@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/registry-3EQG6OOE.js

@@ -0,0 +1,18 @@
+import {
+  DerivationRegistry
+} from "./chunk-XUBPSPKD.js";
+import "./chunk-FUOE7UUV.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-3EQG6OOE.js.map

package/dist/registry-3EQG6OOE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/registry-CA327ACV.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-6P5XCKSD.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-CA327ACV.js.map

package/dist/registry-CA327ACV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/registry-E7OXOTSV.js

@@ -0,0 +1,19 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-3QSIU3UT.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-E7OXOTSV.js.map

package/dist/registry-E7OXOTSV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/registry-VW6P6A3J.js

@@ -0,0 +1,8 @@
+import {
+  GuardRegistry
+} from "./chunk-YMUGBZN2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardRegistry
+};
+//# sourceMappingURL=registry-VW6P6A3J.js.map

package/dist/registry-VW6P6A3J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/request-withdrawal-KAH2AAXC.js

@@ -0,0 +1,31 @@
+import {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+} from "./chunk-WIGQB62E.js";
+import "./chunk-OBKWYKYC.js";
+import "./chunk-OT76OZL6.js";
+import "./chunk-QSFOZUYL.js";
+import "./chunk-OXCSVM3B.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+};
+//# sourceMappingURL=request-withdrawal-KAH2AAXC.js.map

package/dist/request-withdrawal-KAH2AAXC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/reveal-R3JLHMUF.js

@@ -0,0 +1,38 @@
+import {
+  isTombstone
+} from "./chunk-QA2KUPCP.js";
+import {
+  dualReadSealedSlot
+} from "./chunk-VEPTFUJY.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import {
+  ClassifiedRevealError
+} from "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/kernel/enclave/classify/reveal.ts
+async function revealSealedField(ctx, id, field) {
+  const env = await ctx.getEnvelope(id);
+  if (env === null || isTombstone(env, ctx.encrypted)) {
+    throw new ClassifiedRevealError(ctx.collection, field, `record "${id}" not found in "${ctx.collection}"`);
+  }
+  if (!ctx.encrypted) {
+    const record = JSON.parse(env._data || "{}");
+    if (!(field in record)) {
+      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for "${field}"`);
+    }
+    return record[field];
+  }
+  const blob = env._sealed?.[field];
+  if (blob === void 0) {
+    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for "${field}"`);
+  }
+  const cek = await ctx.resolveCek(env);
+  const dek = await ctx.getDEK();
+  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek));
+}
+export {
+  revealSealedField
+};
+//# sourceMappingURL=reveal-R3JLHMUF.js.map

package/dist/reveal-R3JLHMUF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted)) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,GAAG;AACnD,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}

package/dist/revoke-IXLOJ3IH.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-GNMXXTMN.js";
+import "./chunk-PLS64NCS.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-IXLOJ3IH.js.map

package/dist/revoke-IXLOJ3IH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/satellites/index.d.ts

@@ -0,0 +1,4 @@
+export { m2 as JoinedHandle, m3 as PairingMarker, m4 as SatelliteConfigError, m5 as SatelliteSpec } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/satellites/index.js

@@ -0,0 +1,8 @@
+import {
+  SatelliteConfigError
+} from "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  SatelliteConfigError
+};
+//# sourceMappingURL=index.js.map

package/dist/satellites/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sealed-record/index.d.ts

@@ -0,0 +1,68 @@
+import { df as SealedRecordStrategy, dg as SealedCekDeliveryEnvelope } from '../index-DjWbxsjb.js';
+export { dh as NO_SEALED_RECORD, di as SealedCekBinding, dj as SealedRecordExpiredError, dk as SealedRecordMismatchError, dl as SealedRecordNotEnabledError } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';
+
+/**
+ * Enable the sealed-record (grantor-side) capability.
+ * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a
+ * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods
+ * live. The `record-keys` grantor engine is dynamically imported here, so it is
+ * reached only via opt-in.
+ */
+
+declare function withSealedRecord(): SealedRecordStrategy;
+
+/**
+ * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK
+ * sealing.
+ *
+ * The **grantor** side (sealing a record's CEK to a host, revoking, and hard
+ * rotation) lives on `Vault` (`vault.sealRecordToHost` /
+ * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the
+ * collection DEK. This subpath exposes the **recipient host** side:
+ * {@link openSealedRecord} reconstructs a single record's plaintext from
+ * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope
+ * body, and (c) the host's own unsealer — and **nothing else**. The host never
+ * touches a vault DEK and can decrypt exactly the one bound record.
+ *
+ * @module
+ */
+
+/**
+ * Host-side: decrypt a single record whose CEK was sealed to this host by a
+ * vault grantor via `vault.sealRecordToHost()`.
+ *
+ * Verification order (security-critical — do NOT reorder past the unseal):
+ *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text
+ *     `expiresAt` before doing any (potentially expensive) unseal work. This is
+ *     a hint only.
+ *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →
+ *     parse the {@link SealedCekBinding}.
+ *  3. **Binding match** — the binding's `{collection, id}` MUST equal the
+ *     expected pair, else {@link SealedRecordMismatchError}. This is the
+ *     host-denial boundary (a CEK sealed for record A cannot open record B).
+ *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that
+ *     cannot be forged by editing the delivery envelope), else
+ *     {@link SealedRecordExpiredError}.
+ *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a
+ *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)
+ *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.
+ *
+ * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.
+ * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).
+ * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a
+ *                          KMS-backed sealer or `MemoryRecipientSealer`.
+ * @param expectedCollection Collection the caller believes `recordEnvelope` is in.
+ * @param expectedId         Record id the caller believes `recordEnvelope` is.
+ * @returns The decrypted record body as a JSON string.
+ */
+declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
+    readonly _iv: string;
+    readonly _data: string;
+}, recipientSealer: {
+    unseal(bytes: Uint8Array): Promise<Uint8Array>;
+}, expectedCollection: string, expectedId: string): Promise<string>;
+
+export { SealedCekDeliveryEnvelope, SealedRecordStrategy, openSealedRecord, withSealedRecord };

