@noy-db/hub 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/chunk-L5HHBOMS.js

@@ -0,0 +1,232 @@
+import {
+  resolveManagedSecret
+} from "./chunk-MRJPSXPE.js";
+import {
+  parseExtractedPartitionBody,
+  readNoydbBundle,
+  readNoydbBundleHeader
+} from "./chunk-QBLPY44S.js";
+import {
+  createOwnerKeyring
+} from "./chunk-ZCMOS4H2.js";
+import {
+  LEDGER_COLLECTION,
+  LedgerStore
+} from "./chunk-2UT7HJJR.js";
+import {
+  base64ToBuffer,
+  decrypt,
+  unwrapCek,
+  wrapKey
+} from "./chunk-E2MDPPOC.js";
+import {
+  AdoptionStateError,
+  TransferSealError,
+  ValidationError
+} from "./chunk-JZ5DS4DP.js";
+
+// src/bundle/adopt-partition.ts
+async function unsealDeks(seal, transferKey) {
+  if (transferKey.byteLength !== 32) {
+    throw new TransferSealError(
+      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
+    );
+  }
+  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
+  const raw = base64ToBuffer(seal.payload);
+  let plaintext;
+  try {
+    plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: raw.slice(0, 12) },
+      key,
+      raw.slice(12)
+    );
+  } catch {
+    throw new TransferSealError(
+      "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
+    );
+  }
+  let dekMap;
+  try {
+    dekMap = JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
+  }
+  const deks = /* @__PURE__ */ new Map();
+  for (const [collection, b64] of Object.entries(dekMap)) {
+    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
+    deks.set(collection, dek);
+  }
+  return deks;
+}
+async function adoptPartition(bundleBytes, opts) {
+  const { transferKey, destinationStore, vaultName } = opts;
+  const header = readNoydbBundleHeader(bundleBytes);
+  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
+    throw new ValidationError(
+      "adoptPartition requires an extracted-partition bundle with a transfer seal. For ordinary backups use readNoydbBundle + vault.load."
+    );
+  }
+  const { dumpJson } = await readNoydbBundle(bundleBytes);
+  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
+  await unsealDeks(seal, transferKey);
+  const existing = await destinationStore.get(vaultName, "_meta", "adoption");
+  if (existing) {
+    const prior = JSON.parse(existing._data);
+    if (prior.sealId === seal.sealId) {
+      throw new AdoptionStateError(
+        `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
+      );
+    }
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already holds an adopted partition (sealId ${prior.sealId}); adopting a different partition (sealId ${seal.sealId}) here would overwrite it. Adopt into a fresh vaultName instead.`
+    );
+  }
+  const existingKeyring = await destinationStore.list(vaultName, "_keyring");
+  if (existingKeyring.length > 0) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already holds a keyring (an unrelated owner exists at this slot); adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`
+    );
+  }
+  const backup = JSON.parse(dump);
+  await destinationStore.saveAll(vaultName, backup.collections);
+  if (backup._internal) {
+    for (const [collection, records] of Object.entries(backup._internal)) {
+      for (const [id, envelope] of Object.entries(records)) {
+        await destinationStore.put(vaultName, collection, id, envelope);
+      }
+    }
+  }
+  const adoptedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true, transferSeal: seal };
+  await destinationStore.put(vaultName, "_meta", "adoption", {
+    _noydb: 1,
+    _v: 1,
+    _ts: adoptedAt,
+    _iv: "",
+    _data: JSON.stringify(adoption)
+  });
+  return { vaultName, needsOwner: true, sealId: seal.sealId };
+}
+function isManaged(o) {
+  return "passphraseMode" in o && o.passphraseMode === "managed";
+}
+async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
+  const { userId, transferKey } = opts;
+  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === "shamir")) {
+    throw new AdoptionStateError(
+      "managed-mode adoption requires at least one strong (shamir) recovery profile in `recovery` \u2014 paper alone is not strong when there is no user passphrase to fall back on."
+    );
+  }
+  const adoptionEnv = await store.get(vaultName, "_meta", "adoption");
+  if (!adoptionEnv) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
+    );
+  }
+  const adoption = JSON.parse(adoptionEnv._data);
+  if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
+    );
+  }
+  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey);
+  const existingKeyring = await store.get(vaultName, "_keyring", userId);
+  const otherOwners = (await store.list(vaultName, "_keyring")).filter((u) => u !== userId);
+  if (otherOwners.length > 0) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already has a keyring for a different owner; cannot create owner "${userId}".`
+    );
+  }
+  const partitionCollections = [...partitionDeks.keys()];
+  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
+  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
+  if (!ownerMinted) {
+    const passphrase = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.passphrase;
+    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase);
+    const env = await store.get(vaultName, "_keyring", userId);
+    if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
+    const keyringFile = JSON.parse(env._data);
+    const kek = unlocked.kek;
+    if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
+    const mergedDeks = { ...keyringFile.deks };
+    for (const [collection, dek] of partitionDeks) {
+      mergedDeks[collection] = await wrapKey(dek, kek);
+    }
+    const mergedFile = { ...keyringFile, deks: mergedDeks };
+    await store.put(vaultName, "_keyring", userId, { ...env, _data: JSON.stringify(mergedFile) });
+  }
+  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION);
+  if (ledgerDek) {
+    const ledger = new LedgerStore({
+      adapter: store,
+      vault: vaultName,
+      encrypted: true,
+      getDEK: async () => ledgerDek,
+      actor: userId
+    });
+    const creationReason = `creation-of-new-owner:${userId}`;
+    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`;
+    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason));
+    if (!recordedReasons.has(creationReason)) {
+      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: creationReason });
+    }
+    if (!recordedReasons.has(consumedReason)) {
+      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: consumedReason });
+    }
+  }
+  if (isManaged(opts)) {
+    const { createNoydb } = await import("./noydb-NAU2DTFP.js");
+    const db = await createNoydb({
+      store,
+      user: userId,
+      passphraseMode: "managed",
+      sealingKey: opts.sealingKey,
+      shamirRecovery: opts.shamirRecovery
+    });
+    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery });
+  }
+  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await store.put(vaultName, "_meta", "adoption", { ...adoptionEnv, _data: JSON.stringify(consumed) });
+  return { vaultName, userId };
+}
+
+// src/bundle/decrypt-partition.ts
+async function decryptExtractedPartition(bundleBytes, transferKey) {
+  const header = readNoydbBundleHeader(bundleBytes);
+  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
+    throw new Error("decryptExtractedPartition: bundle is not an extracted-partition.");
