@noy-db/hub 0.6.0-pre.23 → 0.6.0-pre.24

package/dist/index.js

@@ -1,20 +1,20 @@
 import {
   LinkEndpointError
-} from "./chunk-JO4MRPEY.js";
+} from "./chunk-65WBEFVT.js";
 import {
   persistSchemaIfNeeded
-} from "./chunk-AZPPARMG.js";
+} from "./chunk-K6J7JKZM.js";
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-ZYG4UWHF.js";
+} from "./chunk-25HI46CB.js";
 import {
   WithdrawalRequestError,
   approveWithdrawal,
   listWithdrawalRequests,
   rejectWithdrawal,
   requestWithdrawal
-} from "./chunk-FNCX4N7X.js";
+} from "./chunk-MGIAYREB.js";
 import {
   applyListProjection
 } from "./chunk-VG2ZSFYD.js";
@@ -24,7 +24,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "./chunk-GNSLP7KA.js";
+} from "./chunk-BZKQRED6.js";
 import {
   COVER_FIELDS,
   DEFAULT_COVER_SCHEMA,
@@ -35,7 +35,7 @@ import {
   blindUpdate,
   coordinatedCutover,
   lockSchema
-} from "./chunk-BNGGSNO7.js";
+} from "./chunk-PU5PNTE2.js";
 import "./chunk-ZVF37PKE.js";
 import {
   DEFAULT_FRESHNESS_MS,
@@ -44,33 +44,33 @@ import {
   checkGate,
   describeGate,
   mergePolicy
-} from "./chunk-RTKREHPV.js";
+} from "./chunk-ESP4K32V.js";
 import "./chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "./chunk-6W3BZCW6.js";
+} from "./chunk-CDHX3SRW.js";
 import {
   classified,
   luhnCheck
-} from "./chunk-7W765AVV.js";
+} from "./chunk-ZI43U6FN.js";
 import {
   decryptExtractedPartition,
   diffVault,
   withCargo
-} from "./chunk-UWRVDBDC.js";
-import "./chunk-SIACMXFK.js";
+} from "./chunk-LU2HAOVP.js";
+import "./chunk-RTBCWDJ3.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "./chunk-ISRAQIYY.js";
+} from "./chunk-PZEDIO72.js";
 import {
   withdrawAccessibleData
-} from "./chunk-I3D67XD7.js";
+} from "./chunk-576CTQ77.js";
 import {
   exportAccessibleData
-} from "./chunk-7LWBD3NO.js";
+} from "./chunk-35K4VWMD.js";
 import {
   routeStore,
   withCache,
@@ -84,15 +84,15 @@ import {
 import {
   withDerivation,
   withRollup
-} from "./chunk-5MU7PUNA.js";
-import "./chunk-RGUAY5IX.js";
-import "./chunk-M2KVSM43.js";
+} from "./chunk-KC3S3OH6.js";
+import "./chunk-S447GUNV.js";
+import "./chunk-MLTGIDNB.js";
 import {
   withMaterializedView
-} from "./chunk-3ZOER5GD.js";
-import "./chunk-LIWA5ROZ.js";
-import "./chunk-L5PTLL7A.js";
-import "./chunk-LPVZDTQF.js";
+} from "./chunk-YZWRJRMF.js";
+import "./chunk-34MSA4AO.js";
+import "./chunk-ZJJ46LNY.js";
+import "./chunk-FEWCVAFV.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -101,16 +101,16 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "./chunk-KF34JCIJ.js";
+} from "./chunk-2ZSBPXFW.js";
 import {
   withOverlayedView
-} from "./chunk-GAZTPQ3D.js";
-import "./chunk-ZA3RBGT3.js";
+} from "./chunk-2MYYXXVM.js";
+import "./chunk-LTC77D4V.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "./chunk-JXFQEOAQ.js";
+} from "./chunk-HMS3OCMA.js";
 import {
   isDiscriminant
