@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/kernel/enclave/record-keys/rekey.d.ts

@@ -1,91 +0,0 @@
-/**
- * Re-key one envelope from an old collection DEK to a new one (#1074).
- *
- * Lives in the enclave because it is envelope surgery: it reads and writes the
- * protected body slots (`_iv`/`_data`/`_cek`), which `enclave-body-only`
- * reserves to `kernel/enclave/**`. `rotateKeys` previously did this inline in
- * `with-party/team/keyring.ts` and got it wrong in two ways that the guard
- * would have caught had the code lived here.
- *
- * @packageDocumentation
- */
-import { type EnclaveKey } from '../crypto.js';
-import type { EncryptedEnvelope } from '../../types.js';
-/**
- * Produce the envelope `envelope` becomes once its collection's DEK rotates
- * from `oldDek` to `newDek`.
- *
- * **Every slot is carried forward except `_bidx`.** The previous inline version
- * built a fresh literal holding only `_noydb/_v/_ts/_iv/_data`, silently
- * discarding `_by`, `_tier`, `_cek`, `_sealed`, `_vdig` and `_source`. Losing
- * `_tier` was the worst of those: tier-0 reads treat elevated as missing, so an
- * elevated record did not error after a rotation — it simply disappeared.
- *
- * `_bidx` is dropped deliberately. It is a DEK-rooted equality tag, so a tag
- * carried across a DEK rotation can never be re-derived to match a query again
- * while still leaking the old equality partition. Index coverage regrows
- * per-record on the next `put()` under the new DEK.
- *
- * Two shapes, and picking the wrong one is why this needed a helper:
- *
- * - **per-record CEK** (`_cek` present) — the body is sealed under the CEK and
- *   the CEK is wrapped under the collection DEK, so rotation re-wraps the CEK
- *   and leaves the body **untouched**. The old inline code instead ran
- *   `decrypt(body, oldDek)` on these, which throws: rotation could not complete
- *   on a collection containing any CEK record.
- * - **bare** — body sealed directly under the DEK, so decrypt and re-encrypt.
- *
- * Idempotence is the caller's problem, not this function's: it assumes
- * `envelope` is still under `oldDek`. A resumable rotation must know which side
- * of the migration each record is on before calling.
- */
-export declare function rekeyEnvelopeToDek(ref: {
-    readonly collection: string;
-    readonly id: string;
-}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope>;
-/**
- * Resumable variant: returns the re-keyed envelope, or `null` when `envelope`
- * is **already** under `newDek` and needs no work (#1074 part 2).
- *
- * A rotation interrupted mid-collection leaves records on both sides of the
- * migration. Resuming means re-running the rotation with the *same* new DEK,
- * which requires distinguishing "not yet moved" from "already moved" without
- * the caller touching protected slots.
- *
- * Detection is by trial decryption under `oldDek`. There is no metadata that
- * says which DEK sealed a record — deliberately, since such a marker would be
- * store-writable and therefore a downgrade lever (the same reasoning that
- * keeps the reader from branching on `_noydb`).
- *
- * A record that opens under *neither* key is genuinely damaged and rethrows,
- * rather than being silently skipped: a rotation that quietly walked past
- * unreadable records would convert a loud failure into permanent silent loss,
- * which is the defect this whole issue is about.
- */
-export declare function rekeyEnvelopeIfNeeded(ref: {
-    readonly collection: string;
-    readonly id: string;
-}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope | null>;
-/**
- * Does this envelope open under ANY of `keys`? A read-only probe — decrypts
- * nothing into a caller-visible value and writes nothing.
- *
- * Exists so a rotation can tell *"this envelope belongs to a DIFFERENT DEK slot
- * the caller also holds"* from *"this envelope is damaged"* (#1125). Those two
- * look identical from a failed `rekeyEnvelopeIfNeeded`, and collapsing them
- * either aborts a legitimate rotation or walks past unreadable data.
- *
- * **The question is deliberately asked of the KEY, not of the envelope's claimed
- * `_tier`.** `_tier` is unencrypted — the store writes it — so routing a
- * rotation on it would let a store mark a tier-0 record `_tier: 5` and have the
- * rotation skip it, leaving a revoked member's DEK live on real data. That is
- * #1115's defect wearing a different hat. A key either opens the body or it does
- * not, and a store cannot forge that.
- *
- * Mirrors `rekeyBlobSet`'s `otherDeks` treatment, which asks the same question
- * about the same kind of ambiguity.
- */
-export declare function envelopeOpensUnderAny(ref: {
-    readonly collection: string;
-    readonly id: string;
-}, envelope: EncryptedEnvelope, keys: readonly EnclaveKey[]): Promise<boolean>;

