@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/restore-to-OOPKLAPU.js

@@ -0,0 +1,66 @@
+import {
+  parseHistoryId
+} from "./chunk-EQ6C2ZPT.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+
+// src/with-commit/history/restore-to.ts
+var HISTORY_COLLECTION = "_history";
+async function candidateCollections(host) {
+  const names = new Set(await host.liveCollectionNames());
+  for (const id of await host.adapter.list(host.vault, HISTORY_COLLECTION)) {
+    const parsed = parseHistoryId(id);
+    if (parsed && !parsed.collection.startsWith("_")) names.add(parsed.collection);
+  }
+  return [...names].sort();
+}
+var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+async function restoreTo(host, timestamp, options) {
+  const dryRun = options?.dryRun === true;
+  const names = options?.collections ?? await candidateCollections(host);
+  const per = {};
+  let written = 0, deleted = 0, unchanged = 0;
+  for (const name of names) {
+    const past = host.instantCollection(name);
+    const live = host.liveCollection(name);
+    const atT = new Set(await past.list());
+    const now = new Set(await host.adapter.list(host.vault, name));
+    const w = [], d = [];
+    let u = 0;
+    for (const id of atT) {
+      const target = await past.get(id);
+      if (target === null || target === void 0) continue;
+      const current = now.has(id) ? await live.get(id).catch(() => null) : null;
+      if (current !== null && same(current, target)) {
+        u++;
+        continue;
+      }
+      if (!dryRun) await live.put(id, target);
+      w.push(id);
+    }
+    for (const id of now) {
+      if (atT.has(id)) continue;
+      const current = await live.get(id).catch(() => null);
+      if (current === null) continue;
+      if (!dryRun) await live.delete(id);
+      d.push(id);
+    }
+    if (w.length || d.length || u) {
+      per[name] = { written: w, deleted: d, unchanged: u };
+      written += w.length;
+      deleted += d.length;
+      unchanged += u;
+    }
+  }
+  return { restoredTo: timestamp, dryRun, written, deleted, unchanged, collections: per };
+}
+export {
+  restoreTo
+};
+//# sourceMappingURL=restore-to-OOPKLAPU.js.map

package/dist/restore-to-OOPKLAPU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/restore-to.ts"],"sourcesContent":["/**\n * core#76 — point-in-time RESTORE, as forward writes.\n *\n * `vault.at(T)` reconstructs any record at T and is read-only by contract.\n * `restoreTo(T)` takes that reconstruction and WRITES it: for every record\n * whose state at T differs from its state now, put the T-state as a new\n * version; for every record that exists now and did not exist at T, delete it.\n *\n * ## Why forward writes, and not a rewrite of history\n *\n * Every write goes through `Collection.put` / `.delete`, so guards, periods,\n * history and the ledger all see it. The restore is therefore itself an\n * audited, reversible event — `restoreTo(T)` can be undone by another\n * `restoreTo`, the ledger's tamper-evidence is untouched, and the result\n * replicates through ordinary sync because it IS ordinary versioned writes.\n * ⭐ That is the whole argument for this over a pod: a pod restore is state\n * REPLACEMENT and needs core#71/#72 to be safe under sync; this needs nothing,\n * because the stack already knows how to gate, audit and replicate a write.\n *\n * ## What bounds it\n *\n * ⚠️ Accuracy is bounded by history retention. If `historyConfig.maxVersions`\n * pruned the versions around T, the reconstruction at T is incomplete and so\n * is the restore — `at(T)` returns null for a record whose earliest retained\n * snapshot is after T, and this treats that as \"did not exist at T\". A vault\n * that prunes history cannot honestly point-in-time restore past the prune\n * horizon, and a pod is the answer there (core#77).\n *\n * ⛔ BLOBS ARE NOT RESTORED AND ARE NOT REPORTED. `_history` holds record\n * envelopes, not chunks; a record's blob fields at T reference chunks that may\n * since have been compacted away. The record comes back with its handles\n * intact and the chunks may or may not still be there. Detecting that\n * reliably means resolving every handle against `_blob_chunks`, which is a\n * blob-subsystem concern this module deliberately does not reach into — a\n * `blobsUnrecoverable: []` that is empty because nothing looked would be worse\n * than the silence, because it would read as a guarantee.\n */\nimport type { RestoreToOptions, RestoreToResult } from '../../kernel/types.js'\nimport type { RestoreToHost } from '../../port/with/restore-host.js'\nimport { parseHistoryId } from './history.js'\n\n/** Local to avoid a new export from `history.ts` for one string. */\nconst HISTORY_COLLECTION = '_history'\n\n/**\n * Collections to consider: what is live now, PLUS what history knows about.\n *\n * ⭐ The union is the point. A collection dropped since T is absent from the\n * live store, and a restore that only walked live collections would silently\n * decline to bring it back — the exact case (\"the store drifted\") this\n * feature exists for.\n */\nasync function candidateCollections(host: RestoreToHost): Promise<string[]> {\n  const names = new Set(await host.liveCollectionNames())\n  for (const id of await host.adapter.list(host.vault, HISTORY_COLLECTION)) {\n    const parsed = parseHistoryId(id)\n    if (parsed && !parsed.collection.startsWith('_')) names.add(parsed.collection)\n  }\n  return [...names].sort()\n}\n\nconst same = (a: unknown, b: unknown): boolean => JSON.stringify(a) === JSON.stringify(b)\n\nexport async function restoreTo(\n  host: RestoreToHost,\n  timestamp: string,\n  options?: RestoreToOptions,\n): Promise<RestoreToResult> {\n  const dryRun = options?.dryRun === true\n  const names = options?.collections ?? await candidateCollections(host)\n  const per: Record<string, { written: string[]; deleted: string[]; unchanged: number }> = {}\n  let written = 0, deleted = 0, unchanged = 0\n\n  for (const name of names) {\n    const past = host.instantCollection(name)\n    const live = host.liveCollection(name)\n    const atT = new Set(await past.list())\n    const now = new Set((await host.adapter.list(host.vault, name)))\n    const w: string[] = [], d: string[] = []\n    let u = 0\n\n    for (const id of atT) {\n      const target = await past.get(id)\n      if (target === null || target === undefined) continue\n      const current = now.has(id) ? await live.get(id).catch(() => null) : null\n      if (current !== null && same(current, target)) { u++; continue }\n      if (!dryRun) await live.put(id, target)\n      w.push(id)\n    }\n    for (const id of now) {\n      if (atT.has(id)) continue\n      const current = await live.get(id).catch(() => null)\n      if (current === null) continue // already gone (tombstone / delete marker)\n      if (!dryRun) await live.delete(id)\n      d.push(id)\n    }\n\n    if (w.length || d.length || u) {\n      per[name] = { written: w, deleted: d, unchanged: u }\n      written += w.length; deleted += d.length; unchanged += u\n    }\n  }\n\n  return { restoredTo: timestamp, dryRun, written, deleted, unchanged, collections: per }\n}\n"],"mappings":";;;;;;;;;;;;;AA0CA,IAAM,qBAAqB;AAU3B,eAAe,qBAAqB,MAAwC;AAC1E,QAAM,QAAQ,IAAI,IAAI,MAAM,KAAK,oBAAoB,CAAC;AACtD,aAAW,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,kBAAkB,GAAG;AACxE,UAAM,SAAS,eAAe,EAAE;AAChC,QAAI,UAAU,CAAC,OAAO,WAAW,WAAW,GAAG,EAAG,OAAM,IAAI,OAAO,UAAU;AAAA,EAC/E;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK;AACzB;AAEA,IAAM,OAAO,CAAC,GAAY,MAAwB,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;AAExF,eAAsB,UACpB,MACA,WACA,SAC0B;AAC1B,QAAM,SAAS,SAAS,WAAW;AACnC,QAAM,QAAQ,SAAS,eAAe,MAAM,qBAAqB,IAAI;AACrE,QAAM,MAAmF,CAAC;AAC1F,MAAI,UAAU,GAAG,UAAU,GAAG,YAAY;AAE1C,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,KAAK,kBAAkB,IAAI;AACxC,UAAM,OAAO,KAAK,eAAe,IAAI;AACrC,UAAM,MAAM,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC;AACrC,UAAM,MAAM,IAAI,IAAK,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,IAAI,CAAE;AAC/D,UAAM,IAAc,CAAC,GAAG,IAAc,CAAC;AACvC,QAAI,IAAI;AAER,eAAW,MAAM,KAAK;AACpB,YAAM,SAAS,MAAM,KAAK,IAAI,EAAE;AAChC,UAAI,WAAW,QAAQ,WAAW,OAAW;AAC7C,YAAM,UAAU,IAAI,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,EAAE,MAAM,MAAM,IAAI,IAAI;AACrE,UAAI,YAAY,QAAQ,KAAK,SAAS,MAAM,GAAG;AAAE;AAAK;AAAA,MAAS;AAC/D,UAAI,CAAC,OAAQ,OAAM,KAAK,IAAI,IAAI,MAAM;AACtC,QAAE,KAAK,EAAE;AAAA,IACX;AACA,eAAW,MAAM,KAAK;AACpB,UAAI,IAAI,IAAI,EAAE,EAAG;AACjB,YAAM,UAAU,MAAM,KAAK,IAAI,EAAE,EAAE,MAAM,MAAM,IAAI;AACnD,UAAI,YAAY,KAAM;AACtB,UAAI,CAAC,OAAQ,OAAM,KAAK,OAAO,EAAE;AACjC,QAAE,KAAK,EAAE;AAAA,IACX;AAEA,QAAI,EAAE,UAAU,EAAE,UAAU,GAAG;AAC7B,UAAI,IAAI,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAAE;AACnD,iBAAW,EAAE;AAAQ,iBAAW,EAAE;AAAQ,mBAAa;AAAA,IACzD;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,WAAW,QAAQ,SAAS,SAAS,WAAW,aAAa,IAAI;AACxF;","names":[]}