 } from "./chunk-PY4KJPYU.js";
@@ -121,7 +121,7 @@ import {
   signRedirect,
   verifyRedirect,
   wrapPodStore
-} from "./chunk-J2KGT2A5.js";
+} from "./chunk-G3ZMEUWD.js";
 import {
   Collection,
   ELEVATION_AUDIT_COLLECTION,
@@ -140,73 +140,73 @@ import {
   refArray,
   via,
   withArchive
-} from "./chunk-ZILONQGE.js";
+} from "./chunk-VZHEFFUO.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName
-} from "./chunk-B3X6S37C.js";
-import "./chunk-CJU3KXHJ.js";
-import "./chunk-C7B3XUI4.js";
+} from "./chunk-HWJZCZSI.js";
+import "./chunk-NKND2IMW.js";
+import "./chunk-YIC34H3M.js";
 import {
   deriveSchemaManifest,
   loadSchemaManifestEntry
-} from "./chunk-JMN3I4OC.js";
+} from "./chunk-WN377AAV.js";
 import {
   MANIFEST_COLLECTION,
   isManifestReservedCollection
 } from "./chunk-EPFF7LOX.js";
-import "./chunk-DZBZCFS7.js";
+import "./chunk-XCNYOVFV.js";
 import "./chunk-GYGLAVCX.js";
-import "./chunk-FFSQFH6D.js";
+import "./chunk-DNKVKO7K.js";
 import "./chunk-KHKKD62N.js";
 import {
   derivePersistedSchema,
   isZodSchema
-} from "./chunk-2QN6NPV6.js";
+} from "./chunk-PORGC5MH.js";
 import "./chunk-6LJY7X5A.js";
 import "./chunk-Y2NBBT6K.js";
-import "./chunk-D5DZ4R7X.js";
+import "./chunk-ICGLT356.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "./chunk-ZLU3IWHK.js";
-import "./chunk-UW5YKCE4.js";
-import "./chunk-R6BGN6IY.js";
+} from "./chunk-E2LYQUB7.js";
+import "./chunk-L34HKPIS.js";
+import "./chunk-PRBJ4BJD.js";
 import {
   NO_CARGO
-} from "./chunk-WBFJZCDJ.js";
+} from "./chunk-GCTZNHDO.js";
 import {
   MemoryRecipientSealer,
   MemorySealingKeyProvider,
   aesGcmOpen,
   parseRsaOaepTlv,
   sealRsaOaepTlv
-} from "./chunk-OTHHO3KI.js";
+} from "./chunk-S2I5MYSA.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema,
   savePersistedSchema
-} from "./chunk-SZFNO7L4.js";
+} from "./chunk-AKPIBKHK.js";
 import {
   NO_SEQUENCE,
   SequenceStore,
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "./chunk-G4577GK7.js";
+} from "./chunk-2S6HROLU.js";
 import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "./chunk-WG66ZPEV.js";
-import "./chunk-ATSIGJRX.js";
+} from "./chunk-KEMD6B3W.js";
+import "./chunk-ODGV6Q6U.js";
 import {
   buildLookupSnapshot
-} from "./chunk-6ZN6X2LW.js";
-import "./chunk-O2A5YCFF.js";
+} from "./chunk-HUAAYTVS.js";
+import "./chunk-ENTVT7PF.js";
 import {
   INDEXED_STORE_POLICY,
   POD_STORE_POLICY,
@@ -214,25 +214,25 @@ import {
 } from "./chunk-T7IR4N2S.js";
 import {
   CONSENT_AUDIT_COLLECTION
-} from "./chunk-7DRKK5FQ.js";
+} from "./chunk-SP3AFEB7.js";
 import "./chunk-PEOZ34EM.js";
-import "./chunk-CWYTN4IK.js";
+import "./chunk-C4DFJ76X.js";
 import "./chunk-GHVIKOHT.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-VXH5Z22C.js";
+} from "./chunk-OQT3G55N.js";
 import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "./chunk-6G4NORTR.js";
+} from "./chunk-4Y7VHLCT.js";