package/dist/kernel/enclave/record-keys/sealed-slot.d.ts

@@ -1,14 +0,0 @@
-/** Parse an `iv:data` sealed slot (split on the FIRST `:`). */
-export declare function parseSealedSlot(blob: string): {
-    iv: string;
-    data: string;
-};
-/**
- * Dual-read: decrypt a sealed slot trying the CEK-derived field key first,
- * falling back to the collection-DEK field key. Legacy records
- * (even ones whose body is CEK-encrypted) are sealed under the collection-DEK
- * key; current writes seal under the per-record CEK. Try the CEK key first; on
- * its AES-GCM auth failure, fall back to the DEK key. Throws only if BOTH fail.
- * Returns the plaintext string (callers `JSON.parse` as needed).
- */
-export declare function dualReadSealedSlot(blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey): Promise<string>;

package/dist/kernel/enclave/record-keys/sealed-slots.d.ts

@@ -1,123 +0,0 @@
-/**
- * Sealed-slot sub-step — the "seal these declared fields into their own
- * `iv:data` slots" mechanism, extracted byte-parity from `RecordCodec`
- * (#629 Task 1; see `.superpowers/sdd/seam-map-classified-blobs.md` §2).
- *
- * This is the ONE genuinely separable sub-step `RecordCodec.encryptRecord`/
- * `decryptRecord` perform (the digest-only `_vdig`/`_bidx` mechanism is NOT
- * separable the same way — it needs write-history `prev` context, see the
- * seam map's separability verdict). `sealFields`/`unsealFields` are the
- * natural shape of a `via` `encodeAtRest`/`decodeAtRest` hook for a "seal
- * this field" via-feature, and `makeSealedSlotCapability`/
- * `makeReservedEnvelopes` (below) are the `ViaCryptoCtx` capability
- * factories built on top of them.
- *
- * The capability factories live here (rather than a sibling
- * `kernel/via-crypto.ts`) so they can call `deriveSealedFieldKey`/
- * `deriveSealedFieldKeyFromCek`/`encrypt`/`decrypt` directly — this file IS
- * kernel enclave code (C3), so it is exempt from `enclave-barrel-only` the
- * same way `record-codec.ts`/`sealing.ts` are. A file outside
- * `kernel/enclave/**` would have had to go through the enclave barrel
- * (`kernel/enclave/index.ts`), which does not (yet) export these symbols.
- */
-import { type EnclaveKey } from '../crypto.js';
-import { SealedHandle } from '../../types.js';
-import type { ViaCryptoCtx } from '../../via/index.js';
-/**
- * Key material for one collection's sealed-field derivation. `cek`, when
- * supplied, is preferred (record-scoped); `getDEK` is the fallback (and,
- * for legacy/no-CEK collections, the only key) — mirrors the dual-read
- * `RecordCodec` has always done.
- */
-export interface SealKeyMaterial {
-    readonly collection: string;
-    readonly cek?: EnclaveKey;
-    getDEK(): Promise<EnclaveKey>;
-}
-export interface SealFieldsResult {
-    readonly openRecord: Record<string, unknown>;
-    readonly sealed: Record<string, string> | undefined;
-}
-/**
- * Peel declared `sensitiveFields` out of `record` BEFORE building `_data`,
- * sealing each into its own `iv:data` slot. Extracted byte-parity from
- * `RecordCodec.encryptRecord` step 2 (pre-#629 `record-codec.ts:261-288`).
- * Returns `record` untouched (and `sealed: undefined`) when no declared
- * field is present with a defined value — the envelope stays byte-identical
- * to legacy output, exactly as before.
- */
-export declare function sealFields(record: Record<string, unknown>, sensitiveFields: ReadonlySet<string>, keyMaterial: SealKeyMaterial): Promise<SealFieldsResult>;
-/**
- * Unseal one `_sealed[field]` slot to its plaintext value: dual-read (try
- * the CEK-derived key, fall back to the DEK-derived key for legacy
- * records), AES-GCM-decrypt the `iv:data` blob, and JSON-parse the result.
- * Extracted byte-parity from `RecordCodec.unsealField`
- * (pre-#629 `record-codec.ts:485-493`).
- */
-export declare function unsealOneField(field: string, blob: string, keyMaterial: SealKeyMaterial): Promise<unknown>;
-/**
- * Build a non-leaking {@link SealedHandle} producer over sealed key
