@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.12

package/dist/storage-GR7KZRH4.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-HK4XTXO4.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-GR7KZRH4.js.map

package/dist/{store-coordination-provider-HPYVFJCV.js → store-coordination-provider-5KDS2RRP.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-Q3XSMOZM.js";
+} from "./chunk-SAL5X5OK.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-HPYVFJCV.js.map
+//# sourceMappingURL=store-coordination-provider-5KDS2RRP.js.map

package/dist/sync/index.js

@@ -2,17 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-W5D62AQD.js";
+} from "../chunk-VXZNSPJM.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-OOLO4LQG.js";
+} from "../chunk-NRYNRSGV.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -23,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-IP2QBAGS.js";
+} from "../chunk-3QSOFZQB.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -32,14 +32,14 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-6QILBDZU.js";
+} from "../chunk-S7TAPIRS.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-W5D62AQD.js";
+} from "../chunk-VXZNSPJM.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-4R4Q64W5.js";
+import "../chunk-KKYEZCQG.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -57,19 +57,19 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-5ZOSG3RJ.js";
-import "../chunk-4N5QFSNQ.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-CCIR2OJH.js";
+import "../chunk-JGUZMC3I.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   TeamNotEnabledError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.js

@@ -9,19 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-H6HM6CVR.js";
-import "../chunk-4R4Q64W5.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-AKEOHKMT.js";
+import "../chunk-KKYEZCQG.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   TiersNotEnabledError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-H44ZE4IE.js";
+} from "../chunk-AAIIDAUC.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-GZWMTOXB.js");
+      const { GuardExecutor } = await import("../executor-UPSH5O3F.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-66RHOW7N.js → verify-QK76NJ4G.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-MSPNM2OM.js";
+} from "./chunk-XS6DLN67.js";
 import {
   dualReadSealedSlot
-} from "./chunk-SYMS4546.js";
+} from "./chunk-NM3IFKBL.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -136,4 +136,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-66RHOW7N.js.map
+//# sourceMappingURL=verify-QK76NJ4G.js.map

package/dist/via/lookup/registry.d.ts

@@ -99,6 +99,15 @@ export interface LookupDictCompat {
  * snapshot seam).
  */
 export declare function collectLookupDictCompat(lookupFields: Record<string, LookupDescriptor> | undefined): LookupDictCompat;
+/**
+ * Reserved-dict deps of a set of named collections (#653) — the `_dict_*`
+ * collections partial sync must auto-include alongside a `collections`
+ * filter, mirroring `SyncEngine`'s existing satellite-pair expansion.
+ * One hop is provably complete: `vault.collection()` refuses `_dict_*`
+ * names, so a dict can never itself declare lookup fields — no
+ * dict-of-dict chain to recurse through.
+ */
+export declare function reservedDictDepsOf(names: readonly string[], dictKeyFieldRegistry: ReadonlyMap<string, Record<string, string>>): readonly string[];
 /**
  * A lookup dimension's sync membership/altKey table, materialized from its
  * backing rows (#650 Task 3). `keys` is every canonical key present;

