {\n  AmendmentForbiddenError,\n  ConflictError,\n  InvariantError,\n  ValidationError,\n} from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport type { GuardExecutor as GuardExecutorModule } from '../../with-audit/guards/executor.js'\nimport type { LedgerEntry } from '../history/ledger/entry.js'\nimport type { TransactionInvariant } from './invariants.js'\nimport type { GuardChange, GuardContext, ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport { bestEffortRevert } from '../../kernel/best-effort-revert.js'\nimport { drainKeyedWrites } from '../../kernel/tx-write-gate.js'\n\n/** One op buffered inside a running `TxContext`. @internal */\nexport interface StagedOp {\n  type: 'put' | 'delete'\n  vaultName: string\n  collectionName: string\n  id: string\n  record?: unknown\n  expectedVersion?: number\n  /**\n   * Optional human-readable tag forwarded to the resulting ledger\n   * entry's `reason` field. Set by callers via\n   * `tx.vault(v).collection(c).put(id, record, { reason })`.\n   */\n  reason?: string\n}\n\n/**\n * One executed op (main staged op or recursive side-effect like a\n * derivation output) paired with the envelope captured before the write.\n * `revertExecuted` walks this array in reverse on rollback.\n * @internal\n */\nexport interface ExecutedOp {\n  op: StagedOp\n  priorEnvelope: EncryptedEnvelope | null\n}\n\n/**\n * Options accepted by `db.transaction({ amendment, reason }, fn)`.\n * Only the amendment variant uses these — a plain `db.transaction(fn)`\n * never sees this shape.\n */\nexport interface AmendmentTxOptions {\n  /** Opt into amendment mode. Required to be `true`. */\n  readonly amendment: true\n  /** Human-readable rationale recorded in the ledger entry. Required. */\n  readonly reason: string\n}\n\n/**\n * Transaction handle passed to the user's body. Use\n * `tx.vault(name).collection<T>(name)` to get a per-collection\n * facade; its `put`/`delete`/`get` calls stage ops against the tx.\n */\nexport class TxContext {\n  /** Stable id for this transaction; shared by all writes it performs. */\n  readonly txId: string = generateULID()\n  /** @internal */\n  readonly _ops: StagedOp[] = []\n  /**\n   * @internal — write log built up in Phase 2. Each entry records the\n   * envelope captured BEFORE the write so a mid-batch failure can\n   * restore prior state via `revertExecuted`. Side-effect writes (e.g.\n   * recursive derivation outputs fired inside `Collection.put`) are\n   * appended here in execution order so they roll back alongside the\n   * main staged ops.\n   */\n  readonly _executed: ExecutedOp[] = []\n  /** @internal */\n  readonly _db: Noydb\n  /**\n   * @internal — true when this TxContext was opened in amendment\n   * mode. Toggles the lazy-`beginAmendment` + role-check path on first\n   * `tx.vault(name)` and unlocks the post-Phase-2 invariant + audit run.\n   */\n  readonly _amendment: boolean\n  /** @internal — vaults that have already had `beginAmendment` called. */\n  readonly _amendmentVaults = new Map<string, Vault>()\n\n  /** @internal */\n  constructor(db: Noydb, amendment = false) {\n    this._db = db\n    this._amendment = amendment\n  }\n\n  /** Scope subsequent `collection()` calls to the named vault. */\n  vault(name: string): TxVault {\n    const v = this._db.vault(name)\n    if (this._amendment && !this._amendmentVaults.has(name)) {\n      // Role check is per-vault. The task spec (\"only admin or owner\n      // can open an amendment\") is implemented lazy-on-first-touch\n      // because the role lives on the vault's keyring, and `tx.vault()`\n      // is the first place we know which vault we're addressing. The\n      // observable effect is identical to an eager check in the single-\n      // vault case the tests exercise; multi-vault amendments check\n      // each touched vault as they first appear.\n      const role = v.role\n      // FR-6: custodian is admin-rank for operational mutations, and an\n      // amendment is an operational (data-correcting) act — not an ownership\n      // meta-capability — so custodian is allowed alongside owner/admin.\n      if (role !== 'admin' && role !== 'owner' && role !== 'custodian') {\n        throw new AmendmentForbiddenError(v.userId, role)\n      }\n      // Amendments require an initialised guard registry — they\n      // produce a structured invariant + change-set audit. A vault\n      // opened without `guardStrategies` (or via the sync fallback\n      // path) has a null registry and cannot run an amendment.\n      const reg = v._getGuardRegistry()\n      if (reg === null) {\n        throw new ValidationError(\n          `Vault \"${name}\": amendment mode requires at least one ` +\n          `guardStrategy registered via createNoydb({ guardStrategies }). ` +\n          `Open the vault with guardStrategies before calling ` +\n          `db.transaction({ amendment: true }).`,\n        )\n      }\n      reg.beginAmendment()\n      this._amendmentVaults.set(name, v)\n    }\n    return new TxVault(this, v)\n  }\n}\n\n/** Per-vault facade inside a running transaction. */\nexport class TxVault {\n  /** @internal */\n  readonly _ctx: TxContext\n  /** @internal */\n  readonly _vault: Vault\n\n  /** @internal */\n  constructor(ctx: TxContext, vault: Vault) {\n    this._ctx = ctx\n    this._vault = vault\n  }\n\n  /** Scope subsequent op calls to the named collection. */\n  collection<T>(name: string): TxCollection<T> {\n    const c = this._vault.collection<T>(name)\n    return new TxCollection<T>(this._ctx, this._vault, c, name)\n  }\n}\n\n/** Per-collection facade inside a running transaction. */\nexport class TxCollection<T> {\n  /** @internal */\n  readonly _ctx: TxContext\n  /** @internal */\n  readonly _vault: Vault\n  /** @internal */\n  readonly _coll: Collection<T>\n  /** @internal */\n  readonly _name: string\n\n  /** @internal */\n  constructor(ctx: TxContext, vault: Vault, coll: Collection<T>, name: string) {\n    this._ctx = ctx\n    this._vault = vault\n    this._coll = coll\n    this._name = name\n  }\n\n  /**\n   * Read the current committed value, or the most-recently-staged\n   * value from the same transaction if one exists.\n   */\n  async get(id: string): Promise<T | null> {\n    for (let i = this._ctx._ops.length - 1; i >= 0; i--) {\n      const op = this._ctx._ops[i]!\n      if (\n        op.vaultName === this._vault.name &&\n        op.collectionName === this._name &&\n        op.id === id\n      ) {\n        if (op.type === 'delete') return null\n        return op.record as T\n      }\n    }\n    return this._coll.get(id)\n  }\n\n  /**\n   * Stage a put. Does not write until the transaction body returns.\n   * Supply `{ expectedVersion }` to enforce optimistic concurrency\n   * during the commit pre-flight.