+  }
+  const { dumpJson } = await readNoydbBundle(bundleBytes);
+  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
+  const deks = await unsealDeks(seal, transferKey);
+  const backup = JSON.parse(dump);
+  const out = {};
+  for (const [collection, byId] of Object.entries(backup.collections)) {
+    const dek = deks.get(collection);
+    if (dek === void 0) continue;
+    const recs = [];
+    for (const [id, env] of Object.entries(byId)) {
+      const plaintext = env._cek !== void 0 ? await decrypt(env._iv, env._data, await unwrapCek(env._cek, dek)) : await decrypt(env._iv, env._data, dek);
+      const body = JSON.parse(plaintext);
+      recs.push({
+        id,
+        record: { ...body, id },
+        ts: env._ts,
+        version: env._v,
+        ...env._source !== void 0 ? { source: env._source } : {},
+        ...env._sourceTs !== void 0 ? { sourceTs: env._sourceTs } : {}
+      });
+    }
+    out[collection] = recs;
+  }
+  return out;
+}
+
+export {
+  unsealDeks,
+  adoptPartition,
+  createOwnerOnAdoptedPartition,
+  decryptExtractedPartition
+};
+//# sourceMappingURL=chunk-L5HHBOMS.js.map

package/dist/chunk-L5HHBOMS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bundle/adopt-partition.ts","../src/bundle/decrypt-partition.ts"],"sourcesContent":["/**\n * Partition adoption. Recipient side: verify an extracted bundle,\n * validate the transfer key, import the re-keyed collections into a\n * destination store, and record an `_meta/adoption` marker. The bundle\n * stays UNOWNED after adoption — `createOwnerOnAdoptedPartition`\n * mints the owner; the transfer seal is then destroyed.\n *\n * @module\n */\nimport { base64ToBuffer, wrapKey } from '../crypto.js'\nimport { TransferSealError, AdoptionStateError, ValidationError } from '../errors.js'\nimport type { NoydbStore, VaultSnapshot, KeyringFile } from '../types.js'\nimport { createOwnerKeyring } from '../team/keyring.js'\nimport { resolveManagedSecret } from '../team/managed-passphrase.js'\nimport type { SealingKeyProvider } from '../team/managed-passphrase.js'\nimport type { ShamirRecoveryProvider } from '../team/shamir-recovery-provider.js'\nimport type { RecoveryEnrollmentInput } from '../team/rotate-recover.js'\nimport { LedgerStore } from '../history/ledger/store.js'\nimport { LEDGER_COLLECTION } from '../history/ledger/constants.js'\nimport type { TransferSealPayload } from './bundle.js'\nimport { readNoydbBundleHeader, readNoydbBundle, parseExtractedPartitionBody } from './bundle.js'\n\n/**\n * Reverse of `sealDeks`. Imports the transfer key, decrypts the\n * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and\n * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a\n * wrong key (AES-GCM auth-tag failure) or malformed payload.\n */\nexport async function unsealDeks(\n  seal: TransferSealPayload,\n  transferKey: Uint8Array,\n): Promise<Map<string, CryptoKey>> {\n  if (transferKey.byteLength !== 32) {\n    throw new TransferSealError(\n      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`,\n    )\n  }\n  const key = await crypto.subtle.importKey('raw', transferKey as BufferSource, 'AES-GCM', false, ['decrypt'])\n  const raw = base64ToBuffer(seal.payload)\n  let plaintext: ArrayBuffer\n  try {\n    plaintext = await crypto.subtle.decrypt(\n      { name: 'AES-GCM', iv: raw.slice(0, 12) as BufferSource },\n      key,\n      raw.slice(12) as BufferSource,\n    )\n  } catch {\n    throw new TransferSealError(\n      'transfer seal could not be opened — wrong transfer key (AES-GCM authentication failed).',\n    )\n  }\n  let dekMap: Record<string, string>\n  try {\n    dekMap = JSON.parse(new TextDecoder().decode(plaintext)) as Record<string, string>\n  } catch {\n    throw new TransferSealError('transfer seal payload is not valid JSON after decryption.')\n  }\n  const deks = new Map<string, CryptoKey>()\n  for (const [collection, b64] of Object.entries(dekMap)) {\n    // Extractable: the recipient must be able to re-wrap these under their\n    // own KEK (AES-KW) at owner-creation. Matches generateDEK.\n    const dek = await crypto.subtle.importKey('raw', base64ToBuffer(b64) as BufferSource, 'AES-GCM', true, ['encrypt', 'decrypt'])\n    deks.set(collection, dek)\n  }\n  return deks\n}\n\nexport interface AdoptPartitionOptions {\n  readonly transferKey: Uint8Array\n  readonly destinationStore: NoydbStore\n  readonly vaultName: string\n}\n\nexport interface AdoptPartitionResult {\n  readonly vaultName: string\n  readonly needsOwner: true\n  readonly sealId: string\n}\n\nexport async function adoptPartition(\n  bundleBytes: Uint8Array,\n  opts: AdoptPartitionOptions,\n): Promise<AdoptPartitionResult> {\n  const { transferKey, destinationStore, vaultName } = opts\n\n  const header = readNoydbBundleHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new ValidationError(\n      'adoptPartition requires an extracted-partition bundle with a transfer seal. '\n      + 'For ordinary backups use readNoydbBundle + vault.load.',\n    )\n  }\n\n  const { dumpJson } = await readNoydbBundle(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n\n  // Validate the transfer key by unsealing in memory; throws\n  // TransferSealError on mismatch. DEKs are discarded here — they stay\n  // sealed at rest (in _meta/adoption) until owner-creation wraps them under the\n  // recipient's KEK.\n  await unsealDeks(seal, transferKey)\n\n  // Single-occupancy per vaultName: an `_meta/adoption` marker already present\n  // means this slot holds a partition (adopted-and-unowned, or already owned).\n  // saveAll below would overwrite its data and replace the marker, stranding the\n  // prior adoption's transfer seal. Refuse regardless of sealId — re-adopting the\n  // SAME bundle is a redundant call, and adopting a DIFFERENT bundle here would\n  // clobber the existing partition. Either way, pick a fresh vaultName.\n  const existing = await destinationStore.get(vaultName, '_meta', 'adoption')\n  if (existing) {\n    const prior = JSON.parse(existing._data) as { sealId?: string }\n    if (prior.sealId === seal.sealId) {\n      throw new AdoptionStateError(\n        `partition (sealId ${seal.sealId}) is already adopted into vault \"${vaultName}\".`,\n      )\n    }\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds an adopted partition (sealId ${prior.sealId}); `\n      + `adopting a different partition (sealId ${seal.sealId}) here would overwrite it. `\n      + `Adopt into a fresh vaultName instead.`,\n    )\n  }\n\n  // The marker-only check above misses a worse case: a vaultName already in use\n  // by an ORDINARY vault (createNoydb + openVault) carries no `_meta/adoption`,\n  // yet `saveAll` below is destructive on SQL adapters (`DELETE FROM ... WHERE\n  // vault = ?` followed by upsert) and would wipe the legitimate keyring +\n  // data. Refuse adoption into ANY occupied slot — a fresh vaultName is the\n  // documented precondition.\n  const existingKeyring = await destinationStore.list(vaultName, '_keyring')\n  if (existingKeyring.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds a keyring (an unrelated owner exists at this slot); `\n      + `adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`,\n    )\n  }\n\n  const backup = JSON.parse(dump) as { collections: VaultSnapshot; _internal?: VaultSnapshot }\n  await destinationStore.saveAll(vaultName, backup.collections)\n\n  // Import carried internal collections (e.g. _schemas from carrySchemas).