@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/indexing/index.js

@@ -8,15 +8,15 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-HBRLNOHL.js";
+} from "../chunk-V7ADQF5O.js";
 import {
   CollectionIndexes
-} from "../chunk-YSK2CU2Q.js";
+} from "../chunk-2AFX33YA.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-LGNDFRYC.js";
-import "../chunk-HLEK5VAN.js";
-import "../chunk-Z5HTYMMQ.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-5WWDGFOS.js";
+import "../chunk-SYNY3VB5.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-lookup/indexing/active.ts
 function withIndexing() {

package/dist/introspection/index.js

@@ -1,7 +1,7 @@
 import "../chunk-UBSFPGVJ.js";
 import {
   dumpVaultSchema
-} from "../chunk-BP6DARYA.js";
+} from "../chunk-PP3K67AJ.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
@@ -9,18 +9,17 @@ import "../chunk-RXLYKVTF.js";
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-PSIV7CJV.js";
+import "../chunk-747G6CT3.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3H5KLDZN.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-3L2NBKDR.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 export {
   applyListProjection,
   dumpVaultSchema,

package/dist/issue-YIVBZUTH.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-VMV5SBE4.js";
+import "./chunk-JWWYRR4Q.js";
+import "./chunk-DLD5LGDS.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-YIVBZUTH.js.map

package/dist/kernel/attestation-types.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Hub-owned copies of the attestation types. `@noy-db/attestation` is
+ * BUNDLED into hub (tsup `noExternal`), so hub's emitted `.d.ts` must not
+ * name the package — a consumer would otherwise need it installed to
+ * typecheck. The shapes are structurally identical; the `_Pins` block in
+ * `__tests__/no-runtime-dependencies.test.ts` asserts mutual assignability,
+ * so drift fails typecheck rather than surfacing at a consumer.
+ */
+type Normalizer = 'trim' | 'lower' | 'upper' | 'alnum-upper' | 'digits' | 'cents' | 'iso-date';
+interface AttestationFieldSpec {
+    readonly path: string;
+    readonly normalize: Normalizer;
+}
+export interface AttestationFieldSchema {
+    readonly fields: readonly AttestationFieldSpec[];
+}
+export interface QrPayload {
+    readonly v: 1;
+    readonly docId: string;
+    readonly salt: string;
+    readonly alg: 'ed25519';
+    readonly keyId: string;
+    readonly fieldHashes: readonly string[];
+    readonly sig: string;
+}
+export interface RevocationList {
+    readonly v: 1;
+    readonly revokedDocIds: readonly string[];
+    readonly asOf: string;
+    readonly keyId: string;
+    readonly sig: string;
+}
+export interface VerifyInput {
+    readonly qr: string;
+    readonly claimedFields: Record<string, unknown>;
+    readonly fieldSchema: AttestationFieldSchema;
+    readonly publicKeys: Readonly<Record<string, string>>;
+    readonly revocation?: {
+        list: RevocationList;
+    };
+}
+export interface VerifyResult {
+    readonly valid: boolean;
+    readonly signatureValid: boolean;
+    readonly perField: ReadonlyArray<{
+        path: string;
+        match: boolean;
+    }>;
+    readonly revoked: boolean | null;
+    readonly reason?: string;
+}
+/**
+ * The signature primitive attestation signs and verifies with. Hub declares
+ * its own copy for the same reason as the rest of this file: `ENCLAVE_SCHEME`
+ * is typed by it, so naming attestation here would put the package back in
+ * hub's `.d.ts`.
+ */
+export interface SignatureScheme {
+    sign(privateKeyPkcs8B64: string, message: Uint8Array): Promise<string>;
+    verify(publicKeyB64: string, sigB64url: string, message: Uint8Array): Promise<boolean>;
+}
+export {};

