@noy-db/hub 0.6.0-pre.14 → 0.6.0-pre.16

package/dist/{chunk-P2UFDX2F.js → chunk-LGGLPURL.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-6ZFTVY3O.js";
+} from "./chunk-SFY6NT7D.js";
 import {
   ValidationError
 } from "./chunk-I64WQSN3.js";
@@ -400,4 +400,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-P2UFDX2F.js.map
+//# sourceMappingURL=chunk-LGGLPURL.js.map

package/dist/{chunk-Y7MJSOZ7.js → chunk-LJDW6LQJ.js}

@@ -5,7 +5,7 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-CK7IRIRY.js";
+} from "./chunk-PZLIA5R3.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -24,7 +24,7 @@ import {
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-6ZFTVY3O.js";
+} from "./chunk-SFY6NT7D.js";
 import {
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
@@ -1024,4 +1024,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-Y7MJSOZ7.js.map
+//# sourceMappingURL=chunk-LJDW6LQJ.js.map

package/dist/{chunk-ZWPUYBNK.js → chunk-LTVETWDH.js}

@@ -1,7 +1,8 @@
 import {
+  buildRecordEnvelope,
   isDeleteMarker,
   isTombstone
-} from "./chunk-IMYGJ5HU.js";
+} from "./chunk-6E2JZRBD.js";
 import {
   blindedEqual,
   openVdigPayload,
@@ -36,7 +37,7 @@ import {
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-6ZFTVY3O.js";
+} from "./chunk-SFY6NT7D.js";
 import {
   ClassifiedConfigError,
   ClassifiedRotationError,
@@ -867,16 +868,17 @@ async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   };
   const envelopeKey = `${collection}/${id}/${hint.pid}`;
   const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    // AES-GCM bypassed — the sealing layer is the security boundary, exactly
-    // like the managed-secret `_meta/sealed-secret` envelope.
-    _iv: "",
-    _data: JSON.stringify(delivery),
-    ...ctx.actor ? { _by: ctx.actor } : {}
-  };
+  const env = buildRecordEnvelope(
+    { collection: SEALED_CEK_NS, id: envelopeKey },
+    {
+      version: (prior?._v ?? 0) + 1,
+      // AES-GCM bypassed — the sealing layer is the security boundary, exactly
+      // like the managed-secret `_meta/sealed-secret` envelope.
+      iv: "",
+      data: JSON.stringify(delivery),
+      ...ctx.actor ? { by: ctx.actor } : {}
+    }
+  );
   await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
   return { pid: hint.pid, envelopeKey };
 }
@@ -916,30 +918,30 @@ async function rotateRecordCek(ctx, collection, id) {
     }
     vdigOut = out;
   }
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: live._v + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data,
-    _cek: await wrapCek(newCek, dek),
-    ...ctx.actor ? { _by: ctx.actor } : {},
-    ...live._tier !== void 0 ? { _tier: live._tier } : {},
-    ...live._det !== void 0 ? { _det: live._det } : {},
-    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
-    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
-    // below, which are CEK-bound and must be re-sealed under the new CEK.
-    // Dropping this line would silently orphan the equality index on rotation
-    // (the #306 Slice-A data-loss bug, replayed on the index).
-    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
-    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
-    // keys derive off the per-record CEK, so the rotated record's old CEK is
-    // destroyed here — carrying the old `_sealed` slots forward verbatim would
-    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
-    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
-    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
-    ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
-  };
+  const env = buildRecordEnvelope({ collection, id }, {
+    version: live._v + 1,
+    iv,
+    data,
+    cek: await wrapCek(newCek, dek),
+    ...ctx.actor ? { by: ctx.actor } : {},
+    extra: {
+      ...live._tier !== void 0 ? { _tier: live._tier } : {},
+      ...live._det !== void 0 ? { _det: live._det } : {},
+      // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+      // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+      // below, which are CEK-bound and must be re-sealed under the new CEK.
+      // Dropping this line would silently orphan the equality index on rotation
+      // (the #306 Slice-A data-loss bug, replayed on the index).
+      ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
+      // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
+      // keys derive off the per-record CEK, so the rotated record's old CEK is
+      // destroyed here — carrying the old `_sealed` slots forward verbatim would
+      // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
+      // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
+      ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
+      ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
+    }
+  });
   await ctx.adapter.put(ctx.vault, collection, id, env);
   await ctx.invalidateRecordCaches(collection, id);
   const prefix = `${collection}/${id}/`;
@@ -1156,4 +1158,4 @@ export {
   issueChallenge,
   verifyBrokerProof
 };
-//# sourceMappingURL=chunk-ZWPUYBNK.js.map
+//# sourceMappingURL=chunk-LTVETWDH.js.map