@noy-db/hub 0.4.0 → 0.6.0-pre.0

package/dist/{chunk-HLKXPJ4V.js → chunk-3EO7RZLJ.js}

@@ -2,20 +2,20 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-IFOH7RBI.js";
+} from "./chunk-ZWMO5GL5.js";
 import {
   openEnvelopeJson
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-FY343IZR.js";
 import {
   encrypt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-audit/attestation/revoke.ts
 import { signRevocationList } from "@noy-db/attestation";
@@ -82,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-HLKXPJ4V.js.map
+//# sourceMappingURL=chunk-3EO7RZLJ.js.map

package/dist/{chunk-JYJFGD2H.js → chunk-3FSX6LDG.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -34,4 +34,4 @@ export {
   assertTierWritable,
   assertCutoverTierSafe
 };
-//# sourceMappingURL=chunk-JYJFGD2H.js.map
+//# sourceMappingURL=chunk-3FSX6LDG.js.map

package/dist/{chunk-MXUT7FTE.js → chunk-3HYWYLXL.js}

@@ -1,7 +1,7 @@
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -177,4 +177,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-MXUT7FTE.js.map
+//# sourceMappingURL=chunk-3HYWYLXL.js.map

package/dist/{chunk-IVYQAVWO.js → chunk-3IIPWA75.js}

@@ -1,27 +1,27 @@
-import {
-  putDerivedOutput
-} from "./chunk-LRRX57UA.js";
 import {
   wrapDbWithPredicates
-} from "./chunk-3HUYRN24.js";
-import {
-  DEFAULT_JOIN_MAX_ROWS
-} from "./chunk-V6UQZA2H.js";
+} from "./chunk-7F4DBNSP.js";
 import {
   groupAndReduce
-} from "./chunk-KRCBZYTZ.js";
+} from "./chunk-CCZJJ4I2.js";
+import {
+  putDerivedOutput
+} from "./chunk-ZXJXDHNK.js";
+import {
+  DEFAULT_JOIN_MAX_ROWS
+} from "./chunk-E6427JU2.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
 import {
   applyI18nLocale
-} from "./chunk-UADPR6F4.js";
+} from "./chunk-7G6VDWXB.js";
 import {
   JoinTooLargeError,
   LocaleNotSpecifiedError,
   MaterializedViewConfigError,
   MaterializedViewTooLargeError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-formula/materialized-views/executor.ts
 var DEFAULT_MAX_ROWS = 1e5;
@@ -282,4 +282,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-IVYQAVWO.js.map
+//# sourceMappingURL=chunk-3IIPWA75.js.map

package/dist/{chunk-7H3WWH6J.js → chunk-3UK6STWO.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-FY343IZR.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-FPHKWDWT.js"));
+var loadMVExecutor = lazy(() => import("./executor-3JZ4POTW.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-7H3WWH6J.js.map
+//# sourceMappingURL=chunk-3UK6STWO.js.map

