@noy-db/hub 0.10.0-pre.0 → 0.10.0-pre.2

package/dist/{chunk-U277K5GR.js → chunk-AIHBYQHF.js}

@@ -1,3 +1,6 @@
+import {
+  resolveStaleOnRead
+} from "./chunk-2SIREKBR.js";
 import {
   isManifestReservedCollection
 } from "./chunk-EPFF7LOX.js";
@@ -7,28 +10,25 @@ import {
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-QNOWNCZS.js";
+} from "./chunk-MMSSHMHW.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-NHEKQWFI.js";
-import {
-  resolveStaleOnRead
-} from "./chunk-ZNVBCKMV.js";
+} from "./chunk-J4L4AS2W.js";
 import {
   loadFence
-} from "./chunk-TLIFNRU5.js";
+} from "./chunk-63LZLRWG.js";
 import {
   DELEGATIONS_COLLECTION
-} from "./chunk-JQMEXCUZ.js";
+} from "./chunk-VYBBE7RN.js";
 import {
   buildPersistedIndexCallbacks,
   syncTierSearch
-} from "./chunk-CSAN22QG.js";
+} from "./chunk-TT4D52EK.js";
 import {
   isBaseLive,
   liveBaseIdSet
-} from "./chunk-X6Z2SIRF.js";
+} from "./chunk-E2JIE4S3.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -36,19 +36,19 @@ import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-BSEPI3HD.js";
+} from "./chunk-PR36DD2X.js";
 import {
   NO_PORTABILITY
-} from "./chunk-R4GLRJ55.js";
+} from "./chunk-HRNQYGLQ.js";
 import {
   NO_CARGO
-} from "./chunk-IFUYLIEY.js";
+} from "./chunk-YF7P2DG7.js";
 import {
   saveSealedSecret
-} from "./chunk-GU6QXHPZ.js";
+} from "./chunk-OIBFIWVJ.js";
 import {
   runDrainBarrier
-} from "./chunk-PWAMX5KU.js";
+} from "./chunk-OOLF5FU2.js";
 import {
   NO_FORMATS
 } from "./chunk-RWFQVNXR.js";
@@ -58,7 +58,7 @@ import {
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-AI35LNWQ.js";
+} from "./chunk-NQQ4MOPC.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph,
@@ -72,21 +72,21 @@ import {
   resolveComputedEdges,
   resolveDescribeFieldIds,
   resolveVirtualMoneyFields
-} from "./chunk-VLRY2UH4.js";
+} from "./chunk-U7CMJY5P.js";
 import {
   findMatchingIdsByPairs
 } from "./chunk-TFMM5DBB.js";
 import {
   encodeVecId
-} from "./chunk-TU6ZJTYT.js";
+} from "./chunk-PZNK4HTV.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-ID4ZBC3X.js";
+} from "./chunk-NYEXUZDW.js";
 import {
   derivePersistedSchema
-} from "./chunk-UORWAG7K.js";
+} from "./chunk-FY4FFNKK.js";
 import {
   findRollupSpecForIntent,
   forgetDerivedFanout,
@@ -96,7 +96,7 @@ import {
   runGraphDispatchWave,
   selfWriteFieldEqual,
   touchFor
-} from "./chunk-WIUH6EJ7.js";
+} from "./chunk-LWQFGR34.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -111,19 +111,19 @@ import {
   resolveDictSource,
   resolveLabelFromMap,
   updateReferencingRecords
-} from "./chunk-PZN76MMV.js";
+} from "./chunk-RIACRFWA.js";
 import {
   OverlayedCollection
-} from "./chunk-PU5ZEV65.js";
+} from "./chunk-UZVHSYIF.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC,
   openRejection,
   sealRejection
-} from "./chunk-7UHLO4ZN.js";
+} from "./chunk-B2HU55QD.js";
 import {
   NO_ATTESTATION
-} from "./chunk-LZN6DTFI.js";
+} from "./chunk-ECDM6YRX.js";
 import {
   NO_COVERAGE
 } from "./chunk-NV4OESHC.js";
@@ -136,7 +136,7 @@ import {
   resolvePeriodKey,
   resolveReopenState,
   samePartition
-} from "./chunk-2T2TGRWE.js";
