@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.18

package/dist/{dead-filter-6HG5FP3I.js → dead-filter-XP7MPHCJ.js}

@@ -5,7 +5,7 @@ import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-N3IMFNGS.js");
+  const { loadPersistedSchema } = await import("./storage-WCZOCA46.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -25,4 +25,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-6HG5FP3I.js.map
+//# sourceMappingURL=dead-filter-XP7MPHCJ.js.map

package/dist/{delegation-7EGBYBRN.js → delegation-Q3HEAVLA.js}

@@ -1,13 +1,17 @@
-import {
-  dekKey
-} from "./chunk-YVOW35HH.js";
+import "./chunk-DL4GDOWL.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
+  dekKey
+} from "./chunk-7WD2G6K4.js";
+import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+} from "./chunk-X3AXSYBL.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -17,9 +21,7 @@ import {
   unwrapKey,
   wrapKey
 } from "./chunk-QTDAPDDV.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import {
   DelegationTargetMissingError
 } from "./chunk-I64WQSN3.js";
@@ -54,15 +56,12 @@ async function issueDelegation(store, vault, grantor, targetKek, delegationsDek,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   const plaintext = JSON.stringify(token);
-  const { iv, data } = await encrypt(plaintext, delegationsDek);
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: token.createdAt,
-    _iv: iv,
-    _data: data,
-    _by: grantor.userId
-  };
+  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 };
+  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity));
+  const envelope = buildRecordEnvelope(
+    identity,
+    { ts: token.createdAt, iv, data }
+  );
   await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope);
   return token;
 }
@@ -75,7 +74,7 @@ async function loadActiveDelegations(store, vault, user, delegationsDek, now = /
     if (!env) continue;
     let token;
     try {
-      const plaintext = await openEnvelopeJson(env, delegationsDek);
+      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek);
       token = JSON.parse(plaintext);
     } catch {
       continue;
@@ -104,4 +103,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-7EGBYBRN.js.map
+//# sourceMappingURL=delegation-Q3HEAVLA.js.map

package/dist/delegation-Q3HEAVLA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 }\n  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts: token.createdAt, iv, data},\n  )\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,WAAW,EAAE,YAAY,wBAAwB,IAAI,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS,EAAE;AACpG,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,gBAAgB,eAAe,QAAQ,CAAC;AACtF,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,MAAM,WAAW,IAAI,KAAI;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,GAAG,GAAG,KAAK,cAAc;AACxG,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/derivations/index.js

@@ -9,14 +9,14 @@ import {
   DerivationExecutor
 } from "../chunk-YDJXGYYA.js";
 import "../chunk-YH65A6WM.js";
-import "../chunk-LTVETWDH.js";
-import "../chunk-6E2JZRBD.js";
+import "../chunk-X3AXSYBL.js";
+import "../chunk-ZVAFJQZB.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-QTDAPDDV.js";
-import "../chunk-SFY6NT7D.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,

package/dist/{derive-XKAYJ2OA.js → derive-SVDY36ER.js}

@@ -4,14 +4,14 @@ import {
   isZodSchema
 } from "./chunk-HNOBRU24.js";
 import "./chunk-Y2NBBT6K.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -19,4 +19,4 @@ export {
   isZod4Schema,
   isZodSchema
 };
-//# sourceMappingURL=derive-XKAYJ2OA.js.map
+//# sourceMappingURL=derive-SVDY36ER.js.map

package/dist/directory/index.js

@@ -1,7 +1,7 @@
 import "../chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "../chunk-4XEUSZWN.js";
+} from "../chunk-6D3CN2JR.js";
 import {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,
@@ -16,15 +16,15 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "../chunk-PZLIA5R3.js";
-import "../chunk-LTVETWDH.js";
-import "../chunk-6E2JZRBD.js";
+} from "../chunk-ITXPKEDP.js";
+import "../chunk-X3AXSYBL.js";
+import "../chunk-ZVAFJQZB.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-QTDAPDDV.js";
-import "../chunk-SFY6NT7D.js";
+import "../chunk-3Y4OFWQJ.js";
 import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/{dispatch-56T7VPGE.js → dispatch-MG5KNMWG.js}