\n   */\n  put(id: string, record: T, options?: { expectedVersion?: number; reason?: string }): void {\n    const op: StagedOp = {\n      type: 'put',\n      vaultName: this._vault.name,\n      collectionName: this._name,\n      id,\n      record,\n    }\n    if (options?.expectedVersion !== undefined) op.expectedVersion = options.expectedVersion\n    if (options?.reason !== undefined) op.reason = options.reason\n    this._ctx._ops.push(op)\n  }\n\n  /**\n   * Stage a delete. Does not write until the transaction body returns.\n   * Supply `{ expectedVersion }` to enforce optimistic concurrency\n   * during the commit pre-flight.\n   */\n  delete(id: string, options?: { expectedVersion?: number }): void {\n    const op: StagedOp = {\n      type: 'delete',\n      vaultName: this._vault.name,\n      collectionName: this._name,\n      id,\n    }\n    if (options?.expectedVersion !== undefined) op.expectedVersion = options.expectedVersion\n    this._ctx._ops.push(op)\n  }\n}\n\n/**\n * Commit plan: pre-flight check + execution + revert plan.\n *\n * @internal — driven by `withTransactions()` (via `tx/active.ts`) for\n * user-facing `db.transaction(...)` calls and by the `amendment` path\n * in `noydb.ts`. `Collection.putManyAtomic` runs its own Phase 2 loop\n * but shares the `_activeTxContext` mechanism (and the `revertExecuted`\n * helper) so nested side-effect derivation writes get registered for\n * revert alongside the bulk-put source ops.\n */\nexport async function runTransaction<T>(\n  db: Noydb,\n  fn: (tx: TxContext) => Promise<T> | T,\n  options?: AmendmentTxOptions,\n  txInvariants?: ReadonlyArray<TransactionInvariant>,\n): Promise<T> {\n  // ─── Amendment-mode pre-flight ───────────────────────────────\n  // `reason` is the only thing we can validate before the body runs;\n  // the per-vault role check happens lazily on first `tx.vault(name)`\n  // because we don't know which vaults the body will touch ahead of\n  // time. Throwing here keeps the failure mode close to the call site\n  // so the developer doesn't have to walk an async stack to find the\n  // missing-reason mistake.\n  if (options?.amendment) {\n    if (typeof options.reason !== 'string' || options.reason.trim().length === 0) {\n      throw new ValidationError(\n        'db.transaction({ amendment: true }) requires a non-empty `reason` string.',\n      )\n    }\n  }\n\n  const ctx = new TxContext(db, options?.amendment === true)\n  const bodyResult = await fn(ctx)\n\n  if (ctx._ops.length === 0) {\n    // Body produced no ops. If amendment mode was active we still\n    // need to close any opened windows so a subsequent (unrelated)\n    // write doesn't surprise-collect into a stale change-set. Each\n    // `beginAmendment` is matched by exactly one `consumeChanges`.\n    if (ctx._amendment) {\n      for (const v of ctx._amendmentVaults.values()) {\n        // Registry is guaranteed non-null here — `tx.vault(name)`\n        // threw above if it was null before adding to\n        // `_amendmentVaults`.\n        const reg = v._getGuardRegistry()\n        if (reg !== null) {\n          reg.consumeChanges()\n          reg.consumeMeta()\n        }\n      }\n    }\n    return bodyResult\n  }\n\n  // Phase 1 — pre-flight: snapshot every touched envelope and enforce\n  // any caller-supplied expectedVersion. Same (vault, coll, id) touched\n  // more than once in one tx snapshots only the *initial* committed\n  // state; the in-order replay in Phase 2 takes care of successor ops.\n  const priorEnvelopes = new Map<string, EncryptedEnvelope | null>()\n  const store = db._store\n\n  // #1420 — before the first pre-flight read, wait out any plain\n  // `Collection.put()`/`.delete()` already in flight on a key this commit is\n  // about to touch. Without it the pre-flight's re-read cannot see a write\n  // that has started but not yet reached the store, so the check passes\n  // against a stale snapshot and one of the two writes vanishes with both\n  // reporting success. Draining makes the in-flight case behave exactly like\n  // the fully-awaited one, which the pre-flight below already handled\n  // correctly. Deadlock-free by construction — see `kernel/tx-write-gate.ts`.\n  await drainKeyedWrites(store, ctx._ops.map(keyOf))\n\n  // Commit-time changeset invariants need PLAINTEXT prior records\n  // for `before`, but `priorEnvelopes` holds ENCRYPTED envelopes. So for\n  // ops in a watched scope we additionally decrypt the prior record here,\n  // in Phase 1, BEFORE Phase 2 overwrites it. Snapshots only the initial\n  // committed state per (vault, coll, id), matching the envelope snapshot.\n  const invariants = txInvariants ?? []\n  const watchedScopes = new Set(invariants.map(i => i.scope))\n  const plainBefore = new Map<string, unknown>()\n\n  for (const op of ctx._ops) {\n    const key = keyOf(op)\n    if (!priorEnvelopes.has(key)) {\n      const env = await store.get(op.vaultName, op.collectionName, op.id)\n      priorEnvelopes.set(key, env)\n    }\n    if (watchedScopes.has(op.collectionName) && !plainBefore.has(key)) {\n      const prior = await db\n        .vault(op.vaultName)\n        .collection(op.collectionName)\n        .get(op.id)\n      plainBefore.set(key, prior ?? null)\n    }\n    if (op.expectedVersion !== undefined) {\n      const env = priorEnvelopes.get(key) ?? null\n      const actual = env?._v ?? 0\n      if (actual !== op.expectedVersion) {\n        throw new ConflictError(\n          actual,\n          `Transaction pre-flight: ${op.vaultName}/${op.collectionName}/${op.id} ` +\n            `expected v${op.expectedVersion}, found v${actual}`,\n        )\n      }\n    }\n  }\n\n  // Phase 2 — execute via the Collection layer so history snapshots,\n  // ledger entries, and change events fire normally. We capture each\n  // successful op so a mid-batch throw can revert in Phase 3.\n  //\n  // `_activeTxContext` is published on the Noydb instance for the\n  // duration of Phase 2 so recursive writes triggered inside\n  // `Collection.put` (today: eager derivation outputs) can register\n  // their own envelopes onto `ctx._executed` and roll back alongside\n  // the main staged ops. The `finally` clears it before the\n  // amendment commit phase runs.\n  db._setActiveTxContext(ctx)\n  try {\n    if (canCommitAtomically(db, ctx)) {\n      // #906 — the whole batch goes to the store as ONE `tx()` write set.\n      // Tracked here because the atomic path bypasses `Collection.put()`,\n      // which is where an ordinary write enters the queue: without this,\n      // `hub.writeQueue.pending` would read false for the entire commit.\n      // One tracked unit, not one per op — the batch IS one logical write.