\n  // saveAll only writes data collections; _internal is written per-record.\n  if (backup._internal) {\n    for (const [collection, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await destinationStore.put(vaultName, collection, id, envelope)\n      }\n    }\n  }\n\n  const adoptedAt = new Date().toISOString()\n  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true as const, transferSeal: seal }\n  await destinationStore.put(vaultName, '_meta', 'adoption', {\n    _noydb: 1, _v: 1, _ts: adoptedAt, _iv: '', _data: JSON.stringify(adoption),\n  })\n\n  return { vaultName, needsOwner: true, sealId: seal.sealId }\n}\n\nexport interface CreateOwnerResult {\n  readonly vaultName: string\n  readonly userId: string\n}\n\n/** Standard-mode owner: recipient supplies the passphrase. */\nexport interface CreateOwnerStandardOptions {\n  readonly userId: string\n  readonly passphrase: string\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Managed-mode owner: the passphrase is minted + sealed under\n * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition\n * auto-unlocks on the recipient's device. Managed mode mandates a strong\n * (Shamir) recovery profile at creation, which needs the\n * `shamirRecovery` provider injected.\n */\nexport interface CreateOwnerManagedOptions {\n  readonly userId: string\n  readonly passphraseMode: 'managed'\n  readonly sealingKey: SealingKeyProvider\n  readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>\n  readonly shamirRecovery: ShamirRecoveryProvider\n  readonly transferKey: Uint8Array\n}\n\nexport type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions\n\nfunction isManaged(o: CreateOwnerOptions): o is CreateOwnerManagedOptions {\n  return 'passphraseMode' in o && o.passphraseMode === 'managed'\n}\n\n/**\n * Mint the first owner keyring on an adopted-but-unowned partition,\n * then destroy the transfer seal.\n *\n * Standard mode: the recipient supplies a passphrase. Managed mode: the\n * passphrase is minted + sealed under a `SealingKeyProvider` and a strong\n * (Shamir) recovery profile is enrolled — orchestrated via the existing\n * `openVaultAndEnrollRecovery` ceremony.\n *\n * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base\n * keyring, then wraps the partition's DEKs (recovered from the seal) under that\n * KEK and re-persists the merged keyring file.\n *\n * Idempotent under retry: the seal is destroyed LAST (Stage D), after the\n * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —\n * strong-recovery enrollment (Stage C). A failure in the fallible enrollment\n * step leaves the seal intact, and re-running with the same `userId` +\n * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery\n * arrays may re-enroll an already-enrolled profile on retry; managed mode's\n * mandated single Shamir profile does not.)\n */\nexport async function createOwnerOnAdoptedPartition(\n  store: NoydbStore,\n  vaultName: string,\n  opts: CreateOwnerOptions,\n): Promise<CreateOwnerResult> {\n  const { userId, transferKey } = opts\n\n  // Managed mode requires a strong (Shamir) recovery profile, validated BEFORE\n  // any disk write — same gate as createNoydb.\n  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === 'shamir')) {\n    throw new AdoptionStateError(\n      'managed-mode adoption requires at least one strong (shamir) recovery profile in '\n      + '`recovery` — paper alone is not strong when there is no user passphrase to fall back on.',\n    )\n  }\n\n  // 1. Verify adopted-unowned state.\n  const adoptionEnv = await store.get(vaultName, '_meta', 'adoption')\n  if (!adoptionEnv) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" is not an adopted partition (no _meta/adoption). `\n      + `createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`,\n    )\n  }\n  const adoption = JSON.parse(adoptionEnv._data) as {\n    sealId: string; adoptedAt: string; needsOwner?: boolean\n    consumedAt?: string; transferSeal?: TransferSealPayload\n  }\n  if (adoption.consumedAt !== undefined || adoption.transferSeal === undefined) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`,\n    )\n  }\n\n  // 2. Recover the partition DEKs from the seal (throws on wrong key) BEFORE\n  //    writing any keyring, so a bad transfer key leaves no trace. Always\n  //    validated, including when resuming a partial prior call.\n  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey)\n\n  // The ceremony below is split into stages so a failure in the fallible\n  // managed-enrollment step (network/provider outage) leaves the call RETRYABLE\n  // — the seal is destroyed only once everything durable is in place. Each stage\n  // detects its own prior completion rather than relying on a single resume bit.\n\n  // A keyring present for a DIFFERENT user (with the seal still unconsumed) is a\n  // genuine second-owner attempt — refuse it. A same-user keyring is a resumed\n  // partial call and is handled by the stage checks below.\n  const existingKeyring = await store.get(vaultName, '_keyring', userId)\n  const otherOwners = (await store.list(vaultName, '_keyring')).filter((u) => u !== userId)\n  if (otherOwners.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has a keyring for a different owner; cannot create owner \"${userId}\".`,\n    )\n  }\n\n  // Stage A — mint the owner keyring + merge the partition DEKs. Considered done\n  // only when the keyring already holds every partition DEK. createOwnerKeyring\n  // overwrites (fresh KEK + fresh _users DEK), so re-running is safe ONLY while\n  // no recovery has been enrolled yet — guaranteed here because enrollment\n  // (Stage C) runs strictly after Stage A completes.\n  const partitionCollections = [...partitionDeks.keys()]\n  const priorDeks = existingKeyring ? (JSON.parse(existingKeyring._data) as KeyringFile).deks : {}\n  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks)\n  if (!ownerMinted) {\n    // Resolve the owner passphrase. Managed mode mints a random passphrase, seals\n    // it under the provider, and persists _meta/sealed-passphrase (so the\n    // partition auto-unlocks on the recipient's device); standard mode uses the\n    // caller's passphrase. Idempotent under retry — resolveManagedSecret's reopen\n    // arm reuses an already-sealed passphrase.\n    const passphrase = isManaged(opts)\n      ? await resolveManagedSecret(store, vaultName, opts.sealingKey)\n      : opts.passphrase\n\n    // Mint the owner keyring (KEK + _users DEK + canary, written to disk).\n    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase)\n\n    // Merge the partition DEKs (wrapped under the new KEK) into the keyring.\n    const env = await store.get(vaultName, '_keyring', userId)\n    if (!env) throw new AdoptionStateError(`keyring write for \"${userId}\" did not persist`)\n    const keyringFile = JSON.parse(env._data) as KeyringFile\n    const kek = unlocked.kek\n    if (!kek) throw new AdoptionStateError(`owner keyring for \"${userId}\" has no KEK to wrap partition DEKs under`)\n    const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n    for (const [collection, dek] of partitionDeks) {\n      mergedDeks[collection] = await wrapKey(dek, kek)\n    }\n    const mergedFile: KeyringFile = { ...keyringFile, deks: mergedDeks }\n    await store.put(vaultName, '_keyring', userId, { ...env, _data: JSON.stringify(mergedFile) })\n  }\n\n  // Stage B — record the ownership transition on the carried\n  // audit chain (carryLedger sealed the _ledger DEK). No-op without that DEK.