@noy-db/hub 0.9.0 → 0.10.0-pre.1

package/dist/{chunk-GHMINSER.js → chunk-NC6CF37L.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-XBKH4FOC.js";
 import {
   normalizeJoinOn
-} from "./chunk-OK44MD3C.js";
+} from "./chunk-ME6LY5UG.js";
 import {
   sha256Hex
 } from "./chunk-WRLWEYHY.js";
@@ -11,7 +11,7 @@ import {
   MaterializedViewConfigError,
   MaterializedViewSourceUnknownError,
   RefNotDeclaredError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -574,4 +574,4 @@ export {
   ungatedMvContext,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-GHMINSER.js.map
+//# sourceMappingURL=chunk-NC6CF37L.js.map

package/dist/{chunk-XQGKS4OW.js → chunk-OCSKQUNE.js}

@@ -1,9 +1,9 @@
 import {
   dekKey
-} from "./chunk-LJ744WXU.js";
+} from "./chunk-KFYUQMF5.js";
 import {
   TierNotGrantedError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-party/team/tiers.ts
 function effectiveClearance(dekSlots, collection) {
@@ -37,4 +37,4 @@ export {
   keyringClearance,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-XQGKS4OW.js.map
+//# sourceMappingURL=chunk-OCSKQUNE.js.map

package/dist/{chunk-O6VOR4NH.js → chunk-OJAFKGI7.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/capsule/contract.ts
 function assertCapsuleSupports(caps, group, requirer) {
@@ -24,4 +24,4 @@ export {
   assertCapsuleSupports,
   CapsuleNotSupportedError
 };
-//# sourceMappingURL=chunk-O6VOR4NH.js.map
+//# sourceMappingURL=chunk-OJAFKGI7.js.map

package/dist/{chunk-OR3OHKU6.js → chunk-PCYIDPFM.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-formula/computed/index.ts
 var ComputedFieldError = class extends NoydbError {
@@ -35,4 +35,4 @@ export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=chunk-OR3OHKU6.js.map
+//# sourceMappingURL=chunk-PCYIDPFM.js.map

package/dist/{chunk-PWAMX5KU.js → chunk-PIEX7WSG.js}

@@ -1,6 +1,6 @@
 import {
   QuiesceTimeoutError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/port/by/types.ts
 function isQuorum(writers, generation, excludeWriterId) {
@@ -51,4 +51,4 @@ export {
   isQuorum,
   runDrainBarrier
 };
-//# sourceMappingURL=chunk-PWAMX5KU.js.map
+//# sourceMappingURL=chunk-PIEX7WSG.js.map

package/dist/{chunk-AYOQZJDB.js → chunk-PIF3TNU2.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-SXPLIRQH.js";
+} from "./chunk-WQHEEYQA.js";
 
 // src/with-lookup/indexing/index-snapshot.ts
 var FIELD_INDEX_SNAPSHOT_VERSION = 1;
@@ -933,4 +933,4 @@ export {
   normalizeIndexDefs,
   CollectionIndexes
 };
-//# sourceMappingURL=chunk-AYOQZJDB.js.map
+//# sourceMappingURL=chunk-PIF3TNU2.js.map

package/dist/{chunk-FVKQ5QUC.js → chunk-PNEBCVXP.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -33,4 +33,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-FVKQ5QUC.js.map
+//# sourceMappingURL=chunk-PNEBCVXP.js.map

package/dist/{chunk-6BEBWHNL.js → chunk-PQGCWTTI.js}

@@ -9,7 +9,7 @@ import {
   USER_ENVELOPE_COLLECTION,
   USER_ENVELOPE_MAX_BYTES,
   UserEnvelopeOversizedError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-party/directory/storage.ts
 var META_COLLECTION = "_meta";
@@ -138,4 +138,4 @@ export {
   deleteUserEnvelope,
   listUserEnvelopeIds
 };
-//# sourceMappingURL=chunk-6BEBWHNL.js.map
+//# sourceMappingURL=chunk-PQGCWTTI.js.map

