@noy-db/hub 0.6.0-pre.8 → 0.6.0

package/dist/kernel/types.d.ts

@@ -34,6 +34,7 @@ import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { TransactionsStrategy } from '../with-commit/tx/strategy.js';
 import type { HistoryStrategy } from '../with-commit/history/strategy.js';
+import type { VaultHeadStrategy } from '../with-commit/vault-head/strategy.js';
 import type { ForgetStrategy } from '../with-audit/forget/strategy.js';
 import type { SnapshotsStrategy } from '../with-fork/snapshots/strategy.js';
 import type { DerivationSkippedFrozen } from './via/dispatch.js';
@@ -71,7 +72,7 @@ export type { EchoSecretParts };
 /** Format version for encrypted record envelopes. */
 export declare const NOYDB_FORMAT_VERSION: 1;
 /** Format version for keyring files. */
-export declare const NOYDB_KEYRING_VERSION: 1;
+export declare const NOYDB_KEYRING_VERSION: 2;
 /** Format version for backup files. */
 export declare const NOYDB_BACKUP_VERSION: 1;
 /** Format version for sync metadata. */
@@ -908,6 +909,21 @@ export interface KeyringFile {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Record<string, string>;
+    /**
+     * DEKs for a rotation that has STARTED but not committed (#1074).
+     *
+     * `rotateKeys` persists the new DEK here *before* rewriting any record, so an
+     * interruption can never strand records under a key that was only ever in
+     * memory. On commit these move into `deks` and this is cleared.
+     *
+     * Present on disk ⇒ a rotation was interrupted and the collection may hold
+     * records on both sides of the migration. Re-running `rotateKeys` resumes
+     * with this key rather than minting a fresh one.
+     *
+     * Optional: absent on every keyring written before this existed, and absent
+     * in the normal committed state.
+     */
+    readonly pending_deks?: Record<string, string>;
     readonly salt: string;
     readonly created_at: string;
     readonly granted_by: string;
@@ -915,17 +931,31 @@ export interface KeyringFile {
      * Secret canary — base64 AES-KW-wrapped form of a known constant
      * 256-bit value, wrapped under the keyring's KEK.
      *
-     * Optional: older keyrings load with no canary and fall back to
-     * the multi-DEK corruption heuristic. Newer keyrings
-     * carry one and let `loadKeyring` distinguish wrong-secret
-     * from corruption even when ALL DEKs (including a single-DEK keyring's
-     * sole DEK) are corrupted.
+     * Lets `loadKeyring` distinguish wrong-secret from corruption even when
+     * ALL DEKs (including a single-DEK keyring's sole DEK) are corrupted: the
+     * canary unwrapping proves the KEK correct independent of any DEK byte.
      *
      * AES-KW is deterministic — every write site mints fresh on each
      * persist; same KEK + same constant input always produces the same
      * ciphertext, so this round-trips without state.
+     *
+     * REQUIRED as of #1096 (no-legacy policy): the pre-canary fallback
+     * heuristic is deleted, so an absent canary is not an old file, it is a
+     * store that stripped the field — `KeyringTamperedError('canary-missing')`.
+     */
+    readonly canary: string;
+    /**
+     * #1096 — AES-GCM({iv,data}) of the canonical authority fields
+     * (user_id, role, permissions, granted_by, expires_at, capabilities)
+     * under the vault roster key (carried as `deks[ROSTER_KEY_ID]`).
