@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.20

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-7NXHMW6Y.js";
+} from "../chunk-7RCZ436O.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-MSWYQLMQ.js";
+} from "../chunk-PG6PFMDC.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-PRDRGL73.js";
+} from "../chunk-GYUCRDAU.js";
 import {
   NO_I18N,
   applyI18nLocale,
@@ -26,17 +26,17 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-7G6VDWXB.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-VW6ZZGCG.js";
-import "../chunk-VN45YLWM.js";
-import "../chunk-NWCGDAV6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-437FDIHO.js";
+import "../chunk-KDX6VEYV.js";
+import "../chunk-RNSC2ARR.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-W5W6KHN2.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -47,7 +47,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/i18n/densify.ts

package/dist/index.d.ts

@@ -71,10 +71,10 @@
  * @packageDocumentation
  */
 import './kernel/env-check.js';
-export type { Role, Permission, Permissions, EncryptedEnvelope, KeyringAuthenticator, KeyringAuthenticatorWrappingKEK, KeyringAuthenticatorWrappingDEKs, VaultPolicyOnDisk, VaultSnapshot, NoydbStore, ListPageResult, KeyringFile, VaultBackup, DirtyEntry, SyncMetadata, Conflict, ErasureEnforcement, ConflictStrategy, ConflictPolicy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncTransactionResult, SyncStatus, ChangeEvent, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, NoydbOptions, HistoryConfig, HistoryOptions, HistoryEntry, PruneOptions, PutManyItemOptions, PutManyOptions, PutManyResult, DeleteManyResult, ExportStreamOptions, ExportChunk, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, SessionPolicy, ReAuthOperation, PlaintextTranslatorContext, PlaintextTranslatorFn, TranslatorAuditEntry, ExportCapability, ExportFormat, ImportCapability, } from './kernel/types.js';
+export type { Role, Permission, Permissions, EncryptedEnvelope, KeyringAuthenticator, KeyringAuthenticatorWrappingKEK, KeyringAuthenticatorWrappingDEKs, VaultPolicyOnDisk, VaultSnapshot, NoydbStore, ListPageResult, KeyringFile, VaultBackup, DirtyEntry, SyncMetadata, Conflict, ErasureEnforcement, ConflictStrategy, ConflictPolicy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncTransactionResult, SyncStatus, SyncTargetStatus, ChangeEvent, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, NoydbOptions, HistoryConfig, HistoryOptions, HistoryEntry, PruneOptions, PutManyItemOptions, PutManyOptions, PutManyResult, DeleteManyResult, ExportStreamOptions, ExportChunk, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, SessionPolicy, ReAuthOperation, PlaintextTranslatorContext, PlaintextTranslatorFn, TranslatorAuditEntry, ExportCapability, ExportFormat, ImportCapability, } from './kernel/types.js';
 export { NOYDB_FORMAT_VERSION, NOYDB_KEYRING_VERSION, NOYDB_BACKUP_VERSION, NOYDB_SYNC_VERSION, createStore, } from './kernel/types.js';
 export type { StoreAuthKind, StoreAuth, StoreCapabilities, StoreCredentials, StoreCredentialSource, } from './kernel/types.js';
-export type { NoydbPodStore, NoydbBundleStore, BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from './kernel/types.js';
+export type { NoydbPodStore, BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from './kernel/types.js';
 export { BlobSet } from './with-shape/blobs/blob-set.js';
 export { memoryObjectProjection } from './with-shape/blobs/object-projection.js';
 export type { ObjectProjection, ObjectMeta, ObjectListEntry, PutObjectOptions, ObjectUrlOptions, PutUrlOptions, } from './with-shape/blobs/object-projection.js';
@@ -85,8 +85,8 @@ export { detectMimeType, detectMagic, isPreCompressed } from './with-shape/blobs
 export { BLOB_INTENT_COLLECTION, getIntent, createIntent, deleteIntent, sweepBlobIntents, } from './with-shape/blobs/blob-intent.js';
 export type { BlobIntent, BlobIntentHold, BlobIntentResume } from './with-shape/blobs/blob-intent.js';
 export { BlobIntentPendingError, BlobOfflineError } from './kernel/errors.js';
-export { wrapPodStore, createPodStore, wrapBundleStore, createBundleStore } from './with-pod/pod-store.js';