package/dist/kernel/collection-config.d.ts

@@ -1,6 +1,6 @@
 import type { StrategyBag } from '../port/with/strategies.js';
 import type { NoydbStore, ConflictPolicy, CollectionConflictResolver, HistoryConfig, TierMode, CrossTierAccessEvent, VdigFieldPolicy } from './types.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
 import type { NoydbEventEmitter } from './events.js';
 import type { WriteQueueTracker } from './write-queue.js';
@@ -496,53 +496,6 @@ export declare function matchTargetFieldNames(opts: {
     readonly declared: readonly string[];
     readonly virtual: readonly string[];
 };
-/**
- * Compile a collection's declared config into the ordered list of `NoydbVia`s
- * for its `ViaPipeline`.
- *
- * money then i18n then lookup then classified then blob then computed — order
- * pinned for pipeline parity with the hand-wired baseline this replaces: money
- * encode ran before the i18n write stages, and money decode ran before i18n
- * locale/dict-label resolution on read. Lookup compiles right after i18n
- * (#650 Task 2) — a separate binding for native lookup()/enumOf()/dict()
- * fields (`dictKeyFields`/`dictKey()`/`staticDict()` stay on the i18n
- * binding above, unchanged); its `present` hook only adds `<field>Label`,
- * same shape of read-time addition as i18n's own dict-label dressing, and
- * declares no write-pipeline hooks yet (Task 3 adds `ingest`/`enforceWrite`).
- * Classified compiles after those (#629 Task 6): its
- * `encodeAtRest`/`decodeAtRest` hooks make the pipeline's `hasAtRestHooks`
- * true, retiring the codec's inline `sensitiveFields` seal path
- * (record-codec.ts) for any collection that declares `classifiedFields` —
- * `classifiedGuardCtx` is the SAME `ClassifiedGuardCtx`
- * `resolveCollectionConfig` already built for door 1's
- * `guardClassifiedCompat` call, threaded in by its one caller below. Blob
- * compiles next (#629 Task 7) but its position is inert: the blob binding
- * declares NO write/read pipeline hooks (blob content is out-of-band
- * `BlobSet` side-collections — it must never flip `hasAtRestHooks`), only
- * `erase`/`describeFragment`. Computed compiles LAST (#638 Task 7) — its
- * `present` hook must run AFTER money's own `present` so a virtual field's
- * `deps` read the decoded (quantized) amount, not the raw stored form; at
- * present-time i18n/lookup's DRESSING now runs AFTER computed instead (#665
- * `_presentOrder`, `via/pipeline.ts` — compile order here is unchanged).
- * `via/graph-wiring.ts#applyTaintOverlay` appends the `taint`
- * binding after WHATEVER this function returns, so taint's present-time
- * redaction always runs after computed's regardless of this ordering.
- * {@link Collection._applyMoneyFields} PREPENDS money for the same reason
- * on its own (MV-precreation reconcile) path — see its docstring;
- * {@link Collection._applyClassifiedFields} APPENDS classified on that same
- * reconcile path (blobFields/computed have no late-attach reconcile door —
- * `viaFields`, like i18nFields/dictKeyFields, is construction-only).
- *
- * `eraseCfgOut` (#629 Task 10, optional out-param) — this function runs
- * before the owning `Collection` exists (`this.codec` isn't built yet), so
- * the classified binding's `classifySealedShred` closure can't be wired
- * here. When supplied, `eraseCfgOut.classified` is set to the SAME cfg
- * object instance handed to `viaBinder('classified')`, so a caller
- * (`resolveCollectionConfig`) can thread it out to the `Collection`
- * constructor, which mutates `classifySealedShred` in place once
- * `this.codec` exists. Additive — every existing caller omits it and keeps
- * getting a plain `NoydbVia[]`.
- */
 export declare function compileVias<T>(opts: CollectionOpts<T>, classifiedGuardCtx: ClassifiedGuardCtx, eraseCfgOut?: {
     classified?: ClassifiedViaConfig;
 }): NoydbVia[];

