@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/kernel/types.d.ts

@@ -68,7 +68,7 @@ import type { FormatsStrategy } from '../port/with/formats-strategy.js';
 import type { NoydbMesh } from '../port/by/types.js';
 import type { ScriptWarning } from '../port/with/i18n-strategy.js';
 import type { ViaDescriptor } from './via/index.js';
-import type { EnclaveKey, EchoSecretParts } from './enclave/index.js';
+import type { EnclaveKey, EchoSecretParts } from '../capsule/index.js';
 import type { NoydbDeviceSeal } from '../port/with/device-seal-strategy.js';
 export type { EchoSecretParts };
 /** Format version for encrypted record envelopes. */
@@ -163,13 +163,57 @@ export type Permission = 'rw' | 'ro';
  * `'*'` is the wildcard collection matching all collections in the vault.
  */
 export type Permissions = Record<string, Permission>;
-/** The encrypted wrapper stored by stores. Stores only ever see this. */
-export interface EncryptedEnvelope {
+/**
+ * The wrapper stored by stores. Stores only ever see this.
+ *
+ * ⚠️ **`_iv`/`_data` are OPTIONAL, and that is a capsule contract, not a
+ * convenience** (#15). An *enclave* capsule (the default, `enclave-aes`)
+ * always writes both; an *exclave* capsule stores a plaintext row and has no
+ * ciphertext body at all, so it writes neither.
+ *
+ * **Absence and `''` mean the same thing: no sealed body.** That equivalence
+ * is not new — a tombstone, a delete marker (`_del`) and a plaintext
+ * collection have carried `_iv: ''` since the format's first version, and
+ * {@link hasSealedBody} has always been the question callers ask. Widening
+ * only lets a capsule omit the keys instead of emptying them; every existing
+ * envelope on disk keeps its exact bytes and reads back identically.
+ *
+ * Consequently NOTHING here is a wire-format change, and `NOYDB_FORMAT_VERSION`
+ * does not move. What changed is that every READER must now cope with absence
+ * — which is the whole point, since the store contract at `@noy-db/hub/to` is
+ * what an exclave's rows travel through.
+ *
+ * ⛔⛔ THERE ARE TWO KINDS OF BODY, AND CONFLATING THEM IS A REAL BUG. This
+ * cost a downstream package real time in 0.8.0, so it is written here rather
+ * than left to be rediscovered:
+ *
+ *   - **A SEALED body** — `_iv` is a real IV and `_data` is ciphertext. Ask
+ *     {@link hasSealedBody}, which tests `_iv`.
+ *   - **A PLAINTEXT body** — `_data` holds readable JSON and `_iv` is `''`.
+ *     Reserved collections (`_keyring`, `_meta`) and any collection opened
+ *     with `encrypt: false` are this shape, by a convention that predates the
+ *     widening.
+ *
+ * ⛔ So a record can HAVE a body while having NO SEALED body, and
+ * `hasSealedBody` returns **false** for it. Guarding a `_data` read with
+ * `hasSealedBody` therefore rejects every valid record on those collections —
+ * measured: it would reject every enrolled user of a password unlock. To ask
+ * "is there a body to read as text", test `_data` itself (`if (!env._data)`),
+ * which is exactly what the optional type is for.
+ *
+ * ⚠️ And `_iv === ''` is NOT a safe hand-rolled substitute for
+ * `hasSealedBody`. The comparison stays well-typed when `_iv` is absent and
+ * silently answers `false` — four sites inside hub were wrong that way before
+ * the widening landed.
+ */
+export interface Envelope {
     readonly _noydb: typeof NOYDB_FORMAT_VERSION;
     readonly _v: number;
     readonly _ts: string;
-    readonly _iv: string;
-    readonly _data: string;
+    /** Body IV. Absent (≡ `''`) when there is no sealed body — see the interface doc. */
+    readonly _iv?: string;
+    /** Body ciphertext, or plaintext JSON on an unencrypted collection. Absent ≡ `''`. */
+    readonly _data?: string;
     /** User who created this version (unencrypted metadata). */
     readonly _by?: string;
     /**
@@ -208,7 +252,7 @@ export interface EncryptedEnvelope {
      * value)`) without decrypting every record. Leaks equality as a known
      * side channel.
      */
-    readonly _det?: Record<string, string>;
+    readonly _det?: Record<string, DeterministicCipher>;
     /**
      * Structural group-encryption. Map of sensitive field name →
      * per-field sealed ciphertext in `iv:data` form (same shape as a `_det`
@@ -278,6 +322,22 @@ export interface EncryptedEnvelope {
      */
     readonly _del?: true;
 }
+/**
+ * The former name of {@link Envelope}, kept as an exact alias.
+ *
+ * ⚠️ **It is an ALIAS, not a narrower type** — `EncryptedEnvelope._data` is
+ * `string | undefined` here too. Declaring it as a body-required subtype was
+ * considered and rejected: it would have let every existing hub reader keep
+ * compiling untouched, which is precisely the bug — a store handing back an
+ * exclave row would then fail at runtime in 43 files that the compiler had
+ * declared safe.
+ *
+ * Retiring the name is a 0.9 seam decision, not a 0.8 one: it is published
+ * from the root barrel and from `@noy-db/hub/to`, so removing it is breaking
+ * for every satellite that binds the store contract. It stays for the whole
+ * 0.8 line.
+ */
+export type EncryptedEnvelope = Envelope;
 /** Spine policy for one digest-only classified field — the enclave-consumable
  *  projection of a ClassifiedFieldSpec (the enclave never imports with-*). */
 export interface VdigFieldPolicy {
@@ -561,7 +621,7 @@ export interface CrossTierAccessEvent {
  * as `iv:data` (both base64, colon-separated) so a single string per
  * field keeps the envelope compact.
  */
-export type DeterministicCipher = string;
+type DeterministicCipher = string;
 /** All records across all collections for a compartment. */
 export type VaultSnapshot = Record<string, Record<string, EncryptedEnvelope>>;
 /**
@@ -725,9 +785,9 @@ export interface NoydbStore {
      * hub also falls back when the staged batch isn't statically safe
      * to submit as one write set — see `canCommitAtomically`.