+} from "./chunk-EM56MHN5.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -144,7 +144,7 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-A52BK5AY.js";
+} from "./chunk-JRCO67NG.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -155,7 +155,7 @@ import {
   TxContext,
   bestEffortRevert,
   trackKeyedWrite
-} from "./chunk-PFHDQY5L.js";
+} from "./chunk-56Z4NOC6.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -164,26 +164,26 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-DL4GCSTS.js";
+} from "./chunk-Y2RYUWSQ.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-CLOSXHR4.js";
+} from "./chunk-7KNYLHVX.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-ZK2WT532.js";
+} from "./chunk-K5TVSOPQ.js";
 import {
   LazyQuery,
   NO_INDEXING,
   compositeKey,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-2ODEFG6K.js";
+} from "./chunk-EWSIJDWO.js";
 import {
   IMPLICIT_LAZY
 } from "./chunk-66TQOPFM.js";
@@ -201,41 +201,41 @@ import {
 } from "./chunk-GSAK56VF.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-UMV5GBTJ.js";
+} from "./chunk-JPSOFWJR.js";
 import {
   normalizeIndexDefs,
   parseFieldIndexSnapshot
-} from "./chunk-AYOQZJDB.js";
+} from "./chunk-LIX4QPMM.js";
 import {
   EXPORT_REDACTION_MARKER,
   ViaPipeline,
   exportRedact
-} from "./chunk-6WIFF46H.js";
+} from "./chunk-CQLMRCKX.js";
 import {
   ScanBuilder
-} from "./chunk-GZISWBCJ.js";
+} from "./chunk-74W56QPY.js";
 import {
   Query
-} from "./chunk-7C7OF26T.js";
+} from "./chunk-C2NXAR3D.js";
 import {
   NO_REDUCE
 } from "./chunk-3TDUWVWB.js";
 import {
   readPath
-} from "./chunk-SXPLIRQH.js";
+} from "./chunk-NLDBQHDV.js";
 import {
   dictCollectionName
-} from "./chunk-WVQDY3UM.js";
+} from "./chunk-AHA7UALU.js";
 import {
   NO_I18N,
   getAtPath,
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-3M2KK7O7.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-PIO6NW7O.js";
+} from "./chunk-ZG7DBIVX.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -258,12 +258,15 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-GLSCL74M.js";
+} from "./chunk-5AVIUJP4.js";
 import {
+  assertFieldsSupported,
   assertKeyringOpenAllowed,
+  assertPeerKeyringMatches,
+  assertServicesSupported,
   buildRecipientKeyringFile,
   changeSecret,
-  createOwnerKeyring,
+  createOwnerKeyringOrLoad,
   ensureCollectionDEK,
   hasAccess,
   hasExportCapability,
@@ -273,15 +276,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-QVUMKG3Z.js";
+} from "./chunk-UXH4AKH3.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-6BEBWHNL.js";
+} from "./chunk-ZQQLOEWN.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-FVKQ5QUC.js";
+} from "./chunk-JW3I3NNZ.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -290,16 +293,16 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-L4UL4IAR.js";
+} from "./chunk-F7ENMZYJ.js";
 import {
   sha256Hex
-} from "./chunk-QHG7GQKM.js";
+} from "./chunk-5JNEDW7I.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   dekKey,
   liveRecordIsElevated
-} from "./chunk-LJ744WXU.js";
+} from "./chunk-F2FD4LSB.js";
 import {
   NO_VAULT_HEAD
 } from "./chunk-OFD2HD6F.js";
@@ -311,7 +314,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-P6FATPXQ.js";
+} from "./chunk-3ZCVY3T6.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -320,6 +323,7 @@ import {