\n  // Idempotent: appended only if the closing `transfer-seal-consumed` entry is\n  // absent, so a retry does not duplicate the pair.\n  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION)\n  if (ledgerDek) {\n    const ledger = new LedgerStore({\n      adapter: store,\n      vault: vaultName,\n      encrypted: true,\n      getDEK: async () => ledgerDek,\n      actor: userId,\n    })\n    const creationReason = `creation-of-new-owner:${userId}`\n    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`\n    // Gate each append on its own presence — a crash or store error strictly\n    // between the two adjacent puts would otherwise re-append the first one\n    // on retry. The pair is the audit record, not a single transaction.\n    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason))\n    if (!recordedReasons.has(creationReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: creationReason })\n    }\n    if (!recordedReasons.has(consumedReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: consumedReason })\n    }\n  }\n\n  // Stage C — Managed mode: enroll the mandatory strong recovery\n  //    by orchestrating the existing public ceremony. The partition is\n  //    now a managed-mode vault on disk (sealed passphrase + keyring), so we\n  //    open it as a normal client and let openVaultAndEnrollRecovery do the\n  //    gate-bypass + enroll + re-assert. Dynamic import keeps the Noydb class\n  //    out of the @noy-db/hub/bundle static graph. Runs BEFORE seal destruction\n  //    so a failure here leaves the seal intact and the call retryable.\n  if (isManaged(opts)) {\n    const { createNoydb } = await import('../noydb.js')\n    const db = await createNoydb({\n      store,\n      user: userId,\n      passphraseMode: 'managed',\n      sealingKey: opts.sealingKey,\n      shamirRecovery: opts.shamirRecovery,\n    })\n    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery })\n  }\n\n  // Stage D — Destroy the transfer seal LAST — the commit point. Everything\n  //    above is either idempotent or resumable, so the seal is only consumed\n  //    once the owner keyring (and, in managed mode, strong recovery) is\n  //    durably in place. Retain sealId + consumedAt for audit.\n  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: new Date().toISOString() }\n  await store.put(vaultName, '_meta', 'adoption', { ...adoptionEnv, _data: JSON.stringify(consumed) })\n\n  return { vaultName, userId }\n}\n","/**\n * Read-side counterpart to `extractPartition`: decrypt an\n * extracted-partition bundle's records to plaintext using its transfer\n * key, WITHOUT adopting it into a vault. Used by an outward\n * orchestration layer's reconcile/merge and field-authority flows to\n * compare incoming records against a receiver. The transfer key validates the bundle\n * (wrong key throws).\n * @module\n */\nimport type { EncryptedEnvelope } from '../types.js'\nimport { decrypt } from '../crypto.js'\nimport { unwrapCek } from '../record-keys/index.js'\nimport { readNoydbBundleHeader, readNoydbBundle, parseExtractedPartitionBody } from './bundle.js'\nimport { unsealDeks } from './adopt-partition.js'\n\n/** One decrypted record from an extracted-partition compartment. */\nexport interface DecryptedRecord {\n  readonly id: string\n  readonly record: Record<string, unknown>\n  /** Source envelope write timestamp (ISO) — for last-write-wins merges. */\n  readonly ts: string\n  /** Source envelope version. */\n  readonly version: number\n  /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */\n  readonly source?: string\n  /** ISO-8601 timestamp the provenance source was recorded (FR-5). */\n  readonly sourceTs?: string\n}\n\n/**\n * Decrypt every record of an extracted-partition bundle to plaintext,\n * grouped by collection. Throws if the bundle isn't an\n * extracted-partition or the transfer key is wrong.\n */\nexport async function decryptExtractedPartition(\n  bundleBytes: Uint8Array,\n  transferKey: Uint8Array,\n): Promise<Record<string, DecryptedRecord[]>> {\n  const header = readNoydbBundleHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new Error('decryptExtractedPartition: bundle is not an extracted-partition.')\n  }\n  const { dumpJson } = await readNoydbBundle(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n  const deks = await unsealDeks(seal, transferKey) // throws TransferSealError on wrong key\n  const backup = JSON.parse(dump) as { collections: Record<string, Record<string, EncryptedEnvelope>> }\n  const out: Record<string, DecryptedRecord[]> = {}\n  for (const [collection, byId] of Object.entries(backup.collections)) {\n    const dek = deks.get(collection)\n    if (dek === undefined) continue // no DEK sealed for this collection — skip\n    const recs: DecryptedRecord[] = []\n    for (const [id, env] of Object.entries(byId)) {\n      const plaintext = env._cek !== undefined\n        ? await decrypt(env._iv, env._data, await unwrapCek(env._cek, dek))\n        : await decrypt(env._iv, env._data, dek)\n      const body = JSON.parse(plaintext) as Record<string, unknown>\n      recs.push({\n        id,\n        record: { ...body, id },\n        ts: env._ts,\n        version: env._v,\n        ...(env._source !== undefined ? { source: env._source } : {}),\n        ...(env._sourceTs !== undefined ? { sourceTs: env._sourceTs } : {}),\n      })\n    }\n    out[collection] = recs\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,WACpB,MACA,aACiC;AACjC,MAAI,YAAY,eAAe,IAAI;AACjC,UAAM,IAAI;AAAA,MACR,sCAAsC,YAAY,UAAU;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,aAA6B,WAAW,OAAO,CAAC,SAAS,CAAC;AAC3G,QAAM,MAAM,eAAe,KAAK,OAAO;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,OAAO,OAAO;AAAA,MAC9B,EAAE,MAAM,WAAW,IAAI,IAAI,MAAM,GAAG,EAAE,EAAkB;AAAA,MACxD;AAAA,MACA,IAAI,MAAM,EAAE;AAAA,IACd;AAAA,EACF,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,kBAAkB,2DAA2D;AAAA,EACzF;AACA,QAAM,OAAO,oBAAI,IAAuB;AACxC,aAAW,CAAC,YAAY,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAGtD,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe,GAAG,GAAmB,WAAW,MAAM,CAAC,WAAW,SAAS,CAAC;AAC7H,SAAK,IAAI,YAAY,GAAG;AAAA,EAC1B;AACA,SAAO;AACT;AAcA,eAAsB,eACpB,aACA,MAC+B;AAC/B,QAAM,EAAE,aAAa,kBAAkB,UAAU,IAAI;AAErD,QAAM,SAAS,sBAAsB,WAAW;AAChD,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,WAAW;AACtD,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAM3D,QAAM,WAAW,MAAM,WAAW;AAQlC,QAAM,WAAW,MAAM,iBAAiB,IAAI,WAAW,SAAS,UAAU;AAC1E,MAAI,UAAU;AACZ,UAAM,QAAQ,KAAK,MAAM,SAAS,KAAK;AACvC,QAAI,MAAM,WAAW,KAAK,QAAQ;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,KAAK,MAAM,oCAAoC,SAAS;AAAA,MAC/E;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,gDAAgD,MAAM,MAAM,6CACnC,KAAK,MAAM;AAAA,IAEzD;AAAA,EACF;AAQA,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,WAAW,UAAU;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AAI5D,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACpE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,iBAAiB,IAAI,WAAW,YAAY,IAAI,QAAQ;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,WAAW,YAAY,MAAe,cAAc,KAAK;AACjG,QAAM,iBAAiB,IAAI,WAAW,SAAS,YAAY;AAAA,IACzD,QAAQ;AAAA,IAAG,IAAI;AAAA,IAAG,KAAK;AAAA,IAAW,KAAK;AAAA,IAAI,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC3E,CAAC;AAED,SAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,KAAK,OAAO;AAC5D;AAgCA,SAAS,UAAU,GAAuD;AACxE,SAAO,oBAAoB,KAAK,EAAE,mBAAmB;AACvD;AAuBA,eAAsB,8BACpB,OACA,WACA,MAC4B;AAC5B,QAAM,EAAE,QAAQ,YAAY,IAAI;AAIhC,MAAI,UAAU,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,IAAI,WAAW,SAAS,UAAU;AAClE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,MAAM,YAAY,KAAK;AAI7C,MAAI,SAAS,eAAe,UAAa,SAAS,iBAAiB,QAAW;AAC5E,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,qDAAqD,SAAS,UAAU;AAAA,IAC7F;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM,WAAW,SAAS,cAAc,WAAW;AAUzE,QAAM,kBAAkB,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACrE,QAAM,eAAe,MAAM,MAAM,KAAK,WAAW,UAAU,GAAG,OAAO,CAAC,MAAM,MAAM,MAAM;AACxF,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,uEAAuE,MAAM;AAAA,IAClG;AAAA,EACF;AAOA,QAAM,uBAAuB,CAAC,GAAG,cAAc,KAAK,CAAC;AACrD,QAAM,YAAY,kBAAmB,KAAK,MAAM,gBAAgB,KAAK,EAAkB,OAAO,CAAC;AAC/F,QAAM,cAAc,oBAAoB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,KAAK,SAAS;AAChG,MAAI,CAAC,aAAa;AAMhB,UAAM,aAAa,UAAU,IAAI,IAC7B,MAAM,qBAAqB,OAAO,WAAW,KAAK,UAAU,IAC5D,KAAK;AAGT,UAAM,WAAW,MAAM,mBAAmB,OAAO,WAAW,QAAQ,UAAU;AAG9E,UAAM,MAAM,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACzD,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,mBAAmB;AACtF,UAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AACxC,UAAM,MAAM,SAAS;AACrB,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,2CAA2C;AAC9G,UAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,eAAW,CAAC,YAAY,GAAG,KAAK,eAAe;AAC7C,iBAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACjD;AACA,UAAM,aAA0B,EAAE,GAAG,aAAa,MAAM,WAAW;AACnE,UAAM,MAAM,IAAI,WAAW,YAAY,QAAQ,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAAA,EAC9F;AAMA,QAAM,YAAY,cAAc,IAAI,iBAAiB;AACrD,MAAI,WAAW;AACb,UAAM,SAAS,IAAI,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,YAAY;AAAA,MACpB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,iBAAiB,yBAAyB,MAAM;AACtD,UAAM,iBAAiB,0BAA0B,SAAS,MAAM;AAIhE,UAAM,kBAAkB,IAAI,KAAK,MAAM,OAAO,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AACpF,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AACA,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AAAA,EACF;AASA,MAAI,UAAU,IAAI,GAAG;AACnB,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAa;AAClD,UAAM,KAAK,MAAM,YAAY;AAAA,MAC3B;AAAA,MACA,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,2BAA2B,WAAW,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EAC5E;AAMA,QAAM,WAAW,EAAE,QAAQ,SAAS,QAAQ,WAAW,SAAS,WAAW,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChH,QAAM,MAAM,IAAI,WAAW,SAAS,YAAY,EAAE,GAAG,aAAa,OAAO,KAAK,UAAU,QAAQ,EAAE,CAAC;AAEnG,SAAO,EAAE,WAAW,OAAO;AAC7B;;;ACpUA,eAAsB,0BACpB,aACA,aAC4C;AAC5C,QAAM,SAAS,sBAAsB,WAAW;AAChD,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,WAAW;AACtD,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAC3D,QAAM,OAAO,MAAM,WAAW,MAAM,WAAW;AAC/C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACnE,UAAM,MAAM,KAAK,IAAI,UAAU;AAC/B,QAAI,QAAQ,OAAW;AACvB,UAAM,OAA0B,CAAC;AACjC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC5C,YAAM,YAAY,IAAI,SAAS,SAC3B,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,MAAM,UAAU,IAAI,MAAM,GAAG,CAAC,IAChE,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,GAAG;AACzC,YAAM,OAAO,KAAK,MAAM,SAAS;AACjC,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ,EAAE,GAAG,MAAM,GAAG;AAAA,QACtB,IAAI,IAAI;AAAA,QACR,SAAS,IAAI;AAAA,QACb,GAAI,IAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,QAC3D,GAAI,IAAI,cAAc,SAAY,EAAE,UAAU,IAAI,UAAU,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-YK72A4IT.js → chunk-LBILABKZ.js}

@@ -1,6 +1,6 @@
 import {
   dekKey
-} from "./chunk-6S3LLAQ5.js";
+} from "./chunk-MSMDDDDJ.js";
 import {
   generateULID
 } from "./chunk-FZU343FL.js";
@@ -9,10 +9,10 @@ import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-UOF74WQY.js";
+} from "./chunk-E2MDPPOC.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-YDLAFP36.js";
+} from "./chunk-JZ5DS4DP.js";
 
 // src/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -94,4 +94,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-YK72A4IT.js.map
+//# sourceMappingURL=chunk-LBILABKZ.js.map

package/dist/chunk-LXKBG52H.js

@@ -0,0 +1,151 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-A7DNZVAV.js";
+import {
+  bufferToBase64,
+  decrypt,
+  encrypt,
+  generateDEK,
+  unwrapCek,
+  wrapCek
+} from "./chunk-E2MDPPOC.js";
+import {
+  RecordCekNotFoundError,
+  ValidationError
+} from "./chunk-JZ5DS4DP.js";
+
+// src/record-keys/tombstone.ts
+function isTombstone(envelope, encrypted) {
+  if (!encrypted) return false;
+  return !envelope._data && envelope._cek === void 0;
+}
+function buildTombstone(version, actor) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: "",
+    ...actor ? { _by: actor } : {}
+  };
+}
+
+// src/record-keys/lifecycle.ts
+async function resolveStableCek(deps, id) {
+  const cached = deps.cache?.get(id);
+  if (cached) return cached;
+  const live = await deps.getLive(id);
+  if (live?._cek !== void 0) {
+    const cek = await unwrapCek(live._cek, await deps.getDEK());
+    deps.cache?.set(id, cek, 1);
+    return cek;
+  }
+  const fresh = await generateDEK();
+  deps.cache?.set(id, fresh, 1);
+  return fresh;
+}
+async function rewrapBodyToDek(envelope, fromDek, toDek) {
+  if (envelope._cek !== void 0) {
+    const cek = await unwrapCek(envelope._cek, fromDek);
+    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek);
+    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
+    return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
+  }
+  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek);
+  const { iv, data } = await encrypt(plaintext, toDek);
+  return { _iv: iv, _data: data, cek: null };
+}
+
+// src/record-keys/sealing.ts
+var subtle = globalThis.crypto.subtle;
+var SEALED_CEK_NS = "_sealed_cek";
+async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
+  if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
+  if (id.includes("/")) throw new ValidationError(`sealRecordToHost: id "${id}" must not contain "/"`);
+  const live = await ctx.adapter.get(ctx.vault, collection, id);
+  if (!live || live._cek === void 0) {
+    throw new RecordCekNotFoundError(collection, id);
+  }
+  const dek = await ctx.getDEK(collection);
+  const cek = await unwrapCek(live._cek, dek);
+  const rawCek = await subtle.exportKey("raw", cek);
+  const cekB64 = bufferToBase64(rawCek);
+  const hint = await hostSealer.publishRecipientHint();
+  if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
+  const binding = {
+    collection,
+    id,
+    cek: cekB64,
+    expiresAt: opts.expiresAt
+  };
+  const sealed = await hostSealer.sealForRecipient(
+    new TextEncoder().encode(JSON.stringify(binding)),
+    hint
+  );
+  const delivery = {
+    v: 1,
+    _noydb_sealed_cek: 1,
+    pid: hint.pid,
+    payload: bufferToBase64(sealed),
+    expiresAt: opts.expiresAt
+  };
+  const envelopeKey = `${collection}/${id}/${hint.pid}`;
+  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the sealing layer is the security boundary, exactly
+    // like the managed-passphrase `_meta/sealed-passphrase` envelope.
