@noy-db/hub 0.9.0-pre.1 → 0.9.0-pre.2

package/dist/{chunk-Y55XHMQB.js → chunk-DYIR6RC3.js}

@@ -1,15 +1,15 @@
 import {
   MaintenanceMethods
-} from "./chunk-YJGKOSQD.js";
+} from "./chunk-F7X7MPK4.js";
 import {
   installMethods
 } from "./chunk-F6NCB7KT.js";
 import {
   Query
-} from "./chunk-DWCFGF2K.js";
+} from "./chunk-7C7OF26T.js";
 import {
   gateTerminal
-} from "./chunk-66GD7XXU.js";
+} from "./chunk-O3NGOHXQ.js";
 
 // src/kernel/query/live/live.ts
 function buildLiveQuery(recompute, upstreams, options) {
@@ -267,4 +267,4 @@ export {
   buildLiveQuery,
   installLive
 };
-//# sourceMappingURL=chunk-Y55XHMQB.js.map
+//# sourceMappingURL=chunk-DYIR6RC3.js.map

package/dist/{chunk-THQ3BHLM.js → chunk-EPPAEGH5.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/capsule/plumbing/normalize.ts
 function normalizeForVerify(mode, value) {
@@ -154,4 +154,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-THQ3BHLM.js.map
+//# sourceMappingURL=chunk-EPPAEGH5.js.map

package/dist/{chunk-YJGKOSQD.js → chunk-F7X7MPK4.js}

@@ -11,7 +11,7 @@ import {
   filterRecords,
   fnViewDecoder,
   orderKeyOf
-} from "./chunk-DWCFGF2K.js";
+} from "./chunk-7C7OF26T.js";
 
 // src/kernel/query/internal/maintenance.ts
 var MaintenanceMethods = class {
@@ -97,4 +97,4 @@ var MaintenanceMethods = class {
 export {
   MaintenanceMethods
 };
-//# sourceMappingURL=chunk-YJGKOSQD.js.map
+//# sourceMappingURL=chunk-F7X7MPK4.js.map

package/dist/{chunk-R2ZULFXU.js → chunk-FUHUGKDN.js}

@@ -1,14 +1,14 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-KN4LUMH6.js";
+} from "./chunk-U43RSPPX.js";
 import {
   buildRecordEnvelope,
   sha256Hex
 } from "./chunk-WRLWEYHY.js";
 import {
   ReadOnlyError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-R2ZULFXU.js.map
+//# sourceMappingURL=chunk-FUHUGKDN.js.map

package/dist/{chunk-25FXU6WS.js → chunk-FVKQ5QUC.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -33,4 +33,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-25FXU6WS.js.map
+//# sourceMappingURL=chunk-FVKQ5QUC.js.map

package/dist/{chunk-ZNEKQFGF.js → chunk-GHMINSER.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-XBKH4FOC.js";
 import {
   normalizeJoinOn
-} from "./chunk-ICF3TIGY.js";
+} from "./chunk-OK44MD3C.js";
 import {
   sha256Hex
 } from "./chunk-WRLWEYHY.js";
@@ -11,7 +11,7 @@ import {
   MaterializedViewConfigError,
   MaterializedViewSourceUnknownError,
   RefNotDeclaredError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -574,4 +574,4 @@ export {
   ungatedMvContext,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-ZNEKQFGF.js.map
+//# sourceMappingURL=chunk-GHMINSER.js.map

package/dist/{chunk-3G3GOGZZ.js → chunk-GLSCL74M.js}

@@ -21,10 +21,10 @@ import {
   rotateKeys,
   stampAuthority,
   writeKeyringFile
-} from "./chunk-V7AKGAXY.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   dekKey
-} from "./chunk-2LBS62AC.js";
+} from "./chunk-LJ744WXU.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -49,7 +49,7 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-XX4R7TUB.js";
+} from "./chunk-URGHKZPL.js";
 import {
   DelegationTargetMissingError,
   INBOX_KEY_ID,
@@ -62,7 +62,7 @@ import {
   TamperedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/port/with/team-strategy.ts
 var NO_TEAM = {
@@ -965,4 +965,4 @@ export {
   findAuthenticator,
   revokeAuthenticator
 };
-//# sourceMappingURL=chunk-3G3GOGZZ.js.map
+//# sourceMappingURL=chunk-GLSCL74M.js.map

package/dist/{chunk-NTVKHQ3L.js → chunk-GU6QXHPZ.js}

@@ -42,7 +42,7 @@ var MemorySealer = class {
    * says `unseal` MUST throw on tamper, and a double that silently returns
    * corrupted bytes is not modelling the contract it stands in for. Without
    * it, every managed-mode test ran against a provider that could not fail
-   * the way a real one must (found by @noy-db/test-sealer-conformance).
+   * the way a real one must (found by @noy-db/ports/at).
    */
   tag(cipher) {
     let a = 2654435769;
@@ -249,4 +249,4 @@ export {
   loadSealedSecret,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-NTVKHQ3L.js.map
+//# sourceMappingURL=chunk-GU6QXHPZ.js.map