package/dist/{reveal-YQTRNQFH.js → reveal-UAPBG743.js}

@@ -1,15 +1,15 @@
 import {
   dualReadSealedSlot
-} from "./chunk-CB4467G3.js";
-import "./chunk-ABU6A4Z5.js";
+} from "./chunk-5A3HOTP5.js";
+import "./chunk-Q4DBU5RM.js";
 import {
   isTombstone
-} from "./chunk-OM3SEDI4.js";
-import "./chunk-PUBI455O.js";
-import "./chunk-2ELOCEXE.js";
+} from "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
 import {
   ClassifiedRevealError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/capsule/enclave-aes/classify/reveal.ts
 async function revealSealedField(ctx, id, field) {
@@ -35,4 +35,4 @@ async function revealSealedField(ctx, id, field) {
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-YQTRNQFH.js.map
+//# sourceMappingURL=reveal-UAPBG743.js.map

package/dist/revoke-6AFVXTWF.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-UADW5NOU.js";
+import "./chunk-B6EWMGFX.js";
+import "./chunk-IPF5ORDI.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-6AFVXTWF.js.map

package/dist/satellites/index.js

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 export {
   SatelliteConfigError
 };

package/dist/schema-update/index.js

@@ -3,7 +3,7 @@ import {
   blindUpdate,
   coordinatedCutover,
   lockSchema
-} from "../chunk-3Y5JLSXS.js";
+} from "../chunk-X5RGG3ZW.js";
 import {
   computeSchemaDelta,
   evaluateStrategies
@@ -12,7 +12,7 @@ import {
   SchemaUpdateGate
 } from "../chunk-6LJY7X5A.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-2RH5SEY7.js";
 export {
   SchemaUpdateGate,
   additiveOnly,

package/dist/sealed-record/index.js

@@ -1,38 +1,38 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-GRS2HIV6.js";
+} from "../chunk-UMV5GBTJ.js";
 import {
   base64ToBuffer,
   decrypt,
   importCek,
   recordAadFor,
   sealedBodyArgs
-} from "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+} from "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../capsule-57BDK7LG.js");
+      const { sealRecordToHost } = await import("../capsule-YQKQZPH7.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../capsule-57BDK7LG.js");
+      const { revokeSealedRecord } = await import("../capsule-YQKQZPH7.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../capsule-57BDK7LG.js");
+      const { rotateRecordCek } = await import("../capsule-YQKQZPH7.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/search/index.js