package/dist/kernel/collection.d.ts

@@ -11,7 +11,7 @@ import { type ViaDescriptor, type ViaEraseReport } from './via/index.js';
 import type { MutationOrigin } from './mutation.js';
 import { type WaveContext, type RollupOutcome, type RollupDeleteIntent } from './via/dispatch.js';
 import type { ComputedFields } from '../with-formula/computed/index.js';
-import { type SealedShredSlot } from './enclave/index.js';
+import { type SealedShredSlot } from '../capsule/index.js';
 import { type TierMoveResult } from '../with-audit/tiers/index.js';
 import type { GhostRecord } from './types.js';
 import type { StandardSchemaV1 } from './schema.js';

package/dist/kernel/cutover-transform.d.ts

@@ -10,7 +10,7 @@
  * @internal
  */
 import type { EncryptedEnvelope, NoydbStore, VdigFieldPolicy } from './types.js';
-import { type RecordCodec, type EnclaveKey } from './enclave/index.js';
+import { type RecordCodec, type EnclaveKey } from '../capsule/index.js';
 import type { MutationOrigin } from './mutation.js';
 /**
  * @internal Structural (not imported) view of `UnlockedKeyring` — only

package/dist/kernel/errors.d.ts

@@ -136,6 +136,34 @@ export declare class DebugReservedFieldError extends NoydbError {
 export declare class DecryptionError extends NoydbError {
     constructor(message?: string);
 }
+/**
+ * **Means exactly: "this envelope carries no sealed body, and this path needs
+ * one."** (#15)
+ *
+ * Since `_iv`/`_data` became optional, an envelope written by an *exclave*
+ * capsule has no ciphertext body at all. Handed to an AES decrypt path, that
+ * is neither corruption nor an attack — it is a capsule mismatch, and it must
+ * not be reported as one of the two errors it superficially resembles:
+ *
+ *  - **not {@link TamperedError}**, whose entire documented meaning is "the
+ *    AEAD tag did not verify under this key". That class is hub's security
+ *    alert; raising it for a structurally absent body would manufacture a
+ *    tamper signal out of a configuration difference, and the operator
+ *    response to the two is completely different.
+ *  - **not a bare `TypeError`**, which is what reading `.length` or passing
+ *    `undefined` into `decrypt()` produced before this issue — an internal
+ *    slip surfacing as if hub had a bug in its own arithmetic.
+ *
+ * `where` names the call path that required the body, because the same
+ * absence is legitimate two frames earlier: {@link hasSealedBody} answers
+ * false for it, and a tombstone, a `_del` marker and a plaintext collection
+ * all reach that answer by design.
+ */
+export declare class MissingEnvelopeBodyError extends NoydbError {
+    /** The operation that required a sealed body, e.g. `'openEnvelopeJson'`. */
+    readonly where: string;
+    constructor(where: string);
+}
 /**
  * **Means exactly: "AEAD failed under this key."** Nothing more (lanna-db #4,
  * 2026-09-03). AES-256-GCM authenticates the ciphertext on every decrypt; if
@@ -2368,7 +2396,7 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
     constructor(profile: string, tracking: string);
 }
 /**
- * Thrown by a `kernel/enclave` fork's **optional groups** — sealing,
+ * Thrown by a `capsule/enclave-aes` fork's **optional groups** — sealing,
  * deterministic, per-record-key lifecycle — when that fork's crypto
  * engine does not implement the requested behavior.
  *
@@ -2391,7 +2419,7 @@ export declare class EnclaveNotSupportedError extends NoydbError {
  * Raised when a collection's `classifiedFields` configuration is invalid
  * (e.g. a claimed field name collides with a rider companion or another
  * classified field). Homed in `kernel/errors.ts` (rather than the classified
- * feature module) so `kernel/enclave/classify/*` can throw it without
+ * feature module) so `capsule/enclave-aes/classify/*` can throw it without
  * importing with-*; the classified feature module re-exports it under the
  * same name for backward-compatible import paths.
  */

package/dist/kernel/merge-authority.d.ts

@@ -1,5 +1,5 @@
 import type { MergeAuthority } from '../port/with/merge-authority.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 /**
  * ⚠️ **A client cannot verify what it cannot decrypt** — and that boundary is
  * stated here rather than hidden.