\n      await db._writeQueueTracker.track(() => commitAtomicBatch(db, ctx, priorEnvelopes))\n    } else {\n      const writtenKeys = new Set<string>()\n      try {\n        for (const op of ctx._ops) {\n          const coll = db.vault(op.vaultName).collection(op.collectionName)\n          const key = keyOf(op)\n          const prior = priorEnvelopes.get(key) ?? null\n          // #1420 — the per-op path replays through `Collection.put()`, which\n          // carries no CAS: whatever the pre-flight decided stands unchecked\n          // until the write lands. The atomic path re-validates by handing\n          // every leg an `expectedVersion` to `store.tx()`; this is that check\n          // for the path that has no store-level batch. Once THIS transaction\n          // has written the key its version has legitimately moved, so a\n          // second op on the same key is exempt — matching Phase 1, which\n          // snapshots (and checks) only the first occurrence per key.\n          if (op.expectedVersion !== undefined && !writtenKeys.has(key)) {\n            const current = await store.get(op.vaultName, op.collectionName, op.id)\n            const actual = current?._v ?? 0\n            if (actual !== op.expectedVersion) {\n              throw new ConflictError(\n                actual,\n                `Transaction execute: ${op.vaultName}/${op.collectionName}/${op.id} ` +\n                  `expected v${op.expectedVersion}, found v${actual}`,\n              )\n            }\n          }\n          // Record the revert plan BEFORE the call so a mid-`coll.put` throw\n          // (e.g. strict-mode derivation failure firing after `store.put`\n          // has already committed the envelope) still has its source write\n          // reverted. `revertExecuted` is best-effort: putting prior back is\n          // idempotent when the failing op never actually wrote, and\n          // `_invalidateCacheEntry` is a no-op when the collection isn't\n          // hydrated.\n          ctx._executed.push({ op, priorEnvelope: prior })\n          if (op.type === 'put') {\n            // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            await coll.put(op.id, op.record as any, op.reason !== undefined ? { reason: op.reason } : undefined)\n          } else {\n            await coll.delete(op.id)\n          }\n          writtenKeys.add(key)\n        }\n      } catch (err) {\n        // Phase 3 — best-effort revert. See helper docstring.\n        await revertExecuted(ctx._executed, store, db)\n        // Drain amendment windows so the next transaction starts clean.\n        if (ctx._amendment) {\n          for (const v of ctx._amendmentVaults.values()) {\n            const reg = v._getGuardRegistry()\n            if (reg !== null) {\n              reg.consumeChanges()\n              reg.consumeMeta()\n            }\n          }\n        }\n        throw err\n      }\n    }\n  } finally {\n    db._clearActiveTxContext(ctx)\n  }\n\n  // ─── Amendment commit phase (only if amendment === true) ────\n  // Body succeeded — now run each touched vault's invariants over the\n  // collected change-set, then append a structured ledger entry. If\n  // any invariant throws, treat it exactly like a mid-Phase-2 failure:\n  // revert every executed op and re-throw the InvariantError.\n  if (ctx._amendment) {\n    // Lazy-load GuardExecutor at the dispatch site — keeps the floor\n    // bundle free of the guards service when amendments aren't used.\n    // Mirrors the deferred-load pattern from elsewhere in this module.\n    const { GuardExecutor } = (await import('../../with-audit/guards/executor.js')) as {\n      GuardExecutor: typeof GuardExecutorModule\n    }\n    try {\n      for (const [vaultName, v] of ctx._amendmentVaults) {\n        const registry = v._getGuardRegistry()\n        // Registry is guaranteed non-null at this point — the\n        // `tx.vault(name)` path that populates `_amendmentVaults`\n        // throws if the registry is null. The defensive check here\n        // is for TypeScript's narrowing.\n        if (registry === null) continue\n        const changesByCollection = registry.consumeChanges()\n        const meta = registry.consumeMeta()\n        if (changesByCollection.size === 0) continue\n\n        const readOnlyVault = v._getReadOnlyFacade()\n        if (readOnlyVault === null) continue\n\n        // Build the invariant ctx once per vault — it's the same shape\n        // every guard sees on the normal `check` path, just with a\n        // synthetic `existing: null` (invariants get the full change\n        // set in their first parameter; `existing` is a per-record\n        // concept that doesn't apply here).\n        const invariantsPassed: string[] = []\n        for (const [collection, changes] of changesByCollection) {\n          const guards = registry.guardsFor(collection).filter(g => g.amendment !== undefined)\n          for (const guard of guards) {\n            await GuardExecutor.runInvariant(guard, changes, {\n              existing: null,\n              vault: readOnlyVault,\n              userId: v.userId,\n              role: v.role,\n            })\n          }\n          if (guards.length > 0) invariantsPassed.push(collection)\n        }\n\n        // Append the audit ledger entry. Silent no-op when the\n        // history strategy isn't configured — the records still\n        // committed, only the multi-record summary is unavailable.\n        const ledger = v._getLedgerOrNull()\n        if (ledger) {\n          const role = v.role as 'admin' | 'owner'\n          const amendment: NonNullable<LedgerEntry['amendment']> = {\n            reason: options!.reason,\n            role,\n            changes: meta,\n            invariantsPassed,\n          }\n          await ledger.append({\n            op: 'amendment',\n            collection: '',\n            id: '',\n            version: 0,\n            actor: v.userId,\n            // No payload to hash — the per-record entries already\n            // captured `payloadHash` at their own append time. We use\n            // a sha256 of the canonical reason string so the field is\n            // populated with something deterministic and non-empty.\n            payloadHash: '',\n            amendment,\n          })\n        }\n        void vaultName\n      }\n    } catch (err) {\n      await revertExecuted(ctx._executed, store, db)\n      throw err instanceof InvariantError ? err : new InvariantError(\n        err instanceof Error ? err.message : `invariant violated: ${String(err)}`,\n      )\n    }\n  }\n\n  // ─── Commit-time changeset invariant phase ───────────\n  // Runs for BOTH ordinary and amendment transactions (placed after the\n  // amendment phase so an amendment commit is still subject to these\n  // set-level constraints). Assemble the changeset from the executed\n  // staged ops, deduped to the LAST write per (vault, coll, id) while\n  // preserving write order, then group `GuardChange` by collection\n  // (scope) and run each matching invariant. A throw mirrors the\n  // amendment-phase failure mode exactly: revert every executed op and\n  // re-throw as `InvariantError`.