package/dist/chunk-GU6QXHPZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/managed-secret.ts"],"sourcesContent":["/**\n * Managed-secret mode — rubber-hose-resistant vaults.\n *\n * A vault mode where the secret is machine-generated and never\n * exposed to the user, sealed under a developer-provided\n * {@link NoydbSealer} (macOS Keychain, Windows Credential\n * Manager, libsecret, AWS KMS, …). The user has no secret to give\n * up to coercion — they can't reveal what they don't know.\n *\n * ## Components in this file\n *\n *   - {@link NoydbSealer} — the interface concrete providers\n *     implement. Provider implementations live OUTSIDE hub (per-\n *     platform packages).\n *   - {@link MemorySealer} — in-memory test provider; uses\n *     a deterministic per-instance \"key\" so two providers with\n *     different ids cannot unseal each other's outputs.\n *   - {@link RecipientHint} — public material a sender uses to seal\n *     plaintext for a specific recipient; published by\n *     {@link RecipientSealer.publishRecipientHint} and transported\n *     out-of-band to the sender before bundle writes.\n *   - {@link RecipientSealer} — interface for asymmetric/granted\n *     providers that support recipient-target sealing (RSA-OAEP,\n *     cloud-KMS asymmetric, etc.); distinct from self-only\n *     {@link NoydbSealer} (macOS Keychain, WebAuthn-PRF).\n *   - {@link MemoryRecipientSealer} — in-process reference\n *     implementation of both `RecipientSealer` and\n *     `NoydbSealer` using real WebCrypto RSA-OAEP + AES-GCM;\n *     safe for tests and same-process sender/recipient scenarios.\n *   - {@link loadSealedSecret} / {@link saveSealedSecret} —\n *     plaintext envelope storage at `_meta/sealed-secret`.\n *     Mirrors the `_meta/handle` and `_meta/public-envelope` AES-\n *     GCM-bypassed patterns. The sealing layer (provider's job)\n *     is the security boundary; hub doesn't have a key to encrypt\n *     with at this layer — that's the whole point of the design.\n *   - {@link resolveManagedSecret} — orchestrates the \"generate +\n *     seal + persist on first open; unseal on reopen\" flow.\n *     Returns the plaintext secret string that the rest of the\n *     `createNoydb` keyring path consumes.\n *\n * Deferred to follow-ups:\n *   - Block `rotate-secret` policy gate under managed mode.\n *   - Mandatory strong-recovery enforcement.\n *   - Recovery flow under managed mode (generates fresh sealed phrase).\n *\n * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode\n *\n * @module\n */\n\nimport {\n  buildRecordEnvelope,\n  importTransferKey,\n  encryptBytes,\n  decryptBytes,\n  bufferToBase64,\n  base64ToBuffer,\n  generateRecipientKeyPair,\n  exportRecipientPublicKeySpki,\n  importRecipientPublicKeySpki,\n  recipientWrap,\n  recipientUnwrap,\n  type EnclaveKeyPair,\n} from '../../capsule/index.js'\nimport type { NoydbStore, RecipientSealer } from '../../kernel/types.js'\n\n/**\n * The contract concrete providers (per-platform key stores) implement\n * to seal and unseal a hub-generated random secret. The plaintext\n * secret NEVER leaves hub-controlled memory in unsealed form —\n * the provider receives the bytes, returns opaque sealed bytes, and\n * later reverses the operation. Hub treats the sealed bytes as\n * fully opaque.\n *\n * Implementations live OUTSIDE `@noy-db/hub` (separate packages\n * per the issue's \"Concrete providers (live outside hub)\" note):\n *\n * | Platform | Package (TBD) | Backing |\n * |---|---|---|\n * | macOS | `@noy-db/seal-macos-keychain` | Security.framework |\n * | Windows | `@noy-db/seal-wincred` | Credential Manager |\n * | Linux | `@noy-db/seal-libsecret` | libsecret / secret-service |\n * | Cloud / server | `@noy-db/seal-aws-kms` | AWS KMS Decrypt |\n */\nexport interface NoydbSealer {\n  /**\n   * Non-sensitive identifier disclosed in the persisted envelope.\n   * Surfaced to consumers via `loadSealedSecret().providerId` so\n   * a vault opened with the wrong provider class can detect the\n   * mismatch and surface a clear error. NOT secret — fine to log.\n   *\n   * Suggested format: `<family>:<scope>` — e.g. `macos-keychain:com.acme.app`,\n   * `aws-kms:arn:aws:kms:us-east-1:123:key/abc`. The hub never\n   * parses this; it's purely audit metadata.\n   */\n  readonly id: string\n\n  /** Seal raw secret bytes. Output bytes are opaque to hub. */\n  seal(secret: Uint8Array): Promise<Uint8Array>\n\n  /**\n   * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or\n   * any other failure — hub treats a thrown error as \"this provider\n   * cannot unlock this vault\" and surfaces it to the caller.\n   */\n  unseal(sealed: Uint8Array): Promise<Uint8Array>\n}\n\n/**\n * In-memory test provider. NOT secure — uses a deterministic\n * per-instance \"key\" (16-byte SHA-256 of `id`) XOR'd over the\n * secret plus a 4-byte provider-id fingerprint prefix. The XOR is\n * sufficient to make different `id` values produce mutually-unsealable\n * outputs (the contract tests for that), but offers ZERO real\n * confidentiality — never use outside tests.\n *\n * Replace with a real platform provider in production.\n */\nexport class MemorySealer implements NoydbSealer {\n  readonly id: string\n  private readonly fingerprint: Uint8Array\n  private readonly keyBytes: Uint8Array\n\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    // Deterministic 4-byte fingerprint of the provider id, prepended\n    // to every sealed output so we can detect \"wrong provider\" at\n    // unseal time without leaking anything sensitive about either\n    // provider's actual key material.