@noy-db/hub 0.7.0-pre.4 → 0.7.0-pre.6

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog — hub
 
+## 0.7.0-pre.6
+
+### Patch Changes
+
+- Correct a factual claim in the `0.7.0-pre.5` changelog entry: the cached read path returned `undefined`, not `null`.
+
+  That entry described the #1220 failure as _"the cached path returned `null`, indistinguishable from no such record."_ The value is wrong. Measured on published `0.7.0-pre.4` with `to-memory@0.7.0-pre.4`, correct arity throughout:
+
+  | read                              | value                                       |
+  | --------------------------------- | ------------------------------------------- |
+  | genuinely absent id               | `null`                                      |
+  | empty-sealed record, cached path  | **`undefined`**                             |
+  | empty-sealed record, hydrate path | `SyntaxError: Unexpected end of JSON input` |
+
+  **The argument the entry made is unaffected — it gets stronger.** `undefined` is off `get()`'s declared `T | null` contract, so a caller writing `if (!rec)` or `?? fallback` folds it into _"no such record"_ exactly as it would fold `null`, **and** a caller writing `rec === null` fails to catch it as well. The collapse of distinguishable states is wider than the original sentence claimed, not narrower.
+
+  `0.7.0-pre.5`'s entry is left standing as the record of what that release said — its tarball is immutable, so amending it would only make later tarballs disagree with the shipped one. This is the correction published alongside, the same move `0.7.0-pre.4` made for `0.7.0-pre.3`.
+
+  Scope: the incorrect sentence appeared only in `CHANGELOG.md` on the published surface — it was not in any shipped `.d.ts`. No code, type, or behaviour change. The guards added in `0.7.0-pre.5` are unaffected, and note they prevent such a record being **created**, not **read**: a record sealed by an earlier build still throws on the hydrate path today.
+
+- Export `isConflictError` from `@noy-db/hub/to` (#1224).
+
+  The predicate was reachable only from the root barrel, while `/to` exported the `ConflictError` **class**. That is the wrong way round for the one seam that needs it: `isConflictError` exists precisely because a store may bind a different copy of `@noy-db/hub/to` than its caller, making `instanceof` against that class silently miss (#935) — CAS retry loops rethrow instead of retrying, and the sync engine misfiles the conflict with no resolution run.
+
+  A store binds `/to` and nothing else, so store authors were told by the predicate's own documentation to use something they could not import, and the obvious fallback — `instanceof ConflictError` off `/to` — is exactly the defect the predicate prevents.
+
+  Additive: an existing function on an existing subpath. Nothing is removed or renamed, and the root barrel export is unchanged.
+
+  Guarded by an invariant rather than an enumeration: a test parses `kernel/errors.ts` for any `is*` predicate whose contract mentions the store seam and asserts each is reachable from `/to`, so a future sibling cannot repeat this. `/to`'s golden surface baseline moves by one entry.
+
+## 0.7.0-pre.5
+
+### Patch Changes
+
+- Refuse to seal a record against a coerced address or over an empty plaintext (#1220).
+
+  Two boundary values were accepted silently and produced envelopes that are **valid and undecodable** — sealed correctly, addressed or filled with nothing. Both are now `TypeError`s at the seal, stated as output-domain invariants so they hold for every caller rather than for the two calls that surfaced them:
+
+  - **`buildRecordAad` refuses a non-string `collection` or `id`.** `String({})` is `"[object Object]"` and `String(undefined)` is `"undefined"`; both make perfectly good AAD, so a record sealed against one is stored at an address nothing queries. Sibling of the `version` assertion already in that function, and there for the same reason: it can only fire for a caller TypeScript never saw.
+  - **`RecordCodec.encryptJsonString` refuses a non-string plaintext.** `JSON.stringify(undefined)` is `undefined`, so an undefined record sealed over _nothing_ — `_data` a bare GCM tag over zero ciphertext.
+
+  Why this was worth a guard rather than a documentation note: the two read paths disagreed about the same bytes and neither named the cause. The cached path returned `null`, indistinguishable from _no such record_; the hydrate path threw `SyntaxError` out of `decryptRecord`, indistinguishable from _your store returned corrupt bytes_. A `to-*` author or daemon operator meeting that would reasonably suspect their store, indefinitely, over a caller mistake made days earlier.
+
+  No format, encryption, or integrity change: envelopes that seal continue to seal identically, and `NOYDB_ENVELOPE_GENERATION` is unaffected. This only refuses inputs that previously produced unreadable records.
+
 ## 0.7.0-pre.4
 