package/dist/via/money/where.d.ts

@@ -86,12 +86,33 @@ export declare function moneyFieldClause(field: string, op: Operator, value: unk
  * canonical write's probe hits directly (no canonicalization needed for the
  * common case); this note covers the pre-declaration tail.
  *
- * Boundary: this guarantee is EAGER-mode only (`CollectionIndexes`, this
- * file's index probe). LAZY mode's `PersistedCollectionIndex`
- * (`with-lookup/indexing/persisted-indexes.ts`) keeps its own raw bucketing
- * and does not consult money canonicalization — a lazy-mode mixed-era record
- * can still diverge between its fast path and a forced scan. Tracked
- * separately, not fixed here.
+ * Boundary — CLOSED for the index layer (#677): LAZY mode's
+ * `PersistedCollectionIndex` (`with-lookup/indexing/persisted-indexes.ts`)
+ * now consults the SAME `ViaPipeline.canonicalizeIndexKey` at every
+ * bucket-mutation site (`ingest`/`upsert`/`remove`) as `CollectionIndexes`
+ * does, and its query path (`with-lookup/indexing/lazy-builder.ts`'s
+ * `resolveCandidateIds()`) canonicalizes the `==`/`in` probe value before
+ * calling `lookupEqual`/`lookupIn` — mirroring `candidateRecords()` above
+ * resolving `indexValue` before its own `lookupEqual`/`lookupIn` call. A
+ * lazy-mode mixed-era record's bucket and a canonicalized probe now agree,
+ * the same as eager mode.
+ *
+ * Residual boundary CLOSED by #684: `LazyQuery.where()` now builds
+ * `clause.via` exactly like `Query.where()`/`ScanBuilder.where()` do, and
+ * `LazyQuery`'s post-filter (`lazy-builder.ts`'s `toArray()`) runs it
+ * against the RAW record (a dedicated raw-fetch seam on `Collection`, split
+ * out of `get()`) instead of the DECODED one — `clause.via.evaluate` (this
+ * file's {@link evaluateMoneyClause}) now sees the same stored-form
+ * operand/actual-value space eager's `filterRecords` does, at any `scale`.
+ * Only survivors are decoded (`present()`) on the way out. Money RANGE
+ * clauses additionally route around `PersistedCollectionIndex.lookupRange`
+ * (raw/typed, wrong space for scaled-int money) — `resolveCandidateIds()`
+ * enumerates the field's indexed ids instead and lets this now-via-aware
+ * post-filter apply the correct BigInt-exact comparison. `lazyQuery().
+ * where()` on a money field now agrees with `scan().where()` /
+ * `query().where()` at every `scale` — for `.where()` results specifically.
+ * `orderBy` ordering is a separate, still-open lazy-vs-eager divergence,
+ * tracked in #695.
  */
 export declare function moneyIndexProbe(op: Operator, payload: MoneyWhereOperand): unknown | undefined;
 /**

package/dist/{walk-2RWEOCAS.js → walk-XQCBKSBW.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-QLLKLFE2.js";
+} from "./chunk-P2LJI6JE.js";
 import {
   loadPersistedSchema
-} from "./chunk-C7NTK5I3.js";
-import "./chunk-QQJXBZCO.js";
-import "./chunk-FQQF23MC.js";
-import "./chunk-MSPNM2OM.js";
-import "./chunk-SYMS4546.js";
-import "./chunk-X6CMGUAG.js";
+} from "./chunk-HK4XTXO4.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-HUS3J5WM.js";
-import "./chunk-CKZW6P5V.js";
-import "./chunk-FH542DDY.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-2RWEOCAS.js.map
+//# sourceMappingURL=walk-XQCBKSBW.js.map

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-JOQ53DMI.js";
-import "../chunk-5ZOSG3RJ.js";
-import "../chunk-4N5QFSNQ.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-K2DLLK34.js";
+import "../chunk-CCIR2OJH.js";
+import "../chunk-JGUZMC3I.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/with-commit/tx/transaction.d.ts

@@ -199,6 +199,11 @@ export declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Prom
  * state can still reconstruct it by walking the ledger through the
  * failed-tx timestamp.
  *
+ * Delegates the reverse/best-effort/raw-revert shape to the shared
+ * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache
+ * invalidation below rides along as that helper's per-leg `compensate`
+ * callback, gated on `db` exactly as before.
+ *
  * @internal — shared between `runTransaction` and
  * `Collection.putManyAtomic`. Both register source ops + nested
  * derivation side-effect ops onto `_executed`; this helper unwinds the