 import "./chunk-JK733I5V.js";
-import "./chunk-DEKA2MV3.js";
-import "./chunk-2DHEBIJA.js";
+import "./chunk-2D5NXYWY.js";
+import "./chunk-OJYLLNQN.js";
 import {
   CollectionFrame,
   VaultFrame
-} from "./chunk-Z6UMKUAI.js";
+} from "./chunk-MXJMCTSI.js";
 import "./chunk-SMY5X46Z.js";
 import "./chunk-DZFQVICS.js";
 import {
@@ -250,7 +250,7 @@ import {
   verifyPodHeader,
   verifyRecord,
   writePod
-} from "./chunk-XXONVJWA.js";
+} from "./chunk-DM2BZDNV.js";
 import {
   COVER_RECORD_ID,
   isCover,
@@ -258,39 +258,39 @@ import {
   readCover,
   saveCover,
   validateCoverInput
-} from "./chunk-5FRZ7YYU.js";
+} from "./chunk-TTGZ6KGY.js";
 import {
   TxCollection,
   TxContext,
   TxVault,
   runTransaction
-} from "./chunk-LBDG6FHB.js";
+} from "./chunk-VZEBHQRT.js";
 import "./chunk-5D2ALSM5.js";
 import {
   NO_SEARCH,
   tokenize,
   withSearch
-} from "./chunk-VNPSPQNN.js";
+} from "./chunk-ACIEKVFR.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
-import "./chunk-WBRLSPA7.js";
+import "./chunk-JSJS7RHS.js";
 import {
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   Query,
   ScanBuilder,
   buildLiveQuery,
   executePlan
-} from "./chunk-DRVF2YS5.js";
+} from "./chunk-6J7SSCJW.js";
 import {
   DEFAULT_JOIN_MAX_ROWS,
   applyJoins
-} from "./chunk-YNWBBHQK.js";
+} from "./chunk-NUHIPODK.js";
 import {
   importExternalObjects,
   memoryObjectProjection
 } from "./chunk-4Q6HSHHL.js";
-import "./chunk-TA67ZQUH.js";
+import "./chunk-FKLKAO2C.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -307,8 +307,8 @@ import {
   getIntent,
   isPreCompressed,
   sweepBlobIntents
-} from "./chunk-BYX3AUXH.js";
-import "./chunk-4UZDDS4S.js";
+} from "./chunk-24ZDSTEQ.js";
+import "./chunk-DL7NXFAY.js";
 import {
   CollectionIndexes
 } from "./chunk-I3ISCYT7.js";
@@ -320,7 +320,7 @@ import {
   estimateRecordBytes,
   parseBytes
 } from "./chunk-NO272T7Q.js";
-import "./chunk-DXJXVWWE.js";
+import "./chunk-264AKW4K.js";
 import "./chunk-XZHEOSQ2.js";
 import "./chunk-YMUFFJCO.js";
 import "./chunk-ATL3ZVXT.js";
@@ -334,16 +334,16 @@ import {
   resolveCrdtSnapshot
 } from "./chunk-4GPE63GU.js";
 import "./chunk-PVEWA2DU.js";
-import "./chunk-DG4KFJNA.js";
+import "./chunk-DBPQUICN.js";
 import {
   dictKey,
   staticDict
-} from "./chunk-22VRCUV2.js";
+} from "./chunk-M3XEJJDE.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "./chunk-KKVVBFKW.js";
+} from "./chunk-HUDP5NSI.js";
 import {
   applyI18nLocale,
   enforceScript,
@@ -358,15 +358,15 @@ import {
   resolvePolicy,
   setAtPathInPlace,
   validateI18nTextValue
-} from "./chunk-U5ZDYJLQ.js";
+} from "./chunk-IYXP6OR5.js";
 import {
   installViaBinder
-} from "./chunk-LZHIYH32.js";
+} from "./chunk-6PLCNLBC.js";
 import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "./chunk-PFHF3A72.js";
+} from "./chunk-2CURJCLC.js";
 import {
   MAGIC_LINK_GRANTS_COLLECTION,