package/dist/{chunk-BSEPI3HD.js → chunk-PR2R57YF.js}

@@ -1,9 +1,9 @@
 import {
   assertTierAccess
-} from "./chunk-XQGKS4OW.js";
+} from "./chunk-OCSKQUNE.js";
 import {
   dekKey
-} from "./chunk-LJ744WXU.js";
+} from "./chunk-KFYUQMF5.js";
 import {
   applyRewrappedBody,
   buildRecordAad,
@@ -19,14 +19,14 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-URGHKZPL.js";
+} from "./chunk-VUBRHJ4H.js";
 import {
   PersistedIndexCompensationError,
   TierDemoteDeniedError,
   TiersNotEnabledError,
   UniqueConstraintError,
   UnsupportedTierCompositionError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -57,7 +57,7 @@ function withTiers() {
       return checkUniqueAcrossTiers2(ctx, id, record);
     },
     async refreshDelegations(ctx, now) {
-      const { loadActiveDelegations, DELEGATIONS_COLLECTION } = await import("./delegation-7SSGIETH.js");
+      const { loadActiveDelegations, DELEGATIONS_COLLECTION } = await import("./delegation-JIQCMKW6.js");
       const ids = await ctx.adapter.list(ctx.vault, DELEGATIONS_COLLECTION);
       if (ids.length === 0) return [];
       const delegationsDek = ctx.keyring.deks.get(DELEGATIONS_COLLECTION);
@@ -496,4 +496,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-BSEPI3HD.js.map
+//# sourceMappingURL=chunk-PR2R57YF.js.map

package/dist/{chunk-ODBOHPZU.js → chunk-PVBKEBJU.js}

@@ -2,10 +2,10 @@ import {
   CURRENT_COST_BYTE,
   iterationsForCostByte,
   mintAt
-} from "./chunk-Q4DBU5RM.js";
+} from "./chunk-RQLCOSEJ.js";
 import {
   normalizeForVerify
-} from "./chunk-EPPAEGH5.js";
+} from "./chunk-6Y3UJT5H.js";
 
 // src/capsule/enclave-aes/classify/find.ts
 async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
@@ -19,4 +19,4 @@ async function computeBidxTarget(candidate, normalize, dek, collection, field, c
 export {
   computeBidxTarget
 };
-//# sourceMappingURL=chunk-ODBOHPZU.js.map
+//# sourceMappingURL=chunk-PVBKEBJU.js.map

package/dist/{chunk-PFHDQY5L.js → chunk-PVQIME6P.js}

@@ -6,7 +6,7 @@ import {
   ConflictError,
   InvariantError,
   ValidationError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-commit/tx/atomic-eligibility.ts
 function canCommitAtomically(db, ctx) {
@@ -322,7 +322,7 @@ async function runTransaction(db, fn, options, txInvariants) {
     db._clearActiveTxContext(ctx);
   }
   if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-7SY3M6TZ.js");
+    const { GuardExecutor } = await import("./executor-BVVZ5UHG.js");
     try {
       for (const [vaultName, v] of ctx._amendmentVaults) {
         const registry = v._getGuardRegistry();
@@ -500,4 +500,4 @@ export {
   TxCollection,
   runTransaction
 };
-//# sourceMappingURL=chunk-PFHDQY5L.js.map
+//# sourceMappingURL=chunk-PVQIME6P.js.map

package/dist/{chunk-UMV5GBTJ.js → chunk-PZZWAHEJ.js}

@@ -1,6 +1,6 @@
 import {
   SealedRecordNotEnabledError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-audit/sealed-record/strategy.ts
 var NO_SEALED_RECORD = {
@@ -18,4 +18,4 @@ var NO_SEALED_RECORD = {
 export {
   NO_SEALED_RECORD
 };
-//# sourceMappingURL=chunk-UMV5GBTJ.js.map
+//# sourceMappingURL=chunk-PZZWAHEJ.js.map

package/dist/{chunk-R4GLRJ55.js → chunk-QWC2PRUR.js}

@@ -1,6 +1,6 @@
 import {
   PortabilityNotEnabledError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-audit/portability/strategy.ts
 var NO_PORTABILITY = {
@@ -27,4 +27,4 @@ var NO_PORTABILITY = {
 export {
   NO_PORTABILITY
 };
-//# sourceMappingURL=chunk-R4GLRJ55.js.map
+//# sourceMappingURL=chunk-QWC2PRUR.js.map

