@noy-db/hub 0.6.0-pre.17 → 0.6.0-pre.19

package/dist/kernel/enclave/record-keys/envelope-body.d.ts

@@ -13,6 +13,7 @@
  * per-function doc for its oracle call site) — this file introduces no new
  * crypto or semantics, only a narrower door onto what already runs.
  */
+import { type RecordIdentity, type RecordRef } from '../record-aad.js';
 import { type EnclaveKey } from '../crypto.js';
 import type { EncryptedEnvelope } from '../../types.js';
 /**
@@ -27,7 +28,7 @@ import type { EncryptedEnvelope } from '../../types.js';
  *    (the collection DEK), decrypt the body under the unwrapped CEK.
  *  - `env._cek` absent → legacy path, decrypt the body directly under `key`.
  */
-export declare function openEnvelopeJson(env: EncryptedEnvelope, key: EnclaveKey, opts?: {
+export declare function openEnvelopeJson(ref: RecordRef, env: EncryptedEnvelope, key: EnclaveKey, opts?: {
     encrypted?: boolean;
 }): Promise<string>;
 /**
@@ -43,7 +44,7 @@ export declare function openEnvelopeJson(env: EncryptedEnvelope, key: EnclaveKey
  *    generated here rather than supplied by the caller).
  *  - otherwise → legacy path, body encrypted directly under `key`.
  */
-export declare function writeEnvelopeBody(json: string, key: EnclaveKey, opts?: {
+export declare function writeEnvelopeBody(identity: RecordIdentity, json: string, key: EnclaveKey, opts?: {
     encrypted?: boolean;
     perRecordKey?: boolean;
 }): Promise<Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>>;
@@ -85,3 +86,34 @@ export declare function hasPerRecordKey(env: EncryptedEnvelope): boolean;
  * `envelope-body.test.ts`).
  */
 export declare function envelopeBodyForHash(env: EncryptedEnvelope): string;
+/**
+ * Does `env` carry an AEAD-sealed body at all?
+ *
+ * The one question callers outside the enclave legitimately need to ask about
+ * `_iv` — a tombstone and a plaintext-collection record have none, so there is
+ * nothing to authenticate and nothing to re-seal. Both {@link
+ * verifyRecordIdentity} (which treats them as vacuously authentic) and the
+ * merge authority's `advance` (which stamps them without re-sealing) turn on
+ * it, and asking it here keeps `_iv` from leaking back out to the callers —
+ * which `enclave-body-only` refused, correctly, when `advance` tested it inline.
+ */
+export declare function hasSealedBody(env: Pick<EncryptedEnvelope, '_iv'>): boolean;
+/**
+ * Does `env` authenticate at the identity `ref` claims, under `key`? (#1042)
+ *
+ * The merge's fail-closed check, living here because it is envelope surgery:
+ * deciding "is there a sealed body at all" reads `_iv`, which
+ * `enclave-body-only` reserves to this folder. An earlier draft did that test
+ * in `kernel/noydb.ts` and the guard refused it — correctly, since a caller
+ * outside the enclave inspecting protected fields is how envelope knowledge
+ * leaks back out.
+ *
+ * Returns a boolean rather than throwing: `applyRemote` must be able to reject
+ * one poisoned record without halting an entire sync, and a hostile store
+ * would very much like the opposite.
+ *
+ * **A record with no sealed body is vacuously authentic** — a tombstone carries
+ * none, and a plaintext collection has no AEAD to verify. Those are pass-through
+ * by construction, not by omission.
+ */
+export declare function verifyRecordIdentity(ref: RecordRef, env: EncryptedEnvelope, key: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/lifecycle.d.ts

