@noy-db/hub 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/overlay-views/index.d.ts

@@ -1,27 +1,31 @@
-export { w as withOverlayedView } from '../with-overlayed-view-DFaRfgMr.js';
-import { aG as OverlayedViewStrategy, aH as Collection } from '../types-D9eB0Rvh.js';
-export { aI as OverlayedViewRegistry, aJ as OverlayedViewStrategyHandle } from '../types-D9eB0Rvh.js';
-export { O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError } from '../index-BF1B2HB9.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+export { w as withOverlayedView } from '../with-overlayed-view-DVZrc5Hb.js';
+import { aM as OverlayedViewStrategy, aN as Collection } from '../index-DHn9lEP0.js';
+export { aO as OverlayFieldMergeMode, aP as OverlayFieldMergeRule, aQ as OverlayedViewRegistry, aR as OverlayedViewStrategyHandle } from '../index-DHn9lEP0.js';
+export { O as OverlayBaseIsVirtualError, n as OverlayCollectionUnavailableError, o as OverlayIdMismatchError, p as OverlayNameCollisionError } from '../errors-BAWO5Z5a.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
 import '../strategy-BSxFXGzb.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 import '@noy-db/attestation';
 
 /**
  * Virtual-collection proxy returned by `vault.collection(overlayName)`
- * when `overlayName` is a registered `withOverlayedView` (#154).
+ * when `overlayName` is a registered `withOverlayedView`.
  *
  * Implements the core `Collection<T>`-shaped read/write surface with
  * merge-on-read semantics:
- *   - `get(id)`: overlay row wins iff `overlay[shadowField] === shadowValue`
+ *   - `get(id)`: overlay row wins iff `overlay[shadowField] === shadowValue`;
+ *     when `spec.mergeMode` is set, an intermediate status may instead pull
+ *     a declared subset of fields from the overlay over the base (#348)
  *   - `list()` / `.query()`: union of ids, per-id merge applied
  *   - `put(record)` / `put(id, record)`: routes to overlay; id derived
  *     via the base MV's `rowKey` (validated on the two-arg form)
  *   - `delete(id)`: removes the overlay row only; base stays
  *
  * Reactive APIs (`live`, `subscribe`, `query().live()`) are out of
- * scope for #154 and surface as "not yet implemented" — wired in a
+ * scope for this release and surface as "not yet implemented" — wired in a
  * future sub-issue.
  */
 declare class OverlayedCollection<T extends Record<string, unknown> = any> {
@@ -57,8 +61,24 @@ declare class OverlayedCollection<T extends Record<string, unknown> = any> {
      * subsequent reads return it.
      */
     delete(id: string): Promise<void>;
-    /** True when `overlay[shadowField] === shadowValue`. */
-    private shadowPredicateApplies;
+    /**
+     * Merge a single id's overlay + base rows into the visible row.
+     *
+     * Priority (first match wins):
+     *  1. Binary shadow win — overlay present AND
+     *     `overlay[shadowField] === shadowValue` → return the overlay row
+     *     entirely. This stays FIRST so the original binary behaviour is
+     *     unchanged whether or not `mergeMode` is configured.
+     *  2. Field-level merge — overlay present, `mergeMode` configured,
+     *     and a rule whose `whenStatus` equals `overlay[shadowField]`.
+     *     The matched rule pulls its `overlayFields` (those present on
+     *     the overlay row) on top of the base row. With no base row, the
+     *     overlay row is returned as-is.
+     *  3. Fallback — return the base row (possibly `null`). An
+     *     overlay-only row that qualifies under neither (1) nor (2) and
+     *     has no base is therefore NOT surfaced.
+     */
+    private mergeRows;
     /** @throws — chainable Query<T> over a virtual collection is deferred. */
     query(): never;
     /** @throws — change-stream subscription over a virtual collection is deferred. */

package/dist/overlay-views/index.js

@@ -1,18 +1,19 @@
 import {
   withOverlayedView
-} from "../chunk-YL2DR3HY.js";
-import {
-  OverlayedCollection
-} from "../chunk-NGSPBLLE.js";
+} from "../chunk-ASIGWYRA.js";
 import {
   OverlayedViewRegistry
-} from "../chunk-NSLTPGEN.js";
+} from "../chunk-TMUMMAWV.js";
+import {
+  OverlayedCollection
+} from "../chunk-MPIZQGFA.js";
 import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayIdMismatchError,
   OverlayNameCollisionError
-} from "../chunk-YDLAFP36.js";
+} from "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 export {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,