- * material: each call captures only the ciphertext `blob` and a closure to
- * {@link unsealOneField} — the plaintext is never stored on the handle, and
- * (crucially) the DEK is fetched lazily on `reveal()`, never at handle-
- * construction time. Extracted byte-parity from
- * `RecordCodec.makeSealedHandle` (pre-#629 `record-codec.ts:552-554`).
- */
-export declare function makeHandleProducer(keyMaterial: SealKeyMaterial): (field: string, blob: string) => SealedHandle<unknown>;
-/**
- * Restore every `[field]: blob` entry in `sealed` onto `record` (mutated in
- * place, matching the original's mutate-then-return shape): eagerly unseal
- * to plaintext (`opts.asHandles` falsy) or wrap each in a
- * {@link SealedHandle} (`opts.asHandles: true`) so the plaintext is never
- * materialised. Extracted byte-parity from `RecordCodec.decryptRecord`'s
- * sealed-handle block (pre-#629 `record-codec.ts:615-623`).
- */
-export declare function unsealFields(record: Record<string, unknown>, sealed: Record<string, string>, keyMaterial: SealKeyMaterial, opts?: {
-    asHandles?: boolean;
-}): Promise<Record<string, unknown>>;
-/** What {@link makeSealedSlotCapability} needs — a subset of `RecordCodecContext`. */
-export interface SealedSlotCapabilityCtx {
-    readonly name: string;
-    getDEK(): Promise<EnclaveKey>;
-}
-/**
- * Build a `ViaCryptoCtx.sealedSlots` capability pre-bound to one
- * `(collection, recordId)`. The key material (`cek`/DEK resolver) is closed
- * over and never placed on the returned object — `Object.keys`/
- * `Object.values` of the capability expose only the three methods, never a
- * key (zero-knowledge: capabilities never expose keys).
- *
- * `delete(field)` is **advisory and capability-instance-local, not real
- * erasure** — it has no store to reach and never will by itself: it just
- * adds `field` to a `Set` closed over by THIS ONE capability object, so a
- * later `unseal` call on that SAME object refuses. No I/O happens. A fresh
- * capability for the same record (e.g. `seal()`'d again, or a new
- * `makeSealedSlotCapability(...)` call) has an empty set and sees no
- * deletion at all — `seal()` on a given field also clears any prior mark
- * for it. Do not build production logic on `delete()` persisting anything.
- * The real erasure guarantee for a forgotten record is `vault.forget()`'s
- * unconditional `_writeTombstone` call, which replaces the whole live
- * envelope with a fresh, `_sealed`-free tombstone — `_sealed` disappears
- * from the store regardless of what any capability's `delete()` marked.
- * (#629 Task 10 traced this end-to-end; see task-10-report.md "sealedSlots
- * .delete()" section. Removing/changing this method's shape is a phase-E
- * decision, not implied by this comment.)
- */
-export declare function makeSealedSlotCapability(ctx: SealedSlotCapabilityCtx, recordId: string, cek?: EnclaveKey): ViaCryptoCtx['sealedSlots'];
-/** Resolve the DEK for an arbitrary (possibly synthetic, e.g. `_dict_en`) collection name. */
-export type ReservedEnvelopeDekResolver = (collection: string) => Promise<EnclaveKey>;
-/**
- * Build a `ViaCryptoCtx.reservedEnvelopes` capability: a whole-envelope
- * encrypt/decrypt door scoped to collection names under a declared prefix
- * (e.g. `_dict_`) — the shape `via/i18n/dictionary.ts`'s
- * `DictionaryHandle` needs (seam map Part 3): build JSON → encrypt under a
- * DEK → wrap in an `EncryptedEnvelope`; decrypt → JSON text. No per-record
- * CEK — reserved envelopes are whole-DEK-encrypted, same as the dictionary
- * grandfather.
- *
- * `reservedEnvelopes(prefix)` throws `ValidationError` immediately when
- * `prefix` is not in `declaredPrefixes`; each `encrypt`/`decrypt` call
- * throws `ValidationError` when its `collection` argument does not start
- * with `prefix`.
- */
-export declare function makeReservedEnvelopes(dekResolver: ReservedEnvelopeDekResolver, declaredPrefixes: readonly string[]): ViaCryptoCtx['reservedEnvelopes'];