@@ -21,6 +21,7 @@
  */
 import { type EnclaveKey } from '../crypto.js';
 import type { EncryptedEnvelope } from '../../types.js';
+import { type RecordIdentity } from '../record-aad.js';
 import type { Lru } from '../../cache/index.js';
 /** Dependencies {@link resolveStableCek} needs from its collection. */
 export interface StableCekDeps {
@@ -46,15 +47,31 @@ export interface RewrappedBody {
     readonly cek: EnclaveKey | null;
 }
 /**
- * Move a record body from `fromDek` to `toDek`.
+ * Move a record body from `fromDek`/`from` to `toDek`/`to`.
  *
  * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,
  *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The
  *   body key is unchanged → history-chain identity preserved.
  * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`
- *   directly — byte-for-byte the pre-CEK behaviour.
+ *   directly.
+ *
+ * ## Why it takes TWO identities (#1041)
+ *
+ * A rewrap is the one operation where the identity genuinely **changes**. A
+ * tier move rewrites `_tier`; a history snapshot lands at a different
+ * `(collection, id)` entirely. Since AAD binds both, the body must be opened
+ * under the identity it currently has and re-sealed under the one it is moving
+ * to. A single identity would be wrong for one end or the other.
+ *
+ * ⚠️ **This retires an optimisation, deliberately.** Callers used to compute
+ * ONE rewrap and reuse the bytes for both a tier move's live write and its
+ * `_history` snapshot (#728). Those now have different destination identities,
+ * so they need different AAD and therefore different ciphertext — the same
+ * bytes cannot satisfy both. Reusing one rewrap for two destinations is now a
+ * silent corruption, not a saving: it produces a record that opens at one
+ * address and not the other.
  */
-export declare function rewrapBodyToDek(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
+export declare function rewrapBodyToDek(from: RecordIdentity, to: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek' | '_tier' | '_by'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
 /**
  * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping
  * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
@@ -76,7 +93,7 @@ export declare function applyRewrappedBody(envelope: EncryptedEnvelope, body: Re
  * envelope, generalized to any envelope shape (history callers don't bump
  * `_v`/`_ts`/`_tier` the way a tier move does).
  */
-export declare function rewrapEnvelope(envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
+export declare function rewrapEnvelope(identity: RecordIdentity, envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
 /**
  * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under
  * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?
@@ -104,4 +121,4 @@ export declare function rewrapEnvelope(envelope: EncryptedEnvelope, fromDek: Enc
  * those fields themselves, preserving the check-architecture body-access
  * ratchet.
  */
-export declare function isRewrappedUnder(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;
+export declare function isRewrappedUnder(identity: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/record-codec.d.ts