+     * Required: a valid canary with a missing or mismatching tag is refused
+     * as KeyringTamperedError — absence must itself be an error, or a store
+     * opts out of verification by deleting a plaintext field.
      */
-    readonly canary?: string;
+    readonly roster_tag: {
+        readonly iv: string;
+        readonly data: string;
+    };
     /**
      * Tier-2 authenticator slots (multi-slot keyring extension).
      * Optional / append-only: keyring files written before the
@@ -956,7 +986,7 @@ export interface KeyringFile {
      * "this slot works for 30 days then becomes opaque to its holder."
      *
      * Absent on live keyrings written via `db.grant()` — the field is
-     * meaningful for `BundleRecipient` slots produced by
+     * meaningful for `PodRecipient` slots produced by
      * `writePod({ recipients: [...] })`. Setting it on a live
      * keyring is allowed but unusual.
      */
@@ -1284,9 +1314,38 @@ export interface SyncTransactionResult {
 }
 export interface SyncStatus {
     readonly dirty: number;
+    /**
+     * ISO 8601 timestamp of the last push that completed with **no errors**, or
+     * `null` if none ever has (#1036). A failed attempt does not advance it — so
+     * this answers "when did my data last reach the remote?", which is the reading
+     * the name invites and the one the field previously did not honour.
+     */
     readonly lastPush: string | null;
+    /** As {@link SyncStatus.lastPush}, for pulls: last pull that had no errors. */
     readonly lastPull: string | null;
+    /**
+     * Whether the **browser** reports network connectivity — driven solely by the
+     * global `online`/`offline` events (#1034). It is NOT target reachability: an
+     * unreachable store never flips it, and losing Wi-Fi flips it for every target
+     * at once. To detect a failing target, read {@link SyncStatus.lastError}.
+     */
     readonly online: boolean;
+    /**
+     * The failure that ended the most recent push/pull, cleared by the next
+     * success (#1036). **Absent** when nothing has failed since the last success —
+     * so `lastPush: null` with no `lastError` means "never synced", while
+     * `lastPush` set plus a `lastError` means "synced then, failing since".
+     *
+     * Live state, not persisted: a reload cannot know whether the target still
+     * fails, so it starts absent until the next attempt says otherwise.
+     */
+    readonly lastError?: {
+        /** ISO 8601 timestamp of the failed attempt. */
+        readonly at: string;
+        readonly op: 'push' | 'pull';
+        /** Message of the first error the attempt collected. */
+        readonly message: string;
+    };
     /**
      * Per-collection readiness under a `'phased'` pull policy (#809). **Absent**
      * for every other policy, and a collection the sequence never names is absent
@@ -1329,6 +1388,41 @@ export interface SyncTarget {
  * (#948). Deliberately omits any preset *name* — a resolved `SyncPolicy` doesn't
  * retain which preset (if any) it came from, so only its push/pull mode is surfaced.
  */
+/**
+ * Per-target sync state (#1034). `syncStatus()` answers for the vault as a
+ * whole; this answers per target, which is what a redundant topology needs in
+ * order to say "the LAN store is unavailable — syncing via the cloud" rather
+ * than just "something is wrong".
+ *
+ * Deliberately carries **no `online` flag.** `SyncStatus.online` reflects the