-export type { WrappedPodNoydbStore, WrapPodStoreOptions, WrappedBundleNoydbStore, WrapBundleStoreOptions, } from './with-pod/pod-store.js';
+export { wrapPodStore, createPodStore } from './with-pod/pod-store.js';
+export type { WrappedPodNoydbStore, WrapPodStoreOptions, } from './with-pod/pod-store.js';
 export type { WriteQueue } from './kernel/write-queue.js';
 export type { WriteEvent, WriteHook } from './port/with/write-hooks.js';
 /** #841 — the option shape `vault.collection()` takes, so callers can name it. */
@@ -105,14 +105,14 @@ export type { SchemaDelta, FieldChange, UpdateContext, UpdateDecision, SchemaUpd
 export { blindUpdate, additiveOnly, lockSchema, coordinatedCutover } from './with-shape/schema-update/index.js';
 export type { FenceState, FenceDoc } from './with-shape/schema-update/fence.js';
 export type { SyncPolicy, PushPolicy, PullPolicy, PushMode, PullMode, SyncSchedulerStatus, ReadinessState } from './kernel/sync-policy.js';
-export { SyncScheduler, INDEXED_STORE_POLICY, POD_STORE_POLICY, BUNDLE_STORE_POLICY } from './kernel/sync-policy.js';
+export { SyncScheduler, INDEXED_STORE_POLICY, POD_STORE_POLICY } from './kernel/sync-policy.js';
 export type { SyncTarget, SyncTargetInfo, SyncTargetRole } from './kernel/types.js';
 export { memoryStore } from './kernel/memory-store.js';
 export { routeStore } from './with-store/route-store.js';
 export type { RouteStoreOptions, RoutedNoydbStore, BlobStoreRoute, AgeRoute, BlobLifecyclePolicy, OverrideTarget, OverrideOptions, SuspendOptions, RouteStatus, } from './with-store/route-store.js';
 export { wrapStore, withRetry, withLogging, withMetrics, withCircuitBreaker, withCache, withHealthCheck } from './with-store/store-middleware.js';
 export type { StoreMiddleware, RetryOptions, LoggingOptions, LogLevel, MetricsOptions, StoreOperation, CircuitBreakerOptions, StoreCacheOptions, HealthCheckOptions, } from './with-store/store-middleware.js';
-export { NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, PermissionDeniedError, PrivilegeEscalationError, StoreCapabilityError, UnknownStoreKindError, DuplicateStoreKindError, ConflictError, isConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, GroupCardinalityError, BackupLedgerError, BackupCorruptedError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, ElevationExpiredError, AlreadyElevatedError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, SequenceNotEnabledError, BundleIntegrityError, BundleSealMismatchError, PodVersionConflictError, BundleVersionConflictError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, ExportCapabilityError, ImportCapabilityError, KeyringExpiredError, ReadOnlyAtInstantError, ReadOnlyFrameError, RecordLockedError, FieldFrozenError, IllegalTransitionError, InvariantError, AmendmentForbiddenError, AttestationError, AttestationNotEnabledError, ClassifiedNotEnabledError, TiersNotEnabledError, PortabilityNotEnabledError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, } from './kernel/errors.js';
+export { NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, PermissionDeniedError, PrivilegeEscalationError, StoreCapabilityError, UnknownStoreKindError, DuplicateStoreKindError, ConflictError, isConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, GroupCardinalityError, BackupLedgerError, BackupCorruptedError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, ElevationExpiredError, AlreadyElevatedError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, SequenceNotEnabledError, PodIntegrityError, PodSealMismatchError, PodVersionConflictError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, ExportCapabilityError, ImportCapabilityError, KeyringExpiredError, ReadOnlyAtInstantError, ReadOnlyFrameError, RecordLockedError, FieldFrozenError, IllegalTransitionError, InvariantError, AmendmentForbiddenError, AttestationError, AttestationNotEnabledError, ClassifiedNotEnabledError, TiersNotEnabledError, PortabilityNotEnabledError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, } from './kernel/errors.js';
 export { SnapshotNotFoundError } from './kernel/errors.js';
 export type { SnapshotMeta, RetentionPolicy } from './with-fork/snapshots/strategy.js';