@@ -18,6 +18,7 @@
  */
 import { type EnclaveKey } from '../crypto.js';
 import { type EncryptedEnvelope, type CrdtMode, type CrdtStrategy, type VdigFieldPolicy, type SealedHandle } from '../../types.js';
+import { type RecordIdentity, type RecordRef } from '../record-aad.js';
 import { type StandardSchemaV1 } from '../../schema.js';
 import type { Lru } from '../../cache/index.js';
 import type { ViaCryptoCtx } from '../../via/index.js';
@@ -127,11 +128,9 @@ export declare class RecordCodec<T> {
      * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
      * a SEPARATE timestamp (computed by the caller), so the two never share one.
      */
-    static buildEnvelope(p: {
-        version: number;
+    static buildEnvelope(identity: RecordIdentity, p: {
         iv: string;
         data: string;
-        by?: string;
         cek?: string;
         provenance?: {
             source: string;
@@ -140,10 +139,8 @@ export declare class RecordCodec<T> {
         extra?: Partial<Pick<EncryptedEnvelope, '_tier' | '_det' | '_sealed'>>;
     }): EncryptedEnvelope;
     /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
-    static buildPlaintextEnvelope(p: {
-        version: number;
+    static buildPlaintextEnvelope(identity: RecordIdentity, p: {
         data: string;
-        by?: string;
         provenance?: {
             source: string;
             sourceTs: string;
@@ -157,7 +154,7 @@ export declare class RecordCodec<T> {
      * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
      * would collide with the reserved metadata namespace.
      */
-    buildDebugEnvelope(record: T, version: number, source?: string, sourceTs?: string): EncryptedEnvelope;
+    buildDebugEnvelope(id: string, record: T, version: number, source?: string, sourceTs?: string): EncryptedEnvelope;
     /**
      * Encrypt a JSON body into an envelope.
      *
@@ -167,11 +164,41 @@ export declare class RecordCodec<T> {
      * path encrypts the body directly under the collection DEK — byte-identical
      * to pre-CEK behaviour, so non-adopting collections pay nothing.
      */
-    encryptJsonString(json: string, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string): Promise<EncryptedEnvelope>;
-    encryptRecord(record: T, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string, vdig?: {
+    /**
+     * `ref` is the identity the envelope is sealed against, and it is **the
+     * location the bytes are stored at** — not necessarily this codec's own
+     * collection (#1051).
+     *
+     * That distinction was discovered here rather than assumed. Several callers
+     * put the result somewhere else entirely: search's vector sidecar lands in
+     * `_vec` under `encodeVecId(name, id)`, the lexical index under `_ft/<name>`,
+     * indexing's entries under a synthetic `idxId`. A codec that supplied
+     * `this.ctx.name` for those would seal them against a collection they are not
+     * in, and once AAD binds identity every one of them would fail to verify.
+     *
+     * ⚠️ **`_history` is the open case, and it is #1041's to settle.** Snapshots
+     * are produced with the LIVE record's identity here and then re-homed by
+     * `saveHistory` into `_history/<historyId(collection,id,_v)>`. Both readings
+     * are defensible — bind where it lives, or bind what it is a copy of — and
+     * the choice must be made before AAD is switched on, not inferred from this
+     * migration.
+     */
+    encryptJsonString(ref: RecordRef, json: string, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string): Promise<EncryptedEnvelope>;
+    /**
+     * `ref` is FIRST and required (#1051). It was previously a trailing optional
+     * `id?: string`, which TypeScript cannot promote to required because it sits
+     * after other optionals — so the migration would have needed an `id ?? ''`
+     * fallback. That is exactly the silent default this issue exists to remove:
+     * once identity is bound into the AEAD, every record written with an empty id
+     * binds to the SAME identity and becomes interchangeable with the others.
+     * An object, not a bare string, so a swap with `version`/`source` cannot
+     * compile on the hottest write path. Carries the collection too — see
+     * {@link encryptJsonString} for why the codec must not assume its own.
+     */
+    encryptRecord(ref: RecordRef, record: T, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string, vdig?: {
         readonly id: string;
         readonly prev: EncryptedEnvelope | null;
-    }, id?: string): Promise<EncryptedEnvelope>;
+    }): Promise<EncryptedEnvelope>;
     /**
      * Resolve the per-record CEK for a stored envelope, or `undefined` for a
      * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and
@@ -195,7 +222,14 @@ export declare class RecordCodec<T> {
      * The optional `id` lets reads populate the CEK cache; it is omitted by
      * callers (history, conflict merge) that have only the envelope.
      */
-    decryptJsonString(envelope: EncryptedEnvelope, id?: string): Promise<string | null>;
+    /**
+     * `ref` must be the SAME identity the writer sealed against — which is the
+     * storage address, not necessarily this codec's own collection. Search's
+     * vector sidecar lives in `_vec`, its lexical index in `_ft`; passing
+     * `this.ctx.name` for those would recompute the wrong AAD and fail to open a
+     * perfectly good record (#1041).
+     */
+    decryptJsonString(ref: RecordRef, envelope: EncryptedEnvelope): Promise<string | null>;
     /**
      * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
      * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,
@@ -304,7 +338,7 @@ export declare class RecordCodec<T> {
      * output-recompute path, not the public per-record read surface schema
      * validation guards.
      */
-    decryptRecordAtDek(envelope: EncryptedEnvelope, dek: EnclaveKey, id?: string): Promise<T | null>;
+    decryptRecordAtDek(ref: RecordRef, envelope: EncryptedEnvelope, dek: EnclaveKey): Promise<T | null>;
     /**
      * Decrypt an envelope into a record of type `T`.
      *
@@ -320,9 +354,8 @@ export declare class RecordCodec<T> {
      * that may predate a schema change, so validating it would be a
      * false positive. Every non-history read leaves this flag `false`.
      */
-    decryptRecord(envelope: EncryptedEnvelope, opts?: {
+    decryptRecord(ref: RecordRef, envelope: EncryptedEnvelope, opts?: {
         skipValidation?: boolean;
-        id?: string;
         sealedAsHandles?: boolean;
     }): Promise<T | null>;
 }