+ * *browser's* global connectivity — it is set only by the `online`/`offline`
+ * window events and no store outcome ever changes it, so every engine flips at
+ * once for the same reason. Exposing it per target would make a global signal
+ * look per-target: a status list would appear to update row by row while every
+ * row actually moved together. Per-target *reachability* derived from real
+ * store outcomes is a separate, still-unbuilt thing.
+ */
+export interface SyncTargetStatus {
+    /** As registered. `undefined` when the target was declared without one. */
+    readonly label: string | undefined;
+    readonly role: SyncTargetRole;
+    /** Pending local writes for this target. */
+    readonly dirty: number;
+    /** Last push that completed with no errors, or `null`. See {@link SyncStatus.lastPush}. */
+    readonly lastPush: string | null;
+    /** Last pull that completed with no errors, or `null`. */
+    readonly lastPull: string | null;
+    /**
+     * Nothing queued for this target — `dirty === 0`.
+     *
+     * Well-defined for every role: for a `sync-peer` it means the two sides
+     * agree as of the last exchange; for a push-only `backup` it means every
+     * local write has reached it. It is a statement about the *outbound* queue
+     * only, and says nothing about whether the target holds data this client has
+     * not pulled.
+     */
+    readonly caughtUp: boolean;
+}
 export interface SyncTargetInfo {
     readonly label: string | undefined;
     readonly role: SyncTargetRole;
@@ -1544,7 +1638,6 @@ export interface UpdateUserOptions {
 }
 export interface RevokeOptions {
     readonly userId: string;
-    readonly rotateKeys?: boolean;
     /**
      * Cascade behavior when the revoked user is an admin who has granted
      * other admins.
@@ -1868,10 +1961,10 @@ export interface CrdtStrategy {
  * that operate on whole-vault bundles rather than per-record KV.
  *
  * Implement `readBundle` / `writeBundle` instead of the six-method KV
- * contract. Use `wrapBundleStore()` from `@noy-db/hub` to convert to a
+ * contract. Use `wrapPodStore()` from `@noy-db/hub` to convert to a
  * `NoydbStore` that the rest of the API consumes transparently.
  *
- * Named `NoydbPodStore` (not `NoydbBundleAdapter`) for consistency
+ * Named `NoydbPodStore` for consistency
  * with the hub / to-* / in-* rename. Concrete implementations ship
  * in `@noy-db/to-*` packages starting in.
  */
@@ -1907,8 +2000,6 @@ export interface NoydbPodStore {
         size: number;
     }>>;
 }
-/** @deprecated Use `NoydbPodStore`. */
-export type NoydbBundleStore = NoydbPodStore;
 /**
  * Content-addressed blob object stored in the vault-level blob index.
  * Identified by HMAC-SHA-256(blobDEK, plaintext) — opaque to the store.
@@ -2354,6 +2445,13 @@ export interface NoydbOptions {
      * @internal
      */
     readonly historyStrategy?: HistoryStrategy;
+    /**
+     * #1044 — opt in to the vault head, which detects a store that WITHHOLDS.
+     * `withVaultHead()` from `@noy-db/hub/vault-head`. Costs one small write per
+     * commit; on a single-device offline vault it defends against nothing, which
+     * is why it is opt-in while AAD is not.
+     */
+    readonly vaultHeadStrategy?: VaultHeadStrategy;
     /**
      * GDPR right-to-erasure. Pass `withForget({ subjects })`
      * from `@noy-db/hub/forget` to declare which collections carry erasable