+    _iv: "",
+    _data: JSON.stringify(delivery),
+    ...ctx.actor ? { _by: ctx.actor } : {}
+  };
+  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
+  return { pid: hint.pid, envelopeKey };
+}
+async function revokeSealedRecord(ctx, collection, id, pid) {
+  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`);
+}
+async function rotateRecordCek(ctx, collection, id) {
+  const live = await ctx.adapter.get(ctx.vault, collection, id);
+  if (!live || live._cek === void 0) {
+    throw new RecordCekNotFoundError(collection, id);
+  }
+  const dek = await ctx.getDEK(collection);
+  const oldCek = await unwrapCek(live._cek, dek);
+  const json = await decrypt(live._iv, live._data, oldCek);
+  const newCek = await generateDEK();
+  const { iv, data } = await encrypt(json, newCek);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: live._v + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _cek: await wrapCek(newCek, dek),
+    ...ctx.actor ? { _by: ctx.actor } : {},
+    ...live._tier !== void 0 ? { _tier: live._tier } : {},
+    ...live._det !== void 0 ? { _det: live._det } : {}
+  };
+  await ctx.adapter.put(ctx.vault, collection, id, env);
+  await ctx.invalidateRecordCaches(collection, id);
+  const prefix = `${collection}/${id}/`;
+  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS);
+  for (const key of keys) {
+    if (key.startsWith(prefix)) {
+      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key);
+    }
+  }
+}
+
+export {
+  isTombstone,
+  buildTombstone,
+  resolveStableCek,
+  rewrapBodyToDek,
+  sealRecordToHost,
+  revokeSealedRecord,
+  rotateRecordCek
+};
+//# sourceMappingURL=chunk-LXKBG52H.js.map

package/dist/chunk-LXKBG52H.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/record-keys/tombstone.ts","../src/record-keys/lifecycle.ts","../src/record-keys/sealing.ts"],"sourcesContent":["/**\n * Tombstone shape + predicate for the per-record-key (CEK) layer.\n *\n * A *tombstone* is the residue a GDPR crypto-shred (`vault.forget()`, #304)\n * leaves on disk: the live envelope rewritten to `{ _noydb, _v, _ts, _by,\n * _iv:'', _data:'' }`, dropping `_iv`/`_data`/`_cek`/`_det`. With the wrapped\n * per-record CEK gone, the body — and every history version under the same\n * CEK — is permanently undecryptable, while the record KEY survives so the\n * version counter and \"record existed and was erased\" persist for the audit\n * ledger.\n *\n * These two helpers are the pure, collection-independent core of that\n * contract: {@link buildTombstone} mints the shape, {@link isTombstone}\n * recognises it on the read path. The orchestration that *writes* a tombstone\n * (`_writeTombstone`) and drives `vault.forget()` lives with the collection /\n * vault; it calls into these.\n */\nimport { NOYDB_FORMAT_VERSION, type EncryptedEnvelope } from '../types.js'\n\n/**\n * Is this envelope a crypto-shred tombstone?\n *\n * A tombstone carries no body (`_data` empty) and no wrapped CEK (`_cek`\n * absent) — decrypting it would call `decrypt('', '', dek)` → an AES-GCM\n * throw, so every read choke point must short-circuit to `null` instead.\n *\n * `encrypted` is the collection's encryption flag: on an unencrypted\n * collection there are no envelopes to shred, so nothing is ever a tombstone.\n * (Legacy migration envelopes carry non-empty `_iv`/`_data`, so they are not\n * tombstones and stay readable.)\n */\nexport function isTombstone(envelope: EncryptedEnvelope, encrypted: boolean): boolean {\n  if (!encrypted) return false\n  return !envelope._data && envelope._cek === undefined\n}\n\n/**\n * Mint a tombstone envelope from a record's live version + actor.\n *\n * Keeps `_v` (the displaced version) so the counter is monotonic across the\n * shred, stamps a fresh `_ts`, and records `_by` when an actor is supplied.\n * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the\n * erasure.\n */\nexport function buildTombstone(version: number, actor: string): EncryptedEnvelope {\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: '',\n    ...(actor ? { _by: actor } : {}),\n  }\n}\n","/**\n * Per-record CEK lifecycle helpers for the WRITE path (#356 foundation).\n *\n * These are the collection-coupled CEK operations, lifted off `Collection`\n * behind narrow deps so the kernel file delegates instead of carrying the\n * crypto inline:\n *\n *   - {@link resolveStableCek} — the stable-CEK rule: an update or history\n *     snapshot reuses the record's existing CEK so a single CEK delete kills\n *     the whole version chain; a genuine insert (or legacy record being\n *     migrated) mints a fresh one.\n *   - {@link rewrapBodyToDek} — move a record body's wrapping from one DEK to\n *     another (tier elevate/demote, bundle re-key) WITHOUT changing the body\n *     key: unwrap the CEK under the source DEK, re-encrypt the body under the\n *     same CEK, re-wrap the CEK under the destination DEK. History-chain\n *     identity is preserved because the body key never changes.\n *\n * Both are pure functions over their deps — the `cekCache` ownership stays on\n * the collection (its lifetime is tied to `load()`), so callers cache the\n * returned key themselves.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek } from '../crypto.js'\nimport type { EncryptedEnvelope } from '../types.js'\nimport type { Lru } from '../cache/index.js'\n\n/** Dependencies {@link resolveStableCek} needs from its collection. */\nexport interface StableCekDeps {\n  /** The collection's per-record CEK cache (`null` → no caching). */\n  readonly cache: Lru<string, CryptoKey> | null\n  /** Read the record's live envelope (to recover an existing `_cek`). */\n  getLive(id: string): Promise<EncryptedEnvelope | null>\n  /** The DEK the CEK is wrapped under (the collection DEK on the normal path). */\n  getDEK(): Promise<CryptoKey>\n}\n\n/**\n * Resolve the stable CEK for a record on the write path. Caches the resolved\n * key under `id` so an update + its history snapshot share one CEK.\n */\nexport async function resolveStableCek(deps: StableCekDeps, id: string): Promise<CryptoKey> {\n  const cached = deps.cache?.get(id)\n  if (cached) return cached\n\n  const live = await deps.getLive(id)\n  if (live?._cek !== undefined) {\n    const cek = await unwrapCek(live._cek, await deps.getDEK())\n    deps.cache?.set(id, cek, 1)\n    return cek\n  }\n\n  const fresh = await generateDEK()\n  deps.cache?.set(id, fresh, 1)\n  return fresh\n}\n\n/** Re-wrapped body bytes + the (optional) CEK to cache. */\nexport interface RewrappedBody {\n  readonly _iv: string\n  readonly _data: string\n  /** Present iff the source envelope carried a CEK (per-record-key record). */\n  readonly _cek?: string\n  /** The body key when one exists, so the caller can cache it; `null` for a legacy record. */\n  readonly cek: CryptoKey | null\n}\n\n/**\n * Move a record body from `fromDek` to `toDek`.\n *\n * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,\n *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The\n *   body key is unchanged → history-chain identity preserved.\n * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`\n *   directly — byte-for-byte the pre-CEK behaviour.\n */\nexport async function rewrapBodyToDek(\n  envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>,\n  fromDek: CryptoKey,\n  toDek: CryptoKey,\n): Promise<RewrappedBody> {\n  if (envelope._cek !