package/dist/kernel/enclave/record-keys/sealing.d.ts

@@ -1,70 +0,0 @@
-/**
- * Record-scoped CEK sealing — grantor side.
- *
- * The **grantor** holds the collection DEK and seals ONE record's CEK to an
- * `at-*` host so that host — and only that host — can decrypt exactly that
- * record, with no access to the vault DEK and no ability to read any other
- * record. This is the counterpart to the host-side `openSealedRecord`
- * (`@noy-db/hub/sealed-record`), which holds no DEK.
- *
- * These functions are the orchestration behind `vault.sealRecordToHost` /
- * `vault.revokeSealedRecord` / `vault.rotateRecordCek`, lifted off `Vault`
- * behind a narrow {@link SealingContext} so the kernel file delegates. They
- * live in `record-keys/` (the vault-side CEK policy layer), NOT in
- * `sealed-record/`, so the host-side subpath stays DEK-free — the wire
- * *types* they share are spine-owned (`kernel/types.ts`), not imported from
- * `sealed-record/` directly.
- */
-import { type EnclaveKey } from '../crypto.js';
-import { type NoydbStore, type RecipientSealer } from '../../types.js';
-/** The `_sealed_cek` delivery namespace (one envelope per `collection/id/pid`). */
-export declare const SEALED_CEK_NS = "_sealed_cek";
-/** What the grantor functions need from their `Vault`. */
-export interface SealingContext {
-    readonly adapter: NoydbStore;
-    /** Vault id (the adapter's first coordinate). */
-    readonly vault: string;
-    /** Resolve the DEK a record's CEK is wrapped under. */
-    getDEK(collection: string): Promise<EnclaveKey>;
-    /** Actor id stamped on `_by` (empty string → omit). */
-    readonly actor: string;
-    /** Evict the per-record CEK cache + decrypted-record cache after a rotation. */
-    invalidateRecordCaches(collection: string, id: string): Promise<void>;
-}
-/**
- * Seal a record's CEK to a host. See `vault.sealRecordToHost` for the contract.
- * Returns `{ pid, envelopeKey }`.
- */
-export declare function sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {
-    expiresAt: string;
-}): Promise<{
-    pid: string;
-    envelopeKey: string;
-}>;
-/**
- * Revoke one sealed-CEK grant.
- *
- * **Default (`{ hard: false }`) is SOFT** — it only deletes the delivery
- * envelope from the store. A host that already fetched (or cached the unsealed
- * CEK from) that envelope KEEPS decrypt capability for the record; soft revoke
- * is a "stop new fetches" control, not a cryptographic cutoff.
- *
- * **`{ hard: true }`** additionally rotates the record's CEK (via
- * {@link rotateRecordCek}): the live body is re-encrypted under a fresh CEK and
- * EVERY sealed-CEK delivery envelope for the record (all pids) is deleted, so
- * any previously-sealed CEK fails the AES-GCM auth tag on the rotated body —
- * future opens are cryptographically denied. (PRE-rotation history versions,
- * which keep their old `_cek`, remain openable — same semantics as
- * `rotateRecordCek`.)
- */
-export declare function revokeSealedRecord(ctx: SealingContext, collection: string, id: string, pid: string, opts?: {
-    hard?: boolean;
-}): Promise<void>;
-/**
- * HARD-rotate a record's CEK: re-encrypt the live body under a fresh CEK, evict
- * caches, and delete EVERY sealed-CEK delivery envelope for the record. See
- * `vault.rotateRecordCek` for why this bypasses `Collection.put` (no guards, no
- * history bump — a key rotation must not re-encrypt prior history under the new
- * CEK).
- */
-export declare function rotateRecordCek(ctx: SealingContext, collection: string, id: string): Promise<void>;

package/dist/liberate-GRLCZMW4.js

@@ -1,24 +0,0 @@
-import {
-  liberateVault
-} from "./chunk-HVSCEIYL.js";
-import "./chunk-S57HTZ6X.js";
-import "./chunk-WNJ4AVGE.js";
-import "./chunk-ENAG3IY7.js";
-import "./chunk-HBPPGWUM.js";
-import "./chunk-IUWCVHQ7.js";
-import "./chunk-M7NI3IWE.js";
-import "./chunk-7VCXZDA4.js";
-import "./chunk-JCN44NCY.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  liberateVault
-};
-//# sourceMappingURL=liberate-GRLCZMW4.js.map