package/dist/{chunk-7C7OF26T.js → chunk-R4PDYYK5.js}

@@ -3,21 +3,21 @@ import {
 } from "./chunk-3TDUWVWB.js";
 import {
   gateTerminal
-} from "./chunk-O3NGOHXQ.js";
+} from "./chunk-TA5VTIC4.js";
 import {
   evaluateClause,
   hasFnClause,
   normalizeMatches,
   normalizeSubqueryOperand
-} from "./chunk-SXPLIRQH.js";
+} from "./chunk-WQHEEYQA.js";
 import {
   isViaPrefixProbe
-} from "./chunk-PIO6NW7O.js";
+} from "./chunk-ZZLIFVZG.js";
 import {
   CrossJoinSourceUnknownError,
   FieldNotQueryableError,
   QueryExtensionMissingError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/kernel/query/internal/hooks.ts
 var installed;
@@ -1555,4 +1555,4 @@ export {
   sortRecords,
   buildDictLabelResolver
 };
-//# sourceMappingURL=chunk-7C7OF26T.js.map
+//# sourceMappingURL=chunk-R4PDYYK5.js.map

package/dist/{chunk-Y22JWHCP.js → chunk-RKOXA5GZ.js}

@@ -17,7 +17,7 @@ import {
 import {
   LedgerContentionError,
   isConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-commit/history/ledger/patch.ts
 function computePatch(prev, next) {
@@ -695,4 +695,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-Y22JWHCP.js.map
+//# sourceMappingURL=chunk-RKOXA5GZ.js.map

package/dist/{chunk-S2ORTQGS.js → chunk-RNQ7V4LH.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-6BEBWHNL.js";
+} from "./chunk-PQGCWTTI.js";
 import {
   PolicyDeniedError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-S2ORTQGS.js.map
+//# sourceMappingURL=chunk-RNQ7V4LH.js.map

package/dist/{chunk-Q4DBU5RM.js → chunk-RQLCOSEJ.js}

@@ -1,6 +1,6 @@
 import {
   bufferToBase64
-} from "./chunk-EPPAEGH5.js";
+} from "./chunk-6Y3UJT5H.js";
 
 // src/capsule/enclave-aes/classify/digest.ts
 var subtle = globalThis.crypto.subtle;
@@ -75,4 +75,4 @@ export {
   mintAt,
   mintBidxTag
 };
-//# sourceMappingURL=chunk-Q4DBU5RM.js.map
+//# sourceMappingURL=chunk-RQLCOSEJ.js.map

package/dist/{chunk-IPF5ORDI.js → chunk-RRI3JBD6.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   ConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-audit/attestation/signer.ts
 var ATTESTATIONS_COLLECTION = "_attestations";
@@ -54,4 +54,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-IPF5ORDI.js.map
+//# sourceMappingURL=chunk-RRI3JBD6.js.map

package/dist/{chunk-PZN76MMV.js → chunk-S2BQV6HM.js}

@@ -1,14 +1,14 @@
 import {
   dictCollectionName
-} from "./chunk-WVQDY3UM.js";
+} from "./chunk-U2N7DH4S.js";
 import {
   getAtPath,
   presentI18nForJoin
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-ZZZVNHN2.js";
 import {
   UnknownDictCodeError,
   ValidationError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/via/lookup/registry.ts
 function enforceStaticDictOnPut(staticFields, record) {
@@ -320,4 +320,4 @@ export {
   buildPresentForJoin,
   isLookupDescriptor
 };
-//# sourceMappingURL=chunk-PZN76MMV.js.map
+//# sourceMappingURL=chunk-S2BQV6HM.js.map

