@noy-db/hub 0.6.0-pre.18 → 0.6.0-pre.19

package/dist/{chunk-NFPSC2HL.js → chunk-ICCRAPWD.js}

@@ -1,15 +1,15 @@
 import {
   dictCollectionName
-} from "./chunk-CFTPERGL.js";
+} from "./chunk-GYUCRDAU.js";
 import {
   getAtPath,
   presentI18nForJoin
-} from "./chunk-LPAGIMXJ.js";
+} from "./chunk-437FDIHO.js";
 import {
   PeriodClosedError,
   UnknownDictCodeError,
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/via/lookup/registry.ts
 function enforceStaticDictOnPut(staticFields, record) {
@@ -487,4 +487,4 @@ export {
   forgetDerivedFanout,
   selfWriteFieldEqual
 };
-//# sourceMappingURL=chunk-NFPSC2HL.js.map
+//# sourceMappingURL=chunk-ICCRAPWD.js.map

package/dist/{chunk-RAYGDC4A.js → chunk-IOURTXTM.js}

@@ -1,16 +1,16 @@
 import {
   assertTierAccess
-} from "./chunk-DL4GDOWL.js";
+} from "./chunk-HTMQBBF3.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-7WD2G6K4.js";
+} from "./chunk-47ZFULEZ.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope,
   buildSealedRecordEnvelope
@@ -26,7 +26,7 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   BlobIntentPendingError,
   BlobOfflineError,
@@ -37,7 +37,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -3057,4 +3057,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-RAYGDC4A.js.map
+//# sourceMappingURL=chunk-IOURTXTM.js.map

package/dist/{chunk-EWAGI3EM.js → chunk-IPDS2TYW.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-IGJCYUT5.js";
 import {
   installViaBinder
-} from "./chunk-SQSZRCYT.js";
+} from "./chunk-KDX6VEYV.js";
 import {
   NoydbError,
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/via/money/iso4217.ts
 var MINOR_UNITS = {
@@ -1044,4 +1044,4 @@ export {
   decodeMoneyFields,
   exactMath
 };
-//# sourceMappingURL=chunk-EWAGI3EM.js.map
+//# sourceMappingURL=chunk-IPDS2TYW.js.map

package/dist/{chunk-ITXPKEDP.js → chunk-JHO6FGZX.js}

@@ -1,19 +1,19 @@
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   ConflictError,
   USER_ENVELOPE_COLLECTION,
   USER_ENVELOPE_MAX_BYTES,
   UserEnvelopeOversizedError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-party/directory/storage.ts
 var META_COLLECTION = "_meta";
@@ -142,4 +142,4 @@ export {
   deleteUserEnvelope,
   listUserEnvelopeIds
 };
-//# sourceMappingURL=chunk-ITXPKEDP.js.map
+//# sourceMappingURL=chunk-JHO6FGZX.js.map

package/dist/{chunk-YDJXGYYA.js → chunk-JIF3IBRK.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCapExceededError,
   DerivationOutputShapeError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-formula/derivations/executor.ts
 var DerivationExecutor = {
@@ -121,4 +121,4 @@ var DerivationExecutor = {
 export {
   DerivationExecutor
 };
-//# sourceMappingURL=chunk-YDJXGYYA.js.map
+//# sourceMappingURL=chunk-JIF3IBRK.js.map

package/dist/{chunk-S6CP5FWF.js → chunk-KBOPY6W2.js}

@@ -1,7 +1,7 @@
 import {
   NoydbError,
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-shape/links/names.ts
 var LINK_COLLECTION_PREFIX = "_links_";
@@ -60,4 +60,4 @@ export {
   linkRowKey,
   LinkIntegrityError
 };
-//# sourceMappingURL=chunk-S6CP5FWF.js.map
+//# sourceMappingURL=chunk-KBOPY6W2.js.map

package/dist/{chunk-SQSZRCYT.js → chunk-KDX6VEYV.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/kernel/via/index.ts
 var binders = /* @__PURE__ */ new Map();
@@ -26,4 +26,4 @@ export {
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-SQSZRCYT.js.map
+//# sourceMappingURL=chunk-KDX6VEYV.js.map

package/dist/{chunk-H545OIWE.js → chunk-KM6YR5XF.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -27,4 +27,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-H545OIWE.js.map
+//# sourceMappingURL=chunk-KM6YR5XF.js.map

package/dist/{chunk-AFSMT3WI.js → chunk-KUXTWVAR.js}

@@ -1,7 +1,7 @@
 import {
   applyJoins,
   splitAroundJoins
-} from "./chunk-QI2KXQOM.js";
+} from "./chunk-L6FSZFG7.js";
 import {
   NO_REDUCE
 } from "./chunk-YMUFFJCO.js";
@@ -18,7 +18,7 @@ import {
   CrossJoinTooLargeError,
   DanglingReferenceError,
   FieldNotQueryableError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/kernel/query/live.ts
 function buildLiveQuery(recompute, upstreams) {
@@ -1574,4 +1574,4 @@ export {
   executePlan,
   ScanBuilder
 };
-//# sourceMappingURL=chunk-AFSMT3WI.js.map
+//# sourceMappingURL=chunk-KUXTWVAR.js.map

package/dist/{chunk-2NE7ILO7.js → chunk-L2XQ776M.js}

@@ -4,7 +4,7 @@ import {
   formatScaledInt,
   parseToScaledInt,
   rescaleScaledInt
-} from "./chunk-EWAGI3EM.js";
+} from "./chunk-IPDS2TYW.js";
 
