@noy-db/hub 0.6.0-pre.9 → 0.6.0

package/dist/port/with/merge-authority.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The merge's capability to verify and re-stamp store-supplied ciphertext (#1042).
+ *
+ * ## The problem this seam exists to solve
+ *
+ * `with-sync` is DEK-free by design, and `check:architecture` enforces it: the
+ * engine's only enclave import is shape predicates. That is why AAD alone
+ * cannot make the merge fail closed — AAD is verified inside `subtle.decrypt`,
+ * and `applyRemote` never decrypts. It commits the remote envelope and the
+ * client discovers the problem at read time, *after* its own newer copy is
+ * gone.
+ *
+ * Two consequences follow from the same root, and one seam resolves both:
+ *
+ *  1. **The merge cannot reject a forged envelope**, because it holds no key.
+ *  2. **`advancePastRemote` re-stamps `_v` on existing ciphertext** without a
+ *     DEK, which is precisely why `_v` could not be bound into the AAD by
+ *     #1041. Version rollback stayed open as a result.
+ *
+ * ## Why a capability rather than an import
+ *
+ * The engine takes a `MergeAuthority` at construction. The closure holds the
+ * DEK; the engine's import graph is unchanged, so `check:architecture` passes
+ * **unweakened** — no allowlist entry, no guard edit. ADR 0003 states the test
+ * plainly: *if the guard needs relaxing, the design is wrong.*
+ *
+ * @packageDocumentation
+ */
+import type { EncryptedEnvelope } from '../../kernel/types.js';
+export interface MergeAuthority {
+    /**
+     * Does `envelope` authenticate at the identity and version it claims?
+     *
+     * Called **before** `local.put`, so a rejection costs the client nothing: its
+     * existing copy is untouched. Returns a boolean rather than throwing because
+     * a hostile store must not be able to halt an entire sync by poisoning one
+     * record — the caller records the rejection and moves to the next entry.
+     */
+    verify(collection: string, id: string, envelope: EncryptedEnvelope): Promise<boolean>;
+    /**
+     * Re-stamp `envelope` to `toVersion`, re-sealing it under the same DEK.
+     *
+     * Replaces the `{ ...winner, _v: remote._v + 1 }` spread. That spread is the
+     * single reason `_v` is not yet AEAD-bound: it rewrites a version onto
+     * ciphertext nobody re-sealed, so a reader recomputing AAD from the stamped
+     * `_v` would find a body sealed at a different one.
+     *
+     * With this, advancing becomes a re-seal, and binding `_v` becomes possible —
+     * which converts rollback detection into rollback *prevention*.
+     */
+    advance(collection: string, id: string, envelope: EncryptedEnvelope, toVersion: number): Promise<EncryptedEnvelope>;
+}

package/dist/port/with/service-bus.d.ts

@@ -150,7 +150,3 @@ export declare class ServiceBus {
      */
     dispatchGate<P extends GatePoint>(point: P, event: GateEventMap[P]): Promise<void>;
 }
-/** @deprecated Use ServiceBus. */
-export declare const SubsystemBus: typeof ServiceBus;
-/** @deprecated Use ServiceBus. */
-export type SubsystemBus = ServiceBus;

package/dist/port/with/strategies.d.ts

@@ -50,6 +50,7 @@
  *
  * @internal
  */
+import { type VaultHeadStrategy } from '../../with-commit/vault-head/strategy.js';
 import type { NoydbOptions } from '../../kernel/types.js';
 import { type ReduceStrategy } from '../../with-lookup/reduce/strategy.js';
 import { type AttestationStrategy } from '../../with-audit/attestation/strategy.js';
@@ -98,6 +99,7 @@ export interface StrategyBag {
     readonly custody: CustodyStrategy;
     readonly forget: ForgetStrategy;
     readonly history: HistoryStrategy;
+    readonly vaultHead: VaultHeadStrategy;
     readonly i18n: I18nStrategy;
     readonly indexing: IndexingStrategy;
     readonly lazy: LazyStrategy;