package/dist/periods/index.d.ts

@@ -1,10 +1,12 @@
-import { a5 as PeriodsStrategy } from '../types-D9eB0Rvh.js';
-export { a6 as CarryForwardContext, a7 as ClosePeriodOptions, a8 as OpenPeriodOptions, a9 as PERIODS_COLLECTION, aa as PeriodRecord, ab as ReadOnlyCollection, ac as appendPeriodLedgerEntry, ad as assertTsWritable, ae as chainAnchor, af as loadPeriods, ag as validatePeriodName } from '../types-D9eB0Rvh.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+import { ab as PeriodsStrategy } from '../index-DHn9lEP0.js';
+export { ac as CarryForwardContext, ad as ClosePeriodOptions, ae as OpenPeriodOptions, af as PERIODS_COLLECTION, ag as PeriodRecord, ah as ReadOnlyCollection, ai as appendPeriodLedgerEntry, aj as assertTsWritable, ak as chainAnchor, al as loadPeriods, am as validatePeriodName } from '../index-DHn9lEP0.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
+import '../errors-BAWO5Z5a.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-BF1B2HB9.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 import '@noy-db/attestation';
 
 /**

package/dist/periods/index.js

@@ -6,13 +6,14 @@ import {
   loadPeriods,
   validatePeriodName,
   withPeriods
-} from "../chunk-GAUBWHAF.js";
+} from "../chunk-OCYFFBZS.js";
 import "../chunk-UF3BUNQZ.js";
-import "../chunk-74JEQFMT.js";
-import "../chunk-NCO2JGKK.js";
-import "../chunk-FXQYZNOW.js";
-import "../chunk-UOF74WQY.js";
-import "../chunk-YDLAFP36.js";
+import "../chunk-2UT7HJJR.js";
+import "../chunk-PDVP3C2I.js";
+import "../chunk-A7DNZVAV.js";
+import "../chunk-E2MDPPOC.js";
+import "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 export {
   PERIODS_COLLECTION,
   appendPeriodLedgerEntry,

package/dist/{predicate-Dnu81tsS.d.cts → predicate-BmhBSPCH.d.ts}

@@ -30,6 +30,7 @@
  */
 type IndexDef = string | {
     readonly fields: readonly string[];
+    readonly unique?: boolean;
 } | readonly string[];
 /**
  * Internal representation of a built hash index.
@@ -103,12 +104,55 @@ declare class CollectionIndexes {
     lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null;
 }
 