@@ -9,7 +9,7 @@ import {
   segmentTokens,
   tokenize,
   withSearch
-} from "../chunk-TZYTMZZY.js";
+} from "../chunk-DL4GCSTS.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
@@ -17,11 +17,11 @@ import {
   DEFAULT_INDEX_MIN_VECTORS,
   withVectorIndex
 } from "../chunk-NYMLINRP.js";
-import "../chunk-V55JASXO.js";
-import "../chunk-PTJY5R3O.js";
+import "../chunk-UQRKAM2R.js";
+import "../chunk-PIO6NW7O.js";
 import {
   SearchNotEnabledError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 export {
   DEFAULT_INDEX_MIN_VECTORS,
   InvertedIndex,

package/dist/{seed-JMQTRKRE.js → seed-BVYDPVIW.js}

@@ -1,12 +1,15 @@
 import {
   BROKER_COLLECTION,
   BROKER_MEMBER_COLLECTION,
+  assertRosterTagValid,
   ensureCollectionDEK,
-  loadKeyring
-} from "./chunk-45VHWE4C.js";
-import "./chunk-FZXRLNJO.js";
-import "./chunk-UHFGK6YA.js";
-import "./chunk-RIZTZJX6.js";
+  loadKeyring,
+  readKeyringFile,
+  requireRosterKey
+} from "./chunk-QVUMKG3Z.js";
+import "./chunk-6BEBWHNL.js";
+import "./chunk-XQGKS4OW.js";
+import "./chunk-LJ744WXU.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -15,13 +18,13 @@ import {
   deriveBrokerProofBits,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-4J3MNVVX.js";
-import "./chunk-ZBUAX4EF.js";
-import "./chunk-SPPOUJLN.js";
+} from "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-OM3SEDI4.js";
-import "./chunk-PUBI455O.js";
-import "./chunk-2ELOCEXE.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -30,7 +33,7 @@ import {
   TamperedError,
   ValidationError,
   isConflictError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-party/broker/seed.ts
 function isAdminRole(keyring) {
@@ -196,16 +199,28 @@ async function rotateSeed(ctx) {
 async function enrolMemberSeed(ctx, member) {
   const { store, vault, keyring, config } = ctx;
   requireAdminAccess(keyring);
-  const grantee = await loadKeyring(store, vault, { userId: member.userId, secret: member.secret });
-  if (isAdminRole(grantee)) return;
-  const dek = grantee.deks.get(BROKER_MEMBER_COLLECTION);
+  let dek;
+  let role;
+  if ("dek" in member) {
+    const found = await readKeyringFile(store, vault, member.userId);
+    if (!found) throw new BrokerEnrolmentError(`No keyring for "${member.userId}" in vault "${vault}".`);
+    await assertRosterTagValid(found.file, requireRosterKey(keyring, "enrolMemberSeed"), member.userId);
+    if (found.file.role === "owner" || found.file.role === "admin") return;
+    dek = member.dek;
+    role = found.file.role;
+  } else {
+    const grantee = await loadKeyring(store, vault, { userId: member.userId, secret: member.secret });
+    if (isAdminRole(grantee)) return;
+    dek = grantee.deks.get(BROKER_MEMBER_COLLECTION);
+    role = grantee.role;
+  }
   if (!dek) {
     throw new BrokerEnrolmentError(
       `grant() did not mint a _broker_member DEK for "${member.userId}" \u2014 the keyring predates member enrolment; re-grant the user.`
     );
   }
   const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
-  const identity = { userId: member.userId, role: grantee.role };
+  const identity = { userId: member.userId, role };
   const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId, member.userId);
   try {
     await postEnroll(config, vault, proofBits, identity);
@@ -215,7 +230,7 @@ async function enrolMemberSeed(ctx, member) {
   const record = {
     brokerId: config.brokerId,
     userId: member.userId,
-    role: grantee.role,
+    role,
     seed: bufferToBase64(seedBytes),
     endpoint: config.endpoint,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -316,4 +331,4 @@ export {
   revokeMemberSeed,
   rotateSeed
 };
-//# sourceMappingURL=seed-JMQTRKRE.js.map
+//# sourceMappingURL=seed-BVYDPVIW.js.map