package/dist/port/with/team-strategy.d.ts

@@ -22,12 +22,16 @@
  * @internal
  */
 import type { GrantOptions, RevokeOptions, FactorProofBundle } from '../../kernel/types.js';
-import type { RotateResult } from '../../with-party/team/keyring.js';
+import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../../with-party/team/keyring.js';
 import type { TeamFacade } from '../../with-party/team/noydb-facade.js';
 export interface TeamStrategy {
     grant(team: TeamFacade, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
     revoke(team: TeamFacade, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     rotate(team: TeamFacade, vault: string, collections: string[]): Promise<RotateResult>;
+    /** #1121 — read-only sweep naming every `_keyring` file that fails authentication. */
+    verifyRoster(team: TeamFacade, vault: string): Promise<RosterVerifyResult>;
+    /** #1121 — remove an unauthenticatable `_keyring` file and re-key behind it. */
+    quarantineKeyring(team: TeamFacade, vault: string, userId: string, factors?: FactorProofBundle): Promise<QuarantineResult>;
 }
 /**
  * No-op stub — the floor default. Every multi-user team operation throws

package/dist/portability/index.js

@@ -1,36 +1,36 @@
 import {
   NO_PORTABILITY
-} from "../chunk-FUHKW252.js";
+} from "../chunk-OCJ3JA4O.js";
 import {
   PortabilityNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/portability/active.ts
 function withPortability() {
   return {
     async exportAccessibleData(vault, opts) {
-      const { exportAccessibleData } = await import("../export-accessible-4S36PQNR.js");
+      const { exportAccessibleData } = await import("../export-accessible-S3KEB763.js");
       return exportAccessibleData(vault, opts);
     },
     async withdrawAccessibleData(vault, opts) {
-      const { withdrawAccessibleData } = await import("../withdraw-accessible-7PG4DYQK.js");
+      const { withdrawAccessibleData } = await import("../withdraw-accessible-VCINIG6V.js");
       return withdrawAccessibleData(vault, opts);
     },
     async requestWithdrawal(vault, opts) {
-      const { requestWithdrawal } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { requestWithdrawal } = await import("../request-withdrawal-KQ4W4UT5.js");
       return requestWithdrawal(vault, opts);
     },
     async listWithdrawalRequests(vault, opts) {
-      const { listWithdrawalRequests } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { listWithdrawalRequests } = await import("../request-withdrawal-KQ4W4UT5.js");
       return listWithdrawalRequests(vault, opts);
     },
     async approveWithdrawal(vault, requestId, opts) {
-      const { approveWithdrawal } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { approveWithdrawal } = await import("../request-withdrawal-KQ4W4UT5.js");
       return approveWithdrawal(vault, requestId, opts);
     },
     async rejectWithdrawal(vault, requestId, opts) {
-      const { rejectWithdrawal } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { rejectWithdrawal } = await import("../request-withdrawal-KQ4W4UT5.js");
       return rejectWithdrawal(vault, requestId, opts);
     }
   };

package/dist/{post-register-2XSSMGEQ.js → post-register-QCJYRMIK.js}

@@ -1,9 +1,9 @@
 import {
   hashFields
-} from "./chunk-HVQGCKY4.js";
+} from "./chunk-QVXZFJBU.js";
 import {
   SatelliteConfigError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/marker.ts
@@ -14,7 +14,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     joined: spec.joined,
     epoch: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const { loadPersistedSchema } = await import("./storage-V7MTFAQJ.js");
+  const { loadPersistedSchema } = await import("./storage-WSF7ZKTL.js");
   const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek);
   const prior = persisted?.satellite;
   if (prior) {
@@ -25,7 +25,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     }
     return;
   }
-  const { persistSatelliteMarker } = await import("./register-4EFJCVYD.js");
+  const { persistSatelliteMarker } = await import("./register-JBOEHTVX.js");
   await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next });
 }
 
@@ -39,7 +39,7 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
   }
   if (baseSchema !== void 0) {
     try {
-      const { derivePersistedSchema } = await import("./derive-IUA6JFLB.js");
+      const { derivePersistedSchema } = await import("./derive-MPOGZ4NR.js");
       const envelope = await derivePersistedSchema(baseSchema);
       const properties = envelope.jsonSchema?.["properties"];
       const baseFields = Object.keys(properties ?? {});
@@ -57,4 +57,4 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
 export {
   postRegister
 };
-//# sourceMappingURL=post-register-2XSSMGEQ.js.map
+//# sourceMappingURL=post-register-QCJYRMIK.js.map