\n  if (invariants.length > 0) {\n    // Dedup ctx._ops to the last write per key, preserving first-seen\n    // (write) order so the changeset is stable and order-meaningful.\n    const lastOp = new Map<string, StagedOp>()\n    const order: string[] = []\n    for (const op of ctx._ops) {\n      const key = keyOf(op)\n      if (!lastOp.has(key)) order.push(key)\n      lastOp.set(key, op)\n    }\n\n    // Group {before, after} pairs by collection name (the invariant\n    // scope). `before` is the plaintext prior captured in Phase 1 (null\n    // for inserts / unwatched — only watched scopes were captured, and\n    // every grouped key belongs to a watched scope). `after` is the\n    // written record, null for a delete.\n    const changesByScope = new Map<string, GuardChange<unknown>[]>()\n    // Parallel map: scope → the vault name of its (last-seen) op, used to\n    // build the per-invariant read-only ctx (facade + userId + role).\n    const scopeVault = new Map<string, string>()\n    for (const key of order) {\n      const op = lastOp.get(key)!\n      if (!watchedScopes.has(op.collectionName)) continue\n      const before = plainBefore.get(key) ?? null\n      const after = op.type === 'delete' ? null : (op.record ?? null)\n      const change = { before, after } as GuardChange<unknown>\n      const arr = changesByScope.get(op.collectionName)\n      if (arr) arr.push(change)\n      else changesByScope.set(op.collectionName, [change])\n\n      // Stash the vault name alongside so we can build a per-vault ctx.\n      // (All ops in a scope group could span vaults; we resolve the\n      // vault per change below via a parallel map keyed the same way.)\n      scopeVault.set(op.collectionName, op.vaultName)\n    }\n\n    try {\n      for (const inv of invariants) {\n        const changes = changesByScope.get(inv.scope)\n        if (changes === undefined || changes.length === 0) continue\n        const vaultName = scopeVault.get(inv.scope)!\n        const v = db.vault(vaultName)\n        // Prefer the real read-only facade so the invariant can read\n        // sibling collections; fall back to a minimal read-only stub.\n        const facade: ReadOnlyVaultFacade =\n          v._getReadOnlyFacade() ?? {\n            collection<R = unknown>(name: string) {\n              const c = v.collection<R>(name)\n              return {\n                get: (id: string) => c.get(id),\n                list: () => c.list(),\n                query: () => c.query(),\n              }\n            },\n          }\n        const ctxForInv: GuardContext<unknown> = {\n          existing: null,\n          vault: facade,\n          userId: v.userId,\n          role: v.role,\n        }\n        await inv.check(changes, ctxForInv)\n      }\n    } catch (err) {\n      await revertExecuted(ctx._executed, store, db)\n      throw err instanceof InvariantError ? err : new InvariantError(\n        err instanceof Error ? err.message : `invariant violated: ${String(err)}`,\n      )\n    }\n  }\n\n  return bodyResult\n}\n\n/**\n * One prepared leg of an atomic batch: the `store.tx()` op to submit plus the\n * carrier its finalize half needs.\n * @internal\n */\ninterface AtomicLeg {\n  readonly op: StagedOp\n  readonly coll: Collection<unknown>\n  readonly txOp: TxOp\n  readonly prepared: PreparedPut<unknown> | PreparedDelete<unknown>\n}\n\n/**\n * #906 — the atomic commit path: prepare every staged op, submit the whole\n * write set as ONE `store.tx()` call, then finalize each op in staged order.\n *\n * Only ever reached through `canCommitAtomically` (`atomic-eligibility.ts`),\n * whose exclusions are what make this safe — no CRDT, no refs, no\n * derivation/MV source, no unique constraints, no amendment, no id touched\n * twice. Do not call it without that blessing.\n *\n * @internal\n */\nasync function commitAtomicBatch(\n  db: Noydb,\n  ctx: TxContext,\n  priorEnvelopes: ReadonlyMap<string, EncryptedEnvelope | null>,\n): Promise<void> {\n  const store = db._store\n  const legs: AtomicLeg[] = []\n\n  // ─── Prepare ───────────────────────────────────────────────────\n  // Encrypt, resolve the prior version, mint the #589 marker — with zero\n  // observable side effects on the collections the gate admits. A throw here\n  // therefore needs no unwind: nothing has been written yet, and the caller\n  // sees the refusal exactly as it would from `Collection.put()`. The revert\n  // plan is recorded all the same, because a FINALIZE failure below does need\n  // it (same record-before-the-call convention as the OCC loop).\n  for (const op of ctx._ops) {\n    const coll = db.vault(op.vaultName).collection(op.collectionName)\n    // The two refusals `Collection.put()` / `.delete()` assert before anything\n    // else — schema-update gate + schema fence. They live in those wrappers,\n    // not in the prepare halves this path calls, so assert them here, per op.\n    await coll._assertWriteGates()\n    const prior = priorEnvelopes.get(keyOf(op)) ?? null\n    // Every leg carries CAS against the Phase-1 snapshot, so a writer landing\n    // between the body returning and the batch reaching the store loses.\n    const base = { vault: op.vaultName, collection: op.collectionName, id: op.id, expectedVersion: prior?._v ?? 0 }\n    ctx._executed.push({ op, priorEnvelope: prior })\n    if (op.type === 'put') {\n      const prepared = await coll._preparePut(op.id, op.record, op.reason !== undefined ? { reason: op.reason } : undefined)\n      legs.push({ op, coll, prepared, txOp: { type: 'put', ...base, envelope: prepared.envelope } })\n    } else {\n      const prepared = await coll._prepareDelete(op.id, false)\n      if (prepared === null) {\n        // Nothing to delete (no live record / already a marker / shredded) —\n        // the case `_doDelete` answers with `false`. Drop the op and its\n        // revert entry rather than sending a leg for it.\n        ctx._executed.pop()\n        continue\n      }\n      legs.push({\n        op, coll, prepared,\n        // Under sync the delete is a marker PUT at `live._v + 1` (#589);\n        // without sync it is a physical removal.\n        txOp: prepared.marker ? { type: 'put', ...base, envelope: prepared.marker } : { type: 'delete', ...base },\n      })\n    }\n  }\n\n  // Every op turned out to be a no-op delete — same as the OCC loop, which\n  // would have written nothing either. Don't hand the store an empty batch.\n  if (legs.length === 0) return\n\n  // ─── The batch ─────────────────────────────────────────────────\n  // Deliberately NOT inside a revert-guarded try: a rejection means the store\n  // applied nothing (all-or-nothing is the capability we gated on), so there\n  // is nothing to unwind and a revert pass would write over records this\n  // transaction never touched. No ledger entry, history snapshot or change\n  // event has fired either — every one of those lives in finalize below. The\n  // error (a `ConflictError` when a leg lost its CAS) surfaces unwrapped.