package/dist/{chunk-JQMEXCUZ.js → chunk-S4QDN4IQ.js}

@@ -1,13 +1,13 @@
 import {
   openInboxKeyPair,
   readKeyringFile
-} from "./chunk-QVUMKG3Z.js";
+} from "./chunk-WVML7HUZ.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
   dekKey
-} from "./chunk-LJ744WXU.js";
+} from "./chunk-KFYUQMF5.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -26,7 +26,7 @@ import {
   DelegationTargetMissingError,
   INBOX_KEY_ID,
   MemberInboxMissingError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -43,7 +43,7 @@ async function issueDelegation(store, vault, grantor, delegationsDek, opts) {
     );
   }
   const cekBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
-  const targetKek = await importWrappingKey(cekBytes);
+  const cek = await importWrappingKey(cekBytes);
   const sealedCek = bufferToBase64(await recipientWrap(await importRecipientPublicKeySpki(base64ToBuffer(targetInbox.pub)), cekBytes));
   cekBytes.fill(0);
   const tier = opts.tier;
@@ -54,7 +54,7 @@ async function issueDelegation(store, vault, grantor, delegationsDek, opts) {
     const suffix = `#${tier}`;
     const entries = {};
     for (const [slot, dek] of grantor.deks) {
-      if (slot.endsWith(suffix)) entries[slot] = await wrapKey(dek, targetKek);
+      if (slot.endsWith(suffix)) entries[slot] = await wrapKey(dek, cek);
     }
     if (Object.keys(entries).length === 0) {
       throw new DelegationTargetMissingError(
@@ -71,7 +71,7 @@ async function issueDelegation(store, vault, grantor, delegationsDek, opts) {
         `grantor holds no tier-${tier} DEK for collection "${collectionName}", so there is nothing to delegate. Obtain the tier grant first.`
       );
     }
-    wrappedDek = await wrapKey(sourceDek, targetKek);
+    wrappedDek = await wrapKey(sourceDek, cek);
   }
   const until = typeof opts.until === "string" ? opts.until : opts.until.toISOString();
   const token = {
@@ -166,4 +166,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-JQMEXCUZ.js.map
+//# sourceMappingURL=chunk-S4QDN4IQ.js.map