package/dist/query/index.js

@@ -4,22 +4,22 @@ import {
   ScanBuilder,
   buildLiveQuery,
   executePlan
-} from "../chunk-3737A6EA.js";
+} from "../chunk-EHW7NLGD.js";
 import {
   DEFAULT_JOIN_MAX_ROWS,
   applyJoins,
   resetJoinWarnings
-} from "../chunk-E6427JU2.js";
+} from "../chunk-EV2TDHQZ.js";
 import {
   CollectionIndexes
-} from "../chunk-GQ3BX5EA.js";
+} from "../chunk-I3ISCYT7.js";
 import "../chunk-YMUFFJCO.js";
-import "../chunk-CADUYBQD.js";
+import "../chunk-ATL3ZVXT.js";
 import {
   evaluateClause,
   evaluateFieldClause,
   readPath
-} from "../chunk-IGJCYUT5.js";
+} from "../chunk-NSITFOCJ.js";
 import {
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
@@ -29,7 +29,7 @@ import {
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   CollectionIndexes,

package/dist/reduce/index.js

@@ -9,7 +9,7 @@ import {
   groupAndReduce,
   reduceRecords,
   resetGroupByWarnings
-} from "../chunk-CCZJJ4I2.js";
+} from "../chunk-2CBFYXJX.js";
 import "../chunk-XZHEOSQ2.js";
 import {
   NO_REDUCE
@@ -24,11 +24,11 @@ import {
   moneySum,
   reducerBuilder,
   sum
-} from "../chunk-CADUYBQD.js";
-import "../chunk-IGJCYUT5.js";
-import "../chunk-7G6VDWXB.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-HNGSV2YC.js";
+} from "../chunk-ATL3ZVXT.js";
+import "../chunk-NSITFOCJ.js";
+import "../chunk-XPEPMK4Y.js";
+import "../chunk-C3XWJCG7.js";
+import "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/reduce/active.ts

package/dist/register-JBOEHTVX.js

@@ -0,0 +1,32 @@
+import {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+} from "./chunk-JHYKSMVX.js";
+import "./chunk-ZVF37PKE.js";
+import "./chunk-DECNV4QK.js";
+import "./chunk-EPFF7LOX.js";
+import "./chunk-DNKVKO7K.js";
+import "./chunk-6NR36UNB.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-KM6ZXG7U.js";
+import "./chunk-GHVIKOHT.js";
+import "./chunk-JXHNUYQO.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-BZ3WMOYX.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+};
+//# sourceMappingURL=register-JBOEHTVX.js.map

package/dist/registry-5DYHQFJS.js

@@ -0,0 +1,9 @@
+import {
+  GuardRegistry
+} from "./chunk-22GR3O4J.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardRegistry
+};
+//# sourceMappingURL=registry-5DYHQFJS.js.map

package/dist/registry-EANV44W2.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-5IHGJHWC.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-EANV44W2.js.map

package/dist/registry-J25H6VB4.js

@@ -0,0 +1,19 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-GANFIM2M.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-J25H6VB4.js.map

package/dist/registry-R23SQUQH.js

@@ -0,0 +1,18 @@
+import {
+  DerivationRegistry
+} from "./chunk-IWQPYT6S.js";
+import "./chunk-65JXA63J.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-R23SQUQH.js.map

package/dist/request-withdrawal-KQ4W4UT5.js

@@ -0,0 +1,31 @@
+import {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+} from "./chunk-5LZZQMIC.js";
+import "./chunk-QQRRKO7W.js";
+import "./chunk-S6PJ6ZKE.js";
+import "./chunk-GCU42IG7.js";
+import "./chunk-2ZT4INZ4.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+};
+//# sourceMappingURL=request-withdrawal-KQ4W4UT5.js.map

package/dist/{reveal-BW36KCOQ.js → reveal-W7BKZSUP.js}

@@ -1,14 +1,14 @@
 import {
   isTombstone
-} from "./chunk-7H73RIE3.js";
+} from "./chunk-FX3UIDCS.js";
 import {
   dualReadSealedSlot
-} from "./chunk-AR2JDFAE.js";
-import "./chunk-VCETL77O.js";
-import "./chunk-YPYHVOXP.js";
+} from "./chunk-7Q3RHOA5.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
 import {
   ClassifiedRevealError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/reveal.ts
@@ -35,4 +35,4 @@ async function revealSealedField(ctx, id, field) {
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-BW36KCOQ.js.map
+//# sourceMappingURL=reveal-W7BKZSUP.js.map

package/dist/revoke-H3VSTAIE.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-6RH7PRTL.js";
+import "./chunk-2J5IT37K.js";
+import "./chunk-CXPOG3ZY.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-CKKN25P2.js";
+import "./chunk-7Q3RHOA5.js";
+import "./chunk-4K6BIMLF.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-ONPVHX2Y.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-Z3BZXPRO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-H3VSTAIE.js.map