      *
-     * Native implementations today: `to-memory` (one synchronous burst of
-     * Map mutations) and the SQL-backed stores in the sibling `noy-db-to`
-     * repo. `to-dynamo` (`TransactWriteItems`) and `to-browser-idb` (one
+     * Native implementations today: hub's own `memoryStore({ full: true })` (one
+     * synchronous burst of Map mutations) and the SQL-backed stores in the
+     * sibling `noy-db-to` repo — `to-memory` among them, since it moved there. `to-dynamo` (`TransactWriteItems`) and `to-browser-idb` (one
      * `readwrite` transaction) CAN implement it but do not yet. File / S3
      * cannot implement it atomically and should omit the method.
      */
@@ -827,7 +887,7 @@ export type VaultPolicyOnDisk = Record<string, unknown>;
  *   `db.recoverSecret` against these throws
  *   {@link RecoveryProfileNotImplementedError}.
  */
-export type RecoveryEnrollment = {
+type RecoveryEnrollment = {
     readonly profile: 'paper';
     /** Number of single-use codes to print at enrollment. */
     readonly codes: number;
@@ -1170,6 +1230,28 @@ export interface ExportStreamOptions {
      * (a full, all-locale backup; format packages apply their own locale strategy).
      */
     readonly resolveLabels?: string;
+    /**
+     * Export only these collections. Omitted (the default) exports every
+     * collection the caller can read.
+     *
+     * ⭐ This NARROWS THE READ — the excluded collections are neither fetched
+     * nor decrypted (core#45b). That is the whole point of the option living
+     * here rather than in a caller's filter: until 0.8 `vault.export`'s
+     * `collections` filtered the chunks AFTER `exportStream` had decrypted the
+     * entire vault, so a caller scoping an export to limit what a compromised
+     * process could observe got no such limit. The published JSDoc said so
+     * honestly; this makes the caveat false instead of merely known.
+     *
+     * ⚠️ A name that does not exist yields nothing rather than throwing — a
+     * caller exporting "these, if present" is an ordinary call, and refusing it
+     * would push a pre-check onto every caller.
+     *
+     * ⛔ Internal, underscore-prefixed collections stay unexportable even when
+     * named explicitly. The unscoped path gets that filter free from `loadAll`;
+     * the scoped path applies it itself, because a filter that depends on which
+     * route reached the data is a filter waiting to be lost.
+     */
+    readonly collections?: readonly string[];
 }
 /**
  * One chunk yielded by `Vault.exportStream()`.
@@ -1370,6 +1452,35 @@ export interface PushResult {
     /** #590: tombstone enforcements applied during this run (never resolver-visible). */
     readonly erasures?: ErasureEnforcement[];
 }
+/**
+ * core#81 — a progress sample during a pull or push. Emitted as
+ * `sync:progress`, throttled (every 25 records or ~250 ms, whichever first),
+ * and mirrored on `SyncTargetStatus.inFlight` for a UI that polls. `total`
+ * is present once the engine knows it: for a pull, after the remote snapshot
+ * has been downloaded (progress then measures the APPLY phase, which is the
+ * long one on an indexed store); for a push, from the first sample (the
+ * dirty log is local). `bytes` approximates ciphertext payload size.
+ */
+export interface SyncProgress {
+    readonly direction: 'pull' | 'push';
+    readonly phase: 'reserved' | 'summaries' | 'records';
+    readonly records: number;
+    readonly bytes: number;
+    readonly total?: {
+        readonly records: number;
+        readonly bytes?: number;
+    };
+}
+/** core#82 — result of `db.realign(vault)`. */
+export interface RealignResult {
+    /** Local user-collection envelopes examined. */
+    readonly checked: number;
+    /** Envelopes that failed to authenticate locally and were replaced from the target. */
+    readonly replaced: number;
+    /** Envelopes that failed locally AND the target's copy failed or was absent — left as they were, listed in `errors`. */
+    readonly unrecoverable: number;
+    readonly errors: Error[];
+}
 export interface PullResult {
     readonly pulled: number;
     readonly conflicts: Conflict[];
@@ -1413,6 +1524,8 @@ export interface SyncStatus {
     readonly lastPush: string | null;
     /** As {@link SyncStatus.lastPush}, for pulls: last pull that had no errors. */
     readonly lastPull: string | null;
+    /** core#81 — the running sync's latest progress sample, or absent when idle. */
+    readonly inFlight?: SyncProgress;
     /**
      * Whether the **browser** reports network connectivity — driven solely by the
      * global `online`/`offline` events (#1034). It is NOT target reachability: an
@@ -1512,6 +1625,8 @@ export interface SyncTargetStatus {
      * not pulled.
      */
     readonly caughtUp: boolean;
+    /** core#81 — the running sync's latest progress sample, or absent when nothing is in flight. */
+    readonly inFlight?: SyncProgress;
 }
 export interface SyncTargetInfo {
     readonly label: string | undefined;
@@ -1554,6 +1669,8 @@ export interface NoydbEventMap {
     };
     'sync:push': PushResult;
     'sync:pull': PullResult;
+    /** core#81 — emitted while a pull/push runs (throttled); `sync:push`/`sync:pull` stay the terminal events. */
+    'sync:progress': SyncProgress;
     'sync:erasure': ErasureEnforcement;
     'sync:conflict': Conflict;
     'write:conflict': WriteConflict;
@@ -3627,6 +3744,13 @@ export type ActiveTier = 1 | 2 | 3;
  * duplicated here (rather than imported) because the kernel spine may not
  * statically import a with-* service; see {@link PolicyCheckGateFn}.
  */
+/**
+ * `PolicyCheckGateContext` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/policy. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export interface PolicyCheckGateContext {
     /** Tier the active session currently holds. */
     readonly activeTier: ActiveTier;