== undefined) {\n    const cek = await unwrapCek(envelope._cek, fromDek)\n    const plaintext = await decrypt(envelope._iv, envelope._data, cek)\n    const { iv, data } = await encrypt(plaintext, cek)\n    return { _iv: iv, _data: data, _cek: await wrapCek(cek, toDek), cek }\n  }\n  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek)\n  const { iv, data } = await encrypt(plaintext, toDek)\n  return { _iv: iv, _data: data, cek: null }\n}\n","/**\n * Record-scoped CEK sealing — grantor side (#306 slices 2-3).\n *\n * The **grantor** holds the collection DEK and seals ONE record's CEK to an\n * `at-*` host so that host — and only that host — can decrypt exactly that\n * record, with no access to the vault DEK and no ability to read any other\n * record. This is the counterpart to the host-side `openSealedRecord`\n * (`@noy-db/hub/sealed-record`), which holds no DEK.\n *\n * These functions are the orchestration behind `vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`, lifted off `Vault`\n * behind a narrow {@link SealingContext} so the kernel file delegates. They\n * live in `record-keys/` (the vault-side CEK policy layer), NOT in\n * `sealed-record/`, so the host-side subpath stays DEK-free — they import only\n * the wire *types* from there.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, bufferToBase64 } from '../crypto.js'\nimport { NOYDB_FORMAT_VERSION, type EncryptedEnvelope, type NoydbStore } from '../types.js'\nimport { RecordCekNotFoundError, ValidationError } from '../errors.js'\nimport type { RecipientSealer } from '../team/managed-passphrase.js'\nimport type { SealedCekBinding, SealedCekDeliveryEnvelope } from '../sealed-record/types.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** The `_sealed_cek` delivery namespace (one envelope per `collection/id/pid`). */\nconst SEALED_CEK_NS = '_sealed_cek'\n\n/** What the grantor functions need from their `Vault`. */\nexport interface SealingContext {\n  readonly adapter: NoydbStore\n  /** Vault id (the adapter's first coordinate). */\n  readonly vault: string\n  /** Resolve the DEK a record's CEK is wrapped under. */\n  getDEK(collection: string): Promise<CryptoKey>\n  /** Actor id stamped on `_by` (empty string → omit). */\n  readonly actor: string\n  /** Evict the per-record CEK cache + decrypted-record cache after a rotation. */\n  invalidateRecordCaches(collection: string, id: string): Promise<void>\n}\n\n/**\n * Seal a record's CEK to a host. See `vault.sealRecordToHost` for the contract.\n * Returns `{ pid, envelopeKey }`.\n */\nexport async function sealRecordToHost(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n  hostSealer: RecipientSealer,\n  opts: { expiresAt: string },\n): Promise<{ pid: string; envelopeKey: string }> {\n  // Guard separators: the `_sealed_cek` id is `collection/id/pid`, so a `/` in\n  // any component would make the prefix-delete in rotateRecordCek() (which\n  // matches `${collection}/${id}/`) ambiguous and could over- or under-match.\n  if (collection.includes('/')) throw new ValidationError(`sealRecordToHost: collection \"${collection}\" must not contain \"/\"`)\n  if (id.includes('/')) throw new ValidationError(`sealRecordToHost: id \"${id}\" must not contain \"/\"`)\n\n  const live = await ctx.adapter.get(ctx.vault, collection, id)\n  if (!live || live._cek === undefined) {\n    throw new RecordCekNotFoundError(collection, id)\n  }\n\n  const dek = await ctx.getDEK(collection)\n  const cek = await unwrapCek(live._cek, dek)\n  const rawCek = await subtle.exportKey('raw', cek)\n  const cekB64 = bufferToBase64(rawCek)\n\n  const hint = await hostSealer.publishRecipientHint()\n  if (hint.pid.includes('/')) throw new ValidationError(`sealRecordToHost: recipient pid \"${hint.pid}\" must not contain \"/\"`)\n\n  const binding: SealedCekBinding = {\n    collection,\n    id,\n    cek: cekB64,\n    expiresAt: opts.expiresAt,\n  }\n  const sealed = await hostSealer.sealForRecipient(\n    new TextEncoder().encode(JSON.stringify(binding)),\n    hint,\n  )\n\n  const delivery: SealedCekDeliveryEnvelope = {\n    v: 1,\n    _noydb_sealed_cek: 1,\n    pid: hint.pid,\n    payload: bufferToBase64(sealed),\n    expiresAt: opts.expiresAt,\n  }\n\n  const envelopeKey = `${collection}/${id}/${hint.pid}`\n  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    // AES-GCM bypassed — the sealing layer is the security boundary, exactly\n    // like the managed-passphrase `_meta/sealed-passphrase` envelope.\n    _iv: '',\n    _data: JSON.stringify(delivery),\n    ...(ctx.actor ? { _by: ctx.actor } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env)\n\n  return { pid: hint.pid, envelopeKey }\n}\n\n/**\n * Soft-revoke one sealed-CEK delivery envelope (delete it from the store). A\n * host that already fetched the envelope keeps whatever it cached; for a hard\n * revocation use {@link rotateRecordCek}.\n */\nexport async function revokeSealedRecord(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n  pid: string,\n): Promise<void> {\n  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`)\n}\n\n/**\n * HARD-rotate a record's CEK: re-encrypt the live body under a fresh CEK, evict\n * caches, and delete EVERY sealed-CEK delivery envelope for the record. See\n * `vault.rotateRecordCek` for why this bypasses `Collection.put` (no guards, no\n * history bump — a key rotation must not re-encrypt prior history under the new\n * CEK).\n */\nexport async function rotateRecordCek(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n): Promise<void> {\n  const live = await ctx.adapter.get(ctx.vault, collection, id)\n  if (!live || live._cek === undefined) {\n    throw new RecordCekNotFoundError(collection, id)\n  }\n\n  const dek = await ctx.getDEK(collection)\n  const oldCek = await unwrapCek(live._cek, dek)\n  const json = await decrypt(live._iv, live._data, oldCek)\n\n  const newCek = await generateDEK()\n  const { iv, data } = await encrypt(json, newCek)\n\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: live._v + 1,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _cek: await wrapCek(newCek, dek),\n    ...(ctx.actor ? { _by: ctx.actor } : {}),\n    ...(live._tier !== undefined ? { _tier: live._tier } : {}),\n    ...(live._det !== undefined ? { _det: live._det } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, collection, id, env)\n\n  // Evict BOTH caches synchronously so no read returns the stale old-CEK record.\n  await ctx.invalidateRecordCaches(collection, id)\n\n  // Delete every sealed-CEK delivery envelope for this record — all pids.