 export { withArchive } from './with-fork/archive/index.js';
@@ -130,21 +130,21 @@ export { STATE_VAULT_NAME } from './kernel/constants.js';
 export { UnknownShardError, ShardProvisioningError, VaultTemplateNotFoundError, ReservedVaultNameError, DataResidencyError } from './kernel/errors.js';
 export { ForgetStrategyNotConfiguredError } from './kernel/errors.js';
 export { SealedRecordExpiredError, SealedRecordMismatchError, RecordCekNotFoundError, SealedRecordNotEnabledError } from './kernel/errors.js';
-export { writePod, readPod, readPodHeader, writeNoydbBundle, readNoydbBundle, readNoydbBundleHeader, verifyPodHeader, } from './with-pod/bundle.js';
+export { writePod, readPod, readPodHeader, verifyPodHeader, } from './with-pod/pod.js';
 export { exportAccessibleData } from './with-audit/portability/export-accessible.js';
 export type { ExportAccessibleOptions } from './with-audit/portability/export-accessible.js';
 export { withdrawAccessibleData } from './with-audit/portability/withdraw-accessible.js';
 export type { WithdrawAccessibleOptions, WithdrawResult, FrozenSnapshotRef } from './with-audit/portability/withdraw-accessible.js';
 export { requestWithdrawal, listWithdrawalRequests, approveWithdrawal, rejectWithdrawal, WithdrawalRequestError, } from './with-audit/portability/request-withdrawal.js';
 export type { RequestWithdrawalOptions, RequestWithdrawalResult, WithdrawalRequest, WithdrawalRequestStatus, ApproveWithdrawalOptions, RejectWithdrawalOptions, } from './with-audit/portability/request-withdrawal.js';
-export type { NoydbPodHeader, NoydbBundleHeader, CompressionAlgo, UnlockMethod, } from './with-pod/format.js';
-export type { WritePodOptions, WriteNoydbBundleOptions, ReadNoydbBundleOptions, NoydbBundleReadResult, AutoCredentialKind, AutoCredential, PodVerifyResult, } from './with-pod/bundle.js';
-export { NOYDB_BUNDLE_MAGIC, NOYDB_BUNDLE_PREFIX_BYTES, NOYDB_BUNDLE_FORMAT_VERSION, hasNoydbBundleMagic, } from './with-pod/format.js';
+export type { NoydbPodHeader, CompressionAlgo, UnlockMethod, } from './with-pod/format.js';
+export type { WritePodOptions, ReadPodOptions, PodReadResult, AutoCredentialKind, AutoCredential, PodVerifyResult, } from './with-pod/pod.js';
+export { NOYDB_POD_MAGIC, NOYDB_POD_PREFIX_BYTES, NOYDB_POD_FORMAT_VERSION, hasNoydbPodMagic, } from './with-pod/format.js';
 export { generateULID, isULID } from './with-pod/ulid.js';
 export { signRecord, verifyRecord, signedBytes, POD_SIG_ALG } from './with-pod/signature.js';
 export { decryptExtractedPartition } from './with-cargo/decrypt-partition.js';
 export type { DecryptedRecord } from './with-cargo/decrypt-partition.js';
-export { readPodRedirect } from './with-pod/bundle.js';
+export { readPodRedirect } from './with-pod/pod.js';
 export { signRedirect, verifyRedirect, followRedirects } from './with-pod/redirect.js';
 export type { Redirect, RedirectHop, FollowRedirectsResult } from './with-pod/redirect.js';
 export type { DocSigner } from './with-audit/attestation/signer.js';
@@ -181,6 +181,7 @@ export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions,
 export { QuickUnlockStore } from './with-party/session/unlock-state.js';
 export type { QuickUnlockState } from './with-party/session/unlock-state.js';
 export { rotateSecret as keyringRotateSecret } from './with-party/team/rotate-recover.js';
+export { recoverSecret as keyringRecoverSecret } from './with-party/team/rotate-recover.js';
 export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './with-party/team/rotate-recover.js';
 export { buildEchoBlock, verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './with-party/team/echo-secret.js';
 export type { EchoRevealChoice } from './with-party/team/echo-secret.js';
@@ -194,7 +195,7 @@ export type { EchoRecipientSecret } from './with-party/team/keyring.js';
 export { EchoCeremonyRequiredError, WrongPromptError, WrongEchoError } from './kernel/errors.js';
 export { loadCover, saveCover, readCover, resolveSchema as resolveCoverSchema, validateCoverInput, isCover, COVER_FIELDS, DEFAULT_COVER_SCHEMA, COVER_RECORD_ID, } from './with-party/directory/cover/index.js';