package/dist/link-set-JCMJ7ULP.js

@@ -1,30 +0,0 @@
-import {
-  LinkEndpointError,
-  LinkSet
-} from "./chunk-3F7GLNAE.js";
-import {
-  LINK_COLLECTION_PREFIX,
-  LinkIntegrityError,
-  isLinkCollectionName,
-  linkCollectionName,
-  linkRowKey
-} from "./chunk-AOWGXU6D.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  LINK_COLLECTION_PREFIX,
-  LinkEndpointError,
-  LinkIntegrityError,
-  LinkSet,
-  isLinkCollectionName,
-  linkCollectionName,
-  linkRowKey
-};
-//# sourceMappingURL=link-set-JCMJ7ULP.js.map

package/dist/noydb-SWQJ3MZS.js

@@ -1,97 +0,0 @@
-import {
-  Noydb,
-  createNoydb
-} from "./chunk-T2LBQ5DV.js";
-import "./chunk-AOWGXU6D.js";
-import "./chunk-6K7DPM7D.js";
-import "./chunk-TROR3ALR.js";
-import "./chunk-EPFF7LOX.js";
-import "./chunk-L7DOS3TE.js";
-import "./chunk-6LNL42F5.js";
-import "./chunk-GYGLAVCX.js";
-import "./chunk-6LJY7X5A.js";
-import "./chunk-UPD5NWI5.js";
-import "./chunk-ZUVBC32X.js";
-import "./chunk-A6IJU4TK.js";
-import "./chunk-RXLYKVTF.js";
-import "./chunk-ENAG3IY7.js";
-import "./chunk-3JWHAR6E.js";
-import "./chunk-K6W7BVZ6.js";
-import "./chunk-MLPHLJIQ.js";
-import "./chunk-T7IR4N2S.js";
-import "./chunk-X4773RBR.js";
-import "./chunk-SMY5X46Z.js";
-import "./chunk-DZFQVICS.js";
-import "./chunk-5FDLC6G7.js";
-import "./chunk-5D2ALSM5.js";
-import "./chunk-I3JDRCMW.js";
-import "./chunk-AURFOK3D.js";
-import "./chunk-M522UYZ2.js";
-import "./chunk-B6SJIBQK.js";
-import "./chunk-UD5EVGZ7.js";
-import "./chunk-TFMM5DBB.js";
-import "./chunk-MDWKM2XC.js";
-import "./chunk-VYYM3MEN.js";
-import "./chunk-PSIV7CJV.js";
-import "./chunk-Y2NBBT6K.js";
-import "./chunk-3H5KLDZN.js";
-import "./chunk-FH2L2E34.js";
-import "./chunk-QOOUUR4A.js";
-import "./chunk-NYMLINRP.js";
-import "./chunk-HBRLNOHL.js";
-import "./chunk-66TQOPFM.js";
-import "./chunk-V4PXLYWM.js";
-import "./chunk-XZHEOSQ2.js";
-import "./chunk-PVEWA2DU.js";
-import "./chunk-PEOZ34EM.js";
-import "./chunk-RHVMZSUU.js";
-import "./chunk-NRT6QZQB.js";
-import "./chunk-GHVIKOHT.js";
-import "./chunk-FW22ZCXT.js";
-import "./chunk-PDCG6PR5.js";
-import "./chunk-BKT776R5.js";
-import "./chunk-YSK2CU2Q.js";
-import "./chunk-ORDURZBU.js";
-import "./chunk-SUZKW6UR.js";
-import "./chunk-XBKH4FOC.js";
-import "./chunk-LGNDFRYC.js";
-import "./chunk-F24ZZTHQ.js";
-import "./chunk-7JE7BDYJ.js";
-import "./chunk-3TDUWVWB.js";
-import "./chunk-5O7D6ZTW.js";
-import "./chunk-HLEK5VAN.js";
-import "./chunk-GF5BZ7D4.js";
-import "./chunk-ANWPSTZU.js";
-import "./chunk-TKUOEU2F.js";
-import "./chunk-DF73H4UN.js";
-import "./chunk-GHLTDZRS.js";
-import "./chunk-Z5HTYMMQ.js";
-import "./chunk-ZE4CHIED.js";
-import "./chunk-DC5QVPV7.js";
-import "./chunk-M7NI3IWE.js";
-import "./chunk-7VCXZDA4.js";
-import "./chunk-SOIQ4MM4.js";
-import "./chunk-4AF3TUMP.js";
-import "./chunk-VKQCVU2Z.js";
-import "./chunk-4AOERLTV.js";
-import "./chunk-QWGU66MP.js";
-import "./chunk-ZXABPVM6.js";
-import "./chunk-I7FD46FF.js";
-import "./chunk-CKNGS5MH.js";
-import "./chunk-JCN44NCY.js";
-import "./chunk-HK67PX4J.js";
-import "./chunk-J6UOHJY5.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  Noydb,
-  createNoydb
-};
-//# sourceMappingURL=noydb-SWQJ3MZS.js.map