package/dist/kernel/vault.d.ts

@@ -6,7 +6,7 @@ import type { IssueDelegationOptions, DelegationToken } from '../with-party/team
 import { Collection } from './collection.js';
 import type { JoinableSource } from './query/index.js';
 import type { OnDirtyCallback } from './collection.js';
-import type { UnlockedKeyring, BundleRecipient } from '../with-party/team/keyring.js';
+import type { UnlockedKeyring, PodRecipient } from '../with-party/team/keyring.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
 import type { MaterializedViewStrategy } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewRegistry } from '../with-formula/overlay-views/registry.js';
@@ -29,7 +29,7 @@ import { type ForgetResult } from '../with-audit/forget/strategy.js';
 import { type SubjectRef } from '../with-audit/forget/subject-index.js';
 import type { VaultFrame } from '../with-fork/shadow/vault-frame.js';
 import type { ConsentContext, ConsentAuditEntry, ConsentAuditFilter, ConsentOp } from '../with-audit/consent/consent.js';
-import { type PeriodScope, type PeriodGuardPrior } from '../with-audit/periods/vault-facade.js';
+import { type PeriodScope, type PeriodGuardPrior, type ReopenPeriodOptions, type PeriodScopeWithReason } from '../with-audit/periods/vault-facade.js';
 import { type RefDescriptor, type RefViolation } from './refs.js';
 import type { DictionaryHandle, DictionaryOptions } from '../port/with/i18n-strategy.js';
 import { type LinkSpec, type LinkSetHandle } from '../with-shape/links/names.js';
@@ -42,7 +42,7 @@ import type { DerivationRegistry } from '../with-formula/derivations/registry.js
 import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import { type BehaviorSummary } from '../with-shape/introspection/behaviors.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
-import { type PeriodRecord, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
+import { type PeriodRecord, type PeriodReopenEvent, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
 import { type EnclaveKey } from './enclave/index.js';
 import type { RecipientSealer } from '../with-party/team/managed-secret.js';
 import { type ExportBlobsOptions, type ExportBlobsHandle } from '../with-shape/blobs/export-blobs.js';
@@ -336,7 +336,7 @@ export declare class Vault {
      * unblocks R-S7 when a base gains forget coverage after its satellite was
      * already declared without `perRecordKeys`. Call BEFORE re-declaring with
      * `{ satelliteOf, perRecordKeys: true }` AND before this collection serves
-     * writes (unfenced walk — see {@link migrateSatelliteCek}); resumable.
+     * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
      */
     migrateSatellitePerRecordKeys(satelliteName: string): Promise<{
         migrated: number;
@@ -574,7 +574,7 @@ export declare class Vault {
      *
      * @public
      */
-    buildBundleRecipientKeyrings(recipients: readonly BundleRecipient[]): Promise<Record<string, KeyringFile>>;
+    buildBundleRecipientKeyrings(recipients: readonly PodRecipient[]): Promise<Record<string, KeyringFile>>;
     /**
      * Authorize an `@noy-db/as-*` export against the current keyring's
      * `exportCapability`. Throws `ExportCapabilityError` if
@@ -745,7 +745,7 @@ export declare class Vault {
      *
      * @internal
      */
-    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string): Promise<unknown>;
+    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string, recordId: string): Promise<unknown>;
     /**
      * Read-only accessor for the invoking keyring's import capability
      * (issue ). UI affordance — returns false in every default-closed
@@ -1267,6 +1267,12 @@ export declare class Vault {
      * companion and is re-runnable.
      */
     purgePeriodTargets(name: string, options?: PeriodScope): Promise<PeriodRecord>;
+    /** Return a closed period to writable (#1022); logged append-only, close chain untouched. */
+    reopenPeriod(name: string, options?: ReopenPeriodOptions): Promise<PeriodRecord>;
+    /** Seal a reopened period again (#1022) rather than waiting for its `until` to lapse. */
+    reclosePeriod(name: string, options?: PeriodScopeWithReason): Promise<PeriodRecord>;
+    /** The append-only reopen/reclose log for one period (#1022), in order. */
+    listPeriodReopens(name: string, options?: PeriodScope): Promise<readonly PeriodReopenEvent[]>;
     /** @internal — called by the gate bus before put/delete. */
     _assertTsWritable(existing: PeriodGuardPrior | null, incoming: Record<string, unknown> | null, collection?: string): Promise<void>;
     /** List all collection names in this vault. */
@@ -1342,12 +1348,12 @@ export declare class Vault {
      * distinct handles, which is the right behavior — they're
      * separate vault instances now.
      */
-    getBundleHandle(): Promise<string>;
+    getPodHandle(): Promise<string>;
     /**
      * Read the owner-curated cover for this vault (or `undefined` if
      * none is persisted). The cover lives in `_meta/public-envelope`
      * (the frozen wire name) as plaintext — readable without any KEK
-     * — so `getBundleHandle`-style callers can label a vault before
+     * — so `getPodHandle`-style callers can label a vault before
      * unlock.
      *
      * Mirrors `Noydb.getCover(vault, opts)` but scoped to a

package/dist/kernel/via/index.d.ts

@@ -47,8 +47,17 @@ export interface ViaCryptoCtx {
         delete(field: string): Promise<void>;
     };
     reservedEnvelopes(prefix: string): {
-        encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>;
-        decrypt(collection: string, env: EncryptedEnvelope): Promise<string>;
+        /**
+         * `id` is the record id the envelope will be stored under. Required
+         * (#1051) because this function holds the DEK, so it is where record-identity
+         * AAD is applied — a caller that cannot name the id cannot be bound.
+         */
+        encrypt(identity: {
+            readonly collection: string;
+            readonly id: string;
+            readonly by?: string;
+        }, json: string, v: number): Promise<EncryptedEnvelope>;
+        decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>;
     };
 }
 /** Per-call erase context — `forget()`'s per-ref participation door (phase C). */