+/**
+ * Money-aware `where()` comparison (#336).
+ *
+ * Query clauses evaluate against RAW stored records — money decode
+ * happens on output only (#322) — so a money field's stored form is a
+ * scaled-integer digit string (`'1000000'`) while the caller naturally
+ * writes the operand in major units (`10000`, `'10000.00'`). Without a
+ * rewrite the comparison is silently wrong by the scale factor, and a
+ * string-vs-number comparison is excluded by `isComparable` anyway.
+ *
+ * Two halves:
+ *
+ * - {@link moneyFieldClause} runs at QUERY BUILD time: it quantizes the
+ *   caller's major-unit operand into stored scaled-int space via the
+ *   same `parseToScaledInt` path as writes, so a malformed operand
+ *   throws at `.where()` — not silently filters everything out.
+ * - {@link evaluateMoneyClause} runs per record and compares
+ *   `BigInt`-exact in scaled space (exact past 2^53, like the rest of
+ *   the money subsystem).
+ *
+ * Currency semantics (multi mode): an operand carries one currency —
+ * explicit via `{ amount, currency }`, or the descriptor's sole allowed
+ * currency for a bare amount. A record in a DIFFERENT currency has no
+ * defined order against the operand: it matches `!=` and nothing else.
+ */
+
+/** One quantized operand value: scaled digit string + its currency. */
+interface MoneyOperandEntry {
+    readonly scaled: string;
+    readonly currency: string;
+}
+/**
+ * The money payload attached to a {@link FieldClause} over a declared
+ * money field. `entries` holds one element for comparison ops, two for
+ * `between` (lo, hi — same currency), N for `in`.
+ */
+interface MoneyWhereOperand {
+    readonly mode: 'fixed' | 'multi';
+    readonly entries: ReadonlyArray<MoneyOperandEntry>;
+}
+
 /**
  * Operator implementations for the query DSL.
  *
  * All predicates run client-side, AFTER decryption — they never see ciphertext.
- * This file is dependency-free and tree-shakeable.
+ * The only dependency is the money clause evaluator (#336) — still
+ * tree-shakeable through it.
  */
+
 /** Comparison operators supported by the where() builder. */
 type Operator = '==' | '!=' | '<' | '<=' | '>' | '>=' | 'in' | 'contains' | 'startsWith' | 'between';
 /**
@@ -120,6 +164,14 @@ interface FieldClause {
     readonly field: string;
     readonly op: Operator;
     readonly value: unknown;
+    /**
+     * Present when `field` is a declared money field (#336): the operand
+     * quantized into stored scaled-int space at query BUILD time, so the
+     * per-record comparison is BigInt-exact against the raw stored value.
+     * Built by `moneyFieldClause` — `Query.where()` attaches it when the
+     * source declares the field in `moneyFields`.
+     */
+    readonly money?: MoneyWhereOperand;
 }
 /**
  * A user-supplied predicate function escape hatch. Not serializable.
@@ -134,7 +186,7 @@ interface FilterClause {
     readonly fn: (record: unknown) => boolean;
 }
 /**
- * A declared deterministic predicate reference (#153). The query
+ * A declared deterministic predicate reference. The query
  * builder produces this via `.wherePredicate(name, ctx?)` when a
  * Query has been augmented with a predicates map (typically by the
  * materialized-view registry — see MV v2 spec § Function-based
@@ -163,7 +215,31 @@ interface GroupClause {
     readonly op: 'and' | 'or';
     readonly clauses: readonly Clause[];
 }
-type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause;
+/**
+ * Cartesian-product expansion clause. Appended to `QueryPlan.clauses`
+ * by `Query.crossJoin()`. Processed in declaration order by
+ * `executeClausePipeline` — NOT by `evaluateClause` (which is a
+ * per-record predicate and throws on this type).
+ */
+interface CrossJoinClause {
+    readonly type: 'crossJoin';
+    /** Target collection name to cross-join against. */
+    readonly target: string;
+    /** Alias under which the right-side record is exposed on each result row. */
+    readonly as: string;
+    /**
+     * Lateral filter callback. `undefined` → full cartesian product.
+     * Two call shapes:
+     *   - Subset:    `(left) => TTarget[]`            — returns the right rows for this left row
+     *   - Predicate: `(left) => (right) => boolean`   — executor materializes then filters
+     */
+    readonly on?: (left: unknown) => unknown[] | ((right: unknown) => boolean);
+    /** When `on:` was supplied as `{ predicate: name }`, the name is stored here for queryHash. */
+    readonly onPredicateName?: string;
+    /** Per-clause row ceiling override. `undefined` → `DEFAULT_CROSS_JOIN_MAX_ROWS`. */
+    readonly maxRows?: number;
+}
+type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause | CrossJoinClause;
 /**
  * Read a possibly nested field path like "address.city" from a record.
  * Returns undefined if any segment is missing.
@@ -179,7 +255,13 @@ declare function evaluateFieldClause(record: unknown, clause: FieldClause): bool
  * Evaluate any clause (field / filter / group) against a record.
  * The recursion depth is bounded by the user's query expression — no risk of
  * blowing the stack on a 50K-record collection.
+ *
+ * `fnRecord`, when provided, is the view handed to USER CALLBACK clauses
+ * (`filter` / `wherePredicate`) instead of `record` — the executor passes
+ * the money-decoded view there (#335) so user code never sees the stored
+ * scaled-int form, while field clauses keep evaluating against the raw
+ * record (their money operands are pre-quantized to that space, #336).
  */
-declare function evaluateClause(record: unknown, clause: Clause): boolean;
+declare function evaluateClause(record: unknown, clause: Clause, fnRecord?: unknown): boolean;
 