package/dist/seed-BVYDPVIW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/broker/seed.ts"],"sourcesContent":["/**\n * `_broker` reserved-collection seed lifecycle (#479, credential-broker\n * spec §2/§3). Modeled on `with-sync/credentials.ts`: a\n * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under\n * the collection's own DEK, `requireAdminAccess` role gate (owner/admin\n * only — custodian intentionally excluded, same rationale as\n * `_sync_credentials`: this is transport-auth material, not the\n * custodian's operational scope).\n *\n * Three operations, each a free function taking a {@link BrokerSeedCtx}\n * (the {@link BrokerCtx} threaded through `with-party/broker/active.ts`,\n * augmented there with the `config` its closure was built with):\n *\n *  - {@link enrollSeed} — two-phase commit (I9): create-if-absent CAS the\n *    seed (I4), then register its derived proof key with the broker host,\n *    then (only on a 2xx) mark the record `registered: true`. A seed\n *    persisted whose `/enroll` POST failed stays `registered: false` so a\n *    later `credentialSource()` fails fast instead of degrading into an\n *    opaque `BrokerProofError` (I9/V23).\n *  - {@link rotateSeed} — quiesce-then-swap (I5): mint a fresh seed,\n *    register-new-first, THEN overwrite the local record — closing the\n *    torn-proof window a naive local-overwrite-then-register order would\n *    open. The single-flight cache quiesce itself (await in-flight, bump\n *    epoch) is the caller's job (`with-party/broker/active.ts`) since the\n *    cache lives in that closure, not here.\n *  - {@link mintStoreCredentials} — the challenge/response round trip\n *    (`/challenge` then `/credentials`) that produces one `StoreCredentials`\n *    value; the single-flight cache wrapping it lives in `active.ts`.\n *\n * First-seed creation calls `ensureCollectionDEK`, which throws\n * (`ValidationError`) when the keyring's KEK is `null` (PIN quick-resume /\n * session-restore) — this module intercepts that and re-surfaces it as\n * {@link BrokerEnrolmentError} (R-B8/I3): *enrol* needs the KEK; *use* of an\n * already-enrolled seed needs only the DEK.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope, StoreCredentials } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { ensureCollectionDEK, loadKeyring, readKeyringFile, requireRosterKey } from '../../with-party/team/keyring.js'\nimport { assertRosterTagValid } from '../../with-party/team/roster-tag.js'\nimport { BROKER_COLLECTION, BROKER_MEMBER_COLLECTION } from '../../with-party/team/reserved-secret-collections.js'\nimport {\n  buildSealedRecordEnvelope,\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  bufferToBase64,\n  base64ToBuffer,\n  deriveBrokerProofBits,\n  computeBrokerProof,\n} from '../../capsule/index.js'\nimport type { EnclaveKey, BrokerMemberIdentity } from '../../capsule/index.js'\nimport {\n  PermissionDeniedError,\n  ValidationError,\n  isConflictError,\n  NetworkError,\n  BrokerEnrolmentError,\n  BrokerProofError,\n  TamperedError,\n} from '../../kernel/errors.js'\nimport type { BrokerSeedCtx, BrokerConfig } from '../../port/with/broker-strategy.js'\n\n/** The `_broker/<brokerId>` record payload (spec §3). */\ninterface BrokerSeedRecord {\n  readonly brokerId: string\n  /** base64(32 random bytes). */\n  readonly seed: string\n  readonly endpoint: string\n  readonly createdAt: string\n  /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */\n  readonly registered: boolean\n}\n\n/**\n * The `_broker_member/<userId>` record payload (core#73): one per sub-admin\n * member, encrypted under the DEK `grant()` minted for that grantee alone.\n * The host holds the HKDF-derived proof key for `(vault, brokerId, userId)`\n * together with the role it was registered at; the seed itself never leaves\n * the record.\n */\ninterface BrokerMemberRecord {\n  readonly brokerId: string\n  readonly userId: string\n  /** The role registered with the host — informational; the host's own record is what verifies. */\n  readonly role: string\n  /** base64(32 random bytes). */\n  readonly seed: string\n  readonly endpoint: string\n  readonly createdAt: string\n}\n\nfunction isAdminRole(keyring: UnlockedKeyring): boolean {\n  return keyring.role === 'owner' || keyring.role === 'admin'\n}\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // Custodian is INTENTIONALLY excluded — the _broker seed is transport-auth\n  // material (mints cloud store credentials), not the custodian's\n  // operational data scope. Same rationale as _sync_credentials' FR-6 note.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Credential-broker operations require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// `ensureCollectionDEK` only dedupes concurrent first-time DEK creates WITHIN one\n// closure instance — since every call site here asks for a fresh closure, two\n// concurrent `enrollSeed()` calls sharing the same (store, vault, keyring) would\n// otherwise each mint a DIFFERENT `_broker` DEK and race `persistKeyring`, leaving\n// the seed record encrypted under a DEK the keyring no longer holds (TamperedError\n// on the next read). Dedupe across calls here, keyed by store identity + vault\n// (V20 — the CAS enrol vector actually exercises this).\nconst inFlightDekByStore = new WeakMap<NoydbStore, Map<string, Promise<EnclaveKey>>>()\n\nasync function brokerDek(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<EnclaveKey> {\n  const existing = keyring.deks.get(BROKER_COLLECTION)\n  if (existing) return existing\n\n  let perStore = inFlightDekByStore.get(store)\n  if (!perStore) { perStore = new Map(); inFlightDekByStore.set(store, perStore) }\n  const pending = perStore.get(vault)\n  if (pending) return pending\n\n  const promise = (async () => {\n    try {\n      const getDek = await ensureCollectionDEK(store, vault, keyring)\n      return await getDek(BROKER_COLLECTION)\n    } catch (err) {\n      if (err instanceof ValidationError) {\n        throw new BrokerEnrolmentError(\n          'enroll()/rotate() need the KEK to provision the _broker DEK on first use — ' +\n            're-authenticate at tier 1 (secret) before enrolling. Using an already-' +\n            'enrolled seed (credentialSource()) needs only the DEK.',\n        )\n      }\n      throw err\n    }\n  })()\n  perStore.set(vault, promise)\n  try {\n    return await promise\n  } finally {\n    perStore.delete(vault)\n  }\n}\n\nasync function readRecord(\n  store: NoydbStore,\n  vault: string,\n  brokerId: string,\n  dek: EnclaveKey,\n): Promise<{ envelope: EncryptedEnvelope; record: BrokerSeedRecord } | null> {\n  const envelope = await store.get(vault, BROKER_COLLECTION, brokerId)\n  if (!envelope) return null\n  const record = JSON.parse(await openEnvelopeJson({ collection: BROKER_COLLECTION, id: brokerId }, envelope, dek)) as BrokerSeedRecord\n  return { envelope, record }\n}\n\nasync function persistRecord(\n  store: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  dek: EnclaveKey,\n  record: BrokerSeedRecord,\n  expectedVersion: number,\n): Promise<void> {\n  const envelope = await buildSealedRecordEnvelope(\n    { collection: BROKER_COLLECTION, id: record.brokerId, by: keyring.userId, version: expectedVersion + 1 },\n    (identity) => writeEnvelopeBody(identity, JSON.stringify(record), dek),\n    {},\n  )\n  await store.put(vault, BROKER_COLLECTION, record.brokerId, envelope, expectedVersion)\n}\n\ninterface SeedState {\n  readonly seedBytes: Uint8Array\n  readonly record: BrokerSeedRecord\n  readonly dek: EnclaveKey\n  readonly version: number\n}\n\n/** Create-if-absent CAS (I4/V20): a concurrent enrol that loses the race\n *  re-reads the winner's seed instead of persisting a second one. */\nasync function ensureSeedRecord(store: NoydbStore, vault: string, keyring: UnlockedKeyring, config: BrokerConfig): Promise<SeedState> {\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (existing) {\n    return { seedBytes: base64ToBuffer(existing.record.seed), record: existing.record, dek, version: existing.envelope._v }\n  }\n\n  const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(seedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: false,\n  }\n  try {\n    await persistRecord(store, vault, keyring, dek, record, 0)\n    return { seedBytes, record, dek, version: 1 }\n  } catch (err) {\n    if (!