   buildRecordAad,
   buildRecordEnvelope,
   buildTombstone,
+  capabilities,
   encrypt,
   findByDet,
   hasPerRecordKey,
@@ -332,13 +336,13 @@ import {
   resolveStableCek,
   rewrapBodyToDek,
   verifyRecordIdentity
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   validateSchemaInput
-} from "./chunk-HTRLQ4ZZ.js";
+} from "./chunk-I4S7IZSS.js";
 import {
   SealedHandle
-} from "./chunk-URGHKZPL.js";
+} from "./chunk-CR5UPYIJ.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -378,7 +382,7 @@ import {
   UniqueConstraintError,
   ValidationError,
   isConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/merge-authority.ts
 function buildMergeAuthority(keyring) {
@@ -492,6 +496,96 @@ function resolveStrategies(options) {
   return resolved;
 }
 
+// src/kernel/store-segment-guard.ts
+function assertName(value, what) {
+  if (typeof value !== "string" || value === "" || value === "." || value === ".." || value.includes("/") || value.includes("\\") || value.includes("\0")) {
+    throw new ValidationError(
+      `store contract: ${what} must be a single segment \u2014 never empty, "." or "..", and carrying no path separator or NUL. Got ${JSON.stringify(value)}.`
+    );
+  }
+}
+function assertId(id) {
+  if (typeof id !== "string" || id === "") {
+    throw new ValidationError(
+      `store contract: record id must be a non-empty string. Got ${JSON.stringify(id)}.`
+    );
+  }
+  for (const part of id.split("/")) {
+    if (part === "" || part === "." || part === "..") {
+      throw new ValidationError(
+        `store contract: record id has an empty, "." or ".." component, which can escape its vault on a path-based store. A slash IS allowed (hub writes "_idx/<field>/<id>"); an empty or dot component is not. Got ${JSON.stringify(id)}.`
+      );
+    }
+  }
+}
+var POSITIONAL = {
+  loadAll: "v",
+  list: "vc",
+  listSince: "vc",
+  listPage: "vc",
+  get: "vci",
+  put: "vci",
+  delete: "vci",
+  presignUrl: "vci"
+};
+function checkPositional(kind, args) {
+  assertName(args[0], "vault");
+  if (kind === "v") return;
+  assertName(args[1], "collection");
+  if (kind === "vc") return;
+  assertId(args[2]);
+}
+function checkSnapshot(args) {
+  assertName(args[0], "vault");
+  const data = args[1];
+  for (const [collection, records] of Object.entries(data ?? {})) {
+    assertName(collection, "collection");
+    for (const id of Object.keys(records ?? {})) assertId(id);
+  }
+}
+function checkTx(args) {
+  for (const op of args[0] ?? []) {
+    assertName(op?.vault, "vault");
+    assertName(op?.collection, "collection");
+    assertId(op?.id);
+  }
+}
+function unguardedStore(store) {
+  return RAW.get(store) ?? store;
+}
+var RAW = /* @__PURE__ */ new WeakMap();
+function guardStoreSegments(store) {
+  const wrapped = /* @__PURE__ */ new WeakMap();
+  const proxy = new Proxy(store, {
+    // ⚠️ `receiver` is deliberately not taken. Forwarding it would make `this`
+    // the PROXY inside every method, which is the `#private`-field failure this
+    // wrapper exists to avoid — `Reflect.get(target, prop, target)` and
+    // `Reflect.apply(fn, target, …)` both pin the receiver to the real store.