package/dist/satellites/index.js

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   SatelliteConfigError

package/dist/schema-update/index.js

@@ -3,7 +3,7 @@ import {
   blindUpdate,
   coordinatedCutover,
   lockSchema
-} from "../chunk-DMQCLZ4Z.js";
+} from "../chunk-ATY3ZASK.js";
 import {
   computeSchemaDelta,
   evaluateStrategies
@@ -12,7 +12,7 @@ import {
   SchemaUpdateGate
 } from "../chunk-6LJY7X5A.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   SchemaUpdateGate,

package/dist/sealed-record/index.js

@@ -1,38 +1,40 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-FAXZQ5UF.js";
-import "../chunk-3URQC7EH.js";
-import "../chunk-7H73RIE3.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-323MN67Z.js";
+import {
+  recordAadFor
+} from "../chunk-CXPOG3ZY.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-CKKN25P2.js";
+import "../chunk-7Q3RHOA5.js";
+import "../chunk-4K6BIMLF.js";
 import "../chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   decrypt,
   importCek
-} from "../chunk-VCETL77O.js";
-import "../chunk-YPYHVOXP.js";
+} from "../chunk-ONPVHX2Y.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../enclave-JU4YIEPB.js");
+      const { sealRecordToHost } = await import("../enclave-Y2ALNDRD.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../enclave-JU4YIEPB.js");
+      const { revokeSealedRecord } = await import("../enclave-Y2ALNDRD.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../enclave-JU4YIEPB.js");
+      const { rotateRecordCek } = await import("../enclave-Y2ALNDRD.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };
@@ -58,7 +60,12 @@ async function openSealedRecord(sealedCekEnvelope, recordEnvelope, recipientSeal
     throw new SealedRecordExpiredError(binding.expiresAt);
   }
   const cek = await importCek(base64ToBuffer(binding.cek));
-  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek);
+  return decrypt(
+    recordEnvelope._iv,
+    recordEnvelope._data,
+    cek,
+    recordAadFor({ collection: expectedCollection, id: expectedId }, recordEnvelope)
+  );
 }
 export {
   NO_SEALED_RECORD,

package/dist/sealed-record/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: { readonly _iv: string; readonly _data: string },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;ACoCA,eAAsB,iBACpB,mBACA,gBACA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AACvD,SAAO,QAAQ,eAAe,KAAK,eAAe,OAAO,GAAG;AAC9D;","names":[]}
+{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { recordAadFor, decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n *\n * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**\n * (#1041). They are plaintext metadata rather than secrets, but they are bound\n * into the record's AAD, so a host handed only `{_iv, _data}` cannot\n * reconstruct the identity the body was sealed against.\n *\n * That is a feature, not a tax: it means a host cannot be fed a body with its\n * tags stripped or rewritten — a re-tiered or re-authored envelope no longer\n * opens, even with a valid sealed CEK.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: {\n    readonly _iv: string\n    readonly _data: string\n    /** Bound into the AAD since #1093 — a rewound body no longer opens. */\n    readonly _v: number\n    readonly _tier?: number | undefined\n    readonly _by?: string | undefined\n  },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  // AAD from the binding's OWN collection/id — which step (3) has just proven\n  // match the caller's expectation. So a host cannot be handed record A's\n  // sealed CEK alongside record B's body and open it (#1041): the AAD would\n  // describe A while the ciphertext was sealed for B.\n  return decrypt(\n    recordEnvelope._iv,\n    recordEnvelope._data,\n    cek,\n    recordAadFor({ collection: expectedCollection, id: expectedId }, recordEnvelope),\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;AC6CA,eAAsB,iBACpB,mBACA,gBAQA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AAKvD,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf;AAAA,IACA,aAAa,EAAE,YAAY,oBAAoB,IAAI,WAAW,GAAG,cAAc;AAAA,EACjF;AACF;","names":[]}

package/dist/search/index.js

@@ -9,15 +9,15 @@ import {
   segmentTokens,
   tokenize,
   withSearch
-} from "../chunk-3JVXVJ7L.js";
+} from "../chunk-7OBIBPCV.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-7G6VDWXB.js";
-import "../chunk-UHXCLPGC.js";
+import "../chunk-XPEPMK4Y.js";
+import "../chunk-C3XWJCG7.js";
 import {
   SearchNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-Z3BZXPRO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   InvertedIndex,