@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.5

package/dist/port/at/index.d.ts

@@ -3,16 +3,16 @@
  *
  * A sealing-key provider (`at-env`, `at-aws-kms`, `at-gcp-kms`, …) binds
  * ONLY to this subpath: the `SealingKeyProvider` contract concrete
- * providers implement to seal/unseal a hub-generated random passphrase
- * for managed-passphrase mode. Its two methods (`seal`/`unseal`) close
+ * providers implement to seal/unseal a hub-generated random secret
+ * for managed-secret mode. Its two methods (`seal`/`unseal`) close
  * over only `Uint8Array`/`Promise`/`string` — no additional option or
  * result types to re-export.
  *
  * NOTE: `SealingKeyProvider` is implemented in `with-party/team/*` (the
- * managed-passphrase service), not the kernel spine proper — same
+ * managed-secret service), not the kernel spine proper — same
  * precedent as `@noy-db/hub/ui` re-exporting from `with-shape/introspection`.
  *
  * Named re-exports only (no `export *`) so the published surface is explicit and
  * tsup's per-entry bundling keeps class identity stable across subpaths.
  */
-export type { SealingKeyProvider } from '../../with-party/team/managed-passphrase.js';
+export type { SealingKeyProvider } from '../../with-party/team/managed-secret.js';