 export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, SetCoverInput, } from './with-party/directory/cover/index.js';
-export { readPodCover } from './with-pod/bundle.js';
+export { readPodCover } from './with-pod/pod.js';
 export { USER_ENVELOPE_COLLECTION, USER_ENVELOPE_MAX_BYTES, } from './kernel/constants.js';
 export { UserEnvelopeOversizedError } from './kernel/errors.js';
 export { loadUserEnvelope, saveUserEnvelope, deleteUserEnvelope, listUserEnvelopeIds, } from './with-party/directory/user-envelope/index.js';
@@ -227,7 +228,7 @@ export { recoverUser } from './with-party/team/peer-recover.js';
 export type { RecoverUserOptions } from './with-party/team/peer-recover.js';
 export { hasExportCapability, evaluateExportCapability } from './with-party/team/keyring.js';
 export { hasImportCapability, evaluateImportCapability } from './with-party/team/keyring.js';
-export type { BundleRecipient } from './with-party/team/keyring.js';
+export type { PodRecipient } from './with-party/team/keyring.js';
 export { buildRecipientKeyringFile } from './with-party/team/keyring.js';
 export { listUsers, listUsersWithEnvelopes } from './with-party/team/keyring.js';
 export type { ListUsersOptions } from './with-party/team/keyring.js';
@@ -276,8 +277,8 @@ export { dictKey, isDictKeyDescriptor, staticDict, isStaticDictDescriptor, isDic
 export type { DictKeyDescriptor, StaticDictDescriptor, DictEntry, DictionaryOptions, } from './via/i18n/dictionary.js';
 export { i18nText, isI18nTextDescriptor, validateI18nTextValue, resolveI18nText, applyI18nLocale, } from './via/i18n/core.js';
 export type { I18nTextOptions, I18nTextDescriptor, ResolveI18nOptions, I18nMap } from './via/i18n/core.js';
-export { money, isMoneyDescriptor, MoneyPrecisionError, MoneyCurrencyError, MoneyUnsupportedError, scaleForCurrency, mulRate, allocate, asMoney, isMoneyString, moneyNumber, } from './via/money/index.js';
-export type { MoneyDescriptor, MoneyOptions, MoneyOptionsFixed, MoneyOptionsMulti, RoundingMode, FxRates, MulRateOptions, AllocateOptions, MoneyString, } from './via/money/index.js';
+export { money, isMoneyDescriptor, MoneyPrecisionError, MoneyCurrencyError, MoneyUnsupportedError, scaleForCurrency, mulRate, allocate, asMoney, isMoneyString, moneyNumber, exactMath, } from './via/money/index.js';
+export type { MoneyDescriptor, MoneyOptions, MoneyOptionsFixed, MoneyOptionsMulti, RoundingMode, FxRates, MulRateOptions, AllocateOptions, MoneyString, ExactMath, ExactOperand, } from './via/money/index.js';
 export { via, isViaFieldSpec } from './kernel/via/compose.js';
 export type { ViaFieldSpec } from './kernel/via/compose.js';
 export type { ViaPosture, ViaDescriptor } from './kernel/via/index.js';
@@ -305,6 +306,22 @@ export type { SessionToken, CreateSessionResult, CreateSessionOptions, } from '.
 export { enableDevUnlock, loadDevUnlock, clearDevUnlock, isDevUnlockActive, } from './with-party/session/dev-unlock.js';
 export type { DevUnlockOptions } from './with-party/session/dev-unlock.js';
 export { isDiscriminant } from './kernel/util/discriminant.js';
+/**
+ * Record-identity AAD (#1041) — **public because a raw DEK is no longer enough
+ * to read a record.**
+ *
+ * Every record body is sealed with additional authenticated data derived from
+ * `{collection, id, _tier, _by}`, so a holder of a delegated DEK — a magic-link
+ * grantee, an `at-*` host, external tooling reading a backup — must be able to
+ * reproduce it. Without this export a delegated key opens nothing, which would
+ * silently break delegation rather than merely inconvenience it.
+ *
+ * `recordAadFor(address, envelope)` is the reader's form: it takes the address
+ * the envelope was fetched from and reads `_tier`/`_by` off the envelope
+ * itself, so callers thread two fields rather than four.
+ */
+export { recordAadFor } from './kernel/enclave/index.js';
+export type { RecordIdentity, RecordRef } from './kernel/enclave/index.js';
 export { bufferToBase64, base64ToBuffer, encryptBytes, decryptBytes } from './kernel/enclave/index.js';
 export { encryptDeterministic, decryptDeterministic } from './kernel/enclave/index.js';
 export { EnclaveNotSupportedError } from './kernel/errors.js';