(isConflictError(err))) throw err\n    const winner = await readRecord(store, vault, config.brokerId, dek)\n    if (!winner) throw err\n    return { seedBytes: base64ToBuffer(winner.record.seed), record: winner.record, dek, version: winner.envelope._v }\n  }\n}\n\n/** Attested POST to the host (`/enroll`, `/revoke`) — the two calls only an owner/admin makes. */\nasync function postAttested(config: BrokerConfig, path: string, body: Record<string, unknown>, what: string): Promise<void> {\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const attestation = config.attestation ? await config.attestation() : undefined\n  let res: Response\n  try {\n    res = await fetchFn(`${config.endpoint}${path}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        ...(attestation !== undefined ? { authorization: `Bearer ${attestation}` } : {}),\n      },\n      body: JSON.stringify(body),\n    })\n  } catch (err) {\n    throw new BrokerEnrolmentError(`broker ${path} request failed: ${(err as Error).message}`)\n  }\n  if (!res.ok) {\n    throw new BrokerEnrolmentError(`broker refused ${what} (status ${res.status}) — attestation likely missing or invalid`)\n  }\n}\n\nasync function postEnroll(config: BrokerConfig, vault: string, proofBits: Uint8Array, member?: BrokerMemberIdentity): Promise<void> {\n  await postAttested(config, '/enroll', {\n    vaultId: vault, brokerId: config.brokerId, proofKey: bufferToBase64(proofBits),\n    // core#73 — a member registration carries WHO and at WHICH role; the host\n    // stores both and binds them into the canonical it verifies against.\n    ...(member ? { userId: member.userId, role: member.role } : {}),\n  }, 'enrolment')\n}\n\n/**\n * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`\n * seed (I4), derive+register its proof key with the broker host, and only\n * on a 2xx mark the record `registered: true`. Requires owner/admin role\n * and (for first-seed creation only) the KEK.\n */\nexport async function enrollSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  const { seedBytes, record, dek, version } = await ensureSeedRecord(store, vault, keyring, config)\n  if (record.registered) {\n    seedBytes.fill(0)\n    return\n  }\n\n  const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId)\n  seedBytes.fill(0)\n  try {\n    await postEnroll(config, vault, proofBits)\n  } finally {\n    proofBits.fill(0)\n  }\n\n  try {\n    await persistRecord(store, vault, keyring, dek, { ...record, registered: true }, version)\n  } catch (err) {\n    if (isConflictError(err)) {\n      const latest = await readRecord(store, vault, config.brokerId, dek)\n      if (latest?.record.registered) return // a concurrent enrol already committed the same outcome\n    }\n    throw err\n  }\n}\n\n/**\n * Rotate (quiesce-then-swap — I5): mint a fresh seed, register its proof\n * key with the broker host FIRST, then overwrite the local `_broker`\n * record. The broker host is expected to accept both the old and new\n * registration for a short grace window, so an in-flight proof computed\n * under the old key (from before rotation started) still verifies. Cache\n * quiescing (awaiting any in-flight round-trip, bumping the refresh-cache\n * epoch) is the caller's job — `with-party/broker/active.ts` — since the\n * cache lives in that closure, not here.\n */\nexport async function rotateSeed(ctx: BrokerSeedCtx): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  const dek = await brokerDek(store, vault, keyring)\n\n  const existing = await readRecord(store, vault, config.brokerId, dek)\n  if (!existing) {\n    // Nothing to rotate yet — behaves like a first enrol.\n    await enrollSeed(ctx)\n    return\n  }\n\n  const newSeedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const newProofBits = await deriveBrokerProofBits(newSeedBytes, vault, config.brokerId)\n  try {\n    await postEnroll(config, vault, newProofBits)\n  } finally {\n    newProofBits.fill(0)\n  }\n\n  const record: BrokerSeedRecord = {\n    brokerId: config.brokerId,\n    seed: bufferToBase64(newSeedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n    registered: true,\n  }\n  newSeedBytes.fill(0)\n  await persistRecord(store, vault, keyring, dek, record, existing.envelope._v)\n}\n\n/**\n * core#73 — enrol a freshly granted MEMBER with the host under its own key.\n * Called by the kernel right after `grant()`, while the grantor still holds\n * the grantee's secret: that secret opens the grantee's keyring, whose\n * `_broker_member` DEK (minted by `grant()` for this grantee alone) is the\n * only key that can seal the member record. Register-first, then persist,\n * so a record on disk always means a registered member (the same order as\n * `rotateSeed`). Owner/admin grantees use the shared seed and are skipped.\n *\n * A re-grant (role change) lands here again with a NEW DEK and mints a NEW\n * seed, so the host's record for this userId is REPLACED — key and role — and\n * a device still holding the previous enrolment is refused from then on.\n */\nexport async function enrolMemberSeed(\n  ctx: BrokerSeedCtx,\n  member: { readonly userId: string; readonly secret: string } | { readonly userId: string; readonly dek: EnclaveKey },\n): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  let dek: EnclaveKey | undefined\n  let role: string\n  if ('dek' in member) {\n    // core#96 — a role change: the fresh DEK came from `updateKeyringIdentity`,\n    // the role from the file it just wrote. Verified before it is trusted: the\n    // host scopes credentials by this role, so a store-forged one here would\n    // register a forged scope.\n    const found = await readKeyringFile(store, vault, member.userId)\n    if (!found) throw new BrokerEnrolmentError(`No keyring for \"${member.userId}\" in vault \"${vault}\".`)\n    await assertRosterTagValid(found.file, requireRosterKey(keyring, 'enrolMemberSeed'), member.userId)\n    if (found.file.role === 'owner' || found.file.role === 'admin') return\n    dek = member.dek\n    role = found.file.role\n  } else {\n    const grantee = await loadKeyring(store, vault, { userId: member.userId, secret: member.secret })\n    if (isAdminRole(grantee)) return\n    dek = grantee.deks.get(BROKER_MEMBER_COLLECTION)\n    role = grantee.role\n  }\n  if (!dek) {\n    throw new BrokerEnrolmentError(\n      `grant() did not mint a _broker_member DEK for \"${member.userId}\" — the keyring predates member enrolment; re-grant the user.