package/dist/chunk-46V67XP5.js

@@ -0,0 +1,117 @@
+import {
+  assertKeyringNotExpired,
+  grant,
+  loadKeyring,
+  readKeyringFile,
+  resolveEchoReveal,
+  revoke,
+  rotateKeys,
+  verifyPrompt,
+  verifyTypedEcho
+} from "./chunk-RLWY6Z44.js";
+import {
+  NoAccessError,
+  NoydbError,
+  ValidationError,
+  WrongEchoError,
+  WrongPromptError
+} from "./chunk-HNGSV2YC.js";
+
+// src/with-party/team/echo-ceremony.ts
+async function beginEchoUnlock(store, vault, opts) {
+  const { userId, prompt, deviceSeal } = opts;
+  const found = await readKeyringFile(store, vault, userId);
+  if (!found) {
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
+  }
+  const { file: keyringFile } = found;
+  assertKeyringNotExpired(keyringFile);
+  const block = keyringFile.echo;
+  if (block === void 0) {
+    throw new ValidationError("not an echo keyring");
+  }
+  if (!await verifyPrompt(block, prompt)) {
+    throw new WrongPromptError();
+  }
+  const reveal = await resolveEchoReveal(block, prompt, deviceSeal);
+  return {
+    reveal,
+    maskHint: block.mask_hint,
+    async complete(input) {
+      let echo;
+      if (reveal !== null) {
+        if (input.echo !== void 0 && input.echo !== reveal) {
+          throw new WrongEchoError();
+        }
+        echo = reveal;
+      } else {
+        if (input.echo === void 0) {
+          throw new ValidationError("beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.");
+        }
+        if (!await verifyTypedEcho(block, input.echo)) {
+          throw new WrongEchoError();
+        }
+        echo = input.echo;
+      }
+      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } });
+    }
+  };
+}
+
+// src/with-party/team/device-seal.ts
+var MemoryDeviceSealProvider = class {
+  id;
+  keyPromise;
+  constructor(opts) {
+    this.id = opts.id;
+    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, [
+      "encrypt",
+      "decrypt"
+    ]);
+  }
+  async seal(plain) {
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+    const ct = new Uint8Array(
+      await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, await this.keyPromise, plain)
+    );
+    const out = new Uint8Array(12 + ct.length);
+    out.set(iv, 0);
+    out.set(ct, 12);
+    return out;
+  }
+  async unseal(sealed) {
+    try {
+      return new Uint8Array(
+        await globalThis.crypto.subtle.decrypt(
+          { name: "AES-GCM", iv: sealed.slice(0, 12) },
+          await this.keyPromise,
+          sealed.slice(12)
+        )
+      );
+    } catch {
+      throw new NoydbError("DEVICE_SEAL_UNSEAL_FAILED", "Device seal: unseal failed (tamper or wrong device).");
+    }
+  }
+};
+
+// src/with-party/team/active.ts
+function withTeam() {
+  return {
+    async grant(team, vault, options, factors) {
+      return team.runGrant(grant, vault, options, factors);
+    },
+    async revoke(team, vault, options, factors) {
+      return team.runRevoke(revoke, vault, options, factors);
+    },
+    async rotate(team, vault, collections) {
+      return team.runRotate(rotateKeys, vault, collections);
+    }
+  };
+}
+
+export {
+  beginEchoUnlock,
+  MemoryDeviceSealProvider,
+  withTeam
+};
+//# sourceMappingURL=chunk-46V67XP5.js.map

package/dist/chunk-46V67XP5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { DeviceSealProvider } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: DeviceSealProvider\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * docs/superpowers/specs/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * docs/superpowers/specs/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { DeviceSealProvider }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSealProvider implements DeviceSealProvider {\n  readonly id: string\n  private readonly keyPromise: Promise<CryptoKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n      'encrypt',\n      'decrypt',\n    ])\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12))\n    const ct = new Uint8Array(\n      await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await this.keyPromise, plain as BufferSource),\n    )\n    const out = new Uint8Array(12 + ct.length)\n    out.set(iv, 0)\n    out.set(ct, 12)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: sealed.slice(0, 12) },\n          await this.keyPromise,\n          sealed.slice(12) as BufferSource,\n        ),\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;ACjHO,IAAM,2BAAN,MAA6D;AAAA,EACzD;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,MAC9F;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,WAAW,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,YAAY,KAAqB;AAAA,IAC9G;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,GAAG,MAAM;AACzC,QAAI,IAAI,IAAI,CAAC;AACb,QAAI,IAAI,IAAI,EAAE;AACd,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO;AAAA,UAC7B,EAAE,MAAM,WAAW,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,UAC3C,MAAM,KAAK;AAAA,UACX,OAAO,MAAM,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACtCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-NJ4DYYO5.js → chunk-4HDYQL3J.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5D2ALSM5.js";
 
 // src/with-formula/derivations/stale.ts
-var loadDerivationExecutor = lazy(() => import("./executor-IEBLTBCW.js"));
+var loadDerivationExecutor = lazy(() => import("./executor-S4QIKEHW.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
 async function markStale(registry, strategy, sourceId) {
@@ -78,4 +78,4 @@ export {
   markStale,
   resolveStaleOnRead
 };
-//# sourceMappingURL=chunk-NJ4DYYO5.js.map
+//# sourceMappingURL=chunk-4HDYQL3J.js.map

package/dist/{chunk-P4JO3H6R.js → chunk-4MQDV3HZ.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-JEI6JJNI.js";
+} from "./chunk-EK7DT5BT.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-P4JO3H6R.js.map
+//# sourceMappingURL=chunk-4MQDV3HZ.js.map