\n    const encoded = new TextEncoder().encode(opts.id)\n    let h = 0\n    for (let i = 0; i < encoded.length; i++) {\n      h = (h * 31 + encoded[i]!) >>> 0\n    }\n    this.fingerprint = new Uint8Array([\n      (h >>> 24) & 0xff, (h >>> 16) & 0xff, (h >>> 8) & 0xff, h & 0xff,\n    ])\n    // Deterministic 16-byte \"key\" derived from the id by repeating\n    // the fingerprint with offsets. Good enough for the XOR-stream\n    // test cipher; never confuse this with real key derivation.\n    this.keyBytes = new Uint8Array(16)\n    for (let i = 0; i < 16; i++) {\n      this.keyBytes[i] = this.fingerprint[i % 4]! ^ (i * 17)\n    }\n  }\n\n  /**\n   * Deterministic 4-byte integrity tag over the ciphertext, keyed by the\n   * same derived bytes. NOT a MAC and not forgery-resistant — a real\n   * provider authenticates with its backend. It exists because the contract\n   * says `unseal` MUST throw on tamper, and a double that silently returns\n   * corrupted bytes is not modelling the contract it stands in for. Without\n   * it, every managed-mode test ran against a provider that could not fail\n   * the way a real one must (found by @noy-db/ports/at).\n   */\n  private tag(cipher: Uint8Array): Uint8Array {\n    let a = 0x9e3779b9\n    for (let i = 0; i < cipher.length; i++) {\n      a = ((a ^ (cipher[i]! ^ this.keyBytes[i % 16]!)) * 0x01000193) >>> 0\n    }\n    return new Uint8Array([(a >>> 24) & 0xff, (a >>> 16) & 0xff, (a >>> 8) & 0xff, a & 0xff])\n  }\n\n  async seal(secret: Uint8Array): Promise<Uint8Array> {\n    const cipher = new Uint8Array(secret.length)\n    for (let i = 0; i < secret.length; i++) {\n      cipher[i] = secret[i]! ^ this.keyBytes[i % 16]!\n    }\n    const out = new Uint8Array(8 + secret.length)\n    out.set(this.fingerprint, 0)\n    out.set(this.tag(cipher), 4)\n    out.set(cipher, 8)\n    return out\n  }\n\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    if (sealed.length < 8) {\n      throw new Error('MemorySealer: sealed input too short')\n    }\n    for (let i = 0; i < 4; i++) {\n      if (sealed[i] !== this.fingerprint[i]) {\n        throw new Error(\n          `MemorySealer(\"${this.id}\"): provider-id mismatch on unseal `\n          + '(sealed bytes were produced by a different provider)',\n        )\n      }\n    }\n    const cipher = sealed.subarray(8)\n    const expected = this.tag(cipher)\n    for (let i = 0; i < 4; i++) {\n      if (sealed[4 + i] !== expected[i]) {\n        throw new Error(\n          `MemorySealer(\"${this.id}\"): integrity check failed on unseal `\n          + '(the sealed bytes were modified after sealing)',\n        )\n      }\n    }\n    const out = new Uint8Array(cipher.length)\n    for (let i = 0; i < cipher.length; i++) {\n      out[i] = cipher[i]! ^ this.keyBytes[i % 16]!\n    }\n    return out\n  }\n}\n\n/**\n * Public material a sender uses to seal-for-this-recipient. Published by\n * a recipient's RecipientSealer; transported to the sender out-of-band\n * (email, S3, in-app message). The sender obtains the hint, supplies it\n * to writePod's sealedCredentials.perUser[userId].hint, and the\n * hub seals each user's credential against it. Per foundation §11.4.\n */\nexport type RecipientHint = {\n  readonly v: 1\n  /** Recipient's provider id; matches the SealedAutoUnlockEntry.pid they'll unseal under. */\n  readonly pid: string\n  /** Algorithm the sender uses to produce the seal. Slice 1 ships RSA-OAEP-SHA256 only. */\n  readonly alg: 'rsa-oaep-sha256'\n  /** Public material — alg-specific. For 'rsa-oaep-sha256': { publicKeyPem: string }. */\n  readonly material: Readonly<Record<string, unknown>>\n}\n\n// Hoisted to kernel/types.ts (C3 — enclave self-containment: sealing.ts\n// consumes this as a spine-owned contract type). Re-exported here so existing\n// importers of this module are unaffected.\nexport type { RecipientSealer } from '../../kernel/types.js'\n\n/**\n * Shared RSA-OAEP-SHA256 + AES-GCM seal in the canonical recipient-target\n * TLV wire format. Mints a fresh 32-byte CEK, AES-GCM-encrypts `plaintext`\n * under it, RSA-OAEP-SHA256-wraps the CEK to `publicKeyPem`, and packs:\n *\n *   byte  0       : version (0x01)\n *   bytes 1..256  : RSA-OAEP-wrapped CEK (fixed 256 bytes at RSA-2048)\n *   bytes 257..268: AES-GCM IV (12 bytes)\n *   bytes 269..   : AES-GCM ciphertext ‖ 16-byte tag\n *\n * This is the single source of truth for the wire format — both\n * {@link MemoryRecipientSealer} and external sealers (e.g. `@noy-db/at-aws-kms`'s\n * asymmetric-KMS recipient sealer) call it so a blob sealed by one unseals\n * by the other. WebCrypto RSA-OAEP/SHA-256 here is wire-compatible with\n * AWS KMS `RSAES_OAEP_SHA_256` (both RSAES-OAEP, SHA-256 hash, MGF1-SHA256,\n * empty label).\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport async function sealRsaOaepTlv(plaintext: Uint8Array, publicKeyPem: string): Promise<Uint8Array> {\n  // Parse PEM → SPKI bytes.\n  const b64 = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----/, '').replace(/-----END PUBLIC KEY-----/, '').replace(/\\s+/g, '')\n  const recipientPub = await importRecipientPublicKeySpki(base64ToBytes(b64))\n  // Mint fresh CEK, AES-GCM encrypt plaintext.\n  const cekBytes = crypto.getRandomValues(new Uint8Array(32))\n  const cek = await importTransferKey(cekBytes)\n  const { iv: ivB64, data } = await encryptBytes(plaintext, cek)\n  const iv = base64ToBuffer(ivB64)\n  const ct = base64ToBuffer(data)\n  // RSA-OAEP-wrap the CEK bytes.\n  const wrapped = await recipientWrap(recipientPub, cekBytes)\n  cekBytes.fill(0)\n  if (wrapped.length !