`,\n    )\n  }\n\n  const seedBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const identity: BrokerMemberIdentity = { userId: member.userId, role }\n  const proofBits = await deriveBrokerProofBits(seedBytes, vault, config.brokerId, member.userId)\n  try {\n    await postEnroll(config, vault, proofBits, identity)\n  } finally {\n    proofBits.fill(0)\n  }\n\n  const record: BrokerMemberRecord = {\n    brokerId: config.brokerId,\n    userId: member.userId,\n    role,\n    seed: bufferToBase64(seedBytes),\n    endpoint: config.endpoint,\n    createdAt: new Date().toISOString(),\n  }\n  seedBytes.fill(0)\n  const existing = await store.get(vault, BROKER_MEMBER_COLLECTION, member.userId)\n  const expectedVersion = existing?._v ?? 0\n  const envelope = await buildSealedRecordEnvelope(\n    { collection: BROKER_MEMBER_COLLECTION, id: member.userId, by: keyring.userId, version: expectedVersion + 1 },\n    (id) => writeEnvelopeBody(id, JSON.stringify(record), dek),\n    {},\n  )\n  await store.put(vault, BROKER_MEMBER_COLLECTION, member.userId, envelope, expectedVersion)\n}\n\n/**\n * core#73 — de-register a member with the host and drop its record. Called\n * by the kernel right after `revoke()`; the local record goes first (cheap,\n * always succeeds), then the host — a host failure surfaces as\n * {@link BrokerEnrolmentError} AFTER the keyring revocation has completed,\n * so the caller retries the host half, never the revocation.\n */\nexport async function revokeMemberSeed(ctx: BrokerSeedCtx, userId: string): Promise<void> {\n  const { store, vault, keyring, config } = ctx\n  requireAdminAccess(keyring)\n  await store.delete(vault, BROKER_MEMBER_COLLECTION, userId)\n  await postAttested(config, '/revoke', { vaultId: vault, brokerId: config.brokerId, userId }, 'member revocation')\n}\n\n/** Read this member's own seed: the caller's `_broker_member` DEK opens only the caller's record. */\nasync function readMemberSeed(store: NoydbStore, vault: string, keyring: UnlockedKeyring, config: BrokerConfig): Promise<Uint8Array> {\n  const dek = keyring.deks.get(BROKER_MEMBER_COLLECTION)\n  const envelope = dek ? await store.get(vault, BROKER_MEMBER_COLLECTION, keyring.userId) : null\n  if (!dek || !envelope) {\n    throw new BrokerEnrolmentError(\n      `User \"${keyring.userId}\" (${keyring.role}) is not enrolled as a broker member for \"${config.brokerId}\" — ` +\n        'the owner must re-grant the user with a broker configured (enrolment happens at grant time).',\n    )\n  }\n  let json: string\n  try {\n    json = await openEnvelopeJson({ collection: BROKER_MEMBER_COLLECTION, id: keyring.userId }, envelope, dek)\n  } catch (err) {\n    // A re-grant minted a NEW `_broker_member` DEK and re-sealed the record\n    // under it; a session still holding the previous keyring cannot open it.\n    // That is a superseded enrolment, not a tampered store — name it so.\n    if (err instanceof TamperedError) {\n      throw new BrokerEnrolmentError(\n        `User \"${keyring.userId}\"'s broker enrolment was replaced by a re-grant — reopen the vault to load the current keyring.`,\n      )\n    }\n    throw err\n  }\n  const record = JSON.parse(json) as BrokerMemberRecord\n  if (record.brokerId !== config.brokerId) {\n    throw new BrokerEnrolmentError(`User \"${keyring.userId}\" is enrolled with broker \"${record.brokerId}\", not \"${config.brokerId}\".`)\n  }\n  return base64ToBuffer(record.seed)\n}\n\n/**\n * The challenge/response round trip: `POST /challenge`, derive+sign the\n * proof from the decrypted seed, `POST /credentials`. One network round\n * trip per call — the single-flight/cache wrapping lives in `active.ts`.\n *\n * Fails fast with {@link BrokerEnrolmentError} if the seed hasn't completed\n * enrolment yet (`registered !== true` — I9/V23), never degrading into an\n * opaque {@link BrokerProofError}.\n */\nexport async function mintStoreCredentials(ctx: BrokerSeedCtx, profile?: string): Promise<StoreCredentials> {\n  const { store, vault, keyring, config } = ctx\n\n  // core#73 — two seeds, one round trip. An owner/admin proves with the shared\n  // `_broker` seed (canonical v1, no identity); every other role proves with\n  // its OWN `_broker_member` seed (canonical v2: userId + role inside the MAC,\n  // verified by the host against the record it registered at grant time).\n  let seedBytes: Uint8Array\n  let member: BrokerMemberIdentity | undefined\n  if (isAdminRole(keyring)) {\n    const dek = await brokerDek(store, vault, keyring)\n    const found = await readRecord(store, vault, config.brokerId, dek)\n    if (!found) throw new BrokerEnrolmentError(`No _broker seed enrolled for brokerId \"${config.brokerId}\" — call enroll() first.`)\n    if (!found.record.registered) {\n      throw new BrokerEnrolmentError(\n        `The _broker seed for \"${config.brokerId}\" has not completed enrolment with the broker host — call enroll() again.`,\n      )\n    }\n    seedBytes = base64ToBuffer(found.record.seed)\n  } else {\n    seedBytes = await readMemberSeed(store, vault, keyring, config)\n    member = { userId: keyring.userId, role: keyring.role }\n  }\n\n  const fetchFn = config.fetch ?? globalThis.fetch\n  const endpointOrigin = new URL(config.endpoint).origin\n  const who = member ? { userId: member.userId, role: member.role } : {}\n\n  let challengeRes: Response\n  try {\n    challengeRes = await fetchFn(`${config.endpoint}/challenge`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, ...who }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /challenge request failed: ${(err as Error).message}`)\n  }\n  if (!challengeRes.ok) throw new NetworkError(`broker /challenge failed with status ${challengeRes.status}`)\n  const { challenge, expiresAt } = (await challengeRes.json()) as { challenge: string; expiresAt: string }\n\n  const proof = await computeBrokerProof(seedBytes, vault, config.brokerId, { endpointOrigin, member, profile, challenge, expiresAt })\n\n  let credsRes: Response\n  try {\n    credsRes = await fetchFn(`${config.endpoint}/credentials`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ vaultId: vault, brokerId: config.brokerId, ...who, challenge, proof, ...(profile !== undefined ? { profile } : {}) }),\n    })\n  } catch (err) {\n    throw new NetworkError(`broker /credentials request failed: ${(err as Error).message}`)\n  }\n  if (credsRes.status === 401 || credsRes.status === 403) throw new BrokerProofError('broker rejected the challenge proof')\n  if (!credsRes.ok) throw new NetworkError(`broker /credentials failed with status ${credsRes.status}`)\n  return (await credsRes.json()) as