package/dist/with-lookup/indexing/lazy-builder.d.ts

@@ -25,6 +25,7 @@
 import type { FieldClause, Operator } from '../../kernel/query/predicate.js';
 import type { PersistedCollectionIndex } from './persisted-indexes.js';
 import type { QueryField } from '../../kernel/types.js';
+import type { ViaPipeline } from '../../kernel/via/pipeline.js';
 export interface LazyOrderBy {
     readonly field: string;
     readonly direction: 'asc' | 'desc';
@@ -36,10 +37,42 @@ export interface LazyOrderBy {
 export interface LazyQuerySource<T> {
     readonly collectionName: string;
     readonly persistedIndexes: PersistedCollectionIndex;
+    /**
+     * Per-field bucket-key canonicalizer (#677 — lazy twin of the eager
+     * `candidateRecords()` probe-resolution in `kernel/query/builder.ts`).
+     * Consulted in `resolveCandidateIds()` for `==`/`in` clause values
+     * BEFORE calling `lookupEqual`/`lookupIn`, so a mixed-era stored value
+     * (money) probes the SAME canonical bucket the write path now
+     * populates. A narrow closure — not the whole `ViaPipeline` — keeps
+     * the with-lookup/kernel seam thin. `undefined` (no via, or no binding
+     * covers the field) is the common case: falls back to the raw value,
+     * unchanged from today.
+     */
+    canonicalizeIndexKey?(field: string, value: unknown): string | undefined;
     /** Ensure `_idx/<field>/*` side-cars have been bulk-loaded into the mirror. */
     ensurePersistedIndexesLoaded(): Promise<void>;
-    /** Decrypt one record by id, or return null if it's gone. */
-    getRecord(id: string): Promise<T | null>;
+    /**
+     * Decrypt one record by id in RAW (pre-`present()`, stored-form) shape,
+     * or return null if it's gone (#684 — the raw-fetch seam). Used by the
+     * post-filter (`toArray()`) so a `clause.via.evaluate` (e.g. money) sees
+     * the same operand/actual-value space as eager's `filterRecords` — the
+     * DECODED form (e.g. money's canonical decimal) is only materialized
+     * for survivors, via {@link decodeRecord}.
+     */
+    getRawRecord(id: string): Promise<unknown>;
+    /**
+     * Apply this collection's locale/virtual-field decode (`present()`) to a
+     * RAW record already known to match — the output-side twin of
+     * {@link getRawRecord}. Mirrors eager's `Query.decodeVia`.
+     */
+    decodeRecord(record: unknown): Promise<T>;
+    /**
+     * This collection's compiled Via pipeline (money, i18n, …), read lazily
+     * (a method, not a captured value) so a late `_setVia` (#666) is honored
+     * — same closure discipline as {@link canonicalizeIndexKey}. `undefined`
+     * when the collection has no Via-covered fields.
+     */
+    via(): ViaPipeline | undefined;
 }
 interface LazyPlan {
     readonly clauses: readonly FieldClause[];