 // src/via/money/arith.ts
 function parseAmount(label, amount, scale, rounding) {
@@ -120,4 +120,4 @@ export {
   isMoneyString,
   moneyNumber
 };
-//# sourceMappingURL=chunk-2NE7ILO7.js.map
+//# sourceMappingURL=chunk-L2XQ776M.js.map

package/dist/{chunk-QI2KXQOM.js → chunk-L6FSZFG7.js}

@@ -4,7 +4,7 @@ import {
 import {
   DanglingReferenceError,
   JoinTooLargeError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/kernel/query/join.ts
 var DEFAULT_JOIN_MAX_ROWS = 5e4;
@@ -186,4 +186,4 @@ export {
   applyJoins,
   resetJoinWarnings
 };
-//# sourceMappingURL=chunk-QI2KXQOM.js.map
+//# sourceMappingURL=chunk-L6FSZFG7.js.map

package/dist/{chunk-BVIGGV6D.js → chunk-LAFP5H5U.js}

@@ -9,14 +9,14 @@ import {
   mintKeyringCanary,
   persistKeyring,
   readKeyringFile
-} from "./chunk-ZSOTZ2RZ.js";
+} from "./chunk-E6WANBD6.js";
 import {
   dekKey
-} from "./chunk-7WD2G6K4.js";
+} from "./chunk-47ZFULEZ.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
@@ -30,7 +30,7 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   NOYDB_KEYRING_VERSION
 } from "./chunk-3Y4OFWQJ.js";
@@ -43,7 +43,7 @@ import {
   RecoveryProfileNotImplementedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/port/with/team-strategy.ts
 var NO_TEAM = {
@@ -924,4 +924,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-BVIGGV6D.js.map
+//# sourceMappingURL=chunk-LAFP5H5U.js.map

package/dist/{chunk-ZDATYUYG.js → chunk-LBDTQM3R.js}

@@ -8,14 +8,14 @@ import {
   rotateKeys,
   verifyPrompt,
   verifyTypedEcho
-} from "./chunk-ZSOTZ2RZ.js";
+} from "./chunk-E6WANBD6.js";
 import {
   NoAccessError,
   NoydbError,
   ValidationError,
   WrongEchoError,
   WrongPromptError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-party/team/echo-ceremony.ts
 async function beginEchoUnlock(store, vault, opts) {
@@ -114,4 +114,4 @@ export {
   MemoryDeviceSealProvider,
   withTeam
 };
-//# sourceMappingURL=chunk-ZDATYUYG.js.map
+//# sourceMappingURL=chunk-LBDTQM3R.js.map

package/dist/{chunk-2ION5ZRH.js → chunk-M4IKEOJS.js}

@@ -1,20 +1,20 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-S6CP5FWF.js";
+} from "./chunk-KBOPY6W2.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   NoydbError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -130,4 +130,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-2ION5ZRH.js.map
+//# sourceMappingURL=chunk-M4IKEOJS.js.map

package/dist/{chunk-5NKSNW25.js → chunk-MNMYHZVU.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-5NKSNW25.js.map
+//# sourceMappingURL=chunk-MNMYHZVU.js.map

package/dist/{chunk-FDIZHZ3C.js → chunk-MNUTPZRQ.js}

@@ -7,21 +7,21 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-FY33DKPH.js";
+} from "./chunk-RNSC2ARR.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   LedgerContentionError,
   isConflictError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-commit/history/ledger/patch.ts
 function computePatch(prev, next) {
@@ -699,4 +699,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-FDIZHZ3C.js.map
+//# sourceMappingURL=chunk-MNUTPZRQ.js.map

package/dist/{chunk-DWO55ZWE.js → chunk-MQXYR65M.js}

@@ -1,18 +1,18 @@
 import {
   installViaBinder
-} from "./chunk-SQSZRCYT.js";
+} from "./chunk-KDX6VEYV.js";
 import {
   buildRecordAad
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/via/blob/binding.ts
 async function eraseBlobs(ctx, cfg) {
@@ -391,4 +391,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-DWO55ZWE.js.map
+//# sourceMappingURL=chunk-MQXYR65M.js.map

package/dist/{chunk-6QCXMCLZ.js → chunk-N2HKBESK.js}

@@ -1,13 +1,13 @@
 import {
   installViaBinder
-} from "./chunk-SQSZRCYT.js";
+} from "./chunk-KDX6VEYV.js";
 import {
   SealedHandle
 } from "./chunk-3Y4OFWQJ.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/via/classified/descriptor.ts
 function isClassifiedFieldSpec(x) {
@@ -262,4 +262,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-6QCXMCLZ.js.map
+//# sourceMappingURL=chunk-N2HKBESK.js.map