package/dist/kernel/enclave/record-keys/rekey.d.ts

@@ -39,7 +39,10 @@ import type { EncryptedEnvelope } from '../../types.js';
  * `envelope` is still under `oldDek`. A resumable rotation must know which side
  * of the migration each record is on before calling.
  */
-export declare function rekeyEnvelopeToDek(envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope>;
+export declare function rekeyEnvelopeToDek(ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope>;
 /**
  * Resumable variant: returns the re-keyed envelope, or `null` when `envelope`
  * is **already** under `newDek` and needs no work (#1074 part 2).
@@ -59,4 +62,7 @@ export declare function rekeyEnvelopeToDek(envelope: EncryptedEnvelope, oldDek:
  * unreadable records would convert a loud failure into permanent silent loss,
  * which is the defect this whole issue is about.
  */
-export declare function rekeyEnvelopeIfNeeded(envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope | null>;
+export declare function rekeyEnvelopeIfNeeded(ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope | null>;

package/dist/kernel/enclave/record-keys/tombstone.d.ts

@@ -16,7 +16,7 @@
  * vault; it calls into these.
  */
 import { type EncryptedEnvelope } from '../../types.js';
-import type { RecordIdentity } from '../record-aad.js';
+import type { RecordRef } from '../record-aad.js';
 /**
  * Shape-only tombstone recognition for layers that have no per-collection
  * context (the sync engine, #590): a tombstone carries an empty `_data` and
@@ -46,7 +46,7 @@ export declare function isTombstone(envelope: EncryptedEnvelope, encrypted: bool
  * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the
  * erasure.
  */
-export declare function buildTombstone(identity: RecordIdentity, version: number, actor: string): EncryptedEnvelope;
+export declare function buildTombstone(ref: RecordRef, version: number, actor: string): EncryptedEnvelope;
 /** #589: is this envelope an ordinary-delete marker (version-ordered, reads as absent)? */
 export declare function isDeleteMarker(envelope: EncryptedEnvelope): boolean;
 /**
@@ -55,4 +55,4 @@ export declare function isDeleteMarker(envelope: EncryptedEnvelope): boolean;
  * keeps the displaced `_v` — so it wins convergence over the pre-delete copy and a
  * re-create can still win over it at a higher version.
  */
-export declare function buildDeleteMarker(identity: RecordIdentity, version: number, actor: string): EncryptedEnvelope;
+export declare function buildDeleteMarker(ref: RecordRef, version: number, actor: string): EncryptedEnvelope;

package/dist/kernel/errors.d.ts

@@ -143,7 +143,23 @@ export declare class DecryptionError extends NoydbError {
  * Treat it as a security alert: the stored bytes are not what NOYDB wrote.
  */
 export declare class TamperedError extends NoydbError {
-    constructor(message?: string);
+    /**
+     * Why the tag check failed, when the enclave could tell (#1103).
+     *
+     * `'unbound-legacy-format'` — the body opens under an EMPTY AAD, so it was
+     * sealed before identity binding (#1041) and this is a format transition, not
+     * an attack. Positive evidence, not a guess: producing a body that decrypts
+     * under this DEK requires the DEK, which an untrusted store does not hold.
+     *
+     * Absent — no benign explanation was found. Treat as the security alert this
+     * error has always been.
+     *
+     * The field is additive and the throw is unchanged, so
+     * `catch (e) { if (e instanceof TamperedError) … }` keeps working; callers
+     * that want to tell a migration from a breach can now read this.
+     */
+    readonly reason?: 'unbound-legacy-format';
+    constructor(message?: string, reason?: 'unbound-legacy-format');
 }
 /**
  * Thrown when key unwrapping fails, typically because the secret is wrong

package/dist/kernel/merge-authority.d.ts

@@ -0,0 +1,25 @@
+import type { MergeAuthority } from '../port/with/merge-authority.js';
+import type { EnclaveKey } from './enclave/index.js';
+/**
+ * ⚠️ **A client cannot verify what it cannot decrypt** — and that boundary is
+ * stated here rather than hidden.
+ *
+ * A record at a tier this caller holds no key for is accepted **unverified**.
+ * Rejecting it would break replication of data the peer legitimately holds but
+ * this client is not cleared to read, converting a confidentiality boundary
+ * into a replication failure. The residue is narrow: envelopes whose key the
+ * client lacks are pass-through, exactly as every envelope was before #1042.
+ *
+ * Closing that residue needs the vault head (#1044), which can detect absence
+ * and substitution without holding the key.
+ */
+export declare function buildMergeAuthority(
+/**
+ * Just the DEK map, not the whole keyring. `port-layering` refused a type
+ * import of `UnlockedKeyring` from `with-party` — correctly, and the narrower
+ * shape is better anyway: this needs to look up keys, not to know what a
+ * keyring is.
+ */
+keyring: {
+    readonly deks: ReadonlyMap<string, EnclaveKey>;
+}): MergeAuthority;