package/dist/port/with/collection-options.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Options for `Vault.collection()` — opening or declaring a collection (#841).
+ *
+ * ## Why this lives on the port
+ *
+ * The shape references descriptor types owned by services — `EmbeddingDescriptor`
+ * (`with-lookup`), `ComputedFields` (`with-formula`), `FieldMeta` (`with-shape`) —
+ * so it cannot sit in `kernel/`: `port-layering` forbids the spine from
+ * statically importing a `with-*` service, and the grandfathered lists are
+ * frozen per file. `port/with/` is the seam that exists for exactly this, and
+ * port files may reach services freely — the same reasoning that placed the
+ * strategy table here in #838.
+ *
+ * @internal
+ */
+import type { CacheOptions } from '../../kernel/collection.js';
+import type { RefDescriptor } from '../../kernel/refs.js';
+import type { StandardSchemaV1 } from '../../kernel/schema.js';
+import type { ConflictPolicy, HistoryConfig, IndexDefFor, IndexFieldName, MoneyFieldsOpt, SensitiveOpt, TierMode } from '../../kernel/types.js';
+import type { ViaFieldSpec } from '../../kernel/via/compose.js';
+import type { ClassifiedEntry } from '../../port/with/classified-strategy.js';
+import type { CrdtMode } from '../../with-commit/crdt/crdt.js';
+import type { ComputedFields } from '../../with-formula/computed/index.js';
+import type { EmbeddingDescriptor } from '../../with-lookup/embeddings/index.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
+import type { FieldMeta } from '../../with-shape/introspection/field-meta.js';
+import type { CollectionMeta } from '../../with-shape/introspection/meta.js';
+import type { DictKeyDescriptor, I18nTextDescriptor, StaticDictDescriptor } from './i18n-strategy.js';
+import type { LookupDescriptor } from '../../via/lookup/descriptor.js';
+import type { ArchivePolicy } from '../../with-fork/archive/index.js';
+import type { SchemaUpdateStrategy } from '../../with-shape/schema-update/types.js';
+import type { AttestationFieldSchema } from '@noy-db/attestation';
+/**
+ * Options for {@link Vault.collection} — opening or declaring a collection.
+ *
+ * Extracted from a 124-line inline literal (#841). Naming it lets consumers
+ * annotate a call, lets `describe()` reuse the shape, and means a new option
+ * is one edit here rather than an edit buried in the middle of a 534-line
+ * method.
+ *
+ * Named `OpenCollectionOptions`, not `CollectionOptions` as the issue
+ * suggested, to keep a clear gap from the existing `CollectionOpts` in
+ * `collection-config.ts` — that one is the `Collection` CONSTRUCTOR's input,
+ * built from this one. A one-character difference between two adjacent
+ * config types is exactly the wart #844 is about.
+ */
+export interface OpenCollectionOptions<T, S extends keyof T & string = never, Q extends keyof T & string = never, M extends keyof T & string = never> {
+    indexes?: readonly IndexDefFor<IndexFieldName<T, S, Q>>[];
+    /** — auto-reconcile policy for persisted-index drift. */
+    reconcileOnOpen?: 'off' | 'dry-run' | 'auto';
+    prefetch?: boolean;
+    cache?: CacheOptions;
+    schema?: StandardSchemaV1<unknown, T>;
+    refs?: Record<string, RefDescriptor>;
+    /** — declare i18nText fields for locale-aware reads. */
+    i18nFields?: Record<string, I18nTextDescriptor>;
+    /** — embedding config for write-time vector derivation + semantic retrieval. */
+    embeddings?: EmbeddingDescriptor;
+    /** — string fields exposed to client-side `retrieve()`. */
+    textIndexes?: readonly IndexFieldName<T, S>[];
+    /** — pre-build the lexical index on open (eager-only). */
+    warmIndexOnOpen?: boolean;
+    /** — persist the lexical index as an opaque encrypted blob at `_ftindex/<name>`. */
+    textIndexPersist?: boolean;
+    /** — declare dictKey / staticDict fields for label resolution on reads. */
+    dictKeyFields?: Record<string, DictKeyDescriptor | StaticDictDescriptor>;
+    /** — declare lookup() / enumOf() / dict() fields (#650 Task 2 — the 'lookup' via binding's three tiers). */
+    lookupFields?: Record<string, LookupDescriptor>;
+    /** Consumer-neutral per-field descriptors (label/unit/semanticType/sensitivity…). See collection.describe(). */
+    fieldMeta?: Record<string, FieldMeta>;
+    /** The collection's own descriptive metadata (label/description/icon). See collection.describe(). */
+    meta?: CollectionMeta;
+    /** — declare money() fields for currency-safe decimal storage/formatting. */
+    moneyFields?: MoneyFieldsOpt<T, M>;
+    viaFields?: Record<string, ViaFieldSpec>;
+    /** — declare computed scalar fields, evaluated on write (schema-owned). Each entry may be