package/dist/kernel/validation.d.ts

@@ -135,16 +135,6 @@ export declare function assertStrongSecret(s: string, opts?: SecretPolicy & {
  * weak inputs visible in any UI that displays an entropy meter.
  */
 export declare function estimateEntropy(secret: string): number;
-/**
- * Internal compatibility shim. Older code paths used the throwing
- * `validateSecret(s)` directly; some still do via re-exports. Routes
- * to the new `assertStrongSecret` so the contract holds for both
- * shapes during the transition. New code should call
- * {@link assertStrongSecret} directly.
- *
- * @internal
- */
-export declare function legacyAssertSecret(s: string): void;
 /** Dedicated floors for the echo mode's three parts (spec resolved Q1/Q5). */
 export interface EchoSecretPolicy {
     /** Floor for the typed prompt — the brute-forceable-in-isolation part. */

package/dist/kernel/vault.d.ts

@@ -44,7 +44,7 @@ import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import { type BehaviorSummary } from '../with-shape/introspection/behaviors.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
 import { type PeriodRecord, type PeriodReopenEvent, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
-import { type EnclaveKey } from './enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import type { RecipientSealer } from '../with-party/team/managed-secret.js';
 import { type ExportBlobsOptions, type ExportBlobsHandle } from '../with-shape/blobs/export-blobs.js';
 import { type CompactRunOptions, type CompactionResult } from '../with-shape/blobs/blob-compaction.js';
@@ -52,7 +52,7 @@ import { type IssueMagicLinkGrantOptions, type MagicLinkGrantRecord } from '../w
 import { CustodyApi } from '../with-party/custody/index.js';
 import { SchemaFenceController } from '../with-shape/schema-update/fence-controller.js';
 import { type FenceDoc } from '../with-shape/schema-update/fence.js';
-import type { RevocationList } from '@noy-db/attestation';
+import type { RevocationList } from './attestation-types.js';
 import type { DumpSchemaOptions, VaultSchemaSnapshot, SchemaIntrospection } from '../with-shape/introspection/types.js';
 import type { VaultIntrospectState } from '../with-shape/introspection/walk.js';
 import type { VaultMeta } from '../with-shape/introspection/meta.js';
@@ -1152,6 +1152,8 @@ export declare class Vault {
      * collection.
      */
     delegate(opts: IssueDelegationOptions): Promise<DelegationToken>;
+    /** Merge live delegations into the keyring — core#56's read half. Explicit, not automatic; cross-user delegation does not work yet. Both reasons: `with-party/team/delegation.ts`. */
+    refreshDelegations(now?: Date): Promise<DelegationToken[]>;
     /**
      * revoke an issued delegation by id. Safe to call even
      * if the id does not exist.
@@ -1389,6 +1391,8 @@ export declare class Vault {
      * collection-cache clear, ledger-store reset) that `load()` performs on this
      * Vault's private state.
      */
+    /** core#82 — sync pulled a newer copy of THIS user's keyring file: reload it in place, rebuild the DEK resolver, drop cached collections. */
+    _reloadKeyringAfterSync(): Promise<void>;
     private backupContext;
     /**
      * Restore a vault from a verifiable backup.

package/dist/kernel/via/reconcile.d.ts

@@ -39,8 +39,7 @@ import { type HasWritableViaPipeline } from './pipeline.js';
 import { type MergedViaFields } from './compose.js';
 import type { ViaGraph } from './graph.js';
 import type { RefDescriptor } from '../refs.js';
-import { type I18nStrategy, type I18nTextDescriptor, type DictKeyDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../port/with/i18n-strategy.js';
-import { type LookupDescriptor } from '../../port/with/lookup-strategy.js';
+import { type I18nStrategy, type I18nTextDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../port/with/i18n-strategy.js';