\n  await store.tx!(legs.map(l => l.txOp))\n\n  // ─── Finalize ──────────────────────────────────────────────────\n  // History snapshot, ledger entry, cache/index update, change event — per op,\n  // in staged order, all AFTER the bytes are durable (where the OCC loop\n  // interleaves them per op). #931: then the after-write observers (user\n  // `onAfterWrite` hooks + the `afterPut`/`afterDelete` observe bus), which\n  // no longer gate eligibility — they cannot refuse a completed write.\n  try {\n    for (const leg of legs) {\n      if (leg.op.type === 'put') await leg.coll._finalizePut(leg.prepared as PreparedPut<unknown>)\n      else await leg.coll._finalizeDelete(leg.prepared as PreparedDelete<unknown>)\n      await leg.coll._fireAtomicAfterWrite(leg.op.type, leg.prepared)\n    }\n  } catch (err) {\n    // The bytes ARE durable now, so this is today's best-effort unwind over\n    // the plan recorded above. No amendment window to drain — the gate\n    // excludes amendment transactions.\n    await revertExecuted(ctx._executed, store, db)\n    throw err\n  }\n}\n\n/**\n * Phase 3 helper — restore captured prior envelopes via the raw store\n * to avoid re-firing Collection-level side effects (we don't want a\n * cascade of change events undoing themselves). The ledger is left\n * as-is: each committed op appended an entry; the revert is\n * deliberately NOT recorded as a compensating entry because the\n * caller-facing contract is \"atomic or not at all,\" not \"every write\n * visible in the audit trail.\" Auditors who need the intermediate\n * state can still reconstruct it by walking the ledger through the\n * failed-tx timestamp.\n *\n * Delegates the reverse/best-effort/raw-revert shape to the shared\n * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache\n * invalidation below rides along as that helper's per-leg `compensate`\n * callback, gated on `db` exactly as before.\n *\n * @internal — shared between `runTransaction` and\n * `Collection.putManyAtomic`. Both register source ops + nested\n * derivation side-effect ops onto `_executed`; this helper unwinds the\n * combined list in reverse on rollback.\n */\nexport async function revertExecuted(\n  executed: ReadonlyArray<ExecutedOp>,\n  store: Noydb['_store'],\n  db?: Noydb,\n): Promise<void> {\n  const legs = executed.map(({ op, priorEnvelope }) => ({\n    vaultName: op.vaultName,\n    collectionName: op.collectionName,\n    id: op.id,\n    prior: priorEnvelope,\n  }))\n  await bestEffortRevert(\n    legs,\n    store,\n    db\n      ? async (leg) => {\n          // Sync the Collection-layer cache with what we just wrote at\n          // the raw store. Without this, eager-mode `get` would still\n          // return the rolled-back record from its in-memory map. The\n          // Collection's `_invalidateCacheEntry` is a no-op when the\n          // collection hasn't yet been hydrated.\n          const coll = db.vault(leg.vaultName).collection(leg.collectionName)\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          await (coll as any)._invalidateCacheEntry(leg.id)\n        }\n      : undefined,\n  )\n}\n\n/** @internal — shared (vault, collection, id) key shape; also used by `atomic-eligibility.ts`'s duplicate-key scan. */\nexport function keyOf(op: StagedOp): string {\n  return `${op.vaultName}\\x00${op.collectionName}\\x00${op.id}`\n}\n"],"mappings":";;;;;;;;;;;AAmDO,SAAS,oBAAoB,IAAW,KAAyB;AACtE,QAAM,QAAQ,GAAG;AACjB,MAAI,MAAM,cAAc,aAAa,QAAQ,OAAO,MAAM,OAAO,WAAY,QAAO;AACpF,MAAI,IAAI,WAAY,QAAO;AAE3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,MAAM,IAAI,MAAM;AACzB,UAAM,MAAM,MAAM,EAAE;AACpB,QAAI,KAAK,IAAI,GAAG,EAAG,QAAO;AAC1B,SAAK,IAAI,GAAG;AAAA,EACd;AAEA,aAAW,MAAM,IAAI,MAAM;AACzB,UAAM,OAAO,GAAG,MAAM,GAAG,SAAS,EAAE,WAAW,GAAG,cAAc;AAChE,QAAI,CAAC,KAAK,cAAc,GAAG,IAAI,EAAG,QAAO;AAAA,EAC3C;AAEA,SAAO;AACT;;;ACPA,eAAsB,iBACpB,UACA,SACA,YACe;AACf,QAAM,OAAO,CAAC,GAAG,QAAQ,EAAE,QAAQ;AAUnC,MAAI,QAAQ,cAAc,aAAa,QAAQ,OAAO,QAAQ,OAAO,YAAY;AAC/E,UAAM,MAAc,KAAK;AAAA,MAAI,SAC3B,IAAI,UAAU,OACV,EAAE,MAAM,OAAO,OAAO,IAAI,WAAW,YAAY,IAAI,gBAAgB,IAAI,IAAI,IAAI,UAAU,IAAI,MAAM,IACrG,EAAE,MAAM,UAAU,OAAO,IAAI,WAAW,YAAY,IAAI,gBAAgB,IAAI,IAAI,GAAG;AAAA,IACzF;AACA,QAAI;AACF,YAAM,QAAQ,GAAG,GAAG;AACpB,UAAI,WAAY,YAAW,OAAO,MAAM;AAAE,YAAI;AAAE,gBAAM,WAAW,GAAG;AAAA,QAAE,QAAQ;AAAA,QAAoB;AAAA,MAAE;AACpG;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,aAAW,OAAO,MAAM;AACtB,QAAI;AACF,UAAI,IAAI,UAAU,MAAM;AACtB,cAAM,QAAQ,IAAI,IAAI,WAAW,IAAI,gBAAgB,IAAI,IAAI,IAAI,KAAK;AAAA,MACxE,OAAO;AACL,cAAM,QAAQ,OAAO,IAAI,WAAW,IAAI,gBAAgB,IAAI,EAAE;AAAA,MAChE;AACA,UAAI,WAAY,OAAM,WAAW,GAAG;AAAA,IACtC,QAAQ;AAAA,IAIR;AAAA,EACF;AACF;;;AC9CA,IAAM,WAAW,oBAAI,QAAiD;AAG/D,SAAS,aAAa,OAAe,YAAoB,IAAoB;AAClF,SAAO,GAAG,KAAK,KAAO,UAAU,KAAO,EAAE;AAC3C;AASA,eAAsB,gBACpB,OACA,OACA,YACA,IACA,IACY;AACZ,MAAI,QAAQ,SAAS,IAAI,KAAK;AAC9B,MAAI,UAAU,QAAW;AACvB,YAAQ,oBAAI,IAAI;AAChB,aAAS,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,QAAM,MAAM,aAAa,OAAO,YAAY,EAAE;AAC9C,MAAI,UAAU,MAAM,IAAI,GAAG;AAC3B,MAAI,YAAY,QAAW;AACzB,cAAU,oBAAI,IAAI;AAClB,UAAM,IAAI,KAAK,OAAO;AAAA,EACxB;AACA,QAAM,UAAU,GAAG;AAInB,QAAM,UAAU,QAAQ,KAAK,MAAM,QAAW,MAAM,MAAS;AAC7D,UAAQ,IAAI,OAAO;AACnB,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,YAAQ,OAAO,OAAO;AACtB,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,GAAG;AAAA,EAC1C;AACF;AAUA,eAAsB,iBAAiB,OAAe,MAAuC;AAC3F,QAAM,QAAQ,SAAS,IAAI,KAAK;AAChC,MAAI,UAAU,UAAa,MAAM,SAAS,EAAG;AAC7C,MAAI;AACJ,aAAW,OAAO,MAAM;AACtB,UAAM,UAAU,MAAM,IAAI,GAAG;AAC7B,QAAI,YAAY,OAAW;AAC3B,eAAW,KAAK,QAAS,EAAC,UAAU,CAAC,GAAG,KAAK,CAAC;AAAA,EAChD;AACA,MAAI,UAAU,OAAW,OAAM,QAAQ,IAAI,KAAK;AAClD;;;ACoBO,IAAM,YAAN,MAAgB;AAAA;AAAA,EAEZ,OAAe,aAAa;AAAA;AAAA,EAE5B,OAAmB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASpB,YAA0B,CAAC;AAAA;AAAA,EAE3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA,EAEA,mBAAmB,oBAAI,IAAmB;AAAA;AAAA,EAGnD,YAAY,IAAW,YAAY,OAAO;AACxC,SAAK,MAAM;AACX,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGA,MAAM,MAAuB;AAC3B,UAAM,IAAI,KAAK,IAAI,MAAM,IAAI;AAC7B,QAAI,KAAK,cAAc,CAAC,KAAK,iBAAiB,IAAI,IAAI,GAAG;AAQvD,YAAM,OAAO,EAAE;AAIf,UAAI,SAAS,WAAW,SAAS,WAAW,SAAS,aAAa;AAChE,cAAM,IAAI,wBAAwB,EAAE,QAAQ,IAAI;AAAA,MAClD;AAKA,YAAM,MAAM,EAAE,kBAAkB;AAChC,UAAI,QAAQ,MAAM;AAChB,cAAM,IAAI;AAAA,UACR,UAAU,IAAI;AAAA,QAIhB;AAAA,MACF;AACA,UAAI,eAAe;AACnB,WAAK,iBAAiB,IAAI,MAAM,CAAC;AAAA,IACnC;AACA,WAAO,IAAI,QAAQ,MAAM,CAAC;AAAA,EAC5B;AACF;AAGO,IAAM,UAAN,MAAc;AAAA;AAAA,EAEV;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,YAAY,KAAgB,OAAc;AACxC,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,WAAc,MAA+B;AAC3C,UAAM,IAAI,KAAK,OAAO,WAAc,IAAI;AACxC,WAAO,IAAI,aAAgB,KAAK,MAAM,KAAK,QAAQ,GAAG,IAAI;AAAA,EAC5D;AACF;AAGO,IAAM,eAAN,MAAsB;AAAA;AAAA,EAElB;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,YAAY,KAAgB,OAAc,MAAqB,MAAc;AAC3E,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IAAI,IAA+B;AACvC,aAAS,IAAI,KAAK,KAAK,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK;AACnD,YAAM,KAAK,KAAK,KAAK,KAAK,CAAC;AAC3B,UACE,GAAG,cAAc,KAAK,OAAO,QAC7B,GAAG,mBAAmB,KAAK,SAC3B,GAAG,OAAO,IACV;AACA,YAAI,GAAG,SAAS,SAAU,QAAO;AACjC,eAAO,GAAG;AAAA,MACZ;AAAA,IACF;AACA,WAAO,KAAK,MAAM,IAAI,EAAE;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,IAAY,QAAW,SAA+D;AACxF,UAAM,KAAe;AAAA,MACnB,MAAM;AAAA,MACN,WAAW,KAAK,OAAO;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,SAAS,oBAAoB,OAAW,IAAG,kBAAkB,QAAQ;AACzE,QAAI,SAAS,WAAW,OAAW,IAAG,SAAS,QAAQ;AACvD,SAAK,KAAK,KAAK,KAAK,EAAE;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,IAAY,SAA8C;AAC/D,UAAM,KAAe;AAAA,MACnB,MAAM;AAAA,MACN,WAAW,KAAK,OAAO;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,SAAS,oBAAoB,OAAW,IAAG,kBAAkB,QAAQ;AACzE,SAAK,KAAK,KAAK,KAAK,EAAE;AAAA,EACxB;AACF;AAYA,eAAsB,eACpB,IACA,IACA,SACA,cACY;AAQZ,MAAI,SAAS,WAAW;AACtB,QAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,KAAK,EAAE,WAAW,GAAG;AAC5E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,IAAI,UAAU,IAAI,SAAS,cAAc,IAAI;AACzD,QAAM,aAAa,MAAM,GAAG,GAAG;AAE/B,MAAI,IAAI,KAAK,WAAW,GAAG;AAKzB,QAAI,IAAI,YAAY;AAClB,iBAAW,KAAK,IAAI,iBAAiB,OAAO,GAAG;AAI7C,cAAM,MAAM,EAAE,kBAAkB;AAChC,YAAI,QAAQ,MAAM;AAChB,cAAI,eAAe;AACnB,cAAI,YAAY;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,QAAM,iBAAiB,oBAAI,IAAsC;AACjE,QAAM,QAAQ,GAAG;AAUjB,QAAM,iBAAiB,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC;AAOjD,QAAM,aAAa,gBAAgB,CAAC;AACpC,QAAM,gBAAgB,IAAI,IAAI,WAAW,IAAI,OAAK,EAAE,KAAK,CAAC;AAC1D,QAAM,cAAc,oBAAI,IAAqB;AAE7C,aAAW,MAAM,IAAI,MAAM;AACzB,UAAM,MAAM,MAAM,EAAE;AACpB,QAAI,CAAC,eAAe,IAAI,GAAG,GAAG;AAC5B,YAAM,MAAM,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,gBAAgB,GAAG,EAAE;AAClE,qBAAe,IAAI,KAAK,GAAG;AAAA,IAC7B;AACA,QAAI,cAAc,IAAI,GAAG,cAAc,KAAK,CAAC,YAAY,IAAI,GAAG,GAAG;AACjE,YAAM,QAAQ,MAAM,GACjB,MAAM,GAAG,SAAS,EAClB,WAAW,GAAG,cAAc,EAC5B,IAAI,GAAG,EAAE;AACZ,kBAAY,IAAI,KAAK,SAAS,IAAI;AAAA,IACpC;AACA,QAAI,GAAG,oBAAoB,QAAW;AACpC,YAAM,MAAM,eAAe,IAAI,GAAG,KAAK;AACvC,YAAM,SAAS,KAAK,MAAM;AAC1B,UAAI,WAAW,GAAG,iBAAiB;AACjC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,2BAA2B,GAAG,SAAS,IAAI,GAAG,cAAc,IAAI,GAAG,EAAE,cACtD,GAAG,eAAe,YAAY,MAAM;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAYA,KAAG,oBAAoB,GAAG;AAC1B,MAAI;AACF,QAAI,oBAAoB,IAAI,GAAG,GAAG;AAMhC,YAAM,GAAG,mBAAmB,MAAM,MAAM,kBAAkB,IAAI,KAAK,cAAc,CAAC;AAAA,IACpF,OAAO;AACL,YAAM,cAAc,oBAAI,IAAY;AACpC,UAAI;AACF,mBAAW,MAAM,IAAI,MAAM;AACzB,gBAAM,OAAO,GAAG,MAAM,GAAG,SAAS,EAAE,WAAW,GAAG,cAAc;AAChE,gBAAM,MAAM,MAAM,EAAE;AACpB,gBAAM,QAAQ,eAAe,IAAI,GAAG,KAAK;AASzC,cAAI,GAAG,oBAAoB,UAAa,CAAC,YAAY,IAAI,GAAG,GAAG;AAC7D,kBAAM,UAAU,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,gBAAgB,GAAG,EAAE;AACtE,kBAAM,SAAS,SAAS,MAAM;AAC9B,gBAAI,WAAW,GAAG,iBAAiB;AACjC,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA,wBAAwB,GAAG,SAAS,IAAI,GAAG,cAAc,IAAI,GAAG,EAAE,cACnD,GAAG,eAAe,YAAY,MAAM;AAAA,cACrD;AAAA,YACF;AAAA,UACF;AAQA,cAAI,UAAU,KAAK,EAAE,IAAI,eAAe,MAAM,CAAC;AAC/C,cAAI,GAAG,SAAS,OAAO;AAErB,kBAAM,KAAK,IAAI,GAAG,IAAI,GAAG,QAAe,GAAG,WAAW,SAAY,EAAE,QAAQ,GAAG,OAAO,IAAI,MAAS;AAAA,UACrG,OAAO;AACL,kBAAM,KAAK,OAAO,GAAG,EAAE;AAAA,UACzB;AACA,sBAAY,IAAI,GAAG;AAAA,QACrB;AAAA,MACF,SAAS,KAAK;AAEZ,cAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAE7C,YAAI,IAAI,YAAY;AAClB,qBAAW,KAAK,IAAI,iBAAiB,OAAO,GAAG;AAC7C,kBAAM,MAAM,EAAE,kBAAkB;AAChC,gBAAI,QAAQ,MAAM;AAChB,kBAAI,eAAe;AACnB,kBAAI,YAAY;AAAA,YAClB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,UAAE;AACA,OAAG,sBAAsB,GAAG;AAAA,EAC9B;AAOA,MAAI,IAAI,YAAY;AAIlB,UAAM,EAAE,cAAc,IAAK,MAAM,OAAO,wBAAqC;AAG7E,QAAI;AACF,iBAAW,CAAC,WAAW,CAAC,KAAK,IAAI,kBAAkB;AACjD,cAAM,WAAW,EAAE,kBAAkB;AAKrC,YAAI,aAAa,KAAM;AACvB,cAAM,sBAAsB,SAAS,eAAe;AACpD,cAAM,OAAO,SAAS,YAAY;AAClC,YAAI,oBAAoB,SAAS,EAAG;AAEpC,cAAM,gBAAgB,EAAE,mBAAmB;AAC3C,YAAI,kBAAkB,KAAM;AAO5B,cAAM,mBAA6B,CAAC;AACpC,mBAAW,CAAC,YAAY,OAAO,KAAK,qBAAqB;AACvD,gBAAM,SAAS,SAAS,UAAU,UAAU,EAAE,OAAO,OAAK,EAAE,cAAc,MAAS;AACnF,qBAAW,SAAS,QAAQ;AAC1B,kBAAM,cAAc,aAAa,OAAO,SAAS;AAAA,cAC/C,UAAU;AAAA,cACV,OAAO;AAAA,cACP,QAAQ,EAAE;AAAA,cACV,MAAM,EAAE;AAAA,YACV,CAAC;AAAA,UACH;AACA,cAAI,OAAO,SAAS,EAAG,kBAAiB,KAAK,UAAU;AAAA,QACzD;AAKA,cAAM,SAAS,EAAE,iBAAiB;AAClC,YAAI,QAAQ;AACV,gBAAM,OAAO,EAAE;AACf,gBAAM,YAAmD;AAAA,YACvD,QAAQ,QAAS;AAAA,YACjB;AAAA,YACA,SAAS;AAAA,YACT;AAAA,UACF;AACA,gBAAM,OAAO,OAAO;AAAA,YAClB,IAAI;AAAA,YACJ,YAAY;AAAA,YACZ,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,OAAO,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,YAKT,aAAa;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AACA,aAAK;AAAA,MACP;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAC7C,YAAM,eAAe,iBAAiB,MAAM,IAAI;AAAA,QAC9C,eAAe,QAAQ,IAAI,UAAU,uBAAuB,OAAO,GAAG,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAWA,MAAI,WAAW,SAAS,GAAG;AAGzB,UAAM,SAAS,oBAAI,IAAsB;AACzC,UAAM,QAAkB,CAAC;AACzB,eAAW,MAAM,IAAI,MAAM;AACzB,YAAM,MAAM,MAAM,EAAE;AACpB,UAAI,CAAC,OAAO,IAAI,GAAG,EAAG,OAAM,KAAK,GAAG;AACpC,aAAO,IAAI,KAAK,EAAE;AAAA,IACpB;AAOA,UAAM,iBAAiB,oBAAI,IAAoC;AAG/D,UAAM,aAAa,oBAAI,IAAoB;AAC3C,eAAW,OAAO,OAAO;AACvB,YAAM,KAAK,OAAO,IAAI,GAAG;AACzB,UAAI,CAAC,cAAc,IAAI,GAAG,cAAc,EAAG;AAC3C,YAAM,SAAS,YAAY,IAAI,GAAG,KAAK;AACvC,YAAM,QAAQ,GAAG,SAAS,WAAW,OAAQ,GAAG,UAAU;AAC1D,YAAM,SAAS,EAAE,QAAQ,MAAM;AAC/B,YAAM,MAAM,eAAe,IAAI,GAAG,cAAc;AAChD,UAAI,IAAK,KAAI,KAAK,MAAM;AAAA,UACnB,gBAAe,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC;AAKnD,iBAAW,IAAI,GAAG,gBAAgB,GAAG,SAAS;AAAA,IAChD;AAEA,QAAI;AACF,iBAAW,OAAO,YAAY;AAC5B,cAAM,UAAU,eAAe,IAAI,IAAI,KAAK;AAC5C,YAAI,YAAY,UAAa,QAAQ,WAAW,EAAG;AACnD,cAAM,YAAY,WAAW,IAAI,IAAI,KAAK;AAC1C,cAAM,IAAI,GAAG,MAAM,SAAS;AAG5B,cAAM,SACJ,EAAE,mBAAmB,KAAK;AAAA,UACxB,WAAwB,MAAc;AACpC,kBAAM,IAAI,EAAE,WAAc,IAAI;AAC9B,mBAAO;AAAA,cACL,KAAK,CAAC,OAAe,EAAE,IAAI,EAAE;AAAA,cAC7B,MAAM,MAAM,EAAE,KAAK;AAAA,cACnB,OAAO,MAAM,EAAE,MAAM;AAAA,YACvB;AAAA,UACF;AAAA,QACF;AACF,cAAM,YAAmC;AAAA,UACvC,UAAU;AAAA,UACV,OAAO;AAAA,UACP,QAAQ,EAAE;AAAA,UACV,MAAM,EAAE;AAAA,QACV;AACA,cAAM,IAAI,MAAM,SAAS,SAAS;AAAA,MACpC;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAC7C,YAAM,eAAe,iBAAiB,MAAM,IAAI;AAAA,QAC9C,eAAe,QAAQ,IAAI,UAAU,uBAAuB,OAAO,GAAG,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAyBA,eAAe,kBACb,IACA,KACA,gBACe;AACf,QAAM,QAAQ,GAAG;AACjB,QAAM,OAAoB,CAAC;AAS3B,aAAW,MAAM,IAAI,MAAM;AACzB,UAAM,OAAO,GAAG,MAAM,GAAG,SAAS,EAAE,WAAW,GAAG,cAAc;AAIhE,UAAM,KAAK,kBAAkB;AAC7B,UAAM,QAAQ,eAAe,IAAI,MAAM,EAAE,CAAC,KAAK;AAG/C,UAAM,OAAO,EAAE,OAAO,GAAG,WAAW,YAAY,GAAG,gBAAgB,IAAI,GAAG,IAAI,iBAAiB,OAAO,MAAM,EAAE;AAC9G,QAAI,UAAU,KAAK,EAAE,IAAI,eAAe,MAAM,CAAC;AAC/C,QAAI,GAAG,SAAS,OAAO;AACrB,YAAM,WAAW,MAAM,KAAK,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,SAAY,EAAE,QAAQ,GAAG,OAAO,IAAI,MAAS;AACrH,WAAK,KAAK,EAAE,IAAI,MAAM,UAAU,MAAM,EAAE,MAAM,OAAO,GAAG,MAAM,UAAU,SAAS,SAAS,EAAE,CAAC;AAAA,IAC/F,OAAO;AACL,YAAM,WAAW,MAAM,KAAK,eAAe,GAAG,IAAI,KAAK;AACvD,UAAI,aAAa,MAAM;AAIrB,YAAI,UAAU,IAAI;AAClB;AAAA,MACF;AACA,WAAK,KAAK;AAAA,QACR;AAAA,QAAI;AAAA,QAAM;AAAA;AAAA;AAAA,QAGV,MAAM,SAAS,SAAS,EAAE,MAAM,OAAO,GAAG,MAAM,UAAU,SAAS,OAAO,IAAI,EAAE,MAAM,UAAU,GAAG,KAAK;AAAA,MAC1G,CAAC;AAAA,IACH;AAAA,EACF;AAIA,MAAI,KAAK,WAAW,EAAG;AASvB,QAAM,MAAM,GAAI,KAAK,IAAI,OAAK,EAAE,IAAI,CAAC;AAQrC,MAAI;AACF,eAAW,OAAO,MAAM;AACtB,UAAI,IAAI,GAAG,SAAS,MAAO,OAAM,IAAI,KAAK,aAAa,IAAI,QAAgC;AAAA,UACtF,OAAM,IAAI,KAAK,gBAAgB,IAAI,QAAmC;AAC3E,YAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,MAAM,IAAI,QAAQ;AAAA,IAChE;AAAA,EACF,SAAS,KAAK;AAIZ,UAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAC7C,UAAM;AAAA,EACR;AACF;AAuBA,eAAsB,eACpB,UACA,OACA,IACe;AACf,QAAM,OAAO,SAAS,IAAI,CAAC,EAAE,IAAI,cAAc,OAAO;AAAA,IACpD,WAAW,GAAG;AAAA,IACd,gBAAgB,GAAG;AAAA,IACnB,IAAI,GAAG;AAAA,IACP,OAAO;AAAA,EACT,EAAE;AACF,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,KACI,OAAO,QAAQ;AAMb,YAAM,OAAO,GAAG,MAAM,IAAI,SAAS,EAAE,WAAW,IAAI,cAAc;AAElE,YAAO,KAAa,sBAAsB,IAAI,EAAE;AAAA,IAClD,IACA;AAAA,EACN;AACF;AAGO,SAAS,MAAM,IAAsB;AAC1C,SAAO,GAAG,GAAG,SAAS,KAAO,GAAG,cAAc,KAAO,GAAG,EAAE;AAC5D;","names":[]}

package/dist/chunk-UBSFPGVJ.js

@@ -1 +0,0 @@
-//# sourceMappingURL=chunk-UBSFPGVJ.js.map

package/dist/chunk-V3RWOOSO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/custody/active.ts","../src/with-party/custody/strategy.ts","../src/with-party/custody/index.ts"],"sourcesContent":["/**\n * Enable the sovereign-custody (FR-6) capability.\n * Pass to `createNoydb({ custodyStrategy: withCustody() })` to make\n * `db.grantCustodian` / `db.revokeCustodian` (and the `vault.custody.*` facade\n * that delegates to them) plus `vault.custody.liberate()` live. The heavy\n * `liberateVault` ceremony is dynamically imported here, so it is reached only\n * via opt-in; grant/revoke run the host's own gate + keyring engine.\n */\nimport type { CustodyStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine } from '../team/keyring.js'\n\nexport function withCustody(): CustodyStrategy {\n  return {\n    async grantCustodian(host, vault, options, factors) {\n      return host._grantCustodianImpl(grantEngine, vault, options, factors)\n    },\n    async revokeCustodian(host, vault, options, factors) {\n      return host._revokeCustodianImpl(revokeEngine, vault, options, factors)\n    },\n    async liberate(vault, opts) {\n      const { liberateVault } = await import('./liberate.js')\n      return liberateVault(vault, opts)\n    },\n  }\n}\n","/**\n * Sovereign-custody (FR-6) capability strategy — the three on-demand\n * operations the custody surface routes through: minting a custodian\n * (`grantCustodian`), removing one (`revokeCustodian`), and the audited\n * ownership-claim ceremony (`liberate`). The active engine ({@link withCustody})\n * runs the grant/revoke impls the host exposes and dynamically imports the\n * heavy `liberateVault` ceremony (keeping it out of the floor bundle);\n * {@link NO_CUSTODY} throws.\n *\n * `Noydb.grantCustodian` / `Noydb.revokeCustodian` delegate here (passing\n * themselves as the {@link CustodyHost}), and `vault.custody.liberate` delegates\n * here with its {@link Vault}. An un-opted-in caller hits `NO_CUSTODY`'s throw.\n *\n * Note: the lower-level `liberateVault` FREE FUNCTION (exported from\n * `custody/liberate.ts`) stays ungated — it has no `createNoydb` instance to\n * gate against (the same carve-out as the `openSealedRecord` host opener). Only\n * the instance surfaces (`db.grantCustodian` / `db.revokeCustodian` /\n * `vault.custody.*`) are the capability.\n * @internal\n */\nimport type { GrantOptions, RevokeOptions, FactorProofBundle, NoydbStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { UnlockedKeyring } from '../team/keyring.js'\nimport type { GrantCustodianOptions } from './index.js'\nimport type { LiberateOptions, LiberateResult } from './liberate.js'\nimport { CustodyNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * The grant/revoke engine the strategy runs when opted in — implemented by\n * `Noydb` (`_grantCustodianImpl` / `_revokeCustodianImpl` hold the gate +\n * keyring logic; the public `grantCustodian` / `revokeCustodian` route through\n * the strategy). Since the #267 team split the keyring grant/revoke engines\n * are passed IN by `withCustody()` (statically linked there, not in the\n * kernel) so the single-user floor never carries them.\n */\nexport interface CustodyHost {\n  _grantCustodianImpl(\n    engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>,\n    vault: string,\n    options: GrantCustodianOptions,\n    factors?: FactorProofBundle,\n  ): Promise<void>\n  _revokeCustodianImpl(\n    engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>,\n    vault: string,\n    options: RevokeOptions,\n    factors?: FactorProofBundle,\n  ): Promise<void>\n}\n\nexport interface CustodyStrategy {\n  grantCustodian(host: CustodyHost, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>\n  revokeCustodian(host: CustodyHost, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>\n  liberate(vault: Vault, opts: LiberateOptions): Promise<LiberateResult>\n}\n\n/**\n * No-op stub — the floor default. Every custody operation throws\n * {@link CustodyNotEnabledError}; opt in with `custodyStrategy: withCustody()`\n * in createNoydb. @internal\n */\nexport const NO_CUSTODY: CustodyStrategy = {\n  async grantCustodian() { throw new CustodyNotEnabledError() },\n  async revokeCustodian() { throw new CustodyNotEnabledError() },\n  async liberate() { throw new CustodyNotEnabledError() },\n}\n","/**\n * Public `vault.custody.*` API surface (FR-6).\n *\n * The custody namespace is the vault-instance face of the FR-6 sovereign-custody\n * model — it mirrors `vault.user.*` exactly: a thin delegation shell with NO\n * business logic. The Vault constructs one `CustodyApi` per session, injecting\n * closures that bind the vault name / keyring into the genuinely-core\n * implementations (`Noydb.grantCustodian` / `Noydb.revokeCustodian` and the\n * `liberateVault` ceremony). Each method just forwards to its injected callback.\n *\n * Three operations:\n *  - `grantCustodian(opts)` — owner-only: mint a `custodian` who operates the\n *    vault fully but can never grant / rotate / sever / extract.\n *  - `revokeCustodian(opts)` — owner-only: remove a custodian.\n *  - `liberate(opts)` — custodian-only: audited claim of ownership over a\n *    sealed-owner (Deed) vault (mints a DISTINCT new owner; ledger-audited).\n *\n * Provisioning a Deed (`createDeedOwner`) is deliberately NOT on this class: it\n * is a store-level operation that mints the vault's first owner, so there is no\n * vault instance (and thus no custody namespace) yet — it stays the exported\n * `team/deed.ts` function.