@@ -15,7 +15,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-LFHRV6JH.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-FRUVM36Q.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -24,7 +24,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-26ZJLNLG.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-ZWTKUVZX.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -44,7 +44,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-LFHRV6JH.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-FRUVM36Q.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -57,7 +57,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-26ZJLNLG.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-ZWTKUVZX.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -69,4 +69,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-56T7VPGE.js.map
+//# sourceMappingURL=dispatch-MG5KNMWG.js.map

package/dist/{dispatch-BM5GNCE2.js → dispatch-RVJQ4BOL.js}

@@ -4,20 +4,20 @@ import {
 import {
   putDerivedOutput,
   selfWriteFieldEqual
-} from "./chunk-OPGKH5RD.js";
+} from "./chunk-NFPSC2HL.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-IQGIPRSE.js";
-import "./chunk-7LLKPODL.js";
-import "./chunk-RVTOCAHQ.js";
-import "./chunk-53PWELSC.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+import "./chunk-CFTPERGL.js";
+import "./chunk-LPAGIMXJ.js";
+import "./chunk-SQSZRCYT.js";
+import "./chunk-FY33DKPH.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import {
   DerivationCapExceededError
 } from "./chunk-I64WQSN3.js";
@@ -28,7 +28,7 @@ async function dispatchArrayDerivationsOnDelete(ctx, id, eraseRecordShapeToo = f
   const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx;
   const strategies = derivationSource.registry().strategiesForSource(collectionName);
   if (strategies.length === 0) return 0;
-  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-MT2OBMZB.js");
+  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-NZA6J7QB.js");
   const txCtx = derivationSource.getActiveTxContext();
   let erased = 0;
   for (const { spec } of strategies) {
@@ -134,7 +134,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
         const outputCollection = derivationSource.getCollection(outSpec.collection);
         const txCtx = derivationSource.getActiveTxContext();
         if (out.kind === "array") {
-          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-MT2OBMZB.js");
+          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NZA6J7QB.js");
           const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext);
           const prevKeys = new Set(prior?.keys ?? []);
           const newKeysList = out.entries.map((e) => e.key);
@@ -191,4 +191,4 @@ export {
   dispatchArrayDerivationsOnDelete,
   dispatchDerivations
 };
-//# sourceMappingURL=dispatch-BM5GNCE2.js.map
+//# sourceMappingURL=dispatch-RVJQ4BOL.js.map

package/dist/{enclave-KDLGVX5Z.js → enclave-AOZTWFZK.js}

@@ -10,11 +10,15 @@ import {
   envelopeBodySize,
   findByDet,
   hasPerRecordKey,
+  hasSealedBody,
   isRewrappedUnder,
   issueChallenge,
   makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
+  recordAadFor,
+  rekeyEnvelopeIfNeeded,
+  rekeyEnvelopeToDek,
   resolveStableCek,
   revokeSealedRecord,
   rewrapBodyToDek,
@@ -22,16 +26,18 @@ import {
   rotateRecordCek,
   sealRecordToHost,
   verifyBrokerProof,
+  verifyRecordIdentity,
   writeEnvelopeBody
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-X3AXSYBL.js";
 import {
   buildDeleteMarker,
   buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-ZVAFJQZB.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
@@ -77,7 +83,7 @@ import {
   wrapCek,
   wrapKey
 } from "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -89,6 +95,7 @@ export {
   buildDeleteMarker,
   buildRecordAad,
   buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   buildTombstone,
   computeBidxTarget,
   computeBrokerProof,
@@ -122,6 +129,7 @@ export {
   generateIV,
   generateSalt,
   hasPerRecordKey,
+  hasSealedBody,
   hmacSha256Hex,
   importCek,
   isDeleteMarker,
@@ -134,6 +142,9 @@ export {
   openEnvelopeJson,
   pbkdf2VerifyDigest,
   queryByDet,
+  recordAadFor,
+  rekeyEnvelopeIfNeeded,
+  rekeyEnvelopeToDek,
   resolveStableCek,
   revokeSealedRecord,
   rewrapBodyToDek,
@@ -144,8 +155,9 @@ export {
   unwrapCek,
   unwrapKey,
   verifyBrokerProof,
+  verifyRecordIdentity,
   wrapCek,
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-KDLGVX5Z.js.map
+//# sourceMappingURL=enclave-AOZTWFZK.js.map