package/dist/chunk-S4QDN4IQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. While `until` is still in the future, the target merges the\n * unwrapped tier DEKs into their in-memory DEK map by calling\n * `Vault.refreshDelegations()` — EXPLICIT, never automatic; the core#56\n * section below says why a read path must not scan on open.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, under the token's content key\n *   sealedCek,      // that content key, RSA-OAEP-sealed to the target's inbox public half\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * ## Cross-user (core#65)\n *\n * The wrap key is a per-token CONTENT KEY, not anybody's KEK: the tier DEKs are\n * AES-KW-wrapped under it exactly as they used to be under a KEK, and the key\n * itself is RSA-OAEP-sealed to the target's INBOX PUBLIC HALF (core#96 mints\n * that pair for every grantee, private half sealed under a DEK only that\n * member's own KEK unwraps). So a grantor delegates to somebody whose secret it\n * does not know — the thing this module could not do — while the slot NAMES\n * stay readable to any member holding the `_delegations` DEK, which is what\n * makes an audit enumeration possible without making the keys usable.\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is keyed to\n * the token's own content key — see the core#65 section above).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target picks the change up\n * at its next `Vault.refreshDelegations()` call — this module is pure\n * logic and schedules nothing.\n *\n * @module\n */\n\nimport type { NoydbStore, KeyringFile } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport {\n  buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, wrapKey, unwrapKey,\n  importWrappingKey, importRecipientPublicKeySpki, recipientWrap, recipientUnwrap,\n  bufferToBase64, base64ToBuffer, type EnclaveKey,\n} from '../../capsule/index.js'\nimport { dekKey } from './tiers.js'\nimport { readKeyringFile, openInboxKeyPair } from './keyring.js'\nimport { INBOX_KEY_ID } from '../../kernel/constants.js'\nimport { DelegationTargetMissingError, MemberInboxMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped under\n * the token's per-token CONTENT KEY — see {@link DelegationToken.sealedCek},\n * which carries the pre-core#65 exception.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /**\n   * Collection name, or `null` for a COLLECTION-WIDE token — see\n   * {@link DelegationToken.wrappedDeks} for what that means and what it cannot\n   * mean.\n   */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  /**\n   * The delegated tier DEK for {@link DelegationToken.collection}, wrapped\n   * under the token's content key — see {@link DelegationToken.sealedCek},\n   * which carries the pre-core#65 exception. Present on a per-collection\n   * token; absent on a collection-wide one, which carries\n   * {@link DelegationToken.wrappedDeks}.\n   */\n  readonly wrappedDek?: string\n  /**\n   * A collection-wide token's payload: `<collection>#<tier>` → wrapped DEK, one\n   * entry per collection the grantor held at that tier (core#56).\n   *\n   * ## ⛔ Why a MAP and not one key\n   *\n   * Every collection has its OWN tier DEK — measured, `docs#1` and `ledger#1`\n   * are different keys. The original design tried to express \"every collection\"\n   * as a single DEK under a wildcard slot `__any#<tier>`, which cannot work: one\n   * key decrypts one collection. A wildcard accepted at the access gate would\n   * have passed the check and then failed decryption — a gate that says yes\n   * followed by a crypto error. `__any#` is gone; every entry here merges under\n   * its REAL `<collection>#<tier>` key, so `assertTierAccess` needs no wildcard\n   * and gains no new privilege surface.\n   *\n   * ## ⚠️ \"Every collection\" means \"every collection AS OF ISSUE TIME\"\n   *\n   * This is a SNAPSHOT. A collection created after the token was issued is not\n   * in it and will not be granted by it — the grantor did not hold its DEK to\n   * wrap. That is a real limit of the shape, not an oversight, and it is stated\n   * here because a caller who reads \"all collections\" will otherwise assume\n   * otherwise.\n   */\n  readonly wrappedDeks?: Readonly<Record<string, string>>\n  /**\n   * core#65 — the token's CONTENT KEY, RSA-OAEP-sealed to the target's inbox\n   * public half. `wrappedDek` / `wrappedDeks` are AES-KW-wrapped under it, so\n   * only the target can unwrap them, and only they can: the matching private\n   * half is sealed in their keyring under a DEK their own KEK unwraps.\n   *\n   * Absent on a token written before core#65, whose wraps are under the\n   * grantor's own KEK — those still load for a target that shares that KEK\n   * (the only case that ever worked) and are skipped for anyone else, exactly\n   * as before.\n   */\n  readonly sealedCek?: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N DEK; the\n * target must have a keyring in this vault with an inbox key pair (core#96).