+    get(target, prop) {
+      const value = Reflect.get(target, prop, target);
+      if (typeof value !== "function" || typeof prop !== "string") return value;
+      const check = prop === "saveAll" ? checkSnapshot : prop === "tx" ? checkTx : POSITIONAL[prop] !== void 0 ? (args) => checkPositional(POSITIONAL[prop], args) : null;
+      if (check === null) {
+        const cached2 = wrapped.get(value);
+        if (cached2 !== void 0) return cached2;
+        const passthrough = (...args) => Reflect.apply(value, target, args);
+        wrapped.set(value, passthrough);
+        return passthrough;
+      }
+      const cached = wrapped.get(value);
+      if (cached !== void 0) return cached;
+      const guarded = async (...args) => {
+        check(args);
+        return Reflect.apply(value, target, args);
+      };
+      wrapped.set(value, guarded);
+      return guarded;
+    }
+  });
+  RAW.set(proxy, store);
+  return proxy;
+}
+
 // src/kernel/secret-mode.ts
 function validateSecretModeOptions(options) {
   const encrypted = options.encrypt !== false;
@@ -558,7 +652,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-H5WYSJ46.js");
+    const { resolveManagedSecret } = await import("./managed-secret-RPRVEYZA.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -576,11 +670,22 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultMesh(store) {
-  const { StoreMesh } = await import("./store-coordination-provider-2YD2PTTP.js");
+  const { StoreMesh } = await import("./store-coordination-provider-SEQM7SHJ.js");
   return new StoreMesh(store);
 }
 
 // src/port/with/collection-registries.ts
+function reconcileDeclarationOnlyOptions(r, collectionName, options) {
+  if (options === void 0) return;
+  if ((options.schemaUpdate?.length ?? 0) > 0) {
+    throw new ValidationError(
+      `vault.collection(${JSON.stringify(collectionName)}, { schemaUpdate }): this collection is already open, and schemaUpdate can only take effect at its FIRST acquisition \u2014 its gate is built once, when the collection is constructed, so declaring it here used to be dropped in silence. Pass it on the first vault.collection(${JSON.stringify(collectionName)}, ...) call in this process, or acquire the open collection with vault.collection(${JSON.stringify(collectionName)}) and no options.`
+    );
+  }
+  if (options.archive !== void 0) {
+    r.archiveRegistry.set(collectionName, options.archive);
+  }
+}
 function populateCollectionRegistries(r, collectionName, options, effectiveViaFields) {
   if (options?.refs) {
     r.refRegistry.register(collectionName, options.refs);
@@ -642,16 +747,26 @@ async function resolveExportSource(adapter, vault, opts) {
       // every collection's envelopes out of the store before declining to
       // decrypt most of them — the fetch would already have happened, which is
       // precisely the half that makes "scoping" a word rather than a property.
-      ids: async (collection) => await adapter.list(vault, collection)
+      ids: async (collection) => await adapter.list(vault, collection),
+      // One `get` per record, and only when `withEnvelopeMeta` is set — a
+      // scoped export that does not ask still reads exactly what core#45b
+      // narrowed it to.
+      envelope: async (collection, id) => await adapter.get(vault, collection, id)
     };
   }
   const snapshot = await adapter.loadAll(vault);
   return {
     collections: Object.keys(snapshot).sort(),
     scoped: false,
-    ids: async (collection) => Object.keys(snapshot[collection] ?? {})
+    ids: async (collection) => Object.keys(snapshot[collection] ?? {}),
+    // Free: the envelope is already in the snapshot this source was built from.
+    envelope: async (collection, id) => snapshot[collection]?.[id] ?? null
   };
 }
+async function readEnvelopeMeta(source, collection, id) {
+  const envelope = await source.envelope(collection, id);
+  return { version: envelope?._v ?? 0, ts: envelope?._ts ?? "" };
+}
 
 // src/kernel/generation-map.ts
 var tick = 0;
@@ -1752,7 +1867,7 @@ async function commitSequentially(ctx, entries, priors) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-LZLSYOPG.js"));
+var loadComputed = lazy(() => import("./computed-UCYVPMZA.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2185,6 +2300,12 @@ var Collection = class {
     this.deterministicFields = cfg.deterministicFields;
     this.sensitiveFields = cfg.sensitiveFields;
     this.perRecordCek = cfg.perRecordCek;
+    assertFieldsSupported(this.name, {
+      sensitiveFields: cfg.sensitiveFields,
+      deterministicFields: cfg.deterministicFields,
+      perRecordKeys: cfg.perRecordCek === true,
+      classifiedByField: cfg.classified?.byField ?? null
+    }, capabilities());
     this.cekCache = cfg.cekCache;
     this.provenance = cfg.provenance;
     if (this.sensitiveFields.size > 0 && !this.storeCiphertext) {
@@ -2247,7 +2368,7 @@ var Collection = class {
       if (policy === "last-writer-wins") {