package/dist/{executor-LFHRV6JH.js → executor-FRUVM36Q.js}

@@ -1,29 +1,29 @@
 import {
   MaterializedViewExecutor
-} from "./chunk-4DJQU3PH.js";
+} from "./chunk-OCCNYGKG.js";
 import "./chunk-C66T4W5P.js";
-import "./chunk-JU3JKOY5.js";
-import "./chunk-3JQVA527.js";
-import "./chunk-OPGKH5RD.js";
+import "./chunk-EWAGI3EM.js";
+import "./chunk-NFPSC2HL.js";
 import "./chunk-QI2KXQOM.js";
+import "./chunk-LU6NPJWN.js";
 import "./chunk-XZHEOSQ2.js";
 import "./chunk-CADUYBQD.js";
 import "./chunk-IGJCYUT5.js";
-import "./chunk-IQGIPRSE.js";
-import "./chunk-7LLKPODL.js";
-import "./chunk-RVTOCAHQ.js";
-import "./chunk-53PWELSC.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+import "./chunk-CFTPERGL.js";
+import "./chunk-LPAGIMXJ.js";
+import "./chunk-SQSZRCYT.js";
+import "./chunk-FY33DKPH.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=executor-LFHRV6JH.js.map
+//# sourceMappingURL=executor-FRUVM36Q.js.map

package/dist/{export-accessible-HFBJ4JJY.js → export-accessible-HDDHZYPM.js}

@@ -2,17 +2,17 @@ import {
   buildAccessibleBundle,
   exportAccessibleData,
   resolveAccessibleCollections
-} from "./chunk-TWPTRJEU.js";
-import "./chunk-THUITYH7.js";
-import "./chunk-I5OLA3H6.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+} from "./chunk-BBU3OD3D.js";
+import "./chunk-TNOQNU3R.js";
+import "./chunk-O4QDBAB6.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -20,4 +20,4 @@ export {
   exportAccessibleData,
   resolveAccessibleCollections
 };
-//# sourceMappingURL=export-accessible-HFBJ4JJY.js.map
+//# sourceMappingURL=export-accessible-HDDHZYPM.js.map

package/dist/{extract-partition-7ZRFN6QP.js → extract-partition-TRADP234.js}

@@ -6,24 +6,24 @@ import {
   reKeyLedger,
   reKeySchemas,
   sealDeks
-} from "./chunk-MKSTUVMJ.js";
-import "./chunk-NY6RQBUN.js";
-import "./chunk-A3WHDOWI.js";
-import "./chunk-THUITYH7.js";
-import "./chunk-I5OLA3H6.js";
-import "./chunk-YVOW35HH.js";
+} from "./chunk-AMMYIT7F.js";
+import "./chunk-IN5EZWYQ.js";
+import "./chunk-TNOQNU3R.js";
+import "./chunk-O4QDBAB6.js";
+import "./chunk-RAYGDC4A.js";
+import "./chunk-DL4GDOWL.js";
 import "./chunk-4AOERLTV.js";
 import "./chunk-I7FD46FF.js";
-import "./chunk-AMKCY454.js";
-import "./chunk-53PWELSC.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+import "./chunk-FY33DKPH.js";
+import "./chunk-7WD2G6K4.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -35,4 +35,4 @@ export {
   reKeySchemas,
   sealDeks
 };
-//# sourceMappingURL=extract-partition-7ZRFN6QP.js.map
+//# sourceMappingURL=extract-partition-TRADP234.js.map