 ### Patch Changes

package/dist/{api-ENZ2ADVW.js → api-OAZLPNVV.js}

@@ -1,9 +1,9 @@
 import {
   UserApi,
   createUserApi
-} from "./chunk-5D5VN3EH.js";
-import "./chunk-HO6F7YBI.js";
-import "./chunk-PE4LXIRT.js";
+} from "./chunk-JHLJQUXU.js";
+import "./chunk-26W5VETY.js";
+import "./chunk-BYBB4ABD.js";
 import "./chunk-QU3YUP2X.js";
 import "./chunk-FOG7YEJP.js";
 import "./chunk-KDJGJR7F.js";
@@ -17,4 +17,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=api-ENZ2ADVW.js.map
+//# sourceMappingURL=api-OAZLPNVV.js.map

package/dist/as/index.js

@@ -1,13 +1,13 @@
 import "../chunk-UBSFPGVJ.js";
-import "../chunk-UT7IVDZK.js";
+import "../chunk-XWNLKG6R.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-KHKKD62N.js";
 import "../chunk-P6ASQOZR.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-RK4FY5C5.js";
-import "../chunk-PE4LXIRT.js";
+import "../chunk-626TSARM.js";
+import "../chunk-BYBB4ABD.js";
 import "../chunk-QU3YUP2X.js";
 import "../chunk-FOG7YEJP.js";
 import "../chunk-KDJGJR7F.js";

package/dist/at/index.js

@@ -4,7 +4,7 @@ import {
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
 } from "../chunk-2QNKXGUS.js";
-import "../chunk-PE4LXIRT.js";
+import "../chunk-BYBB4ABD.js";
 import "../chunk-QU3YUP2X.js";
 import "../chunk-FOG7YEJP.js";
 import "../chunk-KDJGJR7F.js";

package/dist/attestation/index.js

@@ -1,20 +1,20 @@
 import {
   issueAttestationCore
-} from "../chunk-7CHX7QON.js";
+} from "../chunk-L3FHEWA3.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-CSNKE6OP.js";
+} from "../chunk-BWWUXE3L.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-OIHSOAZO.js";
+} from "../chunk-LFDMKZIP.js";
 import {
   NO_ATTESTATION
 } from "../chunk-E6YA6UAP.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-PE4LXIRT.js";
+import "../chunk-BYBB4ABD.js";
 import "../chunk-QU3YUP2X.js";
 import "../chunk-FOG7YEJP.js";
 import "../chunk-KDJGJR7F.js";
@@ -32,11 +32,11 @@ import "../chunk-PZ5AY32C.js";
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-J5IPOKLJ.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-2DGG7NKE.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-K2GEB47Y.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-HJHTGX7X.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-G63G7D23.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-4NRSCPNW.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-G63G7D23.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-4NRSCPNW.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-G63G7D23.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-4NRSCPNW.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-G63G7D23.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-4NRSCPNW.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-PT7L6TP7.js → backup-SZBDQQSL.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-RK4FY5C5.js";
+} from "./chunk-626TSARM.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-ACAQXGRE.js";
+} from "./chunk-S3I7VKID.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -18,7 +18,7 @@ import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-PE4LXIRT.js";
+import "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-PT7L6TP7.js.map
+//# sourceMappingURL=backup-SZBDQQSL.js.map