package/dist/kernel/via/reconcile.d.ts

@@ -38,6 +38,7 @@ import type { Collection } from '../collection.js';
 import { type HasWritableViaPipeline } from './pipeline.js';
 import { type MergedViaFields } from './compose.js';
 import type { ViaGraph } from './graph.js';
+import type { RefDescriptor } from '../refs.js';
 import { type I18nStrategy, type I18nTextDescriptor, type DictKeyDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../port/with/i18n-strategy.js';
 import { type LookupDescriptor } from '../../port/with/lookup-strategy.js';
 type AnyCollection = Collection<Record<string, unknown>>;
@@ -56,6 +57,8 @@ export interface ReconcilableCollection extends HasWritableViaPipeline {
     _applyFieldMeta(fieldMeta: Parameters<AnyCollection['_applyFieldMeta']>[0]): void;
     _applyMeta(meta: Parameters<AnyCollection['_applyMeta']>[0]): void;
     _applyClassifiedFields(classifiedFields: Parameters<AnyCollection['_applyClassifiedFields']>[0]): void;
+    /** #1141 — refresh the outbound-ref snapshot after a late `refs` declaration. */
+    _attachDeclaredRefs(refs: Parameters<AnyCollection['_attachDeclaredRefs']>[0]): void;
     /** #671 items 1-3 — the reader + writer seam for `getDictionary`/legacy describe() lists/`presentForJoin`. */
     readonly _viaFieldsSnapshot: AnyCollection['_viaFieldsSnapshot'];
     _reconcileReadState(patch: Parameters<AnyCollection['_reconcileReadState']>[0]): void;
@@ -66,6 +69,11 @@ export interface ReconcilableCollection extends HasWritableViaPipeline {
  *  `autoTranslateHook` :1111-1155), passed as plain values (never `this: Vault`) so this module
  *  never imports the `Vault` class. */
 export interface ViaReconcileVaultCtx {
+    /** #1141 — the vault's ref registry, so a late `refs` declaration can still reach it. */
+    readonly refRegistry: {
+        register(collection: string, refs: Record<string, RefDescriptor>): void;
+        getOutbound(collection: string): Record<string, RefDescriptor>;
+    };
     readonly i18nStrategy: I18nStrategy;
     /** — named `locale`, not `defaultLocale`, to match `Vault`'s own field name 1:1 (so `this`
      *  satisfies this interface structurally with zero adapter object at the call site). */
@@ -137,6 +145,10 @@ export declare function reconcileLookupFields(coll: ReconcilableCollection, vaul
  *  though a bare blobFields late-attach is otherwise silently inert, matching pre-#664 behavior). */
 export interface ReconcileLateAttachPlan {
     readonly effectiveViaFields: MergedViaFields;
+    /** #1141 — outbound `refs` from this `vault.collection()` call. Not a via binding: it lands in
+     *  the VAULT's `RefRegistry`, which is why it was the one declaration with no late-attach path
+     *  and got silently dropped whenever the collection already existed. */
+    readonly refs?: Record<string, RefDescriptor>;
     readonly computed?: Parameters<AnyCollection['_applyComputed']>[0];
     readonly fieldMeta?: Parameters<AnyCollection['_applyFieldMeta']>[0];
     readonly meta?: Parameters<AnyCollection['_applyMeta']>[0];

package/dist/{ledger-AETNF4OM.js → ledger-MQIIOTZB.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-Q6TEJXBX.js";
+} from "./chunk-JXHNUYQO.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-6SAFL5YE.js";
-import "./chunk-3URQC7EH.js";
-import "./chunk-7H73RIE3.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-BZ3WMOYX.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-VCETL77O.js";
-import "./chunk-YPYHVOXP.js";
-import "./chunk-HNGSV2YC.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LEDGER_COLLECTION,
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-AETNF4OM.js.map
+//# sourceMappingURL=ledger-MQIIOTZB.js.map