StoreCredentials\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,YAAY,SAAmC;AACtD,SAAO,QAAQ,SAAS,WAAW,QAAQ,SAAS;AACtD;AAEA,SAAS,mBAAmB,SAAgC;AAI1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,4EAA4E,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AASA,IAAM,qBAAqB,oBAAI,QAAsD;AAErF,eAAe,UAAU,OAAmB,OAAe,SAA+C;AACxG,QAAM,WAAW,QAAQ,KAAK,IAAI,iBAAiB;AACnD,MAAI,SAAU,QAAO;AAErB,MAAI,WAAW,mBAAmB,IAAI,KAAK;AAC3C,MAAI,CAAC,UAAU;AAAE,eAAW,oBAAI,IAAI;AAAG,uBAAmB,IAAI,OAAO,QAAQ;AAAA,EAAE;AAC/E,QAAM,UAAU,SAAS,IAAI,KAAK;AAClC,MAAI,QAAS,QAAO;AAEpB,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,oBAAoB,OAAO,OAAO,OAAO;AAC9D,aAAO,MAAM,OAAO,iBAAiB;AAAA,IACvC,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB;AAClC,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,GAAG;AACH,WAAS,IAAI,OAAO,OAAO;AAC3B,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,aAAS,OAAO,KAAK;AAAA,EACvB;AACF;AAEA,eAAe,WACb,OACA,OACA,UACA,KAC2E;AAC3E,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,mBAAmB,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,mBAAmB,IAAI,SAAS,GAAG,UAAU,GAAG,CAAC;AAChH,SAAO,EAAE,UAAU,OAAO;AAC5B;AAEA,eAAe,cACb,OACA,OACA,SACA,KACA,QACA,iBACe;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,EAAE,YAAY,mBAAmB,IAAI,OAAO,UAAU,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,EAAE;AAAA,IACvG,CAAC,aAAa,kBAAkB,UAAU,KAAK,UAAU,MAAM,GAAG,GAAG;AAAA,IACrE,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,mBAAmB,OAAO,UAAU,UAAU,eAAe;AACtF;AAWA,eAAe,iBAAiB,OAAmB,OAAe,SAA0B,QAA0C;AACpI,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,UAAU;AACZ,WAAO,EAAE,WAAW,eAAe,SAAS,OAAO,IAAI,GAAG,QAAQ,SAAS,QAAQ,KAAK,SAAS,SAAS,SAAS,GAAG;AAAA,EACxH;AAEA,QAAM,YAAY,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACtE,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,SAAS;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC;AACzD,WAAO,EAAE,WAAW,QAAQ,KAAK,SAAS,EAAE;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAI,CAAE,gBAAgB,GAAG,EAAI,OAAM;AACnC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,EAAE,WAAW,eAAe,OAAO,OAAO,IAAI,GAAG,QAAQ,OAAO,QAAQ,KAAK,SAAS,OAAO,SAAS,GAAG;AAAA,EAClH;AACF;AAGA,eAAe,aAAa,QAAsB,MAAc,MAA+B,MAA6B;AAC1H,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,cAAc,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI;AACtE,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,GAAG,IAAI,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,gBAAgB,SAAY,EAAE,eAAe,UAAU,WAAW,GAAG,IAAI,CAAC;AAAA,MAChF;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,qBAAqB,UAAU,IAAI,oBAAqB,IAAc,OAAO,EAAE;AAAA,EAC3F;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,qBAAqB,kBAAkB,IAAI,YAAY,IAAI,MAAM,gDAA2C;AAAA,EACxH;AACF;AAEA,eAAe,WAAW,QAAsB,OAAe,WAAuB,QAA8C;AAClI,QAAM,aAAa,QAAQ,WAAW;AAAA,IACpC,SAAS;AAAA,IAAO,UAAU,OAAO;AAAA,IAAU,UAAU,eAAe,SAAS;AAAA;AAAA;AAAA,IAG7E,GAAI,SAAS,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,EAC/D,GAAG,WAAW;AAChB;AAQA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,QAAM,EAAE,WAAW,QAAQ,KAAK,QAAQ,IAAI,MAAM,iBAAiB,OAAO,OAAO,SAAS,MAAM;AAChG,MAAI,OAAO,YAAY;AACrB,cAAU,KAAK,CAAC;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,sBAAsB,WAAW,OAAO,OAAO,QAAQ;AAC/E,YAAU,KAAK,CAAC;AAChB,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,SAAS;AAAA,EAC3C,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,cAAc,OAAO,OAAO,SAAS,KAAK,EAAE,GAAG,QAAQ,YAAY,KAAK,GAAG,OAAO;AAAA,EAC1F,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AAClE,UAAI,QAAQ,OAAO,WAAY;AAAA,IACjC;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,WAAW,KAAmC;AAClE,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AAEjD,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACpE,MAAI,CAAC,UAAU;AAEb,UAAM,WAAW,GAAG;AACpB;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACzE,QAAM,eAAe,MAAM,sBAAsB,cAAc,OAAO,OAAO,QAAQ;AACrF,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,YAAY;AAAA,EAC9C,UAAE;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAEA,QAAM,SAA2B;AAAA,IAC/B,UAAU,OAAO;AAAA,IACjB,MAAM,eAAe,YAAY;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY;AAAA,EACd;AACA,eAAa,KAAK,CAAC;AACnB,QAAM,cAAc,OAAO,OAAO,SAAS,KAAK,QAAQ,SAAS,SAAS,EAAE;AAC9E;AAeA,eAAsB,gBACpB,KACA,QACe;AACf,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS,QAAQ;AAKnB,UAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,OAAO,MAAM;AAC/D,QAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB,mBAAmB,OAAO,MAAM,eAAe,KAAK,IAAI;AACnG,UAAM,qBAAqB,MAAM,MAAM,iBAAiB,SAAS,iBAAiB,GAAG,OAAO,MAAM;AAClG,QAAI,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK,SAAS,QAAS;AAChE,UAAM,OAAO;AACb,WAAO,MAAM,KAAK;AAAA,EACpB,OAAO;AACL,UAAM,UAAU,MAAM,YAAY,OAAO,OAAO,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,OAAO,CAAC;AAChG,QAAI,YAAY,OAAO,EAAG;AAC1B,UAAM,QAAQ,KAAK,IAAI,wBAAwB;AAC/C,WAAO,QAAQ;AAAA,EACjB;AACA,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR,kDAAkD,OAAO,MAAM;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,YAAY,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACtE,QAAM,WAAiC,EAAE,QAAQ,OAAO,QAAQ,KAAK;AACrE,QAAM,YAAY,MAAM,sBAAsB,WAAW,OAAO,OAAO,UAAU,OAAO,MAAM;AAC9F,MAAI;AACF,UAAM,WAAW,QAAQ,OAAO,WAAW,QAAQ;AAAA,EACrD,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AAEA,QAAM,SAA6B;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,eAAe,SAAS;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,YAAU,KAAK,CAAC;AAChB,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,0BAA0B,OAAO,MAAM;AAC/E,QAAM,kBAAkB,UAAU,MAAM;AACxC,QAAM,WAAW,MAAM;AAAA,IACrB,EAAE,YAAY,0BAA0B,IAAI,OAAO,QAAQ,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,EAAE;AAAA,IAC5G,CAAC,OAAO,kBAAkB,IAAI,KAAK,UAAU,MAAM,GAAG,GAAG;AAAA,IACzD,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,0BAA0B,OAAO,QAAQ,UAAU,eAAe;AAC3F;AASA,eAAsB,iBAAiB,KAAoB,QAA+B;AACxF,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAC1C,qBAAmB,OAAO;AAC1B,QAAM,MAAM,OAAO,OAAO,0BAA0B,MAAM;AAC1D,QAAM,aAAa,QAAQ,WAAW,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,OAAO,GAAG,mBAAmB;AAClH;AAGA,eAAe,eAAe,OAAmB,OAAe,SAA0B,QAA2C;AACnI,QAAM,MAAM,QAAQ,KAAK,IAAI,wBAAwB;AACrD,QAAM,WAAW,MAAM,MAAM,MAAM,IAAI,OAAO,0BAA0B,QAAQ,MAAM,IAAI;AAC1F,MAAI,CAAC,OAAO,CAAC,UAAU;AACrB,UAAM,IAAI;AAAA,MACR,SAAS,QAAQ,MAAM,MAAM,QAAQ,IAAI,6CAA6C,OAAO,QAAQ;AAAA,IAEvG;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,iBAAiB,EAAE,YAAY,0BAA0B,IAAI,QAAQ,OAAO,GAAG,UAAU,GAAG;AAAA,EAC3G,SAAS,KAAK;AAIZ,QAAI,eAAe,eAAe;AAChC,YAAM,IAAI;AAAA,QACR,SAAS,QAAQ,MAAM;AAAA,MACzB;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,aAAa,OAAO,UAAU;AACvC,UAAM,IAAI,qBAAqB,SAAS,QAAQ,MAAM,8BAA8B,OAAO,QAAQ,WAAW,OAAO,QAAQ,IAAI;AAAA,EACnI;AACA,SAAO,eAAe,OAAO,IAAI;AACnC;AAWA,eAAsB,qBAAqB,KAAoB,SAA6C;AAC1G,QAAM,EAAE,OAAO,OAAO,SAAS,OAAO,IAAI;AAM1C,MAAI;AACJ,MAAI;AACJ,MAAI,YAAY,OAAO,GAAG;AACxB,UAAM,MAAM,MAAM,UAAU,OAAO,OAAO,OAAO;AACjD,UAAM,QAAQ,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,GAAG;AACjE,QAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB,0CAA0C,OAAO,QAAQ,+BAA0B;AAC9H,QAAI,CAAC,MAAM,OAAO,YAAY;AAC5B,YAAM,IAAI;AAAA,QACR,yBAAyB,OAAO,QAAQ;AAAA,MAC1C;AAAA,IACF;AACA,gBAAY,eAAe,MAAM,OAAO,IAAI;AAAA,EAC9C,OAAO;AACL,gBAAY,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;AAC9D,aAAS,EAAE,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,KAAK;AAAA,EACxD;AAEA,QAAM,UAAU,OAAO,SAAS,WAAW;AAC3C,QAAM,iBAAiB,IAAI,IAAI,OAAO,QAAQ,EAAE;AAChD,QAAM,MAAM,SAAS,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK,IAAI,CAAC;AAErE,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,QAAQ,GAAG,OAAO,QAAQ,cAAc;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,GAAG,IAAI,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,qCAAsC,IAAc,OAAO,EAAE;AAAA,EACtF;AACA,MAAI,CAAC,aAAa,GAAI,OAAM,IAAI,aAAa,wCAAwC,aAAa,MAAM,EAAE;AAC1G,QAAM,EAAE,WAAW,UAAU,IAAK,MAAM,aAAa,KAAK;AAE1D,QAAM,QAAQ,MAAM,mBAAmB,WAAW,OAAO,OAAO,UAAU,EAAE,gBAAgB,QAAQ,SAAS,WAAW,UAAU,CAAC;AAEnI,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,OAAO,QAAQ,gBAAgB;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,UAAU,OAAO,UAAU,GAAG,KAAK,WAAW,OAAO,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AAAA,IAC7I,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI,aAAa,uCAAwC,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,OAAM,IAAI,iBAAiB,qCAAqC;AACxH,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,aAAa,0CAA0C,SAAS,MAAM,EAAE;AACpG,SAAQ,MAAM,SAAS,KAAK;AAC9B;","names":[]}