         resolver = async (_id, local, remote) => local._ts >= remote._ts ? local : remote;
       } else if (policy === "first-writer-wins") {
-        resolver = async (_id, local, remote) => local._v <= remote._v ? local : remote;
+        resolver = async (_id, local, remote) => local._v < remote._v ? local : remote;
       } else if (policy === "manual") {
         resolver = (id, local, remote) => new Promise((resolvePromise) => {
           let settled = false;
@@ -2561,7 +2682,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-QWO5UKD6.js");
+    const { verifyDigestField } = await import("./capsule-YAITMH77.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2773,7 +2894,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-CROGJBIJ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-PUCZH5GJ.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3005,7 +3126,8 @@ var Collection = class {
     if ((envelope._tier ?? 0) > 0) return { admitted: true };
     let incoming;
     try {
-      incoming = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { skipValidation: true });
+      const raw = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { skipValidation: true });
+      incoming = this.via ? this.via.canonicalizeStored(raw) : raw;
     } catch {
       return { admitted: true };
     }
@@ -3228,6 +3350,16 @@ var Collection = class {
     }
     await assertTierWritable(this.adapter, this.vault, this.name, id, this.tiers !== null);
     if (this.via) record = this.via.ingest(record);
+    const viaWriteCtx = {
+      id,
+      vault: this.vault,
+      prior: async () => await this.resolveDensifyPrior(id) ?? null,
+      emit: (e, p) => this.emitter.emit(e, p)
+    };
+    if (this.via) await this.via.enforceWrite(record, viaWriteCtx);
+    if (this.computed !== void 0) {
+      record = (await loadEvalComputedFields())(record, this.computed, id);
+    }
     if (this.subsystemBus?.hasGateHandlers("beforePut")) {
       const { env: existingEnv, record: existingRecord } = await this.resolveGatePrior("beforePut", id);
       const gateEvent = {
@@ -3245,16 +3377,6 @@ var Collection = class {
       };
       await this.subsystemBus.dispatchGate("beforePut", gateEvent);
     }
-    const viaWriteCtx = {
-      id,
-      vault: this.vault,
-      prior: async () => await this.resolveDensifyPrior(id) ?? null,
-      emit: (e, p) => this.emitter.emit(e, p)
-    };
-    if (this.via) await this.via.enforceWrite(record, viaWriteCtx);
-    if (this.computed !== void 0) {
-      record = (await loadEvalComputedFields())(record, this.computed, id);
-    }
     if (this.schema !== void 0) {
       record = await validateSchemaInput(this.schema, record, `put(${id})`);
     }
@@ -3394,7 +3516,7 @@ var Collection = class {
    */
   async _dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-KOPDDPEQ.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-V5WLDTVX.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3560,13 +3682,13 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async _dispatchDerivations(id, record, version, wave, prior) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-4BUYPWMJ.js");
+    const { dispatchDerivations } = await import("./dispatch-QW32QBLW.js");
     return dispatchDerivations(this.#derivationDispatchCtx(), id, record, version, wave, prior);
   }
   /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
   async _dispatchTriggerDerivationsOnDelete(id, deleted) {
     if (this.derivationSource === void 0) return;
-    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-4BUYPWMJ.js");
+    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-QW32QBLW.js");
     return dispatchTriggerDerivationsOnDelete(this.#derivationDispatchCtx(), id, deleted);
   }
   /**
@@ -3889,7 +4011,7 @@ var Collection = class {
    */
   async _dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-4BUYPWMJ.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-QW32QBLW.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -3903,7 +4025,7 @@ var Collection = class {
    */
   async _dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-KOPDDPEQ.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-V5WLDTVX.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -3923,7 +4045,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-CROGJBIJ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-PUCZH5GJ.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -3970,7 +4092,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-CROGJBIJ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-PUCZH5GJ.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5150,14 +5272,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-7HXDMYHI.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-HKMRC7SC.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-7HXDMYHI.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-HKMRC7SC.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -6825,7 +6947,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-KMUBFN2L.js").then(