package/dist/kernel/paths.d.ts

@@ -1,11 +1,35 @@
 /**
- * Generic dotted-path / `[]`-wildcard record helpers. Kernel-owned:
- * these carry zero i18n logic — they were extracted out of
- * `via/i18n/core.ts` (Task 7, #623) so kernel call-sites (put-time
- * validation, densify) can import them without a spine→service edge.
+ * Refuse a malformed field path AT DECLARATION TIME.
  *
- * @internal
+ * ⛔ WHY THIS EXISTS. {@link getAtPath} performs no validation by design — it
+ * answers "what is at this path", and "nothing" is a legitimate answer for an
+ * optional field or an empty array. The consequence is that a MALFORMED path
+ * is indistinguishable from an absent value: `'contacts[.name'` contains no
+ * `[].` and no `.`, so it falls through to `obj['contacts[.name']`, resolves
+ * to `undefined`, and the declaration does nothing. Forever. Silently.
+ *
+ * Measured 2026-09-13: an `i18nFields` declaration with `required: 'all'` and
+ * a malformed path accepted a record missing every required language, while
+ * the same spec on a well-formed path refused it. The guarantee was not
+ * weakened — it was never installed.
+ *
+ * ⭐ SAME CLASS AS core#19 AND `moneyFields`. `via/money/paths.ts` already
+ * guards its own grammar and says why in its header ("a declared-but-
+ * unreachable path that was silently ignored ... a latent 100× bug");
+ * `classifiedFields` did not, and a consumer found the leak. This is the third
+ * instance, which is why the check lives HERE, beside the resolver every
+ * path-taking family shares, rather than being written a third time.
+ *
+ * ⚠️ SYNTAX ONLY. A well-formed path naming a field that does not exist
+ * (`titel` for `title`) is NOT caught here and cannot be — that needs the
+ * collection's schema, which is not always declared. It is a real and separate
+ * gap; see the issue filed alongside this guard.
+ *
+ * Trailing `[]` is refused because `getAtPath` cannot consume it: the wildcard
+ * is recognised as the three-character marker `[].`, so `'contacts[]'` with
+ * nothing after it is read as an ordinary key and resolves to nothing.
  */
+export declare function assertFieldPath(path: string, context: string): void;
 /**
  * Return all leaf values at `path`, expanding `[].` array wildcards.
  *

package/dist/kernel/prepared-write.d.ts

@@ -11,7 +11,7 @@
  * kernel-surface line budget.
  */
 import type { EncryptedEnvelope } from './types.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 /** @internal Everything `_commitPut` needs after `_preparePut` produced the envelope. */
 export interface PreparedPut<T> {
     readonly id: string;

package/dist/kernel/secret-mode.d.ts

@@ -14,7 +14,7 @@
  * @module
  */
 import type { NoydbOptions, NoydbStore } from './types.js';
-import type { EchoSecretParts } from './enclave/index.js';
+import type { EchoSecretParts } from '../capsule/index.js';
 /**
  * Cross-check the secret-mode-related options at `createNoydb` time, before
  * any store touch. Throws `ValidationError` on the first violation.