package/dist/liberate-LW7OKVBH.js

@@ -0,0 +1,25 @@
+import {
+  liberateVault
+} from "./chunk-PJX72ICF.js";
+import "./chunk-QQRRKO7W.js";
+import "./chunk-S6PJ6ZKE.js";
+import "./chunk-S2I5MYSA.js";
+import "./chunk-GCU42IG7.js";
+import "./chunk-2ZT4INZ4.js";
+import "./chunk-J6I5VR6P.js";
+import "./chunk-ZJUZOJVW.js";
+import "./chunk-D2YFQ7XG.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-LW7OKVBH.js.map

package/dist/{link-set-E5HNY67I.js → link-set-5PJBBR63.js}

@@ -1,23 +1,23 @@
 import {
   LinkEndpointError,
   LinkSet
-} from "./chunk-PDLLCOGD.js";
+} from "./chunk-3OE2QNSM.js";
 import {
   LINK_COLLECTION_PREFIX,
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-HNHCQ556.js";
-import "./chunk-3URQC7EH.js";
-import "./chunk-7H73RIE3.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-PFWE7FJG.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-VCETL77O.js";
-import "./chunk-YPYHVOXP.js";
-import "./chunk-HNGSV2YC.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LINK_COLLECTION_PREFIX,
@@ -28,4 +28,4 @@ export {
   linkCollectionName,
   linkRowKey
 };
-//# sourceMappingURL=link-set-E5HNY67I.js.map
+//# sourceMappingURL=link-set-5PJBBR63.js.map

package/dist/{managed-secret-CWQ6PND5.js → managed-secret-ETDG6AAE.js}

@@ -9,8 +9,16 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-XWX7GL56.js";
-import "./chunk-YPYHVOXP.js";
+} from "./chunk-S2I5MYSA.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MemoryRecipientSealer,
@@ -24,4 +32,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-CWQ6PND5.js.map
+//# sourceMappingURL=managed-secret-ETDG6AAE.js.map

package/dist/materialized-views/index.js

@@ -1,48 +1,48 @@
 import {
   withMaterializedView
-} from "../chunk-CEJWMBXO.js";
+} from "../chunk-5OT4G5N5.js";
+import {
+  MaterializedViewExecutor
+} from "../chunk-64WHKBMP.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-BEFVYAR5.js";
-import {
-  MaterializedViewExecutor
-} from "../chunk-GAG7QOVO.js";
+} from "../chunk-EQOTJL76.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
   canonicalizeQueryPlan,
   computeQueryHash,
   summarizeQueryPlan
-} from "../chunk-7F4DBNSP.js";
-import "../chunk-RXYYFSBB.js";
-import "../chunk-CCZJJ4I2.js";
-import "../chunk-5ZKS6ZE2.js";
+} from "../chunk-GANFIM2M.js";
+import "../chunk-GKTW3KLV.js";
+import "../chunk-K6CPIK3R.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-E6427JU2.js";
+import "../chunk-EV2TDHQZ.js";
+import "../chunk-2CBFYXJX.js";
 import "../chunk-XZHEOSQ2.js";
-import "../chunk-CADUYBQD.js";
-import "../chunk-IGJCYUT5.js";
-import "../chunk-WFUIE565.js";
-import "../chunk-7G6VDWXB.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-6SAFL5YE.js";
-import "../chunk-3URQC7EH.js";
-import "../chunk-7H73RIE3.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+import "../chunk-ATL3ZVXT.js";
+import "../chunk-NSITFOCJ.js";
+import "../chunk-FNYCT27B.js";
+import "../chunk-XPEPMK4Y.js";
+import "../chunk-C3XWJCG7.js";
+import "../chunk-BZ3WMOYX.js";
+import "../chunk-CXPOG3ZY.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-CKKN25P2.js";
+import "../chunk-7Q3RHOA5.js";
+import "../chunk-4K6BIMLF.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-YPYHVOXP.js";
+import "../chunk-ONPVHX2Y.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError,
   MaterializedViewTooLargeError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MaterializedViewConfigError,