-export { CollectionIndexes as C, type FieldClause as F, type GroupClause as G, type HashIndex as H, type IndexDef as I, type Operator as O, type Clause as a, type FilterClause as b, evaluateFieldClause as c, evaluateClause as e, readPath as r };
+export { CollectionIndexes as C, type FieldClause as F, type GroupClause as G, type HashIndex as H, type IndexDef as I, type Operator as O, type Clause as a, type FilterClause as b, evaluateFieldClause as c, type CrossJoinClause as d, evaluateClause as e, readPath as r };

package/dist/{public-envelope-OHQ5UZFM.js → public-envelope-MFMBFJLZ.js}

@@ -12,9 +12,10 @@ import {
   resolveLocale,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-FS7A4XNF.js";
-import "./chunk-FXQYZNOW.js";
-import "./chunk-YDLAFP36.js";
+} from "./chunk-QWJCNXH2.js";
+import "./chunk-A7DNZVAV.js";
+import "./chunk-JZ5DS4DP.js";
+import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
   PUBLIC_ENVELOPE_FIELDS,
@@ -28,4 +29,4 @@ export {
   savePublicEnvelope,
   validatePublicEnvelopeInput
 };
-//# sourceMappingURL=public-envelope-OHQ5UZFM.js.map
+//# sourceMappingURL=public-envelope-MFMBFJLZ.js.map

package/dist/query/index.d.ts

@@ -1,3 +1,4 @@
-export { y as DEFAULT_JOIN_MAX_ROWS, z as DanglingReferenceError, V as GroupCardinalityError, X as IndexRequiredError, Y as IndexWriteFailureError, _ as JoinContext, $ as JoinLeg, a0 as JoinStrategy, a1 as JoinTooLargeError, a2 as JoinableSource, a6 as LiveQuery, a7 as LiveUpstream, ad as OrderBy, Q as Query, ai as QueryPlan, aj as QuerySource, au as ScanBuilder, av as ScanPageProvider, aF as applyJoins, aG as buildLiveQuery, aH as executePlan, aJ as resetJoinWarnings } from '../index-BF1B2HB9.js';
-export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from '../predicate-Dnu81tsS.js';
-export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, m as buildLiveAggregation, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, s as resetGroupByWarnings, t as sum } from '../strategy-DSTrsZ8t.js';
+export { D as DEFAULT_CROSS_JOIN_MAX_ROWS, a as DEFAULT_JOIN_MAX_ROWS, J as JoinContext, b as JoinLeg, c as JoinStrategy, d as JoinableSource, L as LiveQuery, e as LiveUpstream, O as OrderBy, Q as Query, f as QueryPlan, g as QuerySource, S as ScanBuilder, m as ScanPageProvider, n as applyJoins, o as buildLiveQuery, p as executePlan, t as resetJoinWarnings } from '../index-Ddm8D3Oo.js';
+export { a as Clause, C as CollectionIndexes, d as CrossJoinClause, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from '../predicate-BmhBSPCH.js';
+export { j as AggregateResult, k as AggregateSpec, l as Aggregation, m as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, n as GROUPBY_WARN_CARDINALITY, o as GroupedAggregation, p as GroupedQuery, q as GroupedQueryN, t as GroupedRow, u as GroupedRowN, w as LiveAggregation, x as Reducer, y as ReducerOptions, z as avg, B as buildLiveAggregation, C as count, D as groupAndReduce, E as max, F as min, H as reduceRecords, J as resetGroupByWarnings, K as sum } from '../strategy-8QGs5KQE.js';
+export { K as CrossJoinSourceUnknownError, Q as CrossJoinTooLargeError, V as DanglingReferenceError, a6 as GroupCardinalityError, a8 as IndexRequiredError, a9 as IndexWriteFailureError, ab as JoinTooLargeError } from '../errors-BAWO5Z5a.js';