package/dist/sealed-record/index.js

@@ -0,0 +1,71 @@
+import {
+  NO_SEALED_RECORD
+} from "../chunk-HPWKV3YB.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  decrypt,
+  importCek
+} from "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import {
+  SealedRecordExpiredError,
+  SealedRecordMismatchError,
+  SealedRecordNotEnabledError
+} from "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-audit/sealed-record/active.ts
+function withSealedRecord() {
+  return {
+    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
+      const { sealRecordToHost } = await import("../enclave-NHORSWSF.js");
+      return sealRecordToHost(ctx, collection, id, hostSealer, opts);
+    },
+    async revokeSealedRecord(ctx, collection, id, pid, opts) {
+      const { revokeSealedRecord } = await import("../enclave-NHORSWSF.js");
+      return revokeSealedRecord(ctx, collection, id, pid, opts);
+    },
+    async rotateRecordCek(ctx, collection, id) {
+      const { rotateRecordCek } = await import("../enclave-NHORSWSF.js");
+      return rotateRecordCek(ctx, collection, id);
+    }
+  };
+}
+
+// src/with-audit/sealed-record/index.ts
+async function openSealedRecord(sealedCekEnvelope, recordEnvelope, recipientSealer, expectedCollection, expectedId) {
+  const fastT = Date.parse(sealedCekEnvelope.expiresAt);
+  if (!Number.isFinite(fastT) || fastT <= Date.now()) {
+    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt);
+  }
+  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload);
+  const openedBytes = await recipientSealer.unseal(payloadBytes);
+  const binding = JSON.parse(new TextDecoder().decode(openedBytes));
+  if (binding.collection !== expectedCollection || binding.id !== expectedId) {
+    throw new SealedRecordMismatchError(
+      { collection: expectedCollection, id: expectedId },
+      { collection: binding.collection, id: binding.id }
+    );
+  }
+  const t = Date.parse(binding.expiresAt);
+  if (!Number.isFinite(t) || t <= Date.now()) {
+    throw new SealedRecordExpiredError(binding.expiresAt);
+  }
+  const cek = await importCek(base64ToBuffer(binding.cek));
+  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek);
+}
+export {
+  NO_SEALED_RECORD,
+  SealedRecordExpiredError,
+  SealedRecordMismatchError,
+  SealedRecordNotEnabledError,
+  openSealedRecord,
+  withSealedRecord
+};
+//# sourceMappingURL=index.js.map

package/dist/sealed-record/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: { readonly _iv: string; readonly _data: string },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;ACoCA,eAAsB,iBACpB,mBACA,gBACA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AACvD,SAAO,QAAQ,eAAe,KAAK,eAAe,OAAO,GAAG;AAC9D;","names":[]}

package/dist/session/index.d.ts

@@ -1,11 +1,8 @@
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from '../dev-unlock-B4kDxep_.js';
-import { w as SessionStrategy } from '../types-Df28QFKb.js';
-export { P as PolicyEnforcer, x as createEnforcer, y as validateSessionPolicy } from '../types-Df28QFKb.js';
-export { b as SessionExpiredError, c as SessionNotFoundError, d as SessionPolicyError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from '../dev-unlock-Bmm2pgJ0.js';
+import { S as SessionStrategy } from '../index-DjWbxsjb.js';
+export { P as PolicyEnforcer, a as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, d as createEnforcer, v as validateSessionPolicy } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/session/index.js

@@ -12,16 +12,24 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-H2X3ISXG.js";
-import "../chunk-FZU343FL.js";
-import "../chunk-PP6W64Y3.js";
+} from "../chunk-3MATJ6O4.js";
+import "../chunk-ZJADGNYF.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/session/active.ts
+// src/with-party/session/active.ts
 function withSession() {
   return {
     validateSessionPolicy,

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/shadow/index.d.ts

@@ -1,10 +1,7 @@
-import { ay as ShadowStrategy } from '../types-Df28QFKb.js';
-export { az as CollectionFrame, aA as VaultFrame } from '../types-Df28QFKb.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { bn as ShadowStrategy } from '../index-DjWbxsjb.js';
+export { bo as CollectionFrame, bp as VaultFrame } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/shadow/index.js