package/dist/{chunk-X4MVWPHV.js → chunk-4UVDI4XE.js}

@@ -4,13 +4,13 @@ import {
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
   ValidationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-party/session/session.ts
 var subtle = globalThis.crypto.subtle;
@@ -364,4 +364,4 @@ export {
   clearDevUnlock,
   isDevUnlockActive
 };
-//# sourceMappingURL=chunk-X4MVWPHV.js.map
+//# sourceMappingURL=chunk-4UVDI4XE.js.map

package/dist/{chunk-LXRTP3AQ.js → chunk-4VCWI42L.js}

@@ -1,6 +1,6 @@
 import {
   LookupHandle
-} from "./chunk-OWHP3H5C.js";
+} from "./chunk-XB7LUDKM.js";
 
 // src/via/lookup/active.ts
 function withLookup() {
@@ -33,4 +33,4 @@ function withLookup() {
 export {
   withLookup
 };
-//# sourceMappingURL=chunk-LXRTP3AQ.js.map
+//# sourceMappingURL=chunk-4VCWI42L.js.map

package/dist/{chunk-QJNCB5SK.js → chunk-747LRSOO.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-LP7BEXCT.js";
 import {
   bufferToBase64
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 
 // src/kernel/enclave/classify/bidx.ts
 var subtle = globalThis.crypto.subtle;
@@ -66,4 +66,4 @@ export {
   mintBidxTag,
   computeBidxTarget
 };
-//# sourceMappingURL=chunk-QJNCB5SK.js.map
+//# sourceMappingURL=chunk-747LRSOO.js.map

package/dist/{chunk-3HUYRN24.js → chunk-7F4DBNSP.js}

@@ -1,9 +1,9 @@
 import {
   sha256Hex
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 import {
   MaterializedViewSourceUnknownError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -366,4 +366,4 @@ export {
   MaterializedViewRegistry,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-3HUYRN24.js.map
+//# sourceMappingURL=chunk-7F4DBNSP.js.map

package/dist/{chunk-UADPR6F4.js → chunk-7G6VDWXB.js}

@@ -1,12 +1,12 @@
 import {
   installViaBinder
-} from "./chunk-6UBZ6I5Z.js";
+} from "./chunk-UHXCLPGC.js";
 import {
   LocaleNotSpecifiedError,
   MissingTranslationError,
   ScriptViolationError,
   TranslatorNotConfiguredError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/port/with/i18n-strategy.ts
 function notEnabled(op) {
@@ -618,4 +618,4 @@ export {
   presentI18nForJoin,
   stripI18nFilled
 };
-//# sourceMappingURL=chunk-UADPR6F4.js.map
+//# sourceMappingURL=chunk-7G6VDWXB.js.map

package/dist/{chunk-PTHKZWEH.js → chunk-AHLJSVRL.js}

@@ -1,6 +1,6 @@
 import {
   TierNotGrantedError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-party/team/tiers.ts
 function dekKey(collection, tier) {
@@ -19,4 +19,4 @@ export {
   dekKey,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-PTHKZWEH.js.map
+//# sourceMappingURL=chunk-AHLJSVRL.js.map

package/dist/{chunk-NFZGZ4AK.js → chunk-AR2JDFAE.js}

@@ -2,7 +2,7 @@ import {
   decrypt,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 
 // src/kernel/enclave/record-keys/sealed-slot.ts
 function parseSealedSlot(blob) {
@@ -26,4 +26,4 @@ export {
   parseSealedSlot,
   dualReadSealedSlot
 };
-//# sourceMappingURL=chunk-NFZGZ4AK.js.map
+//# sourceMappingURL=chunk-AR2JDFAE.js.map