package/dist/{fanout-sidecar-MT2OBMZB.js → fanout-sidecar-NZA6J7QB.js}

@@ -1,7 +1,10 @@
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+} from "./chunk-X3AXSYBL.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -9,9 +12,7 @@ import "./chunk-LP7BEXCT.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 
@@ -23,7 +24,7 @@ function recordId(source, sourceId, outputKey) {
 async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
   const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
   if (!envelope) return void 0;
-  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson({ collection: "_meta", id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION));
   const parsed = JSON.parse(json);
   if (parsed._noydb_fanout !== 1) return void 0;
   if (!Array.isArray(parsed.keys)) return void 0;
@@ -42,24 +43,14 @@ async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
   const id = recordId(payload.source, payload.sourceId, payload.outputKey);
   const prior = await store.get(vault, "_meta", id);
   const json = JSON.stringify(doc);
+  const version = (prior?._v ?? 0) + 1;
+  const identity = { collection: "_meta", id, version };
   let envelope;
   if (!encrypted) {
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: json
-    };
+    envelope = buildRecordEnvelope(identity, { iv: "", data: json });
   } else {
-    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: iv,
-      _data: data
-    };
+    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity));
+    envelope = buildRecordEnvelope(identity, { iv, data });
   }
   await store.put(vault, "_meta", id, envelope);
 }
@@ -71,4 +62,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-MT2OBMZB.js.map
+//# sourceMappingURL=fanout-sidecar-NZA6J7QB.js.map

package/dist/fanout-sidecar-NZA6J7QB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/forget/index.js

@@ -1,15 +1,15 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-35RIRCGW.js";
-import "../chunk-LTVETWDH.js";
-import "../chunk-6E2JZRBD.js";
+} from "../chunk-KLVGF2D4.js";
+import "../chunk-X3AXSYBL.js";
+import "../chunk-ZVAFJQZB.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-QTDAPDDV.js";
-import "../chunk-SFY6NT7D.js";
+import "../chunk-3Y4OFWQJ.js";
 import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 

package/dist/history/index.js

@@ -1,31 +1,31 @@
 import {
   CollectionInstant,
-  VaultInstant,
+  VaultInstant
+} from "../chunk-CGQUSSW7.js";
+import {
+  diff,
+  formatDiff
+} from "../chunk-SVLR4POP.js";
+import {
+  NO_HISTORY,
   clearHistory,
   getHistory,
   getVersionEnvelope,
+  historyIdentity,
   pruneHistory,
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-T6CCRXD3.js";
-import {
-  diff,
-  formatDiff
-} from "../chunk-SVLR4POP.js";
-import {
-  NO_HISTORY
-} from "../chunk-AFHQATY4.js";
+} from "../chunk-UIYZ5SOU.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-5TF5DUQ5.js";
+} from "../chunk-FDIZHZ3C.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "../chunk-I7FD46FF.js";
-import "../chunk-AMKCY454.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -33,15 +33,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-53PWELSC.js";
-import "../chunk-LTVETWDH.js";
-import "../chunk-6E2JZRBD.js";
+} from "../chunk-FY33DKPH.js";
+import "../chunk-7WD2G6K4.js";
+import "../chunk-X3AXSYBL.js";
+import "../chunk-ZVAFJQZB.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-QTDAPDDV.js";
-import "../chunk-SFY6NT7D.js";
+import "../chunk-3Y4OFWQJ.js";
 import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 
@@ -49,6 +50,7 @@ import "../chunk-PZ5AY32C.js";
 function withHistory() {
   return {
     saveHistory,
+    historyIdentity,
     getHistoryEntries: getHistory,
     getVersionEnvelope,
     pruneHistory,
@@ -89,6 +91,7 @@ export {
   getHistory,
   getVersionEnvelope,
   hashEntry,
+  historyIdentity,
   paddedIndex,
   parseIndex,
   pruneHistory,