@@ -1,10 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-DFMLEQZB.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-VRIYFLBA.js";
+import "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/shadow/active.ts
+// src/with-fork/shadow/active.ts
 function withShadow() {
   return {
     buildFrame(vault) {

package/dist/shadow/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/shadow/active.ts"],"sourcesContent":["/**\n * Active shadow strategy — the only place `VaultFrame` is constructed.\n * Only reachable through `@noy-db/hub/shadow`.\n */\n\nimport { VaultFrame } from './vault-frame.js'\nimport type { ShadowStrategy } from './strategy.js'\nimport type { Vault } from '../vault.js'\n\nexport function withShadow(): ShadowStrategy {\n  return {\n    buildFrame(vault) { return new VaultFrame(vault as Vault) },\n  }\n}\n"],"mappings":";;;;;;;AASO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,WAAW,OAAO;AAAE,aAAO,IAAI,WAAW,KAAc;AAAA,IAAE;AAAA,EAC5D;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-fork/shadow/active.ts"],"sourcesContent":["/**\n * Active shadow strategy — the only place `VaultFrame` is constructed.\n * Only reachable through `@noy-db/hub/shadow`.\n */\n\nimport { VaultFrame } from './vault-frame.js'\nimport type { ShadowStrategy } from './strategy.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport function withShadow(): ShadowStrategy {\n  return {\n    buildFrame(vault) { return new VaultFrame(vault as Vault) },\n  }\n}\n"],"mappings":";;;;;;;;AASO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,WAAW,OAAO;AAAE,aAAO,IAAI,WAAW,KAAc;AAAA,IAAE;AAAA,EAC5D;AACF;","names":[]}

package/dist/signer-Y46N2GJ3.js

@@ -0,0 +1,25 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-PLS64NCS.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-Y46N2GJ3.js.map

package/dist/signer-Y46N2GJ3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/snapshots/index.d.ts

@@ -1,15 +1,12 @@
-import { aB as NoydbBundleStore, aC as RetentionPolicy, aD as SnapshotPolicy, aE as SnapshotStrategy } from '../types-Df28QFKb.js';
-export { aF as SnapshotMeta, aG as SnapshotMode } from '../types-Df28QFKb.js';
-export { f as SnapshotNotFoundError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+import { bq as NoydbPodStore, br as RetentionPolicy, bs as SnapshotPolicy, bt as SnapshotStrategy } from '../index-DjWbxsjb.js';
+export { bu as SnapshotMeta, bv as SnapshotMode, bw as SnapshotNotFoundError } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 interface WithSnapshotsOptions {
     /** Bundle store where snapshot blobs and the sidecar index are written. */
-    store: NoydbBundleStore;
+    store: NoydbPodStore;
     /**
      * Declarative retention policy. Enforced eagerly after each on-demand `snapshot()`.
      * Defaults to no retention (all on-demand snapshots kept forever). Never affects

package/dist/snapshots/index.js

@@ -1,14 +1,22 @@
 import {
-  readNoydbBundle,
-  writeNoydbBundle
-} from "../chunk-BVRYKATC.js";
-import "../chunk-ML236QKC.js";
-import "../chunk-WIRRPTFH.js";
+  readPod,
+  writePod
+} from "../chunk-QSFOZUYL.js";
+import "../chunk-OXCSVM3B.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/snapshots/engine.ts
+// src/with-fork/snapshots/engine.ts
 var SnapshotEngine = class {
   constructor(store, retention) {
     this.store = store;
@@ -36,7 +44,7 @@ var SnapshotEngine = class {
     await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion);
   }
   async snapshot(vault, by, opts) {
-    const bytes = await writeNoydbBundle(vault, {});
+    const bytes = await writePod(vault, {});
     const { index, indexVersion } = await this.readIndex(vault.name);
     const key = this.snapKey(vault.name, index.nextCounter);
     await this.store.writeBundle(key, bytes, null);
@@ -68,7 +76,7 @@ var SnapshotEngine = class {
    * pool — retention never prunes it. Used by the cadence scheduler.
    */
   async autoSnapshot(vault, by, opts) {
-    const bytes = await writeNoydbBundle(vault, {});
+    const bytes = await writePod(vault, {});
     const { index, indexVersion } = await this.readIndex(vault.name);
     const key = this.autoKey(vault.name);
     await this.store.writeBundle(key, bytes, null);
@@ -95,7 +103,7 @@ var SnapshotEngine = class {
     if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version);
     const result = await this.store.readBundle(version);
     if (!result) throw new SnapshotNotFoundError(version);
-    const { dumpJson } = await readNoydbBundle(result.bytes);
+    const { dumpJson } = await readPod(result.bytes);
     await vault.load(dumpJson);
   }
   /**
@@ -126,7 +134,7 @@ var SnapshotEngine = class {
   }
 };
 
-// src/snapshots/active.ts
+// src/with-fork/snapshots/active.ts
 function withSnapshots(opts) {
   const engine = new SnapshotEngine(opts.store, opts.retention ?? {});
   return {