package/dist/{chunk-3ECU57YH.js → chunk-BPTZ4K5L.js}

@@ -1,6 +1,3 @@
-import {
-  SCHEMAS_COLLECTION
-} from "./chunk-KD4HGBJV.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -8,11 +5,14 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-WYUAEZSC.js";
+} from "./chunk-VBY6ZLJT.js";
+import {
+  SCHEMAS_COLLECTION
+} from "./chunk-V5C5NNBR.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-JEI6JJNI.js";
+} from "./chunk-EK7DT5BT.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -23,11 +23,11 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-DQZXPGGZ.js";
+} from "./chunk-24UICKTB.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-FY343IZR.js";
 import {
   bufferToBase64,
   decrypt,
@@ -37,14 +37,14 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   PartitionExtractionError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -492,4 +492,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-3ECU57YH.js.map
+//# sourceMappingURL=chunk-BPTZ4K5L.js.map

package/dist/{chunk-KRCBZYTZ.js → chunk-CCZJJ4I2.js}

@@ -9,13 +9,13 @@ import {
 } from "./chunk-IGJCYUT5.js";
 import {
   applyI18nLocale
-} from "./chunk-UADPR6F4.js";
+} from "./chunk-7G6VDWXB.js";
 import {
   viaBinder
-} from "./chunk-6UBZ6I5Z.js";
+} from "./chunk-UHXCLPGC.js";
 import {
   GroupCardinalityError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-lookup/reduce/reduction.ts
 function reduceRecords(records, spec) {
@@ -361,4 +361,4 @@ export {
   groupAndReduce,
   GroupedReduction
 };
-//# sourceMappingURL=chunk-KRCBZYTZ.js.map
+//# sourceMappingURL=chunk-CCZJJ4I2.js.map

package/dist/{chunk-NYEFP7DY.js → chunk-CJ73OLMW.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-NYEFP7DY.js.map
+//# sourceMappingURL=chunk-CJ73OLMW.js.map

package/dist/{chunk-Q36YXK77.js → chunk-CYQOUTMY.js}

@@ -1,9 +1,9 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   ValidationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-party/directory/cover/custom.ts
 var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
@@ -233,4 +233,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-Q36YXK77.js.map
+//# sourceMappingURL=chunk-CYQOUTMY.js.map

package/dist/{chunk-RBTVFPHF.js → chunk-DCMQR46R.js}

@@ -1,19 +1,19 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-IFOH7RBI.js";
+} from "./chunk-ZWMO5GL5.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   encrypt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   AttestationError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-audit/attestation/issue.ts
 import {
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-RBTVFPHF.js.map
+//# sourceMappingURL=chunk-DCMQR46R.js.map

package/dist/{chunk-TG634KCO.js → chunk-DG27IUVI.js}

@@ -1,7 +1,7 @@
 import {
   CargoNotEnabledError,
   QuiesceTimeoutError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -60,4 +60,4 @@ export {
   isQuorum,
   runDrainBarrier
 };
-//# sourceMappingURL=chunk-TG634KCO.js.map
+//# sourceMappingURL=chunk-DG27IUVI.js.map

package/dist/{chunk-E23UGFVC.js → chunk-DMQCLZ4Z.js}

@@ -1,7 +1,7 @@
 import {
   NonAdditiveSchemaChangeError,
   SchemaLockedError
-} from "./chunk-QZWTRENR.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-shape/schema-update/strategies.ts
 function blindUpdate() {
@@ -11,11 +11,12 @@ function additiveOnly() {
   return {
     name: "additiveOnly",
     onSchemaDelta(delta) {
-      if (delta.kind === "non-additive") {
+      const renamed = delta.renamed ?? [];
+      if (delta.kind === "non-additive" || renamed.length > 0) {
         return {
           action: "reject",
           error: new NonAdditiveSchemaChangeError(
-            `Non-additive schema change to "${delta.collection}" (added: [${delta.added.join(", ")}], removed: [${delta.removed.join(", ")}], changed: [${delta.changed.map((c) => c.field).join(", ")}]). Register a coordinatedCutover() strategy to migrate, or revert the change.`
+            `Non-additive schema change to "${delta.collection}" (added: [${delta.added.join(", ")}], removed: [${delta.removed.join(", ")}], changed: [${delta.changed.map((c) => c.field).join(", ")}]` + (renamed.length > 0 ? `, renamed: [${renamed.map((r) => `${r.from}->${r.to}`).join(", ")}]` : "") + `). Register a coordinatedCutover() strategy to migrate, or revert the change.`
           )
         };
       }
@@ -29,7 +30,8 @@ function lockSchema(opts) {
     name: "lockSchema",
     onSchemaDelta(delta) {
       if (delta.kind === "none") return { action: "allow" };
-      const touched = fields ? [...delta.added, ...delta.removed, ...delta.changed.map((c) => c.field)].filter((f) => fields.includes(f)) : ["<any>"];
+      const renamedNames = (delta.renamed ?? []).flatMap((r) => [r.from, r.to]);
+      const touched = fields ? [...delta.added, ...delta.removed, ...delta.changed.map((c) => c.field), ...renamedNames].filter((f) => fields.includes(f)) : ["<any>"];
       if (touched.length === 0) return { action: "allow" };
       return {
         action: "reject",
@@ -46,7 +48,7 @@ function coordinatedCutover(opts) {
   return {
     name: "coordinatedCutover",
     onSchemaDelta(delta) {
-      if (delta.kind === "non-additive") {
+      if (delta.kind === "non-additive" || (delta.renamed?.length ?? 0) > 0) {
         return { action: "cutover", transform: opts.transform };
       }
       return { action: "allow" };
@@ -60,4 +62,4 @@ export {
   lockSchema,
   coordinatedCutover
 };
-//# sourceMappingURL=chunk-E23UGFVC.js.map
+//# sourceMappingURL=chunk-DMQCLZ4Z.js.map