 type AnyCollection = Collection<Record<string, unknown>>;
 /**
  * Structural reconcile-capable collection handle: `_via`/`_setVia` (#666's writer seam) plus the
@@ -98,46 +97,6 @@ export interface ViaReconcileVaultCtx {
      *  gate has already confirmed it is open — never the door that opens it. */
     getCollection(name: string): AnyCollection;
 }
-/**
- * #664 Part 2 — late-attach i18nText fields. First-wins (mirrors `_applyMoneyFields`'s own
- * first-wins convention): a no-op once the collection already has an 'i18n' binding, whether
- * that binding came from fresh construction or an earlier reconcile call. `dictKeyFields` is an
- * optional SECOND family arriving in the SAME `vault.collection()` call (`mergeViaFields` already
- * combined them for this one call) — passed through so ONE binding rebuild covers both, exactly
- * like `compileVias` builds ONE 'i18n' binding from both maps at fresh construction.
- */
-export declare function reconcileI18nFields(coll: ReconcilableCollection, vaultCtx: ViaReconcileVaultCtx, name: string, i18nFields: Record<string, I18nTextDescriptor> | undefined, dictKeyFields?: Record<string, DictKeyDescriptor | StaticDictDescriptor>): void;
-/**
- * #664 Part 2 — late-attach dictKeyFields (dictKey()/staticDict()) with NO i18nFields in the same
- * call — the dictKey-only late-attach door. First-wins, same convention as
- * {@link reconcileI18nFields} (and, transitively, a no-op if that sibling function already
- * handled a combined i18nFields+dictKeyFields call for this collection).
- */
-export declare function reconcileDictKeyFields(coll: ReconcilableCollection, vaultCtx: ViaReconcileVaultCtx, name: string, dictKeyFields: Record<string, DictKeyDescriptor | StaticDictDescriptor> | undefined): void;
-/**
- * #664 Part 2b — late-attach lookup()/enumOf()/dict() fields, tier-scoped (issue #664, spec-
- * ratified tier policy):
- *
- *  - **enum** (`backing:'static'`, no `table`) / **static** (`+table`) — self-contained:
- *    membership/labels come from the declared `keys`/`table` alone, no vault registry touch, no
- *    cross-collection read. Clean attach, same shape as i18n/dictKey's own reconcile door.
- *  - **reserved** (`dict()` / `lookup(dim, { backing:'reserved' })`) — additionally registers into
- *    the SAME vault registries the fresh path populates (`vault.ts`'s dictKeyFields/lookupFields
- *    registry-population loop) — `dictKeyFieldRegistry`/`reservedLookupCollections` for a bare
- *    dict field; `staticDescriptorByField`/`staticByName`/`staticDictNames` for a table-bearing
- *    static field — via `collectLookupDictCompat` (#650 Task 2's alias-equivalence bridge, the
- *    SAME helper the fresh path already calls), reused verbatim, not duplicated.
- *  - **matrix** (`backing:'collection'`) — gated by {@link refuseUnattachableMatrixLookupFields}.
- *
- * First-wins (mirrors {@link reconcileI18nFields}): a no-op once the collection already has a
- * 'lookup' binding, whether from fresh construction or an earlier reconcile call.
- *
- * Post-attach, registers the SAME cross-collection `'ref'` graph edges the fresh path does
- * (`registerLookupRefEdges` — internally skips the static tier, which has no backing collection to
- * reference-check) — `ViaGraph.referencingEdgesOf` sees them immediately, so delete-time
- * restrict/cascade/nullify semantics are live post-attach too, same as a fresh declaration.
- */
-export declare function reconcileLookupFields(coll: ReconcilableCollection, vaultCtx: ViaReconcileVaultCtx, graph: ViaGraph, name: string, lookupFields: Record<string, LookupDescriptor> | undefined): void;
 /** The late-attach reconcile call's field-declaring options — the slice of `vault.collection()`'s
  *  `options` a reconcile call may carry, plus the `mergeViaFields` output that feeds both the
  *  guard and the money/i18n/dictKey/lookup reconciles. `blobFields` has no `_apply*` door (guard