package/dist/pod-handle-WGDFB4C2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-pod/pod-handle.ts"],"sourcesContent":["/**\n * Vault bundle handle — the stable opaque ULID identifying a vault\n * across `.noydb` exports.\n *\n * Behaviour is byte-identical to the inline `Vault.getPodHandle`\n * method this function replaced. `Vault` keeps the public method as\n * a thin delegator.\n *\n * Internal — reached through `vault.getPodHandle()`.\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js'\nimport { buildRecordEnvelope } from '../kernel/enclave/index.js'\n\n/**\n * Return the stable opaque bundle handle for the given vault adapter,\n * generating and persisting a fresh ULID on first call.\n *\n * See {@link import('../kernel/vault.js').Vault.getPodHandle} for\n * the full rationale and storage-path documentation.\n */\nexport async function buildPodHandle(adapter: NoydbStore, name: string): Promise<string> {\n  const existing = await adapter.get(name, '_meta', 'handle')\n  if (existing) {\n    try {\n      const parsed = JSON.parse(existing._data) as unknown\n      if (parsed !== null && typeof parsed === 'object' && 'handle' in parsed) {\n        const handle = (parsed as { handle: unknown }).handle\n        if (typeof handle === 'string' && /^[0-9A-HJKMNP-TV-Z]{26}$/.test(handle)) {\n          return handle\n        }\n      }\n    } catch {\n      // Fall through to regenerate — corrupted handle envelope\n      // is treated as missing, not as an error. The new handle\n      // overwrites the bad one.\n    }\n  }\n  const { generateULID } = await import('./ulid.js')\n  const handle = generateULID()\n  const envelope: EncryptedEnvelope = buildRecordEnvelope(\n    { collection: '_meta', id: 'handle', version: 1 },\n    { iv: '', data: JSON.stringify({ handle }) },\n  )\n  await adapter.put(name, '_meta', 'handle', envelope)\n  return handle\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,eAAsB,eAAe,SAAqB,MAA+B;AACvF,QAAM,WAAW,MAAM,QAAQ,IAAI,MAAM,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,UAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,YAAY,QAAQ;AACvE,cAAMA,UAAU,OAA+B;AAC/C,YAAI,OAAOA,YAAW,YAAY,2BAA2B,KAAKA,OAAM,GAAG;AACzE,iBAAOA;AAAA,QACT;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAIR;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAW;AACjD,QAAM,SAAS,aAAa;AAC5B,QAAM,WAA8B;AAAA,IAClC,EAAE,YAAY,SAAS,IAAI,UAAU,SAAS,EAAE;AAAA,IAChD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE;AAAA,EAC7C;AACA,QAAM,QAAQ,IAAI,MAAM,SAAS,UAAU,QAAQ;AACnD,SAAO;AACT;","names":["handle"]}