== 256) {\n    throw new Error(`sealRsaOaepTlv: expected 256-byte RSA-OAEP wrap, got ${wrapped.length}`)\n  }\n  // TLV layout.\n  const out = new Uint8Array(1 + 256 + 12 + ct.length)\n  out[0] = 0x01\n  out.set(wrapped, 1)\n  out.set(iv, 1 + 256)\n  out.set(ct, 1 + 256 + 12)\n  return out\n}\n\n/**\n * Parse a {@link sealRsaOaepTlv} blob into its three segments without\n * decrypting. The `wrapped` CEK is RSA-OAEP-SHA256 ciphertext over a\n * 32-byte CEK — the unwrap step is pluggable: {@link MemoryRecipientSealer}\n * decrypts it with a local RSA private key; `@noy-db/at-aws-kms` hands it to\n * KMS `Decrypt`. After unwrapping, pass the CEK + `iv` + `ct` to\n * {@link aesGcmOpen}.\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport function parseRsaOaepTlv(bytes: Uint8Array): { wrapped: Uint8Array; iv: Uint8Array; ct: Uint8Array } {\n  if (bytes.length < 1 + 256 + 12 + 16) {\n    throw new Error('parseRsaOaepTlv: sealed input too short')\n  }\n  if (bytes[0] !== 0x01) {\n    throw new Error(`parseRsaOaepTlv: unknown TLV version ${bytes[0]}`)\n  }\n  return {\n    wrapped: bytes.subarray(1, 1 + 256),\n    iv: bytes.subarray(1 + 256, 1 + 256 + 12),\n    ct: bytes.subarray(1 + 256 + 12),\n  }\n}\n\n/**\n * AES-GCM-decrypt the `ct` segment of a {@link parseRsaOaepTlv} result under\n * the unwrapped 32-byte CEK and its `iv`. Throws on a bad tag (tamper) — the\n * same authenticated-decryption guarantee the TLV relies on.\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport async function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array): Promise<Uint8Array> {\n  const cek = await importTransferKey(cekBytes)\n  return decryptBytes(bufferToBase64(iv), bufferToBase64(ct), cek)\n}\n\n/**\n * Reference implementation of `RecipientSealer` + `NoydbSealer`.\n * Uses WebCrypto RSA-OAEP-SHA256 (2048-bit) to wrap a fresh 32-byte\n * AES-GCM CEK, AES-GCM-encrypts plaintext under it, and packs the\n * result into a self-describing TLV:\n *\n *   byte  0       : version (0x01)\n *   bytes 1..256  : RSA-OAEP-wrapped CEK (fixed 256 bytes at RSA-2048)\n *   bytes 257..268: AES-GCM IV (12 bytes)\n *   bytes 269..   : AES-GCM ciphertext ‖ 16-byte tag\n *\n * Implements BOTH interfaces. `seal(plaintext)` (self-target) is just\n * `sealForRecipient(plaintext, this own hint)` — same TLV. Convenient\n * for tests where one provider plays both ends. Real cloud providers\n * (`at-aws-kms`, etc.) will pick their own internal layouts; the only\n * contract is round-trip identity.\n *\n * SAFE for production within its scope — the cryptography is real\n * (RSA-OAEP + AES-GCM via WebCrypto), but the keypair lives in-process\n * and is regenerated on every construction. Not suitable as a managed\n * keychain; use it for tests and for shipping bundles where the\n * recipient instance lives in the same process as the sender (rare).\n */\nexport class MemoryRecipientSealer implements NoydbSealer, RecipientSealer {\n  readonly id: string\n  private readonly keypair: Promise<EnclaveKeyPair>\n\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keypair = generateRecipientKeyPair()\n  }\n\n  async publishRecipientHint(): Promise<RecipientHint> {\n    const spki = await exportRecipientPublicKeySpki(await this.keypair)\n    const pem = '-----BEGIN PUBLIC KEY-----\\n'\n      + bytesToBase64(spki).match(/.{1,64}/g)!.join('\\n')\n      + '\\n-----END PUBLIC KEY-----\\n'\n    return { v: 1, pid: this.id, alg: 'rsa-oaep-sha256', material: { publicKeyPem: pem } }\n  }\n\n  async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n    if (hint.v !== 1) {\n      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n    }\n    if (hint.alg !== 'rsa-oaep-sha256') {\n      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n    }\n    const pem = hint.material['publicKeyPem']\n    if (typeof pem !== 'string') {\n      throw new Error('MemoryRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n    }\n    return sealRsaOaepTlv(plaintext, pem)\n  }\n\n  async seal(plaintext: Uint8Array): Promise<Uint8Array> {\n    const hint = await this.publishRecipientHint()\n    return this.sealForRecipient(plaintext, hint)\n  }\n\n  async unseal(bytes: Uint8Array): Promise<Uint8Array> {\n    const { wrapped, iv, ct } = parseRsaOaepTlv(bytes)\n    // Local RSA-OAEP-SHA256 unwrap of the CEK — the pluggable step external\n    // sealers replace with KMS Decrypt.\n    const cekBytes = await recipientUnwrap(await this.keypair, wrapped)\n    const pt = await aesGcmOpen(cekBytes, iv, ct)\n    cekBytes.fill(0)\n    return pt\n  }\n}\n\n// ─── Persisted envelope ────────────────────────────────────────────────\n\n/** Reserved id for the managed-secret envelope under `_meta`. */\nexport const SEALED_SECRET_RECORD_ID = 'sealed-secret' as const\n\n/** Plaintext payload stored inside the `_meta/sealed-secret` envelope. */\nexport interface SealedSecret {\n  readonly _noydb_sealed: 1\n  readonly providerId: string\n  /** Sealed bytes. Base64-encoded on the wire; decoded on load. */\n  readonly sealed: Uint8Array\n}\n\n/**\n * Wire-format envelope persisted at `_meta/sealed-secret` for\n * managed-mode vaults. The provider produces raw sealed bytes via\n * {@link NoydbSealer.seal}; this wrapper carries the dispatch\n * metadata hub needs to pick the right provider on the unseal path.\n *\n * Stability boundary: once shipped, the wire format only grows by\n * adding optional fields. See the at-* sealing dimension foundation\n * doc, §11.9.1.\n *\n * v1 shape (this release): `{ v: 1, _noydb_sealed: 1, pid, payload }`.\n *\n * Legacy shape (earlier releases): `{ _noydb_sealed: 1, providerId, sealed }`\n * — accepted on read for backwards compatibility; never produced on\n * write going forward.