+     *  a plain `(record) => value` function, OR `{ fn, deps }` to declare source fields for
+     *  taint propagation (#638 Task 7 — supersedes the retired `computedDeps` option). */
+    computed?: ComputedFields<T>;
+    /** — declare classified() sensitive-field descriptors. See the classified-fields spec. */
+    classifiedFields?: Record<string, ClassifiedEntry>;
+    /** — per-collection conflict resolution policy. */
+    conflictPolicy?: ConflictPolicy<T>;
+    /** — CRDT mode for collaborative editing without conflicts. */
+    crdt?: CrdtMode;
+    /**
+     * declare deterministic-encryption fields for blind
+     * equality search. See `Collection` constructor docs for the full
+     * trade-off. Requires `acknowledgeDeterministicRisk: true`.
+     */
+    deterministicFields?: readonly IndexFieldName<T, S>[];
+    /** — explicit ack that deterministic encryption leaks equality. */
+    acknowledgeDeterministicRisk?: boolean;
+    /** — explicit ack for the classified `equatable` knob (R8 door). Required
+     *  when any classified field declares `equatable: true`. */
+    acknowledgeEquatableRisk?: boolean;
+    /**
+     * — structural group-encryption. Fields sealed into their own
+     * `_sealed[field]` envelope slot (per-field key), kept out of the open
+     * `_data` blob. Default-off; byte-identical output when absent.
+     */
+    sensitive?: SensitiveOpt<T, S>;
+    /**
+     * — per-record content-encryption keys. When `true`, every record
+     * body is encrypted under a fresh per-record CEK wrapped under the
+     * collection DEK (`_cek`), stable across versions. Foundation for
+     * per-record erasure / record-scoped sealing. Off by
+     * default; non-adopting collections take the legacy path unchanged.
+     */
+    perRecordKeys?: boolean;
+    satelliteOf?: string;
+    fields?: readonly string[];
+    joined?: string;
+    /**
+     * Per-record provenance tracking. When `true`, `put()` calls that
+     * supply a `source` option stamp `_source` / `_sourceTs` onto the
+     * unencrypted envelope metadata. Off by default.
+     */
+    provenance?: boolean;
+    /**
+     * declarative blob retention / TTL policy per slot
+     * name. Values are `{ retainDays?, evictWhen? }`. Evaluated only
+     * when `vault.compact()` runs.
+     */
+    blobFields?: BlobFieldsConfig<T>;
+    blobTierPolicy?: 'isolate' | 'dedup';
+    /** — declarative record archival policy: `{ archiveWhen, legalHold? }`. Evaluated when `vault.archive()` runs. */
+    archive?: ArchivePolicy<T>;
+    /** — declared tiers for this collection. */
+    tiers?: readonly number[];
+    /**  — how lower-tier reads see above-tier records. */
+    tierMode?: TierMode;
+    /**
+     * Opt-in persisted JSON Schema. When `true` AND a Zod `schema` is
+     * provided, hub derives a JSON Schema via `zod-to-json-schema`
+     * (optional peer-dep) and writes an encrypted snapshot to
+     * `_schemas/<collectionName>`. Re-runs on every open; hash-skip
+     * avoids write churn when the schema is unchanged.
+     *
+     * Default: `false`. Non-Zod Standard Schema validators receive a
+     * stub envelope flagging the kind without a JSON Schema body.
+     *
+     * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+     */
+    persistJsonSchema?: boolean;
+    /**
+     * Ordered schema-update strategies. On a detected schema
+     * change, evaluated in order; the first non-`allow` decision wins.
+     * A `reject` is enforced at the write path (`put`/`delete` throw).
+     * Requires `persistJsonSchema: true` (detection needs the baseline).
+     */
+    schemaUpdate?: readonly SchemaUpdateStrategy[];
+    /** — declare the per-field schema for document attestation (issue side). */
+    attestation?: AttestationFieldSchema;
+    /**
+     * Per-collection history & tamper-ledger scoping. Overrides the
+     * vault-wide `history` config for THIS collection only (wholesale, not
+     * merged). `enabled: false` suppresses per-record snapshots for this
+     * collection; `ledger: false` excludes its writes from the vault-wide
+     * hash-chained tamper ledger. Lets you confine version snapshots +
+     * tamper-evidence to the few collections where they carry legal weight,
+     * without paying snapshot + ledger-entry-per-write across operational /
+     * derived collections. Defaults to the vault-wide `history` config.
+     */
+    historyConfig?: HistoryConfig;
+    /**
+     * Opt-in: keep the working set encrypted in RAM, decrypting on read (future phase).
+     * Default false — the working set is plaintext.
+     */
+    ramCiphertext?: boolean;
+}