package/dist/kernel/types.d.ts

@@ -68,7 +68,7 @@ import type { FormatsStrategy } from '../port/with/formats-strategy.js';
 import type { NoydbMesh } from '../port/by/types.js';
 import type { ScriptWarning } from '../port/with/i18n-strategy.js';
 import type { ViaDescriptor } from './via/index.js';
-import type { EnclaveKey, EchoSecretParts } from './enclave/index.js';
+import type { EnclaveKey, EchoSecretParts } from '../capsule/index.js';
 import type { NoydbDeviceSeal } from '../port/with/device-seal-strategy.js';
 export type { EchoSecretParts };
 /** Format version for encrypted record envelopes. */
@@ -163,13 +163,34 @@ export type Permission = 'rw' | 'ro';
  * `'*'` is the wildcard collection matching all collections in the vault.
  */
 export type Permissions = Record<string, Permission>;
-/** The encrypted wrapper stored by stores. Stores only ever see this. */
-export interface EncryptedEnvelope {
+/**
+ * The wrapper stored by stores. Stores only ever see this.
+ *
+ * ⚠️ **`_iv`/`_data` are OPTIONAL, and that is a capsule contract, not a
+ * convenience** (#15). An *enclave* capsule (the default, `enclave-aes`)
+ * always writes both; an *exclave* capsule stores a plaintext row and has no
+ * ciphertext body at all, so it writes neither.
+ *
+ * **Absence and `''` mean the same thing: no sealed body.** That equivalence
+ * is not new — a tombstone, a delete marker (`_del`) and a plaintext
+ * collection have carried `_iv: ''` since the format's first version, and
+ * {@link hasSealedBody} has always been the question callers ask. Widening
+ * only lets a capsule omit the keys instead of emptying them; every existing
+ * envelope on disk keeps its exact bytes and reads back identically.
+ *
+ * Consequently NOTHING here is a wire-format change, and `NOYDB_FORMAT_VERSION`
+ * does not move. What changed is that every READER must now cope with absence
+ * — which is the whole point, since the store contract at `@noy-db/hub/to` is
+ * what an exclave's rows travel through.
+ */
+export interface Envelope {
     readonly _noydb: typeof NOYDB_FORMAT_VERSION;
     readonly _v: number;
     readonly _ts: string;
-    readonly _iv: string;
-    readonly _data: string;
+    /** Body IV. Absent (≡ `''`) when there is no sealed body — see the interface doc. */
+    readonly _iv?: string;
+    /** Body ciphertext, or plaintext JSON on an unencrypted collection. Absent ≡ `''`. */
+    readonly _data?: string;
     /** User who created this version (unencrypted metadata). */
     readonly _by?: string;
     /**
@@ -278,6 +299,22 @@ export interface EncryptedEnvelope {
      */
     readonly _del?: true;
 }
+/**
+ * The former name of {@link Envelope}, kept as an exact alias.
+ *
+ * ⚠️ **It is an ALIAS, not a narrower type** — `EncryptedEnvelope._data` is
+ * `string | undefined` here too. Declaring it as a body-required subtype was
+ * considered and rejected: it would have let every existing hub reader keep
+ * compiling untouched, which is precisely the bug — a store handing back an
+ * exclave row would then fail at runtime in 43 files that the compiler had
+ * declared safe.
+ *
+ * Retiring the name is a 0.9 seam decision, not a 0.8 one: it is published
+ * from the root barrel and from `@noy-db/hub/to`, so removing it is breaking
+ * for every satellite that binds the store contract. It stays for the whole
+ * 0.8 line.
+ */
+export type EncryptedEnvelope = Envelope;
 /** Spine policy for one digest-only classified field — the enclave-consumable
  *  projection of a ClassifiedFieldSpec (the enclave never imports with-*). */
 export interface VdigFieldPolicy {