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-N5TIYKHI.js";
+} from "../chunk-ZKRRBRSZ.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,11 +25,11 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-UNOIEPF7.js";
+} from "../chunk-ZQ2UUHSL.js";
 import "../chunk-XDVVBETV.js";
 import "../chunk-HTGRQZFB.js";
 import "../chunk-POS53FG6.js";
-import "../chunk-PE4LXIRT.js";
+import "../chunk-BYBB4ABD.js";
 import "../chunk-QU3YUP2X.js";
 import "../chunk-FOG7YEJP.js";
 import "../chunk-KDJGJR7F.js";

package/dist/broker/index.js

@@ -4,7 +4,7 @@ import {
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-PE4LXIRT.js";
+} from "../chunk-BYBB4ABD.js";
 import "../chunk-QU3YUP2X.js";
 import "../chunk-FOG7YEJP.js";
 import "../chunk-KDJGJR7F.js";
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-ILBQJVRT.js");
+      const { enrollSeed } = await import("../seed-IX5NFSH5.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-ILBQJVRT.js");
+      const { rotateSeed } = await import("../seed-IX5NFSH5.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-ILBQJVRT.js");
+          const { mintStoreCredentials } = await import("../seed-IX5NFSH5.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/cargo/index.js

@@ -5,11 +5,11 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-HG2VWXNA.js";
+} from "../chunk-OMHHGOG4.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-C5JIS3OC.js";
+} from "../chunk-7CWII4BL.js";
 import {
   diffVault
 } from "../chunk-LFUID7OW.js";
@@ -18,9 +18,9 @@ import {
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-RBRNSXPE.js";
-import "../chunk-6K7AID3U.js";
-import "../chunk-A7FUC6HA.js";
+} from "../chunk-4MZEZ37W.js";
+import "../chunk-7XODKGTW.js";
+import "../chunk-4TZUFNXL.js";
 import {
   NO_CARGO
 } from "../chunk-XJ3FEKEY.js";
@@ -29,16 +29,16 @@ import {
   isQuorum,
   runDrainBarrier
 } from "../chunk-CBRS2NEK.js";
-import "../chunk-RK4FY5C5.js";
+import "../chunk-626TSARM.js";
 import {
   CustodyApi
-} from "../chunk-XZ2PWHVM.js";
-import "../chunk-K4W6XBMO.js";
+} from "../chunk-672U6STZ.js";
+import "../chunk-6AQIFBSP.js";
 import "../chunk-44C2URL7.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-UNOIEPF7.js";
+import "../chunk-ZQ2UUHSL.js";
 import {
   groupAndReduce,
   reduceRecords
@@ -50,18 +50,18 @@ import {
 } from "../chunk-NSITFOCJ.js";
 import "../chunk-X67FCULK.js";
 import "../chunk-XDVVBETV.js";
-import "../chunk-NHW3K44E.js";
-import "../chunk-HO6F7YBI.js";
+import "../chunk-ZTYG36DH.js";
+import "../chunk-26W5VETY.js";
 import "../chunk-HTGRQZFB.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-ITWVPY2S.js";
+import "../chunk-UPJMBMCR.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-25KT7D4D.js";
+import "../chunk-WLFABTZ6.js";
 import "../chunk-POS53FG6.js";
-import "../chunk-PE4LXIRT.js";
+import "../chunk-BYBB4ABD.js";
 import "../chunk-QU3YUP2X.js";
 import "../chunk-FOG7YEJP.js";
 import "../chunk-KDJGJR7F.js";

package/dist/{chunk-HO6F7YBI.js → chunk-26W5VETY.js}

@@ -1,7 +1,7 @@
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-PE4LXIRT.js";
+} from "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -142,4 +142,4 @@ export {
   deleteUserEnvelope,
   listUserEnvelopeIds
 };
-//# sourceMappingURL=chunk-HO6F7YBI.js.map
+//# sourceMappingURL=chunk-26W5VETY.js.map