package/dist/port/with/team-strategy.d.ts

@@ -16,7 +16,7 @@
  * argument from the strategy.
  *
  * Deliberately NOT gated (single-user primitives): owner keyring creation,
- * unlock, `listUsers`, `updateUser`, passphrase rotate/recover, and the
+ * unlock, `listUsers`, `updateUser`, secret rotate/recover, and the
  * `createDeedOwner` free function (no createNoydb instance to gate against —
  * the same carve-out as `liberateVault`).
  * @internal

package/dist/portability/index.js

@@ -1,36 +1,36 @@
 import {
   NO_PORTABILITY
-} from "../chunk-GYB2QK5H.js";
+} from "../chunk-OWLZONGX.js";
 import {
   PortabilityNotEnabledError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/portability/active.ts
 function withPortability() {
   return {
     async exportAccessibleData(vault, opts) {
-      const { exportAccessibleData } = await import("../export-accessible-HXMKW5LJ.js");
+      const { exportAccessibleData } = await import("../export-accessible-FBL6TDSK.js");
       return exportAccessibleData(vault, opts);
     },
     async withdrawAccessibleData(vault, opts) {
-      const { withdrawAccessibleData } = await import("../withdraw-accessible-HPOVNG2G.js");
+      const { withdrawAccessibleData } = await import("../withdraw-accessible-Q2EMATCU.js");
       return withdrawAccessibleData(vault, opts);
     },
     async requestWithdrawal(vault, opts) {
-      const { requestWithdrawal } = await import("../request-withdrawal-SEVUEUDG.js");
+      const { requestWithdrawal } = await import("../request-withdrawal-UN3TRHWI.js");
       return requestWithdrawal(vault, opts);
     },
     async listWithdrawalRequests(vault, opts) {
-      const { listWithdrawalRequests } = await import("../request-withdrawal-SEVUEUDG.js");
+      const { listWithdrawalRequests } = await import("../request-withdrawal-UN3TRHWI.js");
       return listWithdrawalRequests(vault, opts);
     },
     async approveWithdrawal(vault, requestId, opts) {
-      const { approveWithdrawal } = await import("../request-withdrawal-SEVUEUDG.js");
+      const { approveWithdrawal } = await import("../request-withdrawal-UN3TRHWI.js");
       return approveWithdrawal(vault, requestId, opts);
     },
     async rejectWithdrawal(vault, requestId, opts) {
-      const { rejectWithdrawal } = await import("../request-withdrawal-SEVUEUDG.js");
+      const { rejectWithdrawal } = await import("../request-withdrawal-UN3TRHWI.js");
       return rejectWithdrawal(vault, requestId, opts);
     }
   };

package/dist/{post-register-A7HCFBP5.js → post-register-XIAHB6KF.js}

@@ -1,9 +1,9 @@
 import {
   hashFields
-} from "./chunk-L4OA7G5T.js";
+} from "./chunk-522MBPE5.js";
 import {
   SatelliteConfigError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/marker.ts
@@ -14,7 +14,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     joined: spec.joined,
     epoch: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const { loadPersistedSchema } = await import("./storage-QOZKQMID.js");
+  const { loadPersistedSchema } = await import("./storage-3R37QZLA.js");
   const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek);
   const prior = persisted?.satellite;
   if (prior) {
@@ -25,7 +25,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     }
     return;
   }
-  const { persistSatelliteMarker } = await import("./register-YBMRLZLO.js");
+  const { persistSatelliteMarker } = await import("./register-HB4TQZSV.js");
   await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next });
 }
 
@@ -39,7 +39,7 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
   }
   if (baseSchema !== void 0) {
     try {
-      const { derivePersistedSchema } = await import("./derive-SGRCCKVP.js");
+      const { derivePersistedSchema } = await import("./derive-CWWFEQ4N.js");
       const envelope = await derivePersistedSchema(baseSchema);
       const properties = envelope.jsonSchema?.["properties"];
       const baseFields = Object.keys(properties ?? {});
@@ -57,4 +57,4 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
 export {
   postRegister
 };
-//# sourceMappingURL=post-register-A7HCFBP5.js.map
+//# sourceMappingURL=post-register-XIAHB6KF.js.map

package/dist/query/index.js

@@ -4,12 +4,12 @@ import {
   ScanBuilder,
   buildLiveQuery,
   executePlan
-} from "../chunk-4X6DJZHY.js";
+} from "../chunk-HQKRZIX6.js";
 import {
   DEFAULT_JOIN_MAX_ROWS,
   applyJoins,
   resetJoinWarnings
-} from "../chunk-OGFPMCSP.js";
+} from "../chunk-SBOHNJUD.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
@@ -33,14 +33,14 @@ import {
   reducerBuilder,
   resetGroupByWarnings,
   sum
-} from "../chunk-JIMEB4C6.js";
+} from "../chunk-QMMOMBH6.js";
 import {
   evaluateClause,
   evaluateFieldClause,
   readPath
 } from "../chunk-IGJCYUT5.js";
-import "../chunk-XGVDLQJE.js";
-import "../chunk-STR7WBOB.js";
+import "../chunk-JN3SGXJE.js";
+import "../chunk-ZUDAK436.js";
 import {
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
@@ -50,7 +50,7 @@ import {
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   Aggregation,

package/dist/register-HB4TQZSV.js

@@ -0,0 +1,23 @@
+import {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+} from "./chunk-YXZNGHID.js";
+import "./chunk-SEU6QHH4.js";
+import "./chunk-S4YERMGJ.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+};
+//# sourceMappingURL=register-HB4TQZSV.js.map

package/dist/registry-6BMBFEXT.js

@@ -0,0 +1,19 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-TNATF3HB.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-6BMBFEXT.js.map