\n */\nexport interface SealedEnvelope {\n  /** Envelope schema version. v1 is the current shape. */\n  readonly v: 1\n  /** Magic marker for forensics + legacy-shape detection. */\n  readonly _noydb_sealed: 1\n  /** Matches the producing provider's `.id`. Dispatch key on unseal. */\n  readonly pid: string\n  /** Sealed bytes from the provider, base64-encoded on the wire. */\n  readonly payload: string\n}\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!)\n  return btoa(binary)\n}\n\nfunction base64ToBytes(b64: string): Uint8Array {\n  const binary = atob(b64)\n  const out = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i)\n  return out\n}\n\n/**\n * Parse a `_meta/sealed-secret` `_data` JSON string into the\n * in-memory {@link SealedSecret} representation. Accepts both:\n *\n *   1. v1 wire format `{ v: 1, _noydb_sealed: 1, pid, payload }` —\n *      the current shape.\n *   2. Legacy wire format `{ _noydb_sealed: 1, providerId, sealed }` —\n *      read-only; never written\n *      going forward.\n *\n * Returns `undefined` for any input that doesn't match either shape,\n * so callers can fall back to \"no managed-mode envelope present.\"\n *\n * @internal — exported only for the migration safety-net test suite.\n */\nexport function parseSealedEnvelope(raw: unknown): SealedSecret | undefined {\n  if (typeof raw !== 'object' || raw === null) return undefined\n  const r = raw as Record<string, unknown>\n  if (r._noydb_sealed !== 1) return undefined\n\n  // v1 shape — preferred.\n  if (\n    r.v === 1\n    && typeof r.pid === 'string'\n    && typeof r.payload === 'string'\n  ) {\n    return {\n      _noydb_sealed: 1,\n      providerId: r.pid,\n      sealed: base64ToBytes(r.payload),\n    }\n  }\n\n  // Legacy shape — earlier releases. Accept on read for compat.\n  if (\n    typeof r.providerId === 'string'\n    && typeof r.sealed === 'string'\n  ) {\n    return {\n      _noydb_sealed: 1,\n      providerId: r.providerId,\n      sealed: base64ToBytes(r.sealed),\n    }\n  }\n\n  return undefined\n}\n\nexport async function saveSealedSecret(\n  store: NoydbStore,\n  vault: string,\n  payload: { readonly providerId: string; readonly sealed: Uint8Array },\n): Promise<void> {\n  const persisted: SealedEnvelope = {\n    v: 1,\n    _noydb_sealed: 1,\n    pid: payload.providerId,\n    payload: bytesToBase64(payload.sealed),\n  }\n  const prior = await store.get(vault, '_meta', SEALED_SECRET_RECORD_ID)\n  const env = buildRecordEnvelope(\n    { collection: '_meta', id: SEALED_SECRET_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n    // AES-GCM bypassed — the sealing layer is the security boundary.\n    { iv: '', data: JSON.stringify(persisted) },\n  )\n  await store.put(vault, '_meta', SEALED_SECRET_RECORD_ID, env)\n}\n\nexport async function loadSealedSecret(\n  store: NoydbStore,\n  vault: string,\n): Promise<SealedSecret | undefined> {\n  const envelope = await store.get(vault, '_meta', SEALED_SECRET_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    return parseSealedEnvelope(JSON.parse(envelope._data ?? ''))\n  } catch {\n    return undefined\n  }\n}\n\n// ─── createNoydb orchestration ─────────────────────────────────────────\n\n/**\n * Resolve the effective plaintext secret string for a managed-mode\n * vault. Two paths:\n *\n *   1. **First open (no envelope persisted):** generate a 256-bit random\n *      via `crypto.getRandomValues`, base64-encode for use as a\n *      secret string, seal the underlying bytes under the\n *      provider, persist `_meta/sealed-secret`, return the\n *      base64 string.\n *\n *   2. **Reopen (envelope exists):** read + unseal + decode → return.\n *      A different provider whose `seal` output disagrees on the\n *      stored bytes throws here, surfaced as a clear error.\n *\n * The returned string is the same shape that `secret:` would take in\n * standard mode — the rest of the keyring path consumes it\n * unchanged.\n *\n * @internal — called from `createNoydb` / `getKeyringInternal`.\n */\nexport async function resolveManagedSecret(\n  store: NoydbStore,\n  vault: string,\n  provider: NoydbSealer,\n): Promise<string> {\n  const existing = await loadSealedSecret(store, vault)\n  if (existing) {\n    if (existing.providerId !== provider.id) {\n      throw new Error(\n        `Managed-mode vault \"${vault}\" was sealed under provider id `\n        + `\"${existing.providerId}\" but the current NoydbSealer is `\n        + `\"${provider.id}\". Pass the same provider that originally enrolled `\n        + 'the vault, or treat this as a fresh enrollment and clear '\n        + '`_meta/sealed-secret` first.',\n      )\n    }\n    const plaintext = await provider.unseal(existing.sealed)\n    return bytesToBase64(plaintext)\n  }\n\n  // First open: mint a 256-bit random, seal, persist.