package/dist/kernel/tier-visibility.d.ts

@@ -52,3 +52,18 @@ export declare function assertTierWritable(adapter: NoydbStore, vault: string, n
  * explicit for concurrent writes generally.
  */
 export declare function assertCutoverTierSafe(adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean): Promise<void>;
+/**
+ * The key a collection's DEK is stored under in `UnlockedKeyring.deks` for a
+ * given tier: `collection` at tier 0, `collection#N` above it.
+ *
+ * Lives in the kernel because the `deks` map is a kernel type and the kernel
+ * reads it — `noydb.ts` needs this to resolve the right DEK when verifying a
+ * pulled envelope (#1042). `with-party/team/tiers.ts` re-exports it, so every
+ * existing importer is unchanged; the definition simply moved to the layer that
+ * owns the map rather than one that happens to use it.
+ *
+ * This move was forced by `port-layering`, and rightly: the alternative was the
+ * kernel spine statically importing a `with-*` service, or duplicating the
+ * naming convention in two places where it could drift.
+ */
+export declare function dekKey(collection: string, tier: number): string;

package/dist/kernel/types.d.ts

@@ -34,6 +34,7 @@ import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { TransactionsStrategy } from '../with-commit/tx/strategy.js';
 import type { HistoryStrategy } from '../with-commit/history/strategy.js';
+import type { VaultHeadStrategy } from '../with-commit/vault-head/strategy.js';
 import type { ForgetStrategy } from '../with-audit/forget/strategy.js';
 import type { SnapshotsStrategy } from '../with-fork/snapshots/strategy.js';
 import type { DerivationSkippedFrozen } from './via/dispatch.js';
@@ -2430,6 +2431,13 @@ export interface NoydbOptions {
      * @internal
      */
     readonly historyStrategy?: HistoryStrategy;
+    /**
+     * #1044 — opt in to the vault head, which detects a store that WITHHOLDS.
+     * `withVaultHead()` from `@noy-db/hub/vault-head`. Costs one small write per
+     * commit; on a single-device offline vault it defends against nothing, which
+     * is why it is opt-in while AAD is not.
+     */
+    readonly vaultHeadStrategy?: VaultHeadStrategy;
     /**
      * GDPR right-to-erasure. Pass `withForget({ subjects })`
      * from `@noy-db/hub/forget` to declare which collections carry erasable

package/dist/kernel/vault.d.ts

@@ -745,7 +745,7 @@ export declare class Vault {
      *
      * @internal
      */
-    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string): Promise<unknown>;
+    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string, recordId: string): Promise<unknown>;
     /**
      * Read-only accessor for the invoking keyring's import capability
      * (issue ). UI affordance — returns false in every default-closed

package/dist/kernel/via/index.d.ts

@@ -47,8 +47,17 @@ export interface ViaCryptoCtx {
         delete(field: string): Promise<void>;
     };
     reservedEnvelopes(prefix: string): {
-        encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>;
-        decrypt(collection: string, env: EncryptedEnvelope): Promise<string>;
+        /**
+         * `id` is the record id the envelope will be stored under. Required
+         * (#1051) because this function holds the DEK, so it is where record-identity
+         * AAD is applied — a caller that cannot name the id cannot be bound.
+         */
+        encrypt(identity: {
+            readonly collection: string;
+            readonly id: string;
+            readonly by?: string;
+        }, json: string, v: number): Promise<EncryptedEnvelope>;
+        decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>;
     };
 }
 /** Per-call erase context — `forget()`'s per-ref participation door (phase C). */

package/dist/{ledger-3RDSSMGD.js → ledger-62CEPRPX.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-IEA3TZJE.js";
+} from "./chunk-MNUTPZRQ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-N4GAJSRQ.js";
-import "./chunk-BKYQNNO3.js";
-import "./chunk-RGPB25DB.js";
-import "./chunk-FSZPQCDR.js";
-import "./chunk-HVR74IBG.js";
-import "./chunk-RBTZLXZJ.js";
+} from "./chunk-RNSC2ARR.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-QTDAPDDV.js";
-import "./chunk-5UGEGEIJ.js";
-import "./chunk-I64WQSN3.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LEDGER_COLLECTION,
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-3RDSSMGD.js.map
+//# sourceMappingURL=ledger-62CEPRPX.js.map