\n *\n * core#65 — the wraps are keyed to a per-token content key sealed to that\n * pair, so the grantor needs nothing of the target's but their PUBLIC half.\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  const targetFound = await readKeyringFile(store, vault, opts.toUser)\n  if (!targetFound) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const targetInbox = targetFound.file.inbox_key\n  if (!targetInbox) {\n    throw new MemberInboxMissingError(\n      opts.toUser,\n      `Delegation target \"${opts.toUser}\" has a keyring with no inbox key pair — it predates core#96, ` +\n      'so a delegated key cannot be sealed to them. Re-grant the user once (a fresh temporary secret ' +\n      'they rotate on first open); the new keyring carries the pair.',\n    )\n  }\n  const cekBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const cek = await importWrappingKey(cekBytes)\n  const sealedCek = bufferToBase64(await recipientWrap(await importRecipientPublicKeySpki(base64ToBuffer(targetInbox.pub)), cekBytes))\n  cekBytes.fill(0)\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n\n  // Collection-wide: wrap EVERY tier DEK the grantor holds at this tier, each\n  // under its own real slot key. See `wrappedDeks` for why this is a map and\n  // for the as-of-issue-time limit it carries.\n  let wrappedDek: string | undefined\n  let wrappedDeks: Record<string, string> | undefined\n  if (collectionName === null) {\n    const suffix = `#${tier}`\n    const entries: Record<string, string> = {}\n    for (const [slot, dek] of grantor.deks) {\n      if (slot.endsWith(suffix)) entries[slot] = await wrapKey(dek, cek)\n    }\n    if (Object.keys(entries).length === 0) {\n      throw new DelegationTargetMissingError(\n        opts.toUser,\n        `grantor holds no tier-${tier} DEK for ANY collection, so a collection-wide ` +\n        `delegation would grant nothing. Obtain a tier grant first, or name a ` +\n        `\\`collection\\`.`,\n      )\n    }\n    wrappedDeks = entries\n  } else {\n    const sourceDek = grantor.deks.get(dekKey(collectionName, tier))\n    if (!sourceDek) {\n      throw new DelegationTargetMissingError(\n        opts.toUser,\n        `grantor holds no tier-${tier} DEK for collection \"${collectionName}\", so there ` +\n        `is nothing to delegate. Obtain the tier grant first.`,\n      )\n    }\n    wrappedDek = await wrapKey(sourceDek, cek)\n  }\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    ...(wrappedDek !== undefined && { wrappedDek }),\n    ...(wrappedDeks !== undefined && { wrappedDeks }),\n    sealedCek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 }\n  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts: token.createdAt, iv, data},\n  )\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * ## Why the vault calls this EXPLICITLY, and never from `openVault` (core#56)\n *\n * The module header above describes a runtime that scans on every open. Doing\n * that automatically would call `getDEK('_delegations')`, which MINTS a DEK when\n * absent and persists the keyring — so merely opening a vault would write to it.\n * Worse, on a vault whose shared `_delegations` DEK this user does not hold, it\n * would mint a WRONG one and then fail to decrypt every token under it.\n *\n * ⛔ A read path must not have that side effect. `Vault.refreshDelegations()`\n * therefore lists first, returns `[]` when nothing is written, and looks the DEK\n * up WITHOUT minting — which also makes the module header's \"at each open\"\n * cheap to honour, and its \"periodic intervals (tracked by the caller)\" is what\n * an explicit method is.\n *\n * ## Cross-user delegation (core#65) — and the one thing it still needs\n *\n * A token's wraps are keyed to a per-token content key sealed to the target's\n * INBOX PUBLIC HALF, so any member can be a target. Opening one therefore needs\n * that member's inbox PRIVATE half, which is sealed in their keyring file under\n * `deks[INBOX_KEY_ID]` — so this function reads the caller's own keyring file,\n * once, and only when a sealed token is actually addressed to them.\n *\n * ⚠️ A pre-core#65 token (no `sealedCek`) is wrapped under the GRANTOR's KEK and\n * still requires `user.kek`; it is skipped for anyone who does not share it,\n * which is the behaviour those tokens were written under.\n */\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  /** This member's own inbox key pair material, read at most once per call. `null` = read, absent. */\n  let ownInbox: NonNullable<KeyringFile['inbox_key']> | null | undefined\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // core#65 — the wrap key. A sealed token carries its own content key,\n    // opened with this member's inbox pair; a legacy token is under the\n    // grantor's KEK and needs `user.kek`, absent on a tier-3 PIN resume, a\n    // wrap-DEKs tier-2 unlock or a session restore (reached again at the next\n    // tier-1 unlock). A sealed token has no such limit: the pair's private\n    // half is sealed under a DEK the rebuilt set already carries.