\n  const random = new Uint8Array(32)\n  globalThis.crypto.getRandomValues(random)\n  const sealed = await provider.seal(random)\n  await saveSealedSecret(store, vault, { providerId: provider.id, sealed })\n  return bytesToBase64(random)\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsHO,IAAM,eAAN,MAA0C;AAAA,EACtC;AAAA,EACQ;AAAA,EACA;AAAA,EAEjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AAKf,UAAM,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAChD,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAK,IAAI,KAAK,QAAQ,CAAC,MAAQ;AAAA,IACjC;AACA,SAAK,cAAc,IAAI,WAAW;AAAA,MAC/B,MAAM,KAAM;AAAA,MAAO,MAAM,KAAM;AAAA,MAAO,MAAM,IAAK;AAAA,MAAM,IAAI;AAAA,IAC9D,CAAC;AAID,SAAK,WAAW,IAAI,WAAW,EAAE;AACjC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,WAAK,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAM,IAAI;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,IAAI,QAAgC;AAC1C,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,WAAM,KAAK,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE,MAAO,aAAgB;AAAA,IACrE;AACA,WAAO,IAAI,WAAW,CAAE,MAAM,KAAM,KAAO,MAAM,KAAM,KAAO,MAAM,IAAK,KAAM,IAAI,GAAI,CAAC;AAAA,EAC1F;AAAA,EAEA,MAAM,KAAK,QAAyC;AAClD,UAAM,SAAS,IAAI,WAAW,OAAO,MAAM;AAC3C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,aAAO,CAAC,IAAI,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE;AAAA,IAC/C;AACA,UAAM,MAAM,IAAI,WAAW,IAAI,OAAO,MAAM;AAC5C,QAAI,IAAI,KAAK,aAAa,CAAC;AAC3B,QAAI,IAAI,KAAK,IAAI,MAAM,GAAG,CAAC;AAC3B,QAAI,IAAI,QAAQ,CAAC;AACjB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,QAAyC;AACpD,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,iBAAiB,KAAK,EAAE;AAAA,QAE1B;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,OAAO,SAAS,CAAC;AAChC,UAAM,WAAW,KAAK,IAAI,MAAM;AAChC,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAI,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG;AACjC,cAAM,IAAI;AAAA,UACR,iBAAiB,KAAK,EAAE;AAAA,QAE1B;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAI,CAAC,IAAI,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AACF;AA2CA,eAAsB,eAAe,WAAuB,cAA2C;AAErG,QAAM,MAAM,aAAa,QAAQ,8BAA8B,EAAE,EAAE,QAAQ,4BAA4B,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAC7H,QAAM,eAAe,MAAM,6BAA6B,cAAc,GAAG,CAAC;AAE1E,QAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC1D,QAAM,MAAM,MAAM,kBAAkB,QAAQ;AAC5C,QAAM,EAAE,IAAI,OAAO,KAAK,IAAI,MAAM,aAAa,WAAW,GAAG;AAC7D,QAAM,KAAK,eAAe,KAAK;AAC/B,QAAM,KAAK,eAAe,IAAI;AAE9B,QAAM,UAAU,MAAM,cAAc,cAAc,QAAQ;AAC1D,WAAS,KAAK,CAAC;AACf,MAAI,QAAQ,WAAW,KAAK;AAC1B,UAAM,IAAI,MAAM,wDAAwD,QAAQ,MAAM,EAAE;AAAA,EAC1F;AAEA,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM,KAAK,GAAG,MAAM;AACnD,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,SAAS,CAAC;AAClB,MAAI,IAAI,IAAI,IAAI,GAAG;AACnB,MAAI,IAAI,IAAI,IAAI,MAAM,EAAE;AACxB,SAAO;AACT;AAYO,SAAS,gBAAgB,OAA4E;AAC1G,MAAI,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI;AACpC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,MAAI,MAAM,CAAC,MAAM,GAAM;AACrB,UAAM,IAAI,MAAM,wCAAwC,MAAM,CAAC,CAAC,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS,GAAG,IAAI,GAAG;AAAA,IAClC,IAAI,MAAM,SAAS,IAAI,KAAK,IAAI,MAAM,EAAE;AAAA,IACxC,IAAI,MAAM,SAAS,IAAI,MAAM,EAAE;AAAA,EACjC;AACF;AASA,eAAsB,WAAW,UAAsB,IAAgB,IAAqC;AAC1G,QAAM,MAAM,MAAM,kBAAkB,QAAQ;AAC5C,SAAO,aAAa,eAAe,EAAE,GAAG,eAAe,EAAE,GAAG,GAAG;AACjE;AAyBO,IAAM,wBAAN,MAAoE;AAAA,EAChE;AAAA,EACQ;AAAA,EAEjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,UAAU,yBAAyB;AAAA,EAC1C;AAAA,EAEA,MAAM,uBAA+C;AACnD,UAAM,OAAO,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAClE,UAAM,MAAM,iCACR,cAAc,IAAI,EAAE,MAAM,UAAU,EAAG,KAAK,IAAI,IAChD;AACJ,WAAO,EAAE,GAAG,GAAG,KAAK,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,cAAc,IAAI,EAAE;AAAA,EACvF;AAAA,EAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,QAAI,KAAK,MAAM,GAAG;AAChB,YAAM,IAAI,MAAM,8DAA8D,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,IAC7G;AACA,QAAI,KAAK,QAAQ,mBAAmB;AAClC,YAAM,IAAI,MAAM,iEAAiE,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,IACnI;AACA,UAAM,MAAM,KAAK,SAAS,cAAc;AACxC,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI,MAAM,4FAA4F;AAAA,IAC9G;AACA,WAAO,eAAe,WAAW,GAAG;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,WAA4C;AACrD,UAAM,OAAO,MAAM,KAAK,qBAAqB;AAC7C,WAAO,KAAK,iBAAiB,WAAW,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,OAAO,OAAwC;AACnD,UAAM,EAAE,SAAS,IAAI,GAAG,IAAI,gBAAgB,KAAK;AAGjD,UAAM,WAAW,MAAM,gBAAgB,MAAM,KAAK,SAAS,OAAO;AAClE,UAAM,KAAK,MAAM,WAAW,UAAU,IAAI,EAAE;AAC5C,aAAS,KAAK,CAAC;AACf,WAAO;AAAA,EACT;AACF;AAKO,IAAM,0BAA0B;AAqCvC,SAAS,cAAc,OAA2B;AAChD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAC9E,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,cAAc,KAAyB;AAC9C,QAAM,SAAS,KAAK,GAAG;AACvB,QAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,SAAO;AACT;AAiBO,SAAS,oBAAoB,KAAwC;AAC1E,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,MAAI,EAAE,kBAAkB,EAAG,QAAO;AAGlC,MACE,EAAE,MAAM,KACL,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,YAAY,UACxB;AACA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,YAAY,EAAE;AAAA,MACd,QAAQ,cAAc,EAAE,OAAO;AAAA,IACjC;AAAA,EACF;AAGA,MACE,OAAO,EAAE,eAAe,YACrB,OAAO,EAAE,WAAW,UACvB;AACA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,YAAY,EAAE;AAAA,MACd,QAAQ,cAAc,EAAE,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,iBACpB,OACA,OACA,SACe;AACf,QAAM,YAA4B;AAAA,IAChC,GAAG;AAAA,IACH,eAAe;AAAA,IACf,KAAK,QAAQ;AAAA,IACb,SAAS,cAAc,QAAQ,MAAM;AAAA,EACvC;AACA,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,uBAAuB;AACrE,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,yBAAyB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAElF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,yBAAyB,GAAG;AAC9D;AAEA,eAAsB,iBACpB,OACA,OACmC;AACnC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,uBAAuB;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,WAAO,oBAAoB,KAAK,MAAM,SAAS,SAAS,EAAE,CAAC;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAwBA,eAAsB,qBACpB,OACA,OACA,UACiB;AACjB,QAAM,WAAW,MAAM,iBAAiB,OAAO,KAAK;AACpD,MAAI,UAAU;AACZ,QAAI,SAAS,eAAe,SAAS,IAAI;AACvC,YAAM,IAAI;AAAA,QACR,uBAAuB,KAAK,mCACtB,SAAS,UAAU,qCACnB,SAAS,EAAE;AAAA,MAGnB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,SAAS,OAAO,SAAS,MAAM;AACvD,WAAO,cAAc,SAAS;AAAA,EAChC;AAGA,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,aAAW,OAAO,gBAAgB,MAAM;AACxC,QAAM,SAAS,MAAM,SAAS,KAAK,MAAM;AACzC,QAAM,iBAAiB,OAAO,OAAO,EAAE,YAAY,SAAS,IAAI,OAAO,CAAC;AACxE,SAAO,cAAc,MAAM;AAC7B;","names":[]}