package/dist/registry-7CZWF3EQ.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-ZX5FNWH7.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-7CZWF3EQ.js.map

package/dist/registry-JOFO7RAH.js

@@ -0,0 +1,18 @@
+import {
+  DerivationRegistry
+} from "./chunk-2PDBYF2O.js";
+import "./chunk-Z4D3YGAB.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-JOFO7RAH.js.map

package/dist/request-withdrawal-UN3TRHWI.js

@@ -0,0 +1,31 @@
+import {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+} from "./chunk-3OWYOECI.js";
+import "./chunk-K4BWPNJO.js";
+import "./chunk-OMSKGLYA.js";
+import "./chunk-YCAJDK4O.js";
+import "./chunk-YFFEF6HR.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+};
+//# sourceMappingURL=request-withdrawal-UN3TRHWI.js.map

package/dist/{reveal-PB3YG544.js → reveal-VWXRV2XU.js}

@@ -1,14 +1,14 @@
 import {
   isTombstone
-} from "./chunk-QXPOEAKR.js";
+} from "./chunk-SC4JLMZI.js";
 import {
   dualReadSealedSlot
-} from "./chunk-M25ZIEB2.js";
-import "./chunk-5P5AAXYA.js";
-import "./chunk-5BHNQNBI.js";
+} from "./chunk-5HSSTOOG.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
 import {
   ClassifiedRevealError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/reveal.ts
@@ -35,4 +35,4 @@ async function revealSealedField(ctx, id, field) {
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-PB3YG544.js.map
+//# sourceMappingURL=reveal-VWXRV2XU.js.map

package/dist/revoke-OLO2OVR7.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-UTEATWHO.js";
+import "./chunk-QZJEYZ4I.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-OLO2OVR7.js.map

package/dist/satellites/index.js

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   SatelliteConfigError

package/dist/sealed-record/index.js

@@ -1,38 +1,38 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-J3VW4J4E.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-7LP7FFJ2.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   decrypt,
   importCek
-} from "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+} from "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../enclave-YFKA3GJT.js");
+      const { sealRecordToHost } = await import("../enclave-I5H3GINP.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../enclave-YFKA3GJT.js");
+      const { revokeSealedRecord } = await import("../enclave-I5H3GINP.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../enclave-YFKA3GJT.js");
+      const { rotateRecordCek } = await import("../enclave-I5H3GINP.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/{seed-EKF4DIBB.js → seed-CDBFOTIK.js}

@@ -1,26 +1,26 @@
 import {
   BROKER_COLLECTION,
   ensureCollectionDEK
-} from "./chunk-WJDYZP3U.js";
-import "./chunk-7B4GPCX7.js";
+} from "./chunk-3LJYHE7S.js";
+import "./chunk-6RPWILRH.js";
 import {
   computeBrokerProof,
   deriveBrokerProofBits,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-PEY6ZTCF.js";
-import "./chunk-QXPOEAKR.js";
-import "./chunk-LLVW4V7R.js";
-import "./chunk-M25ZIEB2.js";
-import "./chunk-5BB3N4KU.js";
+} from "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
 import "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5BHNQNBI.js";
+} from "./chunk-YTW6ZIPD.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -28,7 +28,7 @@ import {
   NetworkError,
   PermissionDeniedError,
   ValidationError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-party/broker/seed.ts
@@ -57,7 +57,7 @@ async function brokerDek(store, vault, keyring) {
     } catch (err) {
       if (err instanceof ValidationError) {
         throw new BrokerEnrolmentError(
-          "enroll()/rotate() need the KEK to provision the _broker DEK on first use \u2014 re-authenticate at tier 1 (passphrase) before enrolling. Using an already-enrolled seed (credentialSource()) needs only the DEK."
+          "enroll()/rotate() need the KEK to provision the _broker DEK on first use \u2014 re-authenticate at tier 1 (secret) before enrolling. Using an already-enrolled seed (credentialSource()) needs only the DEK."
         );
       }
       throw err;
@@ -228,4 +228,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-EKF4DIBB.js.map
+//# sourceMappingURL=seed-CDBFOTIK.js.map