package/dist/migrate-cek-V3VDRV24.js

@@ -0,0 +1,19 @@
+import {
+  SatelliteConfigError
+} from "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/satellites/migrate-cek.ts
+async function migrateSatelliteCek(name, coll) {
+  if (coll.getConfig()?.perRecordKeys !== true) {
+    throw new SatelliteConfigError(
+      `migrateSatellitePerRecordKeys: collection "${name}" was already opened this session without perRecordKeys (construction-only); migrate before its first open, or restart the session.`
+    );
+  }
+  const migrated = await coll._applyCutoverTransform((doc) => doc);
+  return { migrated };
+}
+export {
+  migrateSatelliteCek
+};
+//# sourceMappingURL=migrate-cek-V3VDRV24.js.map

package/dist/migrate-cek-V3VDRV24.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/migrate-cek.ts"],"sourcesContent":["/**\n * Satellite per-record-CEK migration (#599) — the R-S7 retro-coverage\n * unblock.\n *\n * R-S7 (`declare.ts:89-91`) correctly refuses declaring/redeclaring a\n * satellite of a forget-covered base without `perRecordKeys: true` — but\n * `perRecordKeys` is construction-only (`kernel/collection.ts:402`), so an\n * app that shipped a satellite BEFORE its base gained forget coverage has\n * no way past the refusal: the existing records must be re-encrypted under\n * fresh per-record CEKs before the satellite can reopen in\n * `perRecordKeys: true` mode, and the only re-encrypt primitive\n * (`Collection._applyCutoverTransform`) needs the collection already\n * constructed in that mode — chicken-and-egg.\n *\n * The break: `Vault.migrateSatellitePerRecordKeys` (`kernel/vault.ts`)\n * opens the satellite collection via `vault.collection(name, {\n * perRecordKeys: true })` WITHOUT `satelliteOf` — that never enters\n * `declareSatellite`, so R-S7's gate (which only fires on the `satelliteOf`\n * declaration path) never runs for the migration pass. R-S7 stays fully\n * enforced for every NORMAL `satelliteOf` declaration; this module and its\n * call-site never touch `declare.ts`.\n *\n * `migrateSatelliteCek` then reuses `_applyCutoverTransform` verbatim (an\n * identity transform — no field/shape change, only the encryption wrapper\n * changes) rather than duplicating its mint-or-reuse-CEK logic\n * (`resolveRecordCek`/`resolveStableCek`, `collection.ts:2537-2545`): a\n * record with no `_cek` yet gets a freshly minted per-record CEK; a record\n * that already carries `_cek` (already migrated, e.g. a prior interrupted\n * run) reuses its existing CEK unchanged. That mint-or-reuse discrimination\n * is what makes re-running this after a mid-migration failure safe for\n * free — no separate resumability marker needed, no double-mint, no\n * plaintext write, no shared-DEK write.\n *\n * **Mode-assertion guard (review Important 1):** `perRecordKeys` is\n * construction-only and the vault's collection cache is first-wins with no\n * mismatch guard. If `coll`'s name was already opened THIS SESSION without\n * `perRecordKeys` (e.g. an incidental bare `vault.collection(name)` call\n * before the migration ran), `vault.collection(name, { perRecordKeys: true\n * })` cache-HITS that instance instead of constructing a fresh one — the\n * returned handle is silently NOT in per-record-CEK mode. Without a check,\n * `_applyCutoverTransform` would then pass `cek: undefined` for every\n * record (`this.perRecordCek` false) and RE-ENCRYPT EVERY RECORD UNDER THE\n * SHARED COLLECTION DEK while still reporting `{ migrated: N }` as success\n * — a security migration that silently mints nothing. `migrateSatelliteCek`\n * reads the opened handle's own `getConfig()` (the same accessor\n * `dumpSchema()` uses) to confirm `perRecordKeys` is genuinely `true`\n * before walking, and throws `SatelliteConfigError` instead of proceeding\n * if not.