package/dist/{chunk-HNOBRU24.js → chunk-N7YAQKAO.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-HNOBRU24.js.map
+//# sourceMappingURL=chunk-N7YAQKAO.js.map

package/dist/{chunk-6U7M7AX6.js → chunk-NH2MST6J.js}

@@ -1,7 +1,7 @@
 import {
   NonAdditiveSchemaChangeError,
   SchemaLockedError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-shape/schema-update/strategies.ts
 function blindUpdate() {
@@ -62,4 +62,4 @@ export {
   lockSchema,
   coordinatedCutover
 };
-//# sourceMappingURL=chunk-6U7M7AX6.js.map
+//# sourceMappingURL=chunk-NH2MST6J.js.map

package/dist/{chunk-A5QQKWCK.js → chunk-NYSD43OE.js}

@@ -4,13 +4,13 @@ import {
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -66,4 +66,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-A5QQKWCK.js.map
+//# sourceMappingURL=chunk-NYSD43OE.js.map

package/dist/{chunk-Q67P7S2I.js → chunk-ODVIFBAQ.js}

@@ -2,21 +2,21 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-3ODOWQMV.js";
+} from "./chunk-ZBDWKPBW.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-audit/attestation/revoke.ts
 import { signRevocationList } from "@noy-db/attestation";
@@ -81,4 +81,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-Q67P7S2I.js.map
+//# sourceMappingURL=chunk-ODVIFBAQ.js.map

package/dist/{chunk-AIZNLHKN.js → chunk-OIIAXFKM.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-X3AXSYBL.js";
+} from "./chunk-D5UDZANO.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-FRUVM36Q.js"));
+var loadMVExecutor = lazy(() => import("./executor-SHUVRZUJ.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-AIZNLHKN.js.map
+//# sourceMappingURL=chunk-OIIAXFKM.js.map

package/dist/{chunk-FSZPQCDR.js → chunk-OQLYMBJI.js}

@@ -2,10 +2,10 @@ import {
   base64ToBuffer,
   decryptBytesWithAAD,
   encryptBytesWithAAD
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   TamperedError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/kernel/enclave/classify/compare.ts
 var subtle = globalThis.crypto.subtle;
@@ -92,4 +92,4 @@ export {
   openVdigPayload,
   evaluateKofN
 };
-//# sourceMappingURL=chunk-FSZPQCDR.js.map
+//# sourceMappingURL=chunk-OQLYMBJI.js.map

package/dist/{chunk-JYFJNSTW.js → chunk-OWGEHDT2.js}

@@ -5,7 +5,7 @@ import {
   buildStringFieldEntries,
   extractSnippet,
   searchScan
-} from "./chunk-DFFSCYIW.js";
+} from "./chunk-5JT4Y5UE.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
@@ -13,14 +13,14 @@ import {
   getAtPath,
   isStaticDictDescriptor,
   stripI18nFilled
-} from "./chunk-LPAGIMXJ.js";
+} from "./chunk-437FDIHO.js";
 import {
   liveRecordIsElevated
-} from "./chunk-7WD2G6K4.js";
+} from "./chunk-47ZFULEZ.js";
 import {
   EmbeddingDimMismatchError,
   EmbeddingModelMismatchError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-lookup/embeddings/cosine.ts
 function cosine(a, b) {
@@ -394,4 +394,4 @@ export {
   rebuildEmbeddings,
   syncTierSearch
 };
-//# sourceMappingURL=chunk-JYFJNSTW.js.map
+//# sourceMappingURL=chunk-OWGEHDT2.js.map

package/dist/{chunk-I64WQSN3.js → chunk-P7L3OQLL.js}

@@ -35,9 +35,26 @@ var DecryptionError = class extends NoydbError {
   }
 };
 var TamperedError = class extends NoydbError {
-  constructor(message = "Data integrity check failed \u2014 record may have been tampered with") {
+  /**
+   * Why the tag check failed, when the enclave could tell (#1103).
+   *
+   * `'unbound-legacy-format'` — the body opens under an EMPTY AAD, so it was
+   * sealed before identity binding (#1041) and this is a format transition, not
+   * an attack. Positive evidence, not a guess: producing a body that decrypts
+   * under this DEK requires the DEK, which an untrusted store does not hold.
+   *
+   * Absent — no benign explanation was found. Treat as the security alert this
+   * error has always been.
+   *
+   * The field is additive and the throw is unchanged, so
+   * `catch (e) { if (e instanceof TamperedError) … }` keeps working; callers
+   * that want to tell a migration from a breach can now read this.
+   */
+  reason;
+  constructor(message = "Data integrity check failed \u2014 record may have been tampered with", reason) {
     super("TAMPERED", message);
     this.name = "TamperedError";
+    if (reason !== void 0) this.reason = reason;
   }
 };
 var InvalidKeyError = class extends NoydbError {
@@ -1698,4 +1715,4 @@ export {
   ClassifiedRotationError,
   SatelliteConfigError
 };
-//# sourceMappingURL=chunk-I64WQSN3.js.map
+//# sourceMappingURL=chunk-P7L3OQLL.js.map