   NO_TEAM,
@@ -395,13 +395,13 @@ import {
   unwrapDeksFromPaperEntry,
   unwrapMagicLinkGrant,
   writeMagicLinkGrant
-} from "./chunk-66X4XWTM.js";
+} from "./chunk-NFARMKWK.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-3ENNPCIW.js";
+} from "./chunk-ZY6P7M52.js";
 import {
   DEFAULT_ECHO_MIN_WORD_LENGTH,
   DEFAULT_ECHO_PROMPT_MIN_WORDS,
@@ -425,7 +425,7 @@ import {
   validateSecret,
   verifyPrompt,
   verifyTypedEcho
-} from "./chunk-AK6EWGDO.js";
+} from "./chunk-YEEV4ZXL.js";
 import {
   DIRECTORY_RECORD_ID,
   VISIBILITY_RECORD_PREFIX,
@@ -439,9 +439,9 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "./chunk-GJ5TMHKC.js";
-import "./chunk-3UIS6O6N.js";
-import "./chunk-LYQUFIHL.js";
+} from "./chunk-SQWXF2HP.js";
+import "./chunk-57MEX4LL.js";
+import "./chunk-K7HPGV5K.js";
 import {
   PolicyEnforcer,
   activeSessionCount,
@@ -456,7 +456,7 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "./chunk-RBBTJ2HY.js";
+} from "./chunk-H6J6MZ4J.js";
 import "./chunk-VKQCVU2Z.js";
 import {
   generateULID,
@@ -465,17 +465,17 @@ import {
 import {
   CollectionInstant,
   VaultInstant
-} from "./chunk-ZKZXS352.js";
+} from "./chunk-4P3OG2AO.js";
 import {
   diff,
   formatDiff
 } from "./chunk-SVLR4POP.js";
-import "./chunk-7ZPAL3F7.js";
+import "./chunk-LG2P6S32.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-OGB2UTBC.js";
+} from "./chunk-FJGNYSB3.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -487,23 +487,23 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-YLIGPHN4.js";
-import "./chunk-6ZTPSVY7.js";
+} from "./chunk-GU5XWSH4.js";
+import "./chunk-NSZGZYZL.js";
 import "./chunk-HK67PX4J.js";
-import "./chunk-TWELPVXG.js";
+import "./chunk-LT26SRU5.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   recordAadFor,
   validateSchemaInput,
   validateSchemaOutput
-} from "./chunk-FUE2KPKM.js";
+} from "./chunk-43FOH2OK.js";
 import {
   buildRecordEnvelope
-} from "./chunk-PENPHA45.js";
-import "./chunk-OMXUQAZJ.js";
-import "./chunk-PUGHLCBW.js";
-import "./chunk-2LHPMFSR.js";
+} from "./chunk-FX3UIDCS.js";
+import "./chunk-NK7DO6A2.js";
+import "./chunk-AM6V36AG.js";
+import "./chunk-AU45F5FD.js";
 import "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
@@ -514,7 +514,7 @@ import {
   encrypt,
   encryptBytes,
   encryptDeterministic
-} from "./chunk-RQQIB7CD.js";
+} from "./chunk-D7STIWJO.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION,
@@ -522,7 +522,7 @@ import {
   NOYDB_SYNC_VERSION,
   SealedHandle,
   createStore
-} from "./chunk-IGNJOJEP.js";
+} from "./chunk-UJ4Z67UQ.js";
 import {
   AlreadyElevatedError,
   AmendmentForbiddenError,
@@ -666,7 +666,7 @@ import {
   WrongEchoError,
   WrongPromptError,
   isConflictError
-} from "./chunk-HKANJAOP.js";
+} from "./chunk-5OFC3QYL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-commit/numbering/descriptor.ts