package/dist/kernel/write-queue.d.ts

@@ -43,4 +43,21 @@ export declare class WriteQueueTracker implements WriteQueue {
      * error is re-thrown after the queue is decremented.
      */
     track<R>(fn: () => Promise<R>): Promise<R>;
+    /**
+     * Run a write whose PRE-COMMIT phase may legitimately REFUSE — the schema
+     * gates, and a user `beforeWrite` hook that throws to abort. `fn` calls
+     * `committed()` at the point the store write itself begins.
+     *
+     * Before that point a rejection releases the depth it took but records NO
+     * queue error; after it, a rejection settles as a failure like `track`.
+     *
+     * #11 — why the phase is inside `depth` at all: `pending` is the documented
+     * shutdown guard (see the `writeQueue` getter's `beforeunload` example) and
+     * the schema fence does a fresh store read per write, so leaving the gates
+     * outside made `pending` read `false` during a real round-trip on every
+     * write. The refusal carve-out is what the old outside-the-queue placement
+     * was protecting ("a rejected write never counts toward depth") — it is kept
+     * deliberately, so a refused write cannot reject a concurrent `onFlush()`.
+     */
+    trackGated<R>(fn: (committed: () => void) => Promise<R>): Promise<R>;
 }

package/dist/{ledger-KZPCMVZY.js → ledger-MSJGWKGW.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-ZXABPVM6.js";
+} from "./chunk-L2F3CFCH.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,15 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-CKNGS5MH.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
+} from "./chunk-2WJKJZSO.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -38,4 +37,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-KZPCMVZY.js.map
+//# sourceMappingURL=ledger-MSJGWKGW.js.map

package/dist/liberate-LEKDYKTC.js

@@ -0,0 +1,25 @@
+import {
+  liberateVault
+} from "./chunk-XITHENBI.js";
+import "./chunk-SNM7LSYG.js";
+import "./chunk-55P6OBB7.js";
+import "./chunk-XKBTJGFP.js";
+import "./chunk-RDOEOPOI.js";
+import "./chunk-YQFBH5ZJ.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-45VHWE4C.js";
+import "./chunk-FZXRLNJO.js";
+import "./chunk-UHFGK6YA.js";
+import "./chunk-RIZTZJX6.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-LEKDYKTC.js.map