package/dist/post-register-SLSXIPBV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/satellites/marker.ts","../src/with-shape/satellites/post-register.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { SatelliteConfigError } from '../../kernel/errors.js'\nimport { hashFields } from './validate.js'\nimport type { PairingMarker, SatelliteSpec } from './types.js'\n\n/**\n * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.\n * First declaration writes { base, fieldsHash, joined }; later declarations\n * must match exactly or are refused (R-S9). Lazy imports keep the satellite\n * spine tree-shakeable (config-drift.ts pattern).\n */\nexport async function ensureSatelliteMarker(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec, dek: EnclaveKey,\n): Promise<void> {\n  // #597: `epoch` only matters the first time this marker is ever persisted —\n  // when a `prior` marker already exists below we return without ever using\n  // it, so re-declaring a LIVE collection never mints (or compares) a new\n  // epoch; the persisted one is carried forward untouched. Stamped here as a\n  // timestamp (mirrors `derivedAt` in persisted-schemas/register.ts) rather\n  // than a counter, since there's nothing to count from yet.\n  const next: PairingMarker = {\n    base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined,\n    epoch: new Date().toISOString(),\n  }\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek)\n  const prior = persisted?.satellite\n  if (prior) {\n    if (prior.base !== next.base || prior.fieldsHash !== next.fieldsHash || (prior.joined ?? null) !== (next.joined ?? null)) {\n      throw new SatelliteConfigError(\n        `R-S9: satellite \"${spec.satellite}\" re-declared divergently from its persisted pairing marker ` +\n        `(persisted base=\"${prior.base}\" fieldsHash=${prior.fieldsHash}; declared base=\"${next.base}\" fieldsHash=${next.fieldsHash}). ` +\n        `Evolve the marker deliberately, don't redeclare.`,\n      )\n    }\n    return\n  }\n  const { persistSatelliteMarker } = await import('../persisted-schemas/register.js')\n  await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next })\n}\n","import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { SatelliteSpec } from './types.js'\nimport type { SatelliteRegistry } from './registry.js'\nimport { ensureSatelliteMarker } from './marker.js'\n\n/** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */\nexport async function postRegister(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec,\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n  baseSchema: unknown, registry: SatelliteRegistry,\n): Promise<void> {\n  try {\n    await ensureSatelliteMarker(store, vaultName, spec, await getDEK(spec.satellite))\n  } catch (err) {\n    registry.poison(spec.satellite, (err as Error).message); return\n  }\n  if (baseSchema !== undefined) {\n    try {\n      const { derivePersistedSchema } = await import('../persisted-schemas/derive.js')\n      const envelope = await derivePersistedSchema(baseSchema)\n      const properties = (envelope.jsonSchema as Record<string, unknown> | null)?.['properties'] as Record<string, unknown> | undefined\n      const baseFields: string[] = Object.keys(properties ?? {})\n      const overlap = spec.fields.filter(f => baseFields.includes(f))\n      if (overlap.length > 0) {\n        registry.poison(spec.satellite,\n          `R-S1: satellite \"${spec.satellite}\" fields overlap the base schema: ${overlap.join(', ')} — routing must be unambiguous.`)\n      }\n    } catch { /* non-derivable validator → cross-check unavailable, by design (spec R-S5) */ }\n  }\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,sBACpB,OAAmB,WAAmB,MAAqB,KAC5C;AAOf,QAAM,OAAsB;AAAA,IAC1B,MAAM,KAAK;AAAA,IAAM,YAAY,WAAW,KAAK,MAAM;AAAA,IAAG,QAAQ,KAAK;AAAA,IACnE,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,KAAK,WAAW,GAAG;AACjF,QAAM,QAAQ,WAAW;AACzB,MAAI,OAAO;AACT,QAAI,MAAM,SAAS,KAAK,QAAQ,MAAM,eAAe,KAAK,eAAe,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACxH,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,SAAS,gFACd,MAAM,IAAI,gBAAgB,MAAM,UAAU,oBAAoB,KAAK,IAAI,gBAAgB,KAAK,UAAU;AAAA,MAE5H;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,wBAAkC;AAClF,QAAM,uBAAuB,EAAE,OAAO,OAAO,WAAW,gBAAgB,KAAK,WAAW,KAAK,QAAQ,KAAK,CAAC;AAC7G;;;ACjCA,eAAsB,aACpB,OAAmB,WAAmB,MACtC,QACA,YAAqB,UACN;AACf,MAAI;AACF,UAAM,sBAAsB,OAAO,WAAW,MAAM,MAAM,OAAO,KAAK,SAAS,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,aAAS,OAAO,KAAK,WAAY,IAAc,OAAO;AAAG;AAAA,EAC3D;AACA,MAAI,eAAe,QAAW;AAC5B,QAAI;AACF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,sBAAgC;AAC/E,YAAM,WAAW,MAAM,sBAAsB,UAAU;AACvD,YAAM,aAAc,SAAS,aAAgD,YAAY;AACzF,YAAM,aAAuB,OAAO,KAAK,cAAc,CAAC,CAAC;AACzD,YAAM,UAAU,KAAK,OAAO,OAAO,OAAK,WAAW,SAAS,CAAC,CAAC;AAC9D,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS;AAAA,UAAO,KAAK;AAAA,UACnB,oBAAoB,KAAK,SAAS,qCAAqC,QAAQ,KAAK,IAAI,CAAC;AAAA,QAAiC;AAAA,MAC9H;AAAA,IACF,QAAQ;AAAA,IAAiF;AAAA,EAC3F;AACF;","names":[]}

package/dist/register-F3OYE7MJ.js

@@ -1,31 +0,0 @@
-import {
-  persistClassifiedMarker,
-  persistSatelliteMarker,
-  persistSchemaIfNeeded
-} from "./chunk-6LMQ5R26.js";
-import "./chunk-ZVF37PKE.js";
-import "./chunk-SYVZW77S.js";
-import "./chunk-EPFF7LOX.js";
-import "./chunk-L7DOS3TE.js";
-import "./chunk-PSIV7CJV.js";
-import "./chunk-Y2NBBT6K.js";
-import "./chunk-3H5KLDZN.js";
-import "./chunk-GHVIKOHT.js";
-import "./chunk-ZXABPVM6.js";
-import "./chunk-I7FD46FF.js";
-import "./chunk-CKNGS5MH.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  persistClassifiedMarker,
-  persistSatelliteMarker,
-  persistSchemaIfNeeded
-};
-//# sourceMappingURL=register-F3OYE7MJ.js.map