\n *\n * **No-quiesce precondition (review Important 2):** `_applyCutoverTransform`\n * is documented as fence-phase-only (`collection.ts:2517-2522`) — the\n * generic schema-cutover caller (`Vault.runSchemaCutover` →\n * `SchemaFenceController`) always runs it under the vault-wide schema fence,\n * which blocks concurrent writes. This migration does NOT fence: it calls\n * `_applyCutoverTransform` directly, with no fence and CAS-less\n * (`adapter.put` with no `expectedVersion`) writes. A concurrent write to\n * the same satellite collection racing the walk's `await`s can be\n * clobbered by (or clobber) a migration write. Callers MUST run this before\n * the collection serves traffic — e.g. at v2 boot, before declaring the\n * pair, before any client can write — or otherwise ensure the vault is\n * quiescent for this collection for the duration of the call.\n */\nimport { SatelliteConfigError } from '../../kernel/errors.js'\n\n/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */\nexport interface SatelliteCekMigrationTarget {\n  /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */\n  getConfig(): { readonly perRecordKeys?: boolean } | undefined\n  _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>\n}\n\nexport interface SatelliteCekMigrationResult {\n  /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */\n  readonly migrated: number\n}\n\n/**\n * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be\n * a collection handle already opened with `perRecordKeys: true` — see the\n * file header for how the caller gets one past R-S7. Throws\n * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in\n * per-record-CEK mode — see the file header's mode-assertion note.\n * Idempotent/resumable: safe to call again after a partial failure. NOT\n * fenced against concurrent writers — see the file header's no-quiesce\n * precondition; run this before the collection serves traffic.\n *\n * @param name The satellite collection's name — used only for the error\n *   message below; identical to what the caller passed to `vault.collection()`.\n */\nexport async function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult> {\n  if (coll.getConfig()?.perRecordKeys !== true) {\n    throw new SatelliteConfigError(\n      `migrateSatellitePerRecordKeys: collection \"${name}\" was already opened this session without ` +\n      `perRecordKeys (construction-only); migrate before its first open, or restart the session.`,\n    )\n  }\n  // Ledger reason (review Minor): the walk below reuses _applyCutoverTransform's\n  // hardcoded 'schema:coordinated-cutover' ledger reason — it has no reason/label\n  // param, and this migration is not itself a schema cutover. Not threaded through\n  // (would touch collection.ts's own ceilinged surface for a cosmetic label);\n  // flagged here so the audit trail's shared reason string is documented, not silent.\n  const migrated = await coll._applyCutoverTransform((doc) => doc)\n  return { migrated }\n}\n"],"mappings":";;;;;;AAyFA,eAAsB,oBAAoB,MAAc,MAAyE;AAC/H,MAAI,KAAK,UAAU,GAAG,kBAAkB,MAAM;AAC5C,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI;AAAA,IAEpD;AAAA,EACF;AAMA,QAAM,WAAW,MAAM,KAAK,uBAAuB,CAAC,QAAQ,GAAG;AAC/D,SAAO,EAAE,SAAS;AACpB;","names":[]}

package/dist/money/index.js

@@ -4,7 +4,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "../chunk-N35NC4JH.js";
+} from "../chunk-TKBB62DN.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -13,10 +13,10 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "../chunk-RXYYFSBB.js";
-import "../chunk-IGJCYUT5.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-HNGSV2YC.js";
+} from "../chunk-GKTW3KLV.js";
+import "../chunk-NSITFOCJ.js";
+import "../chunk-C3XWJCG7.js";
+import "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MoneyCurrencyError,