package/dist/link-set-QXXSPPHL.js

@@ -0,0 +1,29 @@
+import {
+  LinkEndpointError,
+  LinkSet
+} from "./chunk-EUD3HQM4.js";
+import {
+  LINK_COLLECTION_PREFIX,
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-UAKY6E4N.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  LINK_COLLECTION_PREFIX,
+  LinkEndpointError,
+  LinkIntegrityError,
+  LinkSet,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+};
+//# sourceMappingURL=link-set-QXXSPPHL.js.map

package/dist/{managed-secret-S3MQ6SH6.js → managed-secret-VSK7ANQI.js}

@@ -9,16 +9,15 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-ENAG3IY7.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
+} from "./chunk-XKBTJGFP.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,
@@ -31,4 +30,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-S3MQ6SH6.js.map
+//# sourceMappingURL=managed-secret-VSK7ANQI.js.map

package/dist/materialized-views/index.js

@@ -1,56 +1,55 @@
 import {
   withMaterializedView
-} from "../chunk-X25NWUZB.js";
+} from "../chunk-L5A3KR7R.js";
 import {
   MaterializedViewExecutor
-} from "../chunk-QBBUZ3I3.js";
+} from "../chunk-7BMOS4JQ.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
   canonicalizeQueryPlan,
   computeQueryHash,
   summarizeQueryPlan
-} from "../chunk-NWHBJQAL.js";
+} from "../chunk-D4V5JJAK.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-WX5ADGTZ.js";
-import "../chunk-WY2XXTET.js";
-import "../chunk-T52GX4SA.js";
-import "../chunk-CF5UU4S7.js";
-import "../chunk-K6W7BVZ6.js";
+} from "../chunk-AJFPAHMW.js";
+import "../chunk-OJU67C23.js";
+import "../chunk-LGGIFKJP.js";
+import "../chunk-WHOKGHJ3.js";
+import "../chunk-CAD7N6HQ.js";
+import "../chunk-GETUTTZU.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-FH2L2E34.js";
 import "../chunk-XZHEOSQ2.js";
-import "../chunk-F2TDU7MQ.js";
+import "../chunk-BJH77UY2.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-VHM7HCKB.js";
 import "../chunk-XBKH4FOC.js";
-import "../chunk-4I522ERM.js";
-import "../chunk-MKXXMNJH.js";
-import "../chunk-LGNDFRYC.js";
-import "../chunk-5O7D6ZTW.js";
-import "../chunk-HLEK5VAN.js";
-import "../chunk-DF73H4UN.js";
-import "../chunk-GHLTDZRS.js";
-import "../chunk-Z5HTYMMQ.js";
-import "../chunk-CKNGS5MH.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+import "../chunk-PT2YCQVK.js";
+import "../chunk-5UUJE4FP.js";
+import "../chunk-4CFHL5RY.js";
+import "../chunk-DHU2AQ6T.js";
+import "../chunk-BUE7R3B5.js";
+import "../chunk-NZULV7LK.js";
+import "../chunk-V55JASXO.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-2WJKJZSO.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError,
   MaterializedViewTooLargeError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-VSUQI5Q6.js";
 export {
   MaterializedViewConfigError,
   MaterializedViewCycleError,

package/dist/{migrate-cek-V7GKJZ7O.js → migrate-cek-GEBFYBDC.js}

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-shape/satellites/migrate-cek.ts
 async function migrateSatelliteCek(name, coll) {
@@ -15,4 +15,4 @@ async function migrateSatelliteCek(name, coll) {
 export {
   migrateSatelliteCek
 };
-//# sourceMappingURL=migrate-cek-V7GKJZ7O.js.map
+//# sourceMappingURL=migrate-cek-GEBFYBDC.js.map

package/dist/money/index.js

@@ -4,7 +4,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "../chunk-ID6Z6E66.js";
+} from "../chunk-MQ7YWBQ5.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -13,10 +13,10 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "../chunk-WY2XXTET.js";
-import "../chunk-HLEK5VAN.js";
-import "../chunk-Z5HTYMMQ.js";
-import "../chunk-244VXYPG.js";
+} from "../chunk-OJU67C23.js";
+import "../chunk-BUE7R3B5.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-VSUQI5Q6.js";
 export {
   MoneyCurrencyError,
   MoneyPrecisionError,