package/dist/chunk-DMQCLZ4Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/strategies.ts","../src/with-shape/schema-update/cutover.ts"],"sourcesContent":["/** Bundled light update strategies. */\nimport { NonAdditiveSchemaChangeError, SchemaLockedError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, SchemaDelta } from './types.js'\n\n/** Allow any schema change. Explicit blind / back-compat. */\nexport function blindUpdate(): SchemaUpdateStrategy {\n  return { name: 'blindUpdate', onSchemaDelta: () => ({ action: 'allow' }) }\n}\n\n/**\n * Allow additive changes; reject non-additive ones. The safety backstop.\n *\n * #946: a `renamed` pair is NOT additive-safe *for this gate* — the delta\n * itself carries no data migration, so an allowed rename would orphan\n * existing record values under the old key. `computeSchemaDelta` classifies\n * a pure rename as `kind: 'additive'` (it IS additive-safe as far as the\n * name-change itself is concerned, and the id-carry through `SchemaDelta.\n * renamed` is real), but a guard whose whole job is \"don't admit anything\n * that isn't a mechanical additive write\" must still block it — the same as\n * it blocks any other non-additive change — forcing a `coordinatedCutover()`\n * (or `blindUpdate()`) to actually move the data.\n */\nexport function additiveOnly(): SchemaUpdateStrategy {\n  return {\n    name: 'additiveOnly',\n    onSchemaDelta(delta: SchemaDelta) {\n      const renamed = delta.renamed ?? []\n      if (delta.kind === 'non-additive' || renamed.length > 0) {\n        return {\n          action: 'reject' as const,\n          error: new NonAdditiveSchemaChangeError(\n            `Non-additive schema change to \"${delta.collection}\" ` +\n              `(added: [${delta.added.join(', ')}], removed: [${delta.removed.join(', ')}], ` +\n              `changed: [${delta.changed.map(c => c.field).join(', ')}]` +\n              (renamed.length > 0 ? `, renamed: [${renamed.map(r => `${r.from}->${r.to}`).join(', ')}]` : '') +\n              `). Register a coordinatedCutover() strategy to migrate, or revert the change.`,\n          ),\n        }\n      }\n      return { action: 'allow' as const }\n    },\n  }\n}\n\n/**\n * Reject schema changes. With `fields`, reject only when one of those\n * fields is added/removed/changed/renamed; otherwise reject any non-`none`\n * delta. #946: a `renamed` pair's `from` AND `to` both count as touching a\n * locked field — a rename away from a locked name (or onto one) still\n * violates the lock, and a blanket `lockSchema()` (no `fields`) already\n * blocks any rename since a pure rename's `kind` is never `'none'`.\n */\nexport function lockSchema(opts?: { readonly fields?: readonly string[] }): SchemaUpdateStrategy {\n  const fields = opts?.fields\n  return {\n    name: 'lockSchema',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'none') return { action: 'allow' as const }\n      const renamedNames = (delta.renamed ?? []).flatMap(r => [r.from, r.to])\n      const touched = fields\n        ? [...delta.added, ...delta.removed, ...delta.changed.map(c => c.field), ...renamedNames].filter(f => fields.includes(f))\n        : ['<any>']\n      if (touched.length === 0) return { action: 'allow' as const }\n      return {\n        action: 'reject' as const,\n        error: new SchemaLockedError(\n          `Schema for \"${delta.collection}\" is locked` +\n            (fields ? ` on fields [${fields.join(', ')}] (touched: [${touched.join(', ')}])` : '') +\n            `; the change was refused.