package/dist/query/index.js

@@ -1,4 +1,5 @@
 import {
+  DEFAULT_CROSS_JOIN_MAX_ROWS,
   DEFAULT_JOIN_MAX_ROWS,
   Query,
   ScanBuilder,
@@ -6,17 +7,17 @@ import {
   buildLiveQuery,
   executePlan,
   resetJoinWarnings
-} from "../chunk-4UBOTYP5.js";
+} from "../chunk-QGBBQKDS.js";
 import {
   CollectionIndexes
-} from "../chunk-YMYK7US4.js";
+} from "../chunk-4YD7VZH4.js";
 import {
   avg,
   count,
   max,
   min,
   sum
-} from "../chunk-5ZGZ6HIZ.js";
+} from "../chunk-DEE4CRYN.js";
 import {
   Aggregation,
   GROUPBY_MAX_CARDINALITY,
@@ -28,22 +29,29 @@ import {
   groupAndReduce,
   reduceRecords,
   resetGroupByWarnings
-} from "../chunk-KYKMKLJ6.js";
+} from "../chunk-K6NVSHAH.js";
 import {
   evaluateClause,
   evaluateFieldClause,
   readPath
-} from "../chunk-MRIBLZL3.js";
+} from "../chunk-KJ3K5VZM.js";
+import "../chunk-QXWJQ7UU.js";
 import {
+  CrossJoinSourceUnknownError,
+  CrossJoinTooLargeError,
   DanglingReferenceError,
   GroupCardinalityError,
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-YDLAFP36.js";
+} from "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 export {
   Aggregation,
   CollectionIndexes,
+  CrossJoinSourceUnknownError,
+  CrossJoinTooLargeError,
+  DEFAULT_CROSS_JOIN_MAX_ROWS,
   DEFAULT_JOIN_MAX_ROWS,
   DanglingReferenceError,
   GROUPBY_MAX_CARDINALITY,

package/dist/read-only-facade-3OQRZ3VS.js

@@ -0,0 +1,8 @@
+import {
+  ReadOnlyVaultFacade
+} from "./chunk-ADB7GPM3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ReadOnlyVaultFacade
+};
+//# sourceMappingURL=read-only-facade-3OQRZ3VS.js.map

package/dist/registry-IX5WKK4F.js

@@ -0,0 +1,8 @@
+import {
+  GuardRegistry
+} from "./chunk-A3JMGXPG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardRegistry
+};
+//# sourceMappingURL=registry-IX5WKK4F.js.map

package/dist/registry-LMHO5265.js

@@ -0,0 +1,11 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-RCB6GWTC.js";
+import "./chunk-JZ5DS4DP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-LMHO5265.js.map

package/dist/registry-TXCKWH26.js

@@ -0,0 +1,9 @@
+import {
+  DerivationRegistry
+} from "./chunk-UBF5JEOJ.js";
+import "./chunk-JZ5DS4DP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-TXCKWH26.js.map

package/dist/registry-VFEDQSYV.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-TMUMMAWV.js";
+import "./chunk-JZ5DS4DP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-VFEDQSYV.js.map

package/dist/revoke-5PUOZPJJ.js

@@ -0,0 +1,18 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-JOJPBZSZ.js";
+import "./chunk-5PTX7PKD.js";
+import "./chunk-A7DNZVAV.js";
+import "./chunk-E2MDPPOC.js";
+import "./chunk-JZ5DS4DP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-5PUOZPJJ.js.map

package/dist/revoke-5PUOZPJJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sealed-record/index.d.ts