\n    let wrapKeyForToken: EnclaveKey\n    if (token.sealedCek !== undefined) {\n      const inboxKeyAes = user.deks.get(INBOX_KEY_ID)\n      if (!inboxKeyAes) continue\n      if (ownInbox === undefined) {\n        const own = await readKeyringFile(store, vault, user.userId)\n        ownInbox = own?.file.inbox_key ?? null\n      }\n      if (!ownInbox) continue\n      try {\n        const pair = await openInboxKeyPair(ownInbox, inboxKeyAes)\n        const cekBytes = await recipientUnwrap(pair, base64ToBuffer(token.sealedCek))\n        try {\n          wrapKeyForToken = await importWrappingKey(cekBytes)\n        } finally {\n          cekBytes.fill(0)\n        }\n      } catch {\n        // Sealed to somebody else's pair, or this member's own pair was\n        // replaced (a re-grant mints a fresh one). Not ours to open.\n        continue\n      }\n    } else {\n      if (!user.kek) continue\n      wrapKeyForToken = user.kek\n    }\n\n    // ⭐ Every merged key lands under its REAL `<collection>#<tier>` slot, which\n    // is exactly what `assertTierAccess` and `getDEK` already look up. There is\n    // no wildcard slot and no lookup change anywhere — see `wrappedDeks`.\n    const wraps: Record<string, string> = token.collection\n      ? (token.wrappedDek ? { [dekKey(token.collection, token.tier)]: token.wrappedDek } : {})\n      : { ...(token.wrappedDeks ?? {}) }\n    if (Object.keys(wraps).length === 0) continue\n\n    let anyMerged = false\n    for (const [slot, wrapped] of Object.entries(wraps)) {\n      let dek: EnclaveKey\n      try {\n        dek = await unwrapKey(wrapped, wrapKeyForToken)\n      } catch {\n        // One unusable entry must not discard the rest of a collection-wide\n        // token — a revoked or re-wrapped collection is the expected case.\n        continue\n      }\n      user.deks.set(slot, dek)\n      anyMerged = true\n    }\n    if (!anyMerged) continue\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEO,IAAM,yBAAyB;AAoFtC,eAAsB,gBACpB,OACA,OACA,SACA,gBACA,MAC0B;AAC1B,QAAM,cAAc,MAAM,gBAAgB,OAAO,OAAO,KAAK,MAAM;AACnE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,cAAc,YAAY,KAAK;AACrC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,KAAK;AAAA,MACL,sBAAsB,KAAK,MAAM;AAAA,IAGnC;AAAA,EACF;AACA,QAAM,WAAW,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACrE,QAAM,MAAM,MAAM,kBAAkB,QAAQ;AAC5C,QAAM,YAAY,eAAe,MAAM,cAAc,MAAM,6BAA6B,eAAe,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC;AACnI,WAAS,KAAK,CAAC;AACf,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAK1C,MAAI;AACJ,MAAI;AACJ,MAAI,mBAAmB,MAAM;AAC3B,UAAM,SAAS,IAAI,IAAI;AACvB,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,MAAM,GAAG,KAAK,QAAQ,MAAM;AACtC,UAAI,KAAK,SAAS,MAAM,EAAG,SAAQ,IAAI,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACnE;AACA,QAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,YAAM,IAAI;AAAA,QACR,KAAK;AAAA,QACL,yBAAyB,IAAI;AAAA,MAG/B;AAAA,IACF;AACA,kBAAc;AAAA,EAChB,OAAO;AACL,UAAM,YAAY,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC;AAC/D,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR,KAAK;AAAA,QACL,yBAAyB,IAAI,wBAAwB,cAAc;AAAA,MAErE;AAAA,IACF;AACA,iBAAa,MAAM,QAAQ,WAAW,GAAG;AAAA,EAC3C;AAEA,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA,GAAI,eAAe,UAAa,EAAE,WAAW;AAAA,IAC7C,GAAI,gBAAgB,UAAa,EAAE,YAAY;AAAA,IAC/C;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,WAAW,EAAE,YAAY,wBAAwB,IAAI,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS,EAAE;AACpG,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,gBAAgB,eAAe,QAAQ,CAAC;AACtF,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,MAAM,WAAW,IAAI,KAAI;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAoCA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAE/B,MAAI;AACJ,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,GAAG,GAAG,KAAK,cAAc;AACxG,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAQ3B,QAAI;AACJ,QAAI,MAAM,cAAc,QAAW;AACjC,YAAM,cAAc,KAAK,KAAK,IAAI,YAAY;AAC9C,UAAI,CAAC,YAAa;AAClB,UAAI,aAAa,QAAW;AAC1B,cAAM,MAAM,MAAM,gBAAgB,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,KAAK,KAAK,aAAa;AAAA,MACpC;AACA,UAAI,CAAC,SAAU;AACf,UAAI;AACF,cAAM,OAAO,MAAM,iBAAiB,UAAU,WAAW;AACzD,cAAM,WAAW,MAAM,gBAAgB,MAAM,eAAe,MAAM,SAAS,CAAC;AAC5E,YAAI;AACF,4BAAkB,MAAM,kBAAkB,QAAQ;AAAA,QACpD,UAAE;AACA,mBAAS,KAAK,CAAC;AAAA,QACjB;AAAA,MACF,QAAQ;AAGN;AAAA,MACF;AAAA,IACF,OAAO;AACL,UAAI,CAAC,KAAK,IAAK;AACf,wBAAkB,KAAK;AAAA,IACzB;AAKA,UAAM,QAAgC,MAAM,aACvC,MAAM,aAAa,EAAE,CAAC,OAAO,MAAM,YAAY,MAAM,IAAI,CAAC,GAAG,MAAM,WAAW,IAAI,CAAC,IACpF,EAAE,GAAI,MAAM,eAAe,CAAC,EAAG;AACnC,QAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG;AAErC,QAAI,YAAY;AAChB,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,UAAU,SAAS,eAAe;AAAA,MAChD,QAAQ;AAGN;AAAA,MACF;AACA,WAAK,KAAK,IAAI,MAAM,GAAG;AACvB,kBAAY;AAAA,IACd;AACA,QAAI,CAAC,UAAW;AAChB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/{chunk-TU6ZJTYT.js → chunk-SKF3DF7M.js}