package/dist/liberate-7QY7TULB.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-37P5VB4N.js";
+import "./chunk-TC6MBEGH.js";
+import "./chunk-ZPMXYPBR.js";
+import "./chunk-NRNTXBHT.js";
+import "./chunk-2IK6AC6A.js";
+import "./chunk-DYASJSKI.js";
+import "./chunk-E6WANBD6.js";
+import "./chunk-JHO6FGZX.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-7QY7TULB.js.map

package/dist/{link-set-VJIWWUZO.js → link-set-ZRYNUHN3.js}

@@ -1,23 +1,23 @@
 import {
   LinkEndpointError,
   LinkSet
-} from "./chunk-V3OLO4TK.js";
+} from "./chunk-M4IKEOJS.js";
 import {
   LINK_COLLECTION_PREFIX,
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-S6CP5FWF.js";
-import "./chunk-BKYQNNO3.js";
-import "./chunk-RGPB25DB.js";
-import "./chunk-FSZPQCDR.js";
-import "./chunk-HVR74IBG.js";
-import "./chunk-RBTZLXZJ.js";
+} from "./chunk-KBOPY6W2.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-QTDAPDDV.js";
-import "./chunk-5UGEGEIJ.js";
-import "./chunk-I64WQSN3.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LINK_COLLECTION_PREFIX,
@@ -28,4 +28,4 @@ export {
   linkCollectionName,
   linkRowKey
 };
-//# sourceMappingURL=link-set-VJIWWUZO.js.map
+//# sourceMappingURL=link-set-ZRYNUHN3.js.map

package/dist/{managed-secret-XGGJ3BC3.js → managed-secret-T2WB4O47.js}

@@ -9,8 +9,16 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-JAHIL6WO.js";
-import "./chunk-5UGEGEIJ.js";
+} from "./chunk-NRNTXBHT.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MemoryRecipientSealer,
@@ -24,4 +32,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-XGGJ3BC3.js.map
+//# sourceMappingURL=managed-secret-T2WB4O47.js.map

package/dist/materialized-views/index.js

@@ -1,48 +1,48 @@
 import {
   withMaterializedView
-} from "../chunk-K2MR7ROB.js";
+} from "../chunk-APV42WPR.js";
+import {
+  MaterializedViewExecutor
+} from "../chunk-EG6AQBYW.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-SJOK23XT.js";
-import {
-  MaterializedViewExecutor
-} from "../chunk-VQQUOEON.js";
+} from "../chunk-OIIAXFKM.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
   canonicalizeQueryPlan,
   computeQueryHash,
   summarizeQueryPlan
-} from "../chunk-C66T4W5P.js";
-import "../chunk-JU3JKOY5.js";
-import "../chunk-3JQVA527.js";
-import "../chunk-DEP24EE3.js";
+} from "../chunk-5J5TTSGW.js";
+import "../chunk-IPDS2TYW.js";
+import "../chunk-ICCRAPWD.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-QI2KXQOM.js";
+import "../chunk-L6FSZFG7.js";
+import "../chunk-A4K5GLE6.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-CADUYBQD.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-OXRPH6AR.js";
-import "../chunk-7LLKPODL.js";
-import "../chunk-RVTOCAHQ.js";
-import "../chunk-N4GAJSRQ.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+import "../chunk-GYUCRDAU.js";
+import "../chunk-437FDIHO.js";
+import "../chunk-KDX6VEYV.js";
+import "../chunk-RNSC2ARR.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError,
   MaterializedViewTooLargeError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MaterializedViewConfigError,

package/dist/money/index.js

@@ -4,7 +4,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "../chunk-466KGOQB.js";
+} from "../chunk-L2XQ776M.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -13,10 +13,10 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "../chunk-JU3JKOY5.js";
+} from "../chunk-IPDS2TYW.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-RVTOCAHQ.js";
-import "../chunk-I64WQSN3.js";
+import "../chunk-KDX6VEYV.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MoneyCurrencyError,