@@ -0,0 +1,123 @@
+export { q as SealedRecordExpiredError, r as SealedRecordMismatchError } from '../errors-BAWO5Z5a.js';
+
+/**
+ * Wire + binding types for record-scoped CEK sealing (#306 slices 2-3).
+ *
+ * A vault owner who holds the collection DEK can **seal a single record's
+ * content-encryption key (CEK)** to an `at-*` host (e.g. a KMS-backed
+ * {@link RecipientSealer}) so that host — and only that host — can decrypt
+ * exactly that one record, with no access to the vault DEK and no ability to
+ * read any other record. This is the record-granular counterpart to the
+ * bundle-granular sealed-credential delivery (`SealedEnvelope`).
+ *
+ * Two shapes live here:
+ *
+ *  - {@link SealedCekDeliveryEnvelope} — the **thin delivery envelope** the
+ *    grantor writes to `_sealed_cek/<collection>/<id>/<pid>`. It carries only
+ *    routing metadata (`pid`, `expiresAt`) in the clear plus the opaque sealed
+ *    `payload`. The `expiresAt` here is a *fast-path* hint; the authoritative
+ *    expiry lives INSIDE the sealed payload (see below).
+ *
+ *  - {@link SealedCekBinding} — the plaintext struct that is sealed for the
+ *    host. It binds the CEK to its `{collection, id}` and an authoritative
+ *    `expiresAt`, so a host cannot take a CEK sealed for record A and apply it
+ *    to record B's envelope (mismatch is rejected), nor read past expiry. The
+ *    binding is the security boundary; the delivery envelope is just transport.
+ *
+ * @module
+ */
+/**
+ * Thin delivery envelope persisted at
+ * `_sealed_cek/<collection>/<id>/<pid>`. The grantor writes one per
+ * (record, recipient host) pair. `payload` is the base64 of the bytes returned
+ * by {@link RecipientSealer.sealForRecipient} over a UTF-8
+ * `JSON.stringify({@link SealedCekBinding})`.
+ *
+ * `expiresAt` is duplicated here for a cheap pre-unseal reject, but is NOT
+ * authoritative — the binding inside `payload` carries the expiry the host
+ * verifies after unsealing, so a tampered delivery envelope cannot extend a
+ * grant.
+ */
+interface SealedCekDeliveryEnvelope {
+    /** Envelope schema version. */
+    readonly v: 1;
+    /** Magic marker for forensics + format detection. */
+    readonly _noydb_sealed_cek: 1;
+    /** Recipient host provider id; matches the sealer's `.id` / hint `pid`. */
+    readonly pid: string;
+    /** base64 of the sealed {@link SealedCekBinding} bytes. */
+    readonly payload: string;
+    /** Fast-path expiry hint (ISO 8601). Authoritative copy is inside `payload`. */
+    readonly expiresAt: string;
+}
+/**
+ * The plaintext struct sealed for the recipient host. After the host unseals
+ * `SealedCekDeliveryEnvelope.payload` it parses this and MUST verify:
+ *  - `collection` + `id` match the record envelope it is decrypting, and
+ *  - `expiresAt` has not passed (authoritative expiry check).
+ *
+ * `cek` is the base64 of the raw 32-byte AES-256-GCM record CEK.
+ */
+interface SealedCekBinding {
+    /** Collection the CEK belongs to. */
+    readonly collection: string;
+    /** Record id the CEK belongs to. */
+    readonly id: string;
+    /** base64 of the raw AES-256-GCM CEK bytes. */
+    readonly cek: string;
+    /** Authoritative expiry (ISO 8601). */
+    readonly expiresAt: string;
+}
+
+/**
+ * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK
+ * sealing (#306 slices 2-3).
+ *
+ * The **grantor** side (sealing a record's CEK to a host, revoking, and hard
+ * rotation) lives on `Vault` (`vault.sealRecordToHost` /
+ * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the
+ * collection DEK. This subpath exposes the **recipient host** side:
+ * {@link openSealedRecord} reconstructs a single record's plaintext from
+ * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope
+ * body, and (c) the host's own unsealer — and **nothing else**. The host never
+ * touches a vault DEK and can decrypt exactly the one bound record.
+ *
+ * @module
+ */
+
+/**
+ * Host-side: decrypt a single record whose CEK was sealed to this host by a
+ * vault grantor via `vault.sealRecordToHost()`.
+ *
+ * Verification order (security-critical — do NOT reorder past the unseal):
+ *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text
+ *     `expiresAt` before doing any (potentially expensive) unseal work. This is
+ *     a hint only.
+ *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →
+ *     parse the {@link SealedCekBinding}.
+ *  3. **Binding match** — the binding's `{collection, id}` MUST equal the
+ *     expected pair, else {@link SealedRecordMismatchError}. This is the
+ *     host-denial boundary (a CEK sealed for record A cannot open record B).
+ *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that
+ *     cannot be forged by editing the delivery envelope), else
+ *     {@link SealedRecordExpiredError}.
+ *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a
+ *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)
+ *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.
+ *
+ * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.
+ * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).
+ * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a
+ *                          KMS-backed sealer or `MemoryRecipientSealer`.
+ * @param expectedCollection Collection the caller believes `recordEnvelope` is in.
+ * @param expectedId         Record id the caller believes `recordEnvelope` is.
+ * @returns The decrypted record body as a JSON string.
+ */
+declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
+    readonly _iv: string;
+    readonly _data: string;
+}, recipientSealer: {
+    unseal(bytes: Uint8Array): Promise<Uint8Array>;
+}, expectedCollection: string, expectedId: string): Promise<string>;
+
+export { type SealedCekBinding, type SealedCekDeliveryEnvelope, openSealedRecord };