@@ -1,9 +1,9 @@
 import {
   getAtPath
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-ZZZVNHN2.js";
 import {
   EmbeddingModelMismatchError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-lookup/embeddings/descriptor.ts
 function embeddingSourceText(record, source) {
@@ -290,4 +290,4 @@ export {
   isVecIdFor,
   deriveChunkVectors
 };
-//# sourceMappingURL=chunk-TU6ZJTYT.js.map
+//# sourceMappingURL=chunk-SKF3DF7M.js.map

package/dist/{chunk-AI35LNWQ.js → chunk-SKSHWV3E.js}

@@ -1,10 +1,10 @@
 import {
   grant,
   revoke
-} from "./chunk-QVUMKG3Z.js";
+} from "./chunk-WVML7HUZ.js";
 import {
   CustodyNotEnabledError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-party/custody/active.ts
 function withCustody() {
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-OEOSNNFH.js");
+      const { liberateVault } = await import("./liberate-A7WASOCG.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-AI35LNWQ.js.map
+//# sourceMappingURL=chunk-SKSHWV3E.js.map

package/dist/{chunk-O3NGOHXQ.js → chunk-TA5VTIC4.js}

@@ -1,6 +1,6 @@
 import {
   CollectionNotHydratedError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/kernel/query/hydration.ts
 var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
@@ -50,4 +50,4 @@ function gateTerminal(gate, terminal, compute) {
 export {
   gateTerminal
 };
-//# sourceMappingURL=chunk-O3NGOHXQ.js.map
+//# sourceMappingURL=chunk-TA5VTIC4.js.map

package/dist/{chunk-WVQDY3UM.js → chunk-U2N7DH4S.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-QHG7GQKM.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-URGHKZPL.js";
+} from "./chunk-VUBRHJ4H.js";
 import {
   DictKeyMissingError,
   PermissionDeniedError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/via/lookup/handle.ts
 function isDeleteMarker(envelope) {
@@ -392,4 +392,4 @@ export {
   dictCollectionName,
   LookupHandle
 };
-//# sourceMappingURL=chunk-WVQDY3UM.js.map
+//# sourceMappingURL=chunk-U2N7DH4S.js.map

package/dist/{chunk-6WEPFEMJ.js → chunk-VFGLMRO2.js}

@@ -1,7 +1,7 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-QNOWNCZS.js";
+} from "./chunk-HQPS27BT.js";
 import {
   buildRecordAad,
   buildRecordEnvelope,
@@ -10,7 +10,7 @@ import {
 } from "./chunk-WRLWEYHY.js";
 import {
   NoydbError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -126,4 +126,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-6WEPFEMJ.js.map
+//# sourceMappingURL=chunk-VFGLMRO2.js.map

package/dist/{chunk-CLOSXHR4.js → chunk-VPG2UJYR.js}

@@ -10,7 +10,7 @@ import {
   SequenceOfflineError,
   ValidationError,
   isConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-commit/sequence/active.ts
 function withSequence() {
@@ -197,4 +197,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-CLOSXHR4.js.map
+//# sourceMappingURL=chunk-VPG2UJYR.js.map

package/dist/{chunk-URGHKZPL.js → chunk-VUBRHJ4H.js}

@@ -31,4 +31,4 @@ export {
   SealedHandle,
   createStore
 };
-//# sourceMappingURL=chunk-URGHKZPL.js.map
+//# sourceMappingURL=chunk-VUBRHJ4H.js.map