package/dist/indexing/index.js

@@ -8,12 +8,12 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-4UZDDS4S.js";
+} from "../chunk-DL7NXFAY.js";
 import {
   CollectionIndexes
 } from "../chunk-I3ISCYT7.js";
 import "../chunk-NSITFOCJ.js";
-import "../chunk-HKANJAOP.js";
+import "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/indexing/active.ts

package/dist/introspection/index.js

@@ -1,24 +1,24 @@
 import {
   dumpVaultSchema
-} from "../chunk-L374ZR75.js";
+} from "../chunk-UHFF4G53.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import {
   jsonSchemaToFields
 } from "../chunk-KHKKD62N.js";
-import "../chunk-2QN6NPV6.js";
+import "../chunk-PORGC5MH.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-SZFNO7L4.js";
-import "../chunk-FUE2KPKM.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-OMXUQAZJ.js";
-import "../chunk-PUGHLCBW.js";
-import "../chunk-2LHPMFSR.js";
+import "../chunk-AKPIBKHK.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-RQQIB7CD.js";
-import "../chunk-IGNJOJEP.js";
-import "../chunk-HKANJAOP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
+import "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   applyListProjection,

package/dist/issue-LV2IWCKY.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-C3FCXXNI.js";
+import "./chunk-Z45PK2H5.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-43FOH2OK.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-NK7DO6A2.js";
+import "./chunk-AM6V36AG.js";
+import "./chunk-AU45F5FD.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-D7STIWJO.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-5OFC3QYL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-LV2IWCKY.js.map

package/dist/kernel/constants.d.ts

@@ -34,3 +34,21 @@ export declare const USER_ENVELOPE_COLLECTION = "_users";
  * `rotateKeys` refuses to rotate it — see the guard there for why.
  */
 export declare const ROSTER_KEY_ID = "_roster";
+/**
+ * Vault-lifetime blob CONTENT-ADDRESSING root (#1126). A keyring DEK slot like
+ * `_roster`, and like it **never rotated** — `rotateKeys` refuses it by name.
+ *
+ * That refusal is the whole point: the blob eTag is an HMAC keyed by this root
+ * (domain-separated per tier), so keying it by the rotating `_blob` DEK made
+ * every pre-rotation address permanently wrong. Rotation now re-keys chunk
+ * bodies while addresses stay put.
+ *
+ * The residual it accepts, stated so nobody has to rediscover it: a revoked
+ * member who kept this key retains a CONFIRMATION ORACLE — given plaintext they
+ * already hold, they can recompute an address and test whether the vault still
+ * stores those bytes. They cannot read anything: chunk bodies are under DEKs
+ * that DO rotate. That is the trade a rotation-invariant address makes, and it
+ * is the one the alternative (re-addressing during rotation) avoids at the cost
+ * of rewriting every chunk and index row on every revocation.
+ */
+export declare const BLOB_ADDRESS_KEY_ID = "_blob_addr";