+  const load = () => engine ??= import("./link-set-PC2EJRKL.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7478,7 +7600,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-2AC2STHC.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-RITSNASO.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8438,6 +8560,7 @@ var Vault = class {
     let coll = this.collectionCache.get(collectionName);
     const effectiveViaFields = mergeViaFields({ moneyFields: options?.moneyFields, i18nFields: options?.i18nFields, dictKeyFields: options?.dictKeyFields, lookupFields: options?.lookupFields, viaFields: options?.viaFields });
     if (coll) {
+      reconcileDeclarationOnlyOptions(this.#registries(), collectionName, options);
       reconcileViaAttach(coll, this.graph, collectionName, this._viaReconcileCtx(), {
         effectiveViaFields,
         ...options?.refs !== void 0 ? { refs: options.refs } : {},
@@ -8457,7 +8580,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-PIORIMMR.js");
+          const { persistSchemaIfNeeded } = await import("./register-BB34SK7E.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8607,7 +8730,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-PIORIMMR.js")).persistSchemaIfNeeded({
+            await (await import("./register-BB34SK7E.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -8653,7 +8776,7 @@ var Vault = class {
    * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
    */
   async migrateSatellitePerRecordKeys(satelliteName) {
-    const { migrateSatelliteCek } = await import("./migrate-cek-SPESQAAO.js");
+    const { migrateSatelliteCek } = await import("./migrate-cek-DTSCWGEF.js");
     return migrateSatelliteCek(satelliteName, this.collection(satelliteName, { perRecordKeys: true }));
   }
   /**
@@ -9303,7 +9426,7 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-TW5MAQJP.js");
+    const { loadSigner } = await import("./signer-5P7IZC2K.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
@@ -9805,7 +9928,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-SELCBYEQ.js"),
+      import("./registry-SMNK6UM4.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new GuardRegistry();
@@ -9833,7 +9956,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-JGWLW53D.js"),
+      import("./registry-HU62GPWA.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9865,7 +9988,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-BIMICFUH.js");
+    const { MaterializedViewRegistry } = await import("./registry-65L6V5TO.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9890,7 +10013,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-W327UNYH.js");
+    const { OverlayedViewRegistry } = await import("./registry-X5VPBKCO.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9953,14 +10076,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-SNHW4ELF.js");
+    const { MaterializedViewExecutor } = await import("./executor-JEAAEJUM.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-CROGJBIJ.js");
+    const { clearMVStaleFully } = await import("./stale-PUCZH5GJ.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9973,7 +10096,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-Z3IKK7G3.js");
+    const { DerivationExecutor } = await import("./executor-7QN22OKI.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-BIGO37U3.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10000,7 +10123,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-FYDRL7F3.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-DDONAFJT.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10220,14 +10343,14 @@ var Vault = class {
   /**
    * issue a time-boxed cross-tier delegation. Writes an
    * encrypted envelope to the reserved `_delegations` collection that
-   * the target user's runtime will pick up next time they open the
-   * vault.
+   * the target picks up at their next `refreshDelegations()` call —
+   * explicit, never automatic (core#56).
    *
    * Caller must hold the tier DEK for the requested tier and
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION: DELEGATIONS_COLLECTION2 } = await import("./delegation-7SSGIETH.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION: DELEGATIONS_COLLECTION2 } = await import("./delegation-SNALWRMO.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10245,7 +10368,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION: DELEGATIONS_COLLECTION2 } = await import("./delegation-7SSGIETH.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION: DELEGATIONS_COLLECTION2 } = await import("./delegation-SNALWRMO.js");
     await revokeDelegation(this.adapter, this.name, id);
     await this.onDirty?.(DELEGATIONS_COLLECTION2, id, "delete", 1);
   }
@@ -10502,7 +10625,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-3KEOL7BY.js");
+    const { dumpVaultSchema } = await import("./walk-Z4N7PCZ2.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10598,7 +10721,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getPodHandle() {