package/dist/{chunk-OMF7MYHL.js → chunk-4FPEWQKF.js}

@@ -13,14 +13,14 @@ import {
   persistKeyring,
   readKeyringFile,
   requireRosterKey
-} from "./chunk-NHW3K44E.js";
+} from "./chunk-ZTYG36DH.js";
 import {
   dekKey
 } from "./chunk-POS53FG6.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-PE4LXIRT.js";
+} from "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -965,4 +965,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-OMF7MYHL.js.map
+//# sourceMappingURL=chunk-4FPEWQKF.js.map

package/dist/{chunk-APUCE47B.js → chunk-4JDIRUTT.js}

@@ -1,6 +1,6 @@
 import {
   LookupHandle
-} from "./chunk-52FMTGNW.js";
+} from "./chunk-XBFEKTIY.js";
 
 // src/via/lookup/active.ts
 function withLookup() {
@@ -33,4 +33,4 @@ function withLookup() {
 export {
   withLookup
 };
-//# sourceMappingURL=chunk-APUCE47B.js.map
+//# sourceMappingURL=chunk-4JDIRUTT.js.map

package/dist/{chunk-RBRNSXPE.js → chunk-4MZEZ37W.js}

@@ -1,6 +1,6 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-6K7AID3U.js";
+} from "./chunk-7XODKGTW.js";
 import {
   resolveManagedSecret
 } from "./chunk-2QNKXGUS.js";
@@ -9,7 +9,7 @@ import {
   createOwnerKeyring,
   mintRosterTag,
   requireRosterKey
-} from "./chunk-NHW3K44E.js";
+} from "./chunk-ZTYG36DH.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -135,4 +135,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-RBRNSXPE.js.map
+//# sourceMappingURL=chunk-4MZEZ37W.js.map

package/dist/{chunk-A7FUC6HA.js → chunk-4TZUFNXL.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-K4W6XBMO.js";
+} from "./chunk-6AQIFBSP.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-A7FUC6HA.js.map
+//# sourceMappingURL=chunk-4TZUFNXL.js.map

package/dist/{chunk-RK4FY5C5.js → chunk-626TSARM.js}

@@ -1,7 +1,7 @@
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-PE4LXIRT.js";
+} from "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -45,4 +45,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-RK4FY5C5.js.map
+//# sourceMappingURL=chunk-626TSARM.js.map

package/dist/{chunk-XZ2PWHVM.js → chunk-672U6STZ.js}

@@ -1,7 +1,7 @@
 import {
   grant,
   revoke
-} from "./chunk-NHW3K44E.js";
+} from "./chunk-ZTYG36DH.js";
 import {
   CustodyNotEnabledError
 } from "./chunk-JBIV4FLR.js";
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-DGWJ27ZG.js");
+      const { liberateVault } = await import("./liberate-7NEPRE52.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-XZ2PWHVM.js.map
+//# sourceMappingURL=chunk-672U6STZ.js.map

package/dist/{chunk-K4W6XBMO.js → chunk-6AQIFBSP.js}

@@ -812,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-44J3VS2H.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-ZGRFZKYE.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -1059,4 +1059,4 @@ export {
   readPodRedirect,
   readPod
 };
-//# sourceMappingURL=chunk-K4W6XBMO.js.map
+//# sourceMappingURL=chunk-6AQIFBSP.js.map

package/dist/{chunk-UHM3GMBN.js → chunk-6NRVFD55.js}

@@ -4,7 +4,7 @@ import {
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-25KT7D4D.js";
+} from "./chunk-WLFABTZ6.js";
 import {
   isDeleteMarker
 } from "./chunk-QU3YUP2X.js";
@@ -124,7 +124,7 @@ function validatePeriodName(name, existing, partition) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-APEU3ZIW.js");
+  const { envelopePayloadHash } = await import("./ledger-4X5ZH43X.js");
   await ledger.append({
     op: "put",
     collection,
@@ -198,4 +198,4 @@ export {
   purgeMarkersOn,
   withPeriods
 };
-//# sourceMappingURL=chunk-UHM3GMBN.js.map
+//# sourceMappingURL=chunk-6NRVFD55.js.map