package/dist/kernel/enclave/crypto.d.ts

@@ -172,6 +172,34 @@ export declare function sha256Hex(data: Uint8Array): Promise<string>;
  * so an attacker with store access cannot pre-compute eTags for known files.
  * Deduplication still works within a vault (same key + same content = same eTag).
  */
+/**
+ * Derive the blob CONTENT-ADDRESSING key for one tier (#1126).
+ *
+ * The blob eTag is an HMAC over the plaintext. It used to be keyed by the
+ * `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation
+ * `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it,
+ * permanently. `decryptResponse()` checks that unconditionally, so the
+ * presigned-URL read path raised `TamperedError` on legitimate data forever;
+ * dedup also split, minting a second address for identical bytes.
+ *
+ * The fix is a `root` that rotation never touches (`_blob_addr`, refused by
+ * `rotateKeys` exactly as `_roster` is). Rotation then re-keys chunk BODIES
+ * while every address stays stable, which is what makes the AAD
+ * `{eTag}:{i}:{count}` and every `_blob_index` / `_blob_slots_*` /
+ * `_blob_versions_*` row survive it untouched.
+ *
+ * **Derived PER TIER, deliberately.** A single vault-wide address would make an
+ * elevated blob and a tier-0 blob with identical content share an eTag,
+ * leaking equality across a boundary the tier system exists to enforce — and
+ * `rehomeForTier` re-addresses on a tier move precisely because the address is
+ * tier-scoped today. Domain separation keeps that property while removing the
+ * rotation coupling: the two are independent axes, and only one of them was
+ * ever meant to change the address.
+ *
+ * Same HKDF idiom as `asKwKey`, with its own salt so the addressing key can
+ * never coincide with a wrapping or encryption key.
+ */
+export declare function deriveBlobAddressKey(root: CryptoKey, tier: number): Promise<CryptoKey>;
 export declare function hmacSha256Hex(key: CryptoKey, data: Uint8Array): Promise<string>;
 /**
  * Encrypt raw bytes with AES-256-GCM using Additional Authenticated Data.

package/dist/kernel/enclave/index.d.ts

@@ -56,13 +56,13 @@
  * enclave supports every group, so it never throws this error.
  */
 export type { EnclaveKey, EncryptResult } from './crypto.js';
-export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, } from './crypto.js';
+export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, deriveBlobAddressKey, } from './crypto.js';
 export { deriveKey, deriveSecretKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, encodeEchoParts, deriveEchoKey, } from './crypto.js';
 export type { SecretKeyUsage } from './crypto.js';
 export type { EchoSecretParts } from './crypto.js';
 export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
 export type { RewrappedBody } from './record-keys/lifecycle.js';
-export { rekeyEnvelopeToDek, rekeyEnvelopeIfNeeded } from './record-keys/rekey.js';
+export { rekeyEnvelopeToDek, rekeyEnvelopeIfNeeded, envelopeOpensUnderAny } from './record-keys/rekey.js';
 export { rekeyBlobSet } from './record-keys/rekey-blob.js';
 export { buildRecordEnvelope, buildSealedRecordEnvelope } from './record-envelope.js';
 export type { RecordEnvelopeBody } from './record-envelope.js';

package/dist/kernel/enclave/record-keys/rekey.d.ts

@@ -66,3 +66,26 @@ export declare function rekeyEnvelopeIfNeeded(ref: {
     readonly collection: string;
     readonly id: string;
 }, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope | null>;
+/**
+ * Does this envelope open under ANY of `keys`? A read-only probe — decrypts
+ * nothing into a caller-visible value and writes nothing.
+ *
+ * Exists so a rotation can tell *"this envelope belongs to a DIFFERENT DEK slot
+ * the caller also holds"* from *"this envelope is damaged"* (#1125). Those two
+ * look identical from a failed `rekeyEnvelopeIfNeeded`, and collapsing them
+ * either aborts a legitimate rotation or walks past unreadable data.
+ *
+ * **The question is deliberately asked of the KEY, not of the envelope's claimed
+ * `_tier`.** `_tier` is unencrypted — the store writes it — so routing a
+ * rotation on it would let a store mark a tier-0 record `_tier: 5` and have the
+ * rotation skip it, leaving a revoked member's DEK live on real data. That is
+ * #1115's defect wearing a different hat. A key either opens the body or it does
+ * not, and a store cannot forge that.
+ *
+ * Mirrors `rekeyBlobSet`'s `otherDeks` treatment, which asks the same question
+ * about the same kind of ambiguity.
+ */
+export declare function envelopeOpensUnderAny(ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: EncryptedEnvelope, keys: readonly EnclaveKey[]): Promise<boolean>;