package/dist/kernel/vault.d.ts

@@ -44,7 +44,7 @@ import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import { type BehaviorSummary } from '../with-shape/introspection/behaviors.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
 import { type PeriodRecord, type PeriodReopenEvent, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
-import { type EnclaveKey } from './enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import type { RecipientSealer } from '../with-party/team/managed-secret.js';
 import { type ExportBlobsOptions, type ExportBlobsHandle } from '../with-shape/blobs/export-blobs.js';
 import { type CompactRunOptions, type CompactionResult } from '../with-shape/blobs/blob-compaction.js';
@@ -52,7 +52,7 @@ import { type IssueMagicLinkGrantOptions, type MagicLinkGrantRecord } from '../w
 import { CustodyApi } from '../with-party/custody/index.js';
 import { SchemaFenceController } from '../with-shape/schema-update/fence-controller.js';
 import { type FenceDoc } from '../with-shape/schema-update/fence.js';
-import type { RevocationList } from '@noy-db/attestation';
+import type { RevocationList } from './attestation-types.js';
 import type { DumpSchemaOptions, VaultSchemaSnapshot, SchemaIntrospection } from '../with-shape/introspection/types.js';
 import type { VaultIntrospectState } from '../with-shape/introspection/walk.js';
 import type { VaultMeta } from '../with-shape/introspection/meta.js';

package/dist/kernel/write-queue.d.ts

@@ -43,4 +43,21 @@ export declare class WriteQueueTracker implements WriteQueue {
      * error is re-thrown after the queue is decremented.
      */
     track<R>(fn: () => Promise<R>): Promise<R>;
+    /**
+     * Run a write whose PRE-COMMIT phase may legitimately REFUSE — the schema
+     * gates, and a user `beforeWrite` hook that throws to abort. `fn` calls
+     * `committed()` at the point the store write itself begins.
+     *
+     * Before that point a rejection releases the depth it took but records NO
+     * queue error; after it, a rejection settles as a failure like `track`.
+     *
+     * #11 — why the phase is inside `depth` at all: `pending` is the documented
+     * shutdown guard (see the `writeQueue` getter's `beforeunload` example) and
+     * the schema fence does a fresh store read per write, so leaving the gates
+     * outside made `pending` read `false` during a real round-trip on every
+     * write. The refusal carve-out is what the old outside-the-queue placement
+     * was protecting ("a rejected write never counts toward depth") — it is kept
+     * deliberately, so a refused write cannot reject a concurrent `onFlush()`.
+     */
+    trackGated<R>(fn: (committed: () => void) => Promise<R>): Promise<R>;
 }

package/dist/{ledger-KZPCMVZY.js → ledger-5ZMGE44K.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-ZXABPVM6.js";
+} from "./chunk-N7EVQD5S.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,15 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-CKNGS5MH.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
+} from "./chunk-6QVKPHBF.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -38,4 +37,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-KZPCMVZY.js.map
+//# sourceMappingURL=ledger-5ZMGE44K.js.map

package/dist/liberate-WZSZM2W6.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-UIYESRD6.js";
+import "./chunk-IMQKWR46.js";
+import "./chunk-EJLV62NI.js";
+import "./chunk-3XJQBBZD.js";
+import "./chunk-KZXDLBY6.js";
+import "./chunk-5A4345TG.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-XSPFDUDG.js";
+import "./chunk-LIOVX5TJ.js";
+import "./chunk-FLPCETP6.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-WZSZM2W6.js.map

package/dist/link-set-MFXC24VK.js

@@ -0,0 +1,29 @@
+import {
+  LinkEndpointError,
+  LinkSet
+} from "./chunk-WXE4W2U6.js";
+import {
+  LINK_COLLECTION_PREFIX,
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-Q4UHJ5SN.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  LINK_COLLECTION_PREFIX,
+  LinkEndpointError,
+  LinkIntegrityError,
+  LinkSet,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+};
+//# sourceMappingURL=link-set-MFXC24VK.js.map

package/dist/{managed-secret-S3MQ6SH6.js → managed-secret-MFTFT22X.js}

@@ -9,16 +9,15 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-ENAG3IY7.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
+} from "./chunk-3XJQBBZD.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,
@@ -31,4 +30,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-S3MQ6SH6.js.map
+//# sourceMappingURL=managed-secret-MFTFT22X.js.map