package/dist/{chunk-7K42TSCY.js → chunk-GZISWBCJ.js}

@@ -1,16 +1,16 @@
 import {
   splitAroundJoins
-} from "./chunk-DWCFGF2K.js";
+} from "./chunk-7C7OF26T.js";
 import {
   evaluateClause,
   hasFnClause,
   normalizeMatches,
   normalizeSubqueryOperand
-} from "./chunk-GIQJGXV7.js";
+} from "./chunk-SXPLIRQH.js";
 import {
   FieldNotQueryableError,
   QueryExtensionMissingError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/kernel/query/scan-builder.ts
 var DEFAULT_SCAN_PAGE_SIZE = 100;
@@ -190,4 +190,4 @@ for (const [method, subpath] of SCAN_EXTENSION_METHODS) {
 export {
   ScanBuilder
 };
-//# sourceMappingURL=chunk-7K42TSCY.js.map
+//# sourceMappingURL=chunk-GZISWBCJ.js.map

package/dist/{chunk-ZF6JECDT.js → chunk-HTRLQ4ZZ.js}

@@ -1,10 +1,10 @@
 import {
   normalizeForVerify
-} from "./chunk-THQ3BHLM.js";
+} from "./chunk-EPPAEGH5.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-XX4R7TUB.js";
+} from "./chunk-URGHKZPL.js";
 import {
   ClassifiedConfigError,
   DebugReservedFieldError,
@@ -12,7 +12,7 @@ import {
   RecordCekNotFoundError,
   SchemaValidationError,
   ValidationError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/capsule/plumbing/record-aad.ts
 var SCHEME = "noydb-aad/2";
@@ -1372,4 +1372,4 @@ export {
   makeCapsule,
   ctEqualTags
 };
-//# sourceMappingURL=chunk-ZF6JECDT.js.map
+//# sourceMappingURL=chunk-HTRLQ4ZZ.js.map

package/dist/{chunk-UL6MTRMJ.js → chunk-ICHHNI5E.js}

@@ -4,7 +4,7 @@ import {
 import {
   assemblePodContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-XPW7T2GN.js";
+} from "./chunk-4N4OIVK3.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -12,7 +12,7 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-QFW4MYGN.js";
+} from "./chunk-7IV7GVOS.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -46,10 +46,10 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-XX4R7TUB.js";
+} from "./chunk-URGHKZPL.js";
 import {
   PartitionExtractionError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -490,4 +490,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-UL6MTRMJ.js.map
+//# sourceMappingURL=chunk-ICHHNI5E.js.map

package/dist/{chunk-JAQHWHUN.js → chunk-ID4ZBC3X.js}

@@ -1,13 +1,13 @@
 import {
   installViaBinder
-} from "./chunk-NCTN2FW4.js";
+} from "./chunk-PIO6NW7O.js";
 import {
   SealedHandle
-} from "./chunk-XX4R7TUB.js";
+} from "./chunk-URGHKZPL.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/via/classified/descriptor.ts
 function isClassifiedFieldSpec(x) {
@@ -270,4 +270,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-JAQHWHUN.js.map
+//# sourceMappingURL=chunk-ID4ZBC3X.js.map

package/dist/{chunk-WBUHHMLN.js → chunk-IFUYLIEY.js}

@@ -1,6 +1,6 @@
 import {
   CargoNotEnabledError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -12,4 +12,4 @@ var NO_CARGO = {
 export {
   NO_CARGO
 };
-//# sourceMappingURL=chunk-WBUHHMLN.js.map
+//# sourceMappingURL=chunk-IFUYLIEY.js.map

package/dist/{chunk-ZUTUNVFD.js → chunk-IPF5ORDI.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   ConflictError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-audit/attestation/signer.ts
 var ATTESTATIONS_COLLECTION = "_attestations";
@@ -54,4 +54,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-ZUTUNVFD.js.map
+//# sourceMappingURL=chunk-IPF5ORDI.js.map