package/dist/sequence/index.js

@@ -5,17 +5,17 @@ import {
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "../chunk-BYHCKX73.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+} from "../chunk-CLOSXHR4.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
 import {
   SequenceNotEnabledError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 export {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,

package/dist/session/index.js

@@ -12,23 +12,23 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-JPSL5GIZ.js";
+} from "../chunk-QQLXKDGC.js";
 import {
   NO_SESSION
 } from "../chunk-VKQCVU2Z.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 
 // src/with-party/session/active.ts
 function withSession() {

package/dist/shadow/index.js

@@ -1,11 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-B65CC6Z6.js";
+} from "../chunk-RF5WDM25.js";
 import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-2RH5SEY7.js";
 
 // src/with-fork/shadow/active.ts
 function withShadow() {

package/dist/signer-TW5MAQJP.js

@@ -0,0 +1,23 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-IPF5ORDI.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-TW5MAQJP.js.map

package/dist/snapshots/index.js

@@ -4,19 +4,19 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-RDOEOPOI.js";
-import "../chunk-YQFBH5ZJ.js";
+} from "../chunk-4N4OIVK3.js";
+import "../chunk-WQUIJPN4.js";
 import "../chunk-GMKGGY7V.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 
 // src/with-fork/snapshots/engine.ts
 var SnapshotEngine = class {

package/dist/{stale-SKV33PBU.js → stale-CROGJBIJ.js}

@@ -6,16 +6,16 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-AJFPAHMW.js";
+} from "./chunk-27NCEPKM.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-4J3MNVVX.js";
-import "./chunk-ZBUAX4EF.js";
-import "./chunk-SPPOUJLN.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-OM3SEDI4.js";
-import "./chunk-PUBI455O.js";
-import "./chunk-2ELOCEXE.js";
-import "./chunk-VSUQI5Q6.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
 export {
   MV_STALE_COLLECTION,
   clearMVStale,
@@ -25,4 +25,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-SKV33PBU.js.map
+//# sourceMappingURL=stale-CROGJBIJ.js.map

package/dist/storage-SO2L2Z5J.js

@@ -0,0 +1,21 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-IF2M43G4.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-SO2L2Z5J.js.map

package/dist/{store-coordination-provider-Z6HKPOGM.js → store-coordination-provider-2YD2PTTP.js}

@@ -1,17 +1,17 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-BMHQHH7Q.js";
+} from "./chunk-TLIFNRU5.js";
 import {
   buildRecordEnvelope
-} from "./chunk-4J3MNVVX.js";
-import "./chunk-ZBUAX4EF.js";
-import "./chunk-SPPOUJLN.js";
+} from "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-OM3SEDI4.js";
-import "./chunk-PUBI455O.js";
-import "./chunk-2ELOCEXE.js";
-import "./chunk-VSUQI5Q6.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
 
 // src/with-shape/schema-update/client-registry.ts
 var META_COLLECTION = "_meta";
@@ -144,4 +144,4 @@ function unref(timer) {
 export {
   StoreMesh
 };
-//# sourceMappingURL=store-coordination-provider-Z6HKPOGM.js.map
+//# sourceMappingURL=store-coordination-provider-2YD2PTTP.js.map