`,\n        ),\n      }\n    },\n  }\n}\n","/** The coordinatedCutover update strategy (single-step — no from/to). */\nimport type { SchemaUpdateStrategy, SchemaDelta, TransformFn } from './types.js'\n\nexport function coordinatedCutover(opts: { readonly transform: TransformFn }): SchemaUpdateStrategy {\n  return {\n    name: 'coordinatedCutover',\n    onSchemaDelta(delta: SchemaDelta) {\n      // #946: a detected rename (`delta.renamed`) must ALSO fire the\n      // migration transform — even though computeSchemaDelta classifies a\n      // pure rename as `kind: 'additive'` (the name-change itself is\n      // additive-safe), the delta carries no data migration on its own.\n      // Pre-#946 a rename was a plain drop+add -> `non-additive` -> the\n      // transform fired and the caller re-keyed each record; this restores\n      // that behavior so the user's TransformFn still runs and existing\n      // values move from the old key to the new one instead of being\n      // orphaned.\n      if (delta.kind === 'non-additive' || (delta.renamed?.length ?? 0) > 0) {\n        return { action: 'cutover' as const, transform: opts.transform }\n      }\n      return { action: 'allow' as const }\n    },\n  }\n}\n"],"mappings":";;;;;;AAKO,SAAS,cAAoC;AAClD,SAAO,EAAE,MAAM,eAAe,eAAe,OAAO,EAAE,QAAQ,QAAQ,GAAG;AAC3E;AAeO,SAAS,eAAqC;AACnD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,YAAM,UAAU,MAAM,WAAW,CAAC;AAClC,UAAI,MAAM,SAAS,kBAAkB,QAAQ,SAAS,GAAG;AACvD,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,YACT,kCAAkC,MAAM,UAAU,cACpC,MAAM,MAAM,KAAK,IAAI,CAAC,gBAAgB,MAAM,QAAQ,KAAK,IAAI,CAAC,gBAC7D,MAAM,QAAQ,IAAI,OAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,OACtD,QAAQ,SAAS,IAAI,eAAe,QAAQ,IAAI,OAAK,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,IAAI,CAAC,MAAM,MAC5F;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,QAAQ,QAAiB;AAAA,IACpC;AAAA,EACF;AACF;AAUO,SAAS,WAAW,MAAsE;AAC/F,QAAM,SAAS,MAAM;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,OAAQ,QAAO,EAAE,QAAQ,QAAiB;AAC7D,YAAM,gBAAgB,MAAM,WAAW,CAAC,GAAG,QAAQ,OAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AACtE,YAAM,UAAU,SACZ,CAAC,GAAG,MAAM,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM,QAAQ,IAAI,OAAK,EAAE,KAAK,GAAG,GAAG,YAAY,EAAE,OAAO,OAAK,OAAO,SAAS,CAAC,CAAC,IACtH,CAAC,OAAO;AACZ,UAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,QAAiB;AAC5D,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,UACT,eAAe,MAAM,UAAU,iBAC5B,SAAS,eAAe,OAAO,KAAK,IAAI,CAAC,gBAAgB,QAAQ,KAAK,IAAI,CAAC,OAAO,MACnF;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACtEO,SAAS,mBAAmB,MAAiE;AAClG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAUhC,UAAI,MAAM,SAAS,mBAAmB,MAAM,SAAS,UAAU,KAAK,GAAG;AACrE,eAAO,EAAE,QAAQ,WAAoB,WAAW,KAAK,UAAU;AAAA,MACjE;AACA,aAAO,EAAE,QAAQ,QAAiB;AAAA,IACpC;AAAA,EACF;AACF;","names":[]}