\n  const prefix = `${collection}/${id}/`\n  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS)\n  for (const key of keys) {\n    if (key.startsWith(prefix)) {\n      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+BO,SAAS,YAAY,UAA6B,WAA6B;AACpF,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,CAAC,SAAS,SAAS,SAAS,SAAS;AAC9C;AAUO,SAAS,eAAe,SAAiB,OAAkC;AAChF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,GAAI,QAAQ,EAAE,KAAK,MAAM,IAAI,CAAC;AAAA,EAChC;AACF;;;ACdA,eAAsB,iBAAiB,MAAqB,IAAgC;AAC1F,QAAM,SAAS,KAAK,OAAO,IAAI,EAAE;AACjC,MAAI,OAAQ,QAAO;AAEnB,QAAM,OAAO,MAAM,KAAK,QAAQ,EAAE;AAClC,MAAI,MAAM,SAAS,QAAW;AAC5B,UAAM,MAAM,MAAM,UAAU,KAAK,MAAM,MAAM,KAAK,OAAO,CAAC;AAC1D,SAAK,OAAO,IAAI,IAAI,KAAK,CAAC;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,YAAY;AAChC,OAAK,OAAO,IAAI,IAAI,OAAO,CAAC;AAC5B,SAAO;AACT;AAqBA,eAAsB,gBACpB,UACA,SACA,OACwB;AACxB,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,OAAO;AAClD,UAAMA,aAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AACjE,UAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQF,YAAW,GAAG;AACjD,WAAO,EAAE,KAAKC,KAAI,OAAOC,OAAM,MAAM,MAAM,QAAQ,KAAK,KAAK,GAAG,IAAI;AAAA,EACtE;AACA,QAAM,YAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,OAAO;AACrE,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,KAAK;AACnD,SAAO,EAAE,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK;AAC3C;;;AClEA,IAAM,SAAS,WAAW,OAAO;AAGjC,IAAM,gBAAgB;AAmBtB,eAAsB,iBACpB,KACA,YACA,IACA,YACA,MAC+C;AAI/C,MAAI,WAAW,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,iCAAiC,UAAU,wBAAwB;AAC3H,MAAI,GAAG,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,yBAAyB,EAAE,wBAAwB;AAEnG,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAW;AACpC,UAAM,IAAI,uBAAuB,YAAY,EAAE;AAAA,EACjD;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,UAAU;AACvC,QAAM,MAAM,MAAM,UAAU,KAAK,MAAM,GAAG;AAC1C,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,SAAS,eAAe,MAAM;AAEpC,QAAM,OAAO,MAAM,WAAW,qBAAqB;AACnD,MAAI,KAAK,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,oCAAoC,KAAK,GAAG,wBAAwB;AAE1H,QAAM,UAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,WAAW,KAAK;AAAA,EAClB;AACA,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,WAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,mBAAmB;AAAA,IACnB,KAAK,KAAK;AAAA,IACV,SAAS,eAAe,MAAM;AAAA,IAC9B,WAAW,KAAK;AAAA,EAClB;AAEA,QAAM,cAAc,GAAG,UAAU,IAAI,EAAE,IAAI,KAAK,GAAG;AACnD,QAAM,QAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,eAAe,WAAW;AACzE,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA;AAAA,IAG5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,QAAQ;AAAA,IAC9B,GAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,MAAM,IAAI,CAAC;AAAA,EACxC;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,eAAe,aAAa,GAAG;AAEhE,SAAO,EAAE,KAAK,KAAK,KAAK,YAAY;AACtC;AAOA,eAAsB,mBACpB,KACA,YACA,IACA,KACe;AACf,QAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,eAAe,GAAG,UAAU,IAAI,EAAE,IAAI,GAAG,EAAE;AACjF;AASA,eAAsB,gBACpB,KACA,YACA,IACe;AACf,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAW;AACpC,UAAM,IAAI,uBAAuB,YAAY,EAAE;AAAA,EACjD;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,UAAU;AACvC,QAAM,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG;AAC7C,QAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,KAAK,OAAO,MAAM;AAEvD,QAAM,SAAS,MAAM,YAAY;AACjC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM;AAE/C,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,IAAI,KAAK,KAAK;AAAA,IACd,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,MAAM,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC/B,GAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,MAAM,IAAI,CAAC;AAAA,IACtC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,IAAI,GAAG;AAGpD,QAAM,IAAI,uBAAuB,YAAY,EAAE;AAG/C,QAAM,SAAS,GAAG,UAAU,IAAI,EAAE;AAClC,QAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,aAAa;AAC5D,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,eAAe,GAAG;AAAA,IACxD;AAAA,EACF;AACF;","names":["plaintext","iv","data"]}

package/dist/{chunk-NGSPBLLE.js → chunk-MPIZQGFA.js}

@@ -1,6 +1,6 @@
 import {
   OverlayIdMismatchError
-} from "./chunk-YDLAFP36.js";
+} from "./chunk-JZ5DS4DP.js";
 
 // src/overlay-views/virtual-collection.ts
 var OverlayedCollection = class {
@@ -33,37 +33,34 @@ var OverlayedCollection = class {
   /** Get the merged row by id. */
   async get(id) {
     const overlayRow = await this.overlayCollection.get(id);
-    if (overlayRow !== null && this.shadowPredicateApplies(overlayRow)) {
-      return overlayRow;
-    }
     const baseRow = await this.baseCollection.get(id);
-    if (baseRow !== null) return baseRow;
-    return null;
+    return this.mergeRows(overlayRow, baseRow);
   }
   /** List union of base + overlay ids, applying the merge per row. */
   async list() {
     const baseRows = await this.baseCollection.list();
     const overlayRows = await this.overlayCollection.list();
-    const merged = /* @__PURE__ */ new Map();
     const idOf = (row) => {
       if (this.baseRowKey) return this.baseRowKey(row);
       const idField = row.id;
       return typeof idField === "string" ? idField : "";
     };
+    const baseById = /* @__PURE__ */ new Map();
+    const overlayById = /* @__PURE__ */ new Map();
     for (const row of baseRows) {
       const id = idOf(row);
-      if (id) merged.set(id, row);
+      if (id) baseById.set(id, row);
     }
     for (const row of overlayRows) {
       const id = idOf(row);
-      if (!id) continue;
-      if (this.shadowPredicateApplies(row)) {
-        merged.set(id, row);
-      } else if (!merged.has(id)) {
-        continue;
-      }
+      if (id) overlayById.set(id, row);
     }
-    return [...merged.values()];
+    const out = [];
+    for (const id of /* @__PURE__ */ new Set([...baseById.keys(), ...overlayById.keys()])) {
+      const merged = this.mergeRows(overlayById.get(id) ?? null, baseById.get(id) ?? null);
+      if (merged !== null) out.push(merged);
+    }
+    return out;
   }
   /**
    * Write to the overlay. Two forms:
@@ -103,9 +100,42 @@ var OverlayedCollection = class {
   async delete(id) {
     await this.overlayCollection.delete(id);
   }
-  /** True when `overlay[shadowField] === shadowValue`. */
-  shadowPredicateApplies(row) {
-    return row[this.spec.shadowField] === this.spec.shadowValue;
+  /**
+   * Merge a single id's overlay + base rows into the visible row.
+   *
+   * Priority (first match wins):
+   *  1. Binary shadow win — overlay present AND
+   *     `overlay[shadowField] === shadowValue` → return the overlay row
+   *     entirely. This stays FIRST so the original binary behaviour is
+   *     unchanged whether or not `mergeMode` is configured.
+   *  2. Field-level merge — overlay present, `mergeMode` configured,
+   *     and a rule whose `whenStatus` equals `overlay[shadowField]`.
+   *     The matched rule pulls its `overlayFields` (those present on
+   *     the overlay row) on top of the base row. With no base row, the
+   *     overlay row is returned as-is.
+   *  3. Fallback — return the base row (possibly `null`). An
+   *     overlay-only row that qualifies under neither (1) nor (2) and
+   *     has no base is therefore NOT surfaced.
+   */
+  mergeRows(overlayRow, baseRow) {
+    const shadowField = this.spec.shadowField;
+    if (overlayRow !== null && overlayRow[shadowField] === this.spec.shadowValue) {
+      return overlayRow;
+    }
+    if (overlayRow !== null && this.spec.mergeMode) {
+      const status = overlayRow[shadowField];
+      const rule = this.spec.mergeMode.rules.find((r) => r.whenStatus === status);
+      if (rule) {
+        if (baseRow === null) return overlayRow;
+        const overlaySrc = overlayRow;
+        const picked = {};
+        for (const field of rule.overlayFields) {
+          if (field in overlaySrc) picked[field] = overlaySrc[field];
+        }
+        return { ...baseRow, ...picked };
+      }
+    }
+    return baseRow;
   }
   // ─── Throw-stubs for the unimplemented Collection<T> surface ───────
   //
@@ -116,7 +146,7 @@ var OverlayedCollection = class {
   // error pointing at the relevant issue — so consumers don't hit a
   // cryptic `undefined is not a function` runtime crash.
   //
-  // Closes niwat-review of PR #160.
+  // Throw-stubs so consumers get actionable errors rather than cryptic crashes.
   /** @throws — chainable Query<T> over a virtual collection is deferred. */
   query() {
     throw new Error(
@@ -176,4 +206,4 @@ var OverlayedCollection = class {
 export {
   OverlayedCollection
 };
-//# sourceMappingURL=chunk-NGSPBLLE.js.map
+//# sourceMappingURL=chunk-MPIZQGFA.js.map