\n *\n * @see design-history/2026-06-17-fr6-deed-custodian-liberate-design.md\n * @module\n */\nimport type { GrantOptions, RevokeOptions, FactorProofBundle } from '../../kernel/types.js'\nimport type { LiberateOptions, LiberateResult } from './liberate.js'\n\n/** Options for `vault.custody.grantCustodian` — a grant with the role fixed to `custodian`. */\nexport type GrantCustodianOptions = Omit<GrantOptions, 'role'>\n\n// Capability opt-in seam (S4): grant/revoke custodian + liberate throw\n// CustodyNotEnabledError unless `custodyStrategy: withCustody()` is opted in.\nexport { withCustody } from './active.js'\nexport { NO_CUSTODY, type CustodyStrategy, type CustodyHost } from './strategy.js'\nexport { CustodyNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Implementation behind `vault.custody`. Constructed once per Vault. Holds the\n * injected, vault-bound implementations in closure; every method delegates with\n * no added logic (the owner-only / custodian-only / gate checks all live in the\n * injected implementations — `Noydb.grantCustodian` etc. and `liberateVault`).\n */\nexport class CustodyApi {\n  constructor(\n    /** Bound `Noydb.grantCustodian(this.name, ...)` — owner-only, gated. */\n    private readonly _grantCustodian: (options: GrantCustodianOptions, factors?: FactorProofBundle) => Promise<void>,\n    /** Bound `Noydb.revokeCustodian(this.name, ...)` — owner-only, gated. */\n    private readonly _revokeCustodian: (options: RevokeOptions, factors?: FactorProofBundle) => Promise<void>,\n    /** Bound `liberateVault(this, ...)` — custodian-only audited ownership claim. */\n    private readonly _liberate: (opts: LiberateOptions) => Promise<LiberateResult>,\n  ) {}\n\n  /**\n   * Owner-only: grant the FR-6 `custodian` role. The custodian operates every\n   * collection (rw + access) but is provably unable to grant / revoke / rotate /\n   * extract-and-sever. Defended in depth (gate + owner-only role check) inside\n   * the injected `Noydb.grantCustodian`.\n   */\n  async grantCustodian(options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void> {\n    return this._grantCustodian(options, factors)\n  }\n\n  /** Owner-only: revoke a custodian. */\n  async revokeCustodian(options: RevokeOptions, factors?: FactorProofBundle): Promise<void> {\n    return this._revokeCustodian(options, factors)\n  }\n\n  /**\n   * Custodian-only: the audited claim of ownership over a sealed-owner (Deed)\n   * vault. Mints a DISTINCT new owner re-wrapping the incumbent DEKs under a\n   * fresh KEK (the latent owner is never impersonated), ledger-audited. See\n   * {@link liberateVault}.\n   */\n  async liberate(opts: LiberateOptions): Promise<LiberateResult> {\n    return this._liberate(opts)\n  }\n}\n"],"mappings":";;;;;;;;;AAWO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,MAAM,eAAe,MAAM,OAAO,SAAS,SAAS;AAClD,aAAO,KAAK,oBAAoB,OAAa,OAAO,SAAS,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,gBAAgB,MAAM,OAAO,SAAS,SAAS;AACnD,aAAO,KAAK,qBAAqB,QAAc,OAAO,SAAS,OAAO;AAAA,IACxE;AAAA,IACA,MAAM,SAAS,OAAO,MAAM;AAC1B,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,wBAAe;AACtD,aAAO,cAAc,OAAO,IAAI;AAAA,IAClC;AAAA,EACF;AACF;;;ACqCO,IAAM,aAA8B;AAAA,EACzC,MAAM,iBAAiB;AAAE,UAAM,IAAI,uBAAuB;AAAA,EAAE;AAAA,EAC5D,MAAM,kBAAkB;AAAE,UAAM,IAAI,uBAAuB;AAAA,EAAE;AAAA,EAC7D,MAAM,WAAW;AAAE,UAAM,IAAI,uBAAuB;AAAA,EAAE;AACxD;;;ACtBO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAEmB,iBAEA,kBAEA,WACjB;AALiB;AAEA;AAEA;AAAA,EAChB;AAAA,EALgB;AAAA,EAEA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASnB,MAAM,eAAe,SAAgC,SAA4C;AAC/F,WAAO,KAAK,gBAAgB,SAAS,OAAO;AAAA,EAC9C;AAAA;AAAA,EAGA,MAAM,gBAAgB,SAAwB,SAA4C;AACxF,WAAO,KAAK,iBAAiB,SAAS,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,MAAgD;AAC7D,WAAO,KAAK,UAAU,IAAI;AAAA,EAC5B;AACF;","names":[]}

package/dist/chunk-VAORSCSU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/schema-update/fence.ts"],"sourcesContent":["/**\n * Schema-fence document. Vault-level generation counter + drain\n * state, stored at `_meta/schema-fence` using the plaintext-envelope\n * pattern of `_meta/policy` (no PII — a counter + a state enum).\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\n\nexport type FenceState = 'normal' | 'draining' | 'migrating' | 'complete'\n\nexport interface FenceDoc {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n  /**\n   * Content hash (`PersistedSchemaEnvelope.hash`) of the schema most\n   * recently persisted while the vault sat at `currentSchemaVersion` —\n   * binds \"generation N\" to a concrete schema-content hash (#946), so\n   * \"which schema is generation N\" is answerable from `schemaFenceState()`\n   * alone. Optional: absent on a fresh vault (generation 0, nothing\n   * persisted yet) and on a fence document written before #946.\n   */\n  readonly schemaHash?: string\n}\n\nexport const FENCE_RECORD_ID = 'schema-fence'\nconst META_COLLECTION = '_meta'\n\nexport const DEFAULT_FENCE: FenceDoc = { currentSchemaVersion: 0, fenceState: 'normal' }\n\nexport async function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc> {\n  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID)\n  if (!envelope) return DEFAULT_FENCE\n  try {\n    const parsed = JSON.parse(envelope._data ?? '') as unknown\n    if (!isFenceDoc(parsed)) return DEFAULT_FENCE\n    return parsed\n  } catch {\n    return DEFAULT_FENCE\n  }\n}\n\nexport async function saveFence(store: NoydbStore, vault: string, fence: FenceDoc): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(fence) },\n  )\n  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope)\n}\n\nfunction isFenceDoc(x: unknown): x is FenceDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  if (typeof o['currentSchemaVersion'] !== 'number') return false\n  if (o['fenceState'] !== 'normal' && o['fenceState'] !== 'draining'\n    && o['fenceState'] !== 'migrating' && o['fenceState'] !== 'complete') return false\n  // schemaHash is optional (#946) — a legacy fence doc without it is still valid.\n  return o['schemaHash'] === undefined || typeof o['schemaHash'] === 'string'\n}\n"],"mappings":";;;;;AAwBO,IAAM,kBAAkB;AAC/B,IAAM,kBAAkB;AAEjB,IAAM,gBAA0B,EAAE,sBAAsB,GAAG,YAAY,SAAS;AAEvF,eAAsB,UAAU,OAAmB,OAAkC;AACnF,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,eAAe;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS,EAAE;AAC9C,QAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,UAAU,OAAmB,OAAe,OAAgC;AAChG,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,SAAS,EAAE;AAAA,IAC/D,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,iBAAiB,QAAQ;AACnE;AAEA,SAAS,WAAW,GAA2B;AAC7C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,sBAAsB,MAAM,SAAU,QAAO;AAC1D,MAAI,EAAE,YAAY,MAAM,YAAY,EAAE,YAAY,MAAM,cACnD,EAAE,YAAY,MAAM,eAAe,EAAE,YAAY,MAAM,WAAY,QAAO;AAE/E,SAAO,EAAE,YAAY,MAAM,UAAa,OAAO,EAAE,YAAY,MAAM;AACrE;","names":[]}