package/dist/registry-CILQFXFK.js

@@ -1,8 +0,0 @@
-import {
-  GuardRegistry
-} from "./chunk-VNNRUGMM.js";
-import "./chunk-244VXYPG.js";
-export {
-  GuardRegistry
-};
-//# sourceMappingURL=registry-CILQFXFK.js.map

package/dist/registry-XNNYQVKV.js

@@ -1,8 +0,0 @@
-import {
-  OverlayedViewRegistry
-} from "./chunk-BK2HHQGN.js";
-import "./chunk-244VXYPG.js";
-export {
-  OverlayedViewRegistry
-};
-//# sourceMappingURL=registry-XNNYQVKV.js.map

package/dist/registry-YCDZV3VW.js

@@ -1,35 +0,0 @@
-import {
-  DerivationRegistry
-} from "./chunk-VNPEWFPD.js";
-import "./chunk-FFWI7UH7.js";
-import "./chunk-UD5EVGZ7.js";
-import "./chunk-TFMM5DBB.js";
-import "./chunk-MDWKM2XC.js";
-import "./chunk-VYYM3MEN.js";
-import "./chunk-PSIV7CJV.js";
-import "./chunk-Y2NBBT6K.js";
-import "./chunk-3H5KLDZN.js";
-import "./chunk-FH2L2E34.js";
-import "./chunk-QOOUUR4A.js";
-import "./chunk-NYMLINRP.js";
-import "./chunk-V4PXLYWM.js";
-import "./chunk-ORDURZBU.js";
-import "./chunk-XBKH4FOC.js";
-import "./chunk-TKUOEU2F.js";
-import "./chunk-DF73H4UN.js";
-import "./chunk-GHLTDZRS.js";
-import "./chunk-Z5HTYMMQ.js";
-import "./chunk-CKNGS5MH.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  DerivationRegistry
-};
-//# sourceMappingURL=registry-YCDZV3VW.js.map

package/dist/registry-ZGYS33TE.js

@@ -1,24 +0,0 @@
-import {
-  MaterializedViewRegistry,
-  ungatedMvContext,
-  wrapDbWithPredicates
-} from "./chunk-NWHBJQAL.js";
-import "./chunk-XBKH4FOC.js";
-import "./chunk-MKXXMNJH.js";
-import "./chunk-LGNDFRYC.js";
-import "./chunk-HLEK5VAN.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  MaterializedViewRegistry,
-  ungatedMvContext,
-  wrapDbWithPredicates
-};
-//# sourceMappingURL=registry-ZGYS33TE.js.map

package/dist/request-withdrawal-Z5NC6TXT.js

@@ -1,30 +0,0 @@
-import {
-  WITHDRAWAL_REQUESTS_COLLECTION,
-  WithdrawalRequestError,
-  approveWithdrawal,
-  listWithdrawalRequests,
-  rejectWithdrawal,
-  requestWithdrawal
-} from "./chunk-FCKWQE2H.js";
-import "./chunk-S57HTZ6X.js";
-import "./chunk-WNJ4AVGE.js";
-import "./chunk-HBPPGWUM.js";
-import "./chunk-IUWCVHQ7.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  WITHDRAWAL_REQUESTS_COLLECTION,
-  WithdrawalRequestError,
-  approveWithdrawal,
-  listWithdrawalRequests,
-  rejectWithdrawal,
-  requestWithdrawal
-};
-//# sourceMappingURL=request-withdrawal-Z5NC6TXT.js.map

package/dist/reveal-4BCKPEC2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK,GAAG;AAC3E,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}

package/dist/revoke-ZL62WC2D.js

@@ -1,23 +0,0 @@
-import {
-  getRevokedDocIdsCore,
-  publishRevocationListCore,
-  revokeDocCore,
-  unrevokeDocCore
-} from "./chunk-NNARWO72.js";
-import "./chunk-QWFHIOD2.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  getRevokedDocIdsCore,
-  publishRevocationListCore,
-  revokeDocCore,
-  unrevokeDocCore
-};
-//# sourceMappingURL=revoke-ZL62WC2D.js.map