package/dist/{chunk-C5JIS3OC.js → chunk-7CWII4BL.js}

@@ -1,10 +1,10 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-RK4FY5C5.js";
+} from "./chunk-626TSARM.js";
 import {
   assemblePodContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-K4W6XBMO.js";
+} from "./chunk-6AQIFBSP.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -12,7 +12,7 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-UNOIEPF7.js";
+} from "./chunk-ZQ2UUHSL.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -23,13 +23,13 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-25KT7D4D.js";
+} from "./chunk-WLFABTZ6.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   recordAadFor,
   writeEnvelopeBody
-} from "./chunk-PE4LXIRT.js";
+} from "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -494,4 +494,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-C5JIS3OC.js.map
+//# sourceMappingURL=chunk-7CWII4BL.js.map

package/dist/{chunk-6K7AID3U.js → chunk-7XODKGTW.js}

@@ -1,7 +1,7 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-A7FUC6HA.js";
+} from "./chunk-4TZUFNXL.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -117,4 +117,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-6K7AID3U.js.map
+//# sourceMappingURL=chunk-7XODKGTW.js.map

package/dist/{chunk-B7SJ52ZG.js → chunk-BOFRKAUS.js}

@@ -5,7 +5,7 @@ import {
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-PE4LXIRT.js";
+} from "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -130,4 +130,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-B7SJ52ZG.js.map
+//# sourceMappingURL=chunk-BOFRKAUS.js.map

package/dist/{chunk-CSNKE6OP.js → chunk-BWWUXE3L.js}

@@ -2,11 +2,11 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-OIHSOAZO.js";
+} from "./chunk-LFDMKZIP.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-PE4LXIRT.js";
+} from "./chunk-BYBB4ABD.js";
 import {
   buildRecordEnvelope
 } from "./chunk-QU3YUP2X.js";
@@ -81,4 +81,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-CSNKE6OP.js.map
+//# sourceMappingURL=chunk-BWWUXE3L.js.map

package/dist/{chunk-PE4LXIRT.js → chunk-BYBB4ABD.js}

@@ -59,6 +59,13 @@ function buildRecordAad(identity) {
       `record AAD: version must be a finite number for "${identity.collection}/${identity.id}", received ${String(identity.version)}. Sealing without one produces a record no reader can open.`
     );
   }
+  for (const [field, value] of [["collection", identity.collection], ["id", identity.id]]) {
+    if (typeof value !== "string") {
+      throw new TypeError(
+        `record AAD: ${field} must be a string, received ${String(value)} (${typeof value}). Sealing against a coerced address produces a record no reader can open, and the failure surfaces on the READ path.`
+      );
+    }
+  }
   const parts = [encoder.encode(SCHEME)];
   const pushField = (value) => {
     const bytes = encoder.encode(value);
@@ -546,6 +553,11 @@ var RecordCodec = class _RecordCodec {
    * migration.
    */
   async encryptJsonString(ref, json, version, cek, source, sourceTs) {
+    if (typeof json !== "string") {
+      throw new TypeError(
+        `record seal: plaintext must be a string for "${String(ref.collection)}/${String(ref.id)}", received ${String(json)} (${typeof json}). Sealing over an empty plaintext produces an envelope that is valid and undecodable.`
+      );
+    }
     const identity = { ...ref, version, by: this.ctx.actor };
     const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
     if (!this.ctx.storeCiphertext) {
@@ -1352,4 +1364,4 @@ export {
   issueChallenge,
   verifyBrokerProof
 };
-//# sourceMappingURL=chunk-PE4LXIRT.js.map
+//# sourceMappingURL=chunk-BYBB4ABD.js.map