package/dist/sealed-record/index.js

@@ -0,0 +1,43 @@
+import {
+  base64ToBuffer,
+  decrypt
+} from "../chunk-E2MDPPOC.js";
+import {
+  SealedRecordExpiredError,
+  SealedRecordMismatchError
+} from "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/sealed-record/index.ts
+var subtle = globalThis.crypto.subtle;
+async function openSealedRecord(sealedCekEnvelope, recordEnvelope, recipientSealer, expectedCollection, expectedId) {
+  if (Date.parse(sealedCekEnvelope.expiresAt) <= Date.now()) {
+    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt);
+  }
+  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload);
+  const openedBytes = await recipientSealer.unseal(payloadBytes);
+  const binding = JSON.parse(new TextDecoder().decode(openedBytes));
+  if (binding.collection !== expectedCollection || binding.id !== expectedId) {
+    throw new SealedRecordMismatchError(
+      { collection: expectedCollection, id: expectedId },
+      { collection: binding.collection, id: binding.id }
+    );
+  }
+  if (Date.parse(binding.expiresAt) <= Date.now()) {
+    throw new SealedRecordExpiredError(binding.expiresAt);
+  }
+  const cek = await subtle.importKey(
+    "raw",
+    base64ToBuffer(binding.cek),
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["decrypt"]
+  );
+  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek);
+}
+export {
+  SealedRecordExpiredError,
+  SealedRecordMismatchError,
+  openSealedRecord
+};
+//# sourceMappingURL=index.js.map

package/dist/sealed-record/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/sealed-record/index.ts"],"sourcesContent":["/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing (#306 slices 2-3).\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { decrypt, base64ToBuffer } from '../crypto.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: { readonly _iv: string; readonly _data: string },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope.\n  if (Date.parse(sealedCekEnvelope.expiresAt) <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  if (Date.parse(binding.expiresAt) <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await subtle.importKey(\n    'raw',\n    base64ToBuffer(binding.cek) as BufferSource,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    ['decrypt'],\n  )\n  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek)\n}\n"],"mappings":";;;;;;;;;;;AA6BA,IAAM,SAAS,WAAW,OAAO;AA8BjC,eAAsB,iBACpB,mBACA,gBACA,iBACA,oBACA,YACiB;AAEjB,MAAI,KAAK,MAAM,kBAAkB,SAAS,KAAK,KAAK,IAAI,GAAG;AACzD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAGA,MAAI,KAAK,MAAM,QAAQ,SAAS,KAAK,KAAK,IAAI,GAAG;AAC/C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB;AAAA,IACA,eAAe,QAAQ,GAAG;AAAA,IAC1B,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,IAC/B;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AACA,SAAO,QAAQ,eAAe,KAAK,eAAe,OAAO,GAAG;AAC9D;","names":[]}

package/dist/session/index.d.ts

@@ -1,11 +1,13 @@
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from '../dev-unlock-Cf2B7Kih.js';
-import { S as SessionStrategy } from '../types-D9eB0Rvh.js';
-export { P as PolicyEnforcer, n as createEnforcer, o as validateSessionPolicy } from '../types-D9eB0Rvh.js';
-export { S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError } from '../index-BF1B2HB9.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from '../dev-unlock-CnHTTVea.js';
+import { m as SessionStrategy } from '../index-DHn9lEP0.js';
+export { P as PolicyEnforcer, n as createEnforcer, v as validateSessionPolicy } from '../index-DHn9lEP0.js';
+export { c as SessionExpiredError, d as SessionNotFoundError, e as SessionPolicyError } from '../errors-BAWO5Z5a.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
 import '../strategy-BSxFXGzb.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 import '@noy-db/attestation';
 
 /**