-    const { buildPodHandle } = await import("./pod-handle-GJLCOUGK.js");
+    const { buildPodHandle } = await import("./pod-handle-KBPQRN6Q.js");
     return buildPodHandle(this.adapter, this.name);
   }
   /**
@@ -10630,7 +10753,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-E3GBMNDA.js");
+    const { dumpVault } = await import("./backup-BHKVK5SD.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10718,7 +10841,7 @@ var Vault = class {
    */
   async restoreTo(timestamp, options) {
     const iso = timestamp instanceof Date ? timestamp.toISOString() : timestamp;
-    const { restoreTo } = await import("./restore-to-OOPKLAPU.js");
+    const { restoreTo } = await import("./restore-to-VQHT67OH.js");
     const instant = this.at(iso);
     return restoreTo({
       adapter: this.adapter,
@@ -10729,7 +10852,7 @@ var Vault = class {
     }, iso, options);
   }
   async load(backupJson, options) {
-    const { loadVault } = await import("./backup-E3GBMNDA.js");
+    const { loadVault } = await import("./backup-BHKVK5SD.js");
     return loadVault(this.backupContext(), backupJson, options);
   }
   /**
@@ -10761,7 +10884,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-E3GBMNDA.js");
+    const { verifyBackupIntegrity } = await import("./backup-BHKVK5SD.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10877,17 +11000,24 @@ var Vault = class {
       const dictionaries = dictSnapshotCache.get(collectionName);
       if (granularity === "collection") {
         const records = [];
+        const chunkIds = [];
+        const envelopeMeta = opts.withEnvelopeMeta === true ? [] : void 0;
         for (const id of ids) {
           const record = await coll.get(id, localeOpts);
-          if (record !== null) records.push(exportRedact(coll, record));
+          if (record === null) continue;
+          records.push(exportRedact(coll, record));
+          chunkIds.push(id);
+          if (envelopeMeta !== void 0) envelopeMeta.push(await readEnvelopeMeta(source, collectionName, id));
         }
         const chunk = {
           collection: collectionName,
           schema,
           refs,
           records,
+          ids: chunkIds,
           ...dictionaries !== void 0 ? { dictionaries } : {},
-          ...ledgerHead ? { ledgerHead } : {}
+          ...ledgerHead ? { ledgerHead } : {},
+          ...envelopeMeta !== void 0 ? { envelopeMeta } : {}
         };
         yield chunk;
       } else {
@@ -10899,8 +11029,10 @@ var Vault = class {
             schema,
             refs,
             records: [exportRedact(coll, record)],
+            ids: [id],
             ...dictionaries !== void 0 ? { dictionaries } : {},
-            ...ledgerHead ? { ledgerHead } : {}
+            ...ledgerHead ? { ledgerHead } : {},
+            ...opts.withEnvelopeMeta === true ? { envelopeMeta: [await readEnvelopeMeta(source, collectionName, id)] } : {}
           };
           yield chunk;
         }
@@ -10991,7 +11123,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-E3GBMNDA.js");
+    const { exportVaultJSON } = await import("./backup-BHKVK5SD.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11878,8 +12010,9 @@ function memoryStore(options = {}) {
     async put(vault, collection, id, envelope, expectedVersion) {
       const c = coll(vault, collection);
       const existing = c.get(id);
-      if (expectedVersion !== void 0 && existing && existing._v !== expectedVersion) {
-        throw new ConflictError(existing._v, `Version conflict: expected ${expectedVersion}, found ${existing._v}`);
+      const current = existing?._v ?? 0;
+      if (expectedVersion !== void 0 && current !== expectedVersion) {
+        throw new ConflictError(current, `Version conflict: expected ${expectedVersion}, found ${current}`);
       }
       c.set(id, envelope);
     },
@@ -12522,7 +12655,7 @@ var TeamFacade = class {
   async recoverManagedSecret(vault, options) {
     if (this.deps.options.secretMode !== "managed") {
       throw new ValidationError(
-        "recoverManagedSecret: this method only applies to vaults opened in managed-secret mode. For standard mode, use db.recoverSecret."
+        "recoverManagedSecret: this method only applies to vaults opened in managed-secret mode. For standard mode, use db.team.recoverSecret."
       );
     }
     const provider = this.deps.options.sealingKey;
@@ -12537,7 +12670,7 @@ var TeamFacade = class {
     for (let i = 0; i < randomBytes.length; i++) binary += String.fromCharCode(randomBytes[i]);
     const newSecret = btoa(binary);
     try {
-      const sealed = await provider.seal(randomBytes);
+      const sealed = await provider.seal(randomBytes, { vault });
       await recoverSecret(
         this.deps.options.shamirRecovery,
         this.deps.options.store,
@@ -12582,7 +12715,7 @@ var TeamFacade = class {
    * recovery / TOTP / email-OTP factor proof at the moment of
    * recovery, so the issuer affirmatively re-asserts identity.