package/dist/{chunk-UNL6YGL5.js → chunk-JQMEXCUZ.js}

@@ -1,13 +1,13 @@
 import {
   openInboxKeyPair,
   readKeyringFile
-} from "./chunk-V7AKGAXY.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
   dekKey
-} from "./chunk-2LBS62AC.js";
+} from "./chunk-LJ744WXU.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -26,7 +26,7 @@ import {
   DelegationTargetMissingError,
   INBOX_KEY_ID,
   MemberInboxMissingError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -166,4 +166,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-UNL6YGL5.js.map
+//# sourceMappingURL=chunk-JQMEXCUZ.js.map

package/dist/{chunk-B7Y2BRQA.js → chunk-K5JNK63R.js}

@@ -1,23 +1,23 @@
 import {
   walkClosure
-} from "./chunk-UL6MTRMJ.js";
+} from "./chunk-ICHHNI5E.js";
 import {
   resolveManagedSecret
-} from "./chunk-NTVKHQ3L.js";
+} from "./chunk-GU6QXHPZ.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-XPW7T2GN.js";
+} from "./chunk-4N4OIVK3.js";
 import {
   createOwnerKeyring,
   mintRosterTag,
   requireRosterKey,
   stampAuthority
-} from "./chunk-V7AKGAXY.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   LedgerStore
-} from "./chunk-ONZ3B5EW.js";
+} from "./chunk-Y22JWHCP.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
@@ -35,13 +35,13 @@ import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-cargo/active.ts
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-33747NY5.js");
+      const { extractPartitionCore } = await import("./extract-partition-ELZEJKXM.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -243,7 +243,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-U62OVKXB.js");
+    const { createNoydb } = await import("./noydb-QDZ4QIKO.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -298,4 +298,4 @@ export {
   withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-B7Y2BRQA.js.map
+//# sourceMappingURL=chunk-K5JNK63R.js.map

package/dist/{chunk-MMCN7TLK.js → chunk-KBIS64X4.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-EQ6C2ZPT.js";
 import {
   liveRecordIsElevated
-} from "./chunk-2LBS62AC.js";
+} from "./chunk-LJ744WXU.js";
 import {
   openEnvelopeJson
 } from "./chunk-WRLWEYHY.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-commit/history/time-machine.ts
 var VaultInstant = class {
@@ -208,4 +208,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-MMCN7TLK.js.map
+//# sourceMappingURL=chunk-KBIS64X4.js.map

package/dist/{chunk-2LBS62AC.js → chunk-LJ744WXU.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -49,4 +49,4 @@ export {
   dekKey,
   parseDekKey
 };
-//# sourceMappingURL=chunk-2LBS62AC.js.map
+//# sourceMappingURL=chunk-LJ744WXU.js.map

package/dist/{chunk-LUCQY3OM.js → chunk-LMC5L3MM.js}

@@ -1,23 +1,23 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-R2ZULFXU.js";
+} from "./chunk-FUHUGKDN.js";
 import {
   resolveManagedSecret
-} from "./chunk-NTVKHQ3L.js";
+} from "./chunk-GU6QXHPZ.js";
 import {
   assertRosterTagValid,
   createOwnerKeyring,
   mintRosterTag,
   requireRosterKey,
   stampAuthority
-} from "./chunk-V7AKGAXY.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   buildRecordEnvelope,
   wrapKey
 } from "./chunk-WRLWEYHY.js";
 import {
   PermissionDeniedError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -135,4 +135,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-LUCQY3OM.js.map
+//# sourceMappingURL=chunk-LMC5L3MM.js.map

package/dist/{chunk-SALY3LIJ.js → chunk-LUQBG637.js}

@@ -1,13 +1,13 @@
 import {
   validateProjectionLegs
-} from "./chunk-ZNEKQFGF.js";
+} from "./chunk-GHMINSER.js";
 import {
   describeGroupKey
 } from "./chunk-XBKH4FOC.js";
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -208,4 +208,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-SALY3LIJ.js.map
+//# sourceMappingURL=chunk-LUQBG637.js.map

package/dist/{chunk-FMINS2B6.js → chunk-LZN6DTFI.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-FMINS2B6.js.map
+//# sourceMappingURL=chunk-LZN6DTFI.js.map

package/dist/{chunk-MLVPMDOZ.js → chunk-MMWX5OT5.js}

@@ -1,7 +1,7 @@
 import {
   FieldFrozenError,
   InvariantError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-audit/guards/executor.ts
 var GuardExecutor = {
@@ -77,4 +77,4 @@ function deepEqual(a, b) {
 export {
   GuardExecutor
 };
-//# sourceMappingURL=chunk-MLVPMDOZ.js.map
+//# sourceMappingURL=chunk-MMWX5OT5.js.map

package/dist/{chunk-RUE6TCES.js → chunk-N6EWQ5VB.js}

@@ -9,10 +9,10 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-FPF5HRBE.js";
+} from "./chunk-A52BK5AY.js";
 import {
   parseKeyringEnvelope
-} from "./chunk-V7AKGAXY.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   buildDeleteMarker,
   buildRecordEnvelope,
@@ -28,11 +28,11 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-XX4R7TUB.js";
+} from "./chunk-URGHKZPL.js";
 import {
   ValidationError,
   isConflictError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-sync/presence.ts
 var PresenceHandle = class {
@@ -1906,4 +1906,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-RUE6TCES.js.map
+//# sourceMappingURL=chunk-N6EWQ5VB.js.map

package/dist/{chunk-MCNNZBG7.js → chunk-NHEKQWFI.js}

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "./chunk-IKPQ2GGB.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-shape/satellites/validate.ts
 function validateSatelliteDeclaration(input) {
@@ -47,4 +47,4 @@ export {
   validateSatelliteDeclaration,
   hashFields
 };
-//# sourceMappingURL=chunk-MCNNZBG7.js.map
+//# sourceMappingURL=chunk-NHEKQWFI.js.map