    *
-   * The recipient should call `db.rotateSecret` on first session
+   * The recipient should call `db.team.rotateSecret` on first session
    * to choose their own phrase — the temp acts as a single-use
    * bridge.
    *
@@ -12592,7 +12725,7 @@ var TeamFacade = class {
    *   secret: 'temporary-correct-horse-battery-staple-printer',
    * }, { factors: [{ kind: 'recovery' }] })
    * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-   * // and immediately calls db.rotateSecret to set his own.
+   * // and immediately calls db.team.rotateSecret to set his own.
    * ```
    *
    * @throws `NoAccessError` when no keyring exists for the target.
@@ -13067,7 +13200,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role, ...e.origin !== void 0 ? { origin: e.origin } : {} };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-7SY3M6TZ.js");
+      const { GuardExecutor } = await import("./executor-BJZJNVBB.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13190,7 +13323,7 @@ var Noydb = class {
   }
   /** Uncached single-flight body of {@link openVault} — see `vaultOpening`. */
   async #openVaultFresh(name, opts) {
-    const keyring = await this._getKeyringInternal(name, { create: opts?.create !== false });
+    const keyring = await this._getKeyringInternal(name, { create: opts?.create !== false, requireManagedRecovery: true });
     if (!this.activeTier.has(name)) this.activeTier.set(name, 1);
     if (this.options.encrypt !== false && !this.policyCache.has(name)) {
       await this.bootstrapPolicy(name);
@@ -13989,7 +14122,7 @@ var Noydb = class {
   }
   /** The default store this instance was opened with (#948). */
   get store() {
-    return this.options.store;
+    return unguardedStore(this.options.store);
   }
   /**
    * Currently-running multi-record transaction, or `null` outside
@@ -14117,6 +14250,7 @@ var Noydb = class {
     const t = normalizeSyncTargets(target)[0];
     const declared = t.policy ?? this.options.syncPolicy;
     const keyring = await this._getKeyringInternal(vault);
+    if (this.options.encrypt !== false) await assertPeerKeyringMatches(this.options.store, t.store, vault, this.options.user);
     const engine = this.strategies.sync.buildSyncEngine({
       local: this.options.store,
       remote: t.store,
@@ -14626,6 +14760,7 @@ var Noydb = class {
     }
     await this.strategies.sync.bootstrapKeyrings(this.options.store, normalizeSyncTargets(this.options.sync).find((t) => t.role === "sync-peer")?.store, vault);
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
+    if (opts.requireManagedRecovery === true && this.options.secretMode === "managed" && !this._skipNextManagedRecoveryCheck && !await hasStrongRecoveryEnrolled(this.options.store, vault)) throw new ManagedRecoveryNotEnrolledError(vault);
     const effectiveSecret = await resolveEffectiveSecret(this.options, this.options.store, vault);
     if (!effectiveSecret) {
       throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
@@ -14635,10 +14770,10 @@ var Noydb = class {
       keyring = await loadKeyring(this.options.store, vault, { userId: this.options.user, secret: effectiveSecret });
     } catch (err) {
       if (err instanceof NoAccessError) {
-        keyring = await createOwnerKeyring(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
+        keyring = await createOwnerKeyringOrLoad(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
         await this.options.store.delete(vault, "_keyring", this.options.user);
-        keyring = await createOwnerKeyring(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
+        keyring = await createOwnerKeyringOrLoad(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
       } else {
         throw err;
       }
@@ -14672,10 +14807,11 @@ var Noydb = class {
   }
 };
 async function createNoydb(options) {
-  if (!options.store) options = { ...options, store: memoryStore() };
+  assertServicesSupported(options, capabilities());
+  options = { ...options, store: guardStoreSegments(options.store ?? memoryStore()) };
   validateSecretModeOptions(options);
   if (!options.mesh) options = { ...options, mesh: await createDefaultMesh(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-H4B7ZQXP.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-QSEKT4KS.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14708,4 +14844,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-U277K5GR.js.map
+//# sourceMappingURL=chunk-AIHBYQHF.js.map