package/dist/with-lookup/indexing/persisted-indexes.d.ts

@@ -97,6 +97,23 @@ export declare function compositeKey(fields: readonly string[]): string;
 export declare class PersistedCollectionIndex {
     private readonly indexes;
     private readonly defs;
+    /**
+     * Per-field bucket-key canonicalizer (#677 — lazy twin of #672's
+     * `CollectionIndexes.setCanonicalizer`), registered ONCE via
+     * {@link setCanonicalizer} when the collection wires indexing up
+     * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by
+     * EVERY bucket-mutation site — `ingest`/`upsert`/`remove` — so bucket
+     * membership is symmetric: a legacy non-canonical stored value (e.g.
+     * `'0100'`) and a canonical one (`'100'`) land in the SAME bucket,
+     * mirroring `eager-indexes.ts`'s `addToIndex`/`removeFromIndex`.
+     */
+    private canonicalize?;
+    /**
+     * Register the bucket-key canonicalizer. Called once, where the
+     * collection constructs its indexing state — safe to call again (the
+     * closure is simply replaced) but there is normally only one caller.
+     */
+    setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void;
     /**
      * Declare a single-field index. Subsequent `upsert` / `ingest` calls
      * populate the in-memory mirror; calls before `declare` are no-ops
@@ -156,12 +173,21 @@ export declare class PersistedCollectionIndex {
      * back to scan or throws `IndexRequiredError`). Returns a shared empty
      * set if the field is declared but no record matches — that set MUST
      * NOT be mutated by the caller.
+     *
+     * `value` is bucketed via the plain {@link stringifyKey} — it is NOT
+     * canonicalized here. Callers on a Via-covered field (money) canonicalize
+     * `value` themselves BEFORE calling (see `lazy-builder.ts`'s
+     * `resolveCandidateIds()`, #677) — the SAME caller-canonicalizes split
+     * `eager-indexes.ts`'s `lookupEqual`/`lookupIn` use (see `kernel/query/
+     * builder.ts`'s `candidateRecords()`), so probing here twice never
+     * double-canonicalizes.
      */
     lookupEqual(field: string, value: unknown): ReadonlySet<string> | null;
     /**
      * Set lookup — return the union of record ids whose `field` matches any
      * of `values`. Returns `null` if the field is not declared. Returns a
-     * fresh (non-shared) Set — safe for the caller to mutate.
+     * fresh (non-shared) Set — safe for the caller to mutate. Same
+     * caller-canonicalizes contract as {@link lookupEqual} (#677).
      */
     lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null;
     /**
@@ -174,6 +200,23 @@ export declare class PersistedCollectionIndex {
      * Supported ops: `'<'`, `'<='`, `'>'`, `'>='`, `'between'`. For
      * `'between'`, `value` is `[lo, hi]` and both bounds are inclusive
      * (matches the eager-mode operator contract in `predicate.ts`).
+     *
+     * NOT canonicalized (#677): this method compares `value` against the
+     * ORIGINAL TYPED `state.values`, not a stringified bucket key, so a
+     * `canonicalizeIndexKey`-shaped (`string | undefined`) result would not
+     * even type-check as a bound here. This does NOT mirror eager mode the
+     * way `lookupEqual`/`lookupIn` do: `moneyIndexProbe` (`via/money/
+     * where.ts`) never emits a range probe, so EAGER mode's `candidateRecords`
+     * never calls an index for a range clause and always scans.
+     *
+     * LAZY mode's `resolveCandidateIds()` (`lazy-builder.ts`) no longer
+     * dispatches a Via-covered (e.g. money) range clause through THIS method
+     * at all (#684) — it enumerates the field's indexed ids via `orderedBy()`
+     * instead and leaves the raw/typed comparison here for the (now
+     * Via-aware) post-filter to redo correctly in scaled-int space. A
+     * NON-via range clause still dispatches through this method exactly as
+     * before — the raw/typed comparison here is correct and sufficient for
+     * fields with no decode-transforming Via binding.
      */
     lookupRange(field: string, op: '<' | '<=' | '>' | '>=' | 'between', value: unknown): ReadonlySet<string> | null;
     /**

package/dist/with-party/team/sync.d.ts

@@ -57,6 +57,15 @@ export declare class SyncEngine {
     private reservedLookup?;
     /** Wire the reserved-lookup source (#650 Task 4). */
     setReservedLookupSource(source: ReservedLookupSource): void;
+    /** #653: expands a (pair-expanded) collection-name filter to include the reserved `_dict_*`
+     *  collections those names depend on via their lookup fields — mirrors `pairExpander` so a
+     *  partial `push`/`pull({collections:[...]})` never drops the dictionary a named collection's
+     *  labels/membership rely on. Wired unconditionally from the vault's `dictKeyFieldRegistry` via
+     *  `setReservedDictExpander` (returns `[]` when the vault has no dict-backed collections); only
+     *  `undefined` on a standalone engine that was never vault-attached. */
+    private reservedDictExpander?;
+    /** Wire the reserved-dict expansion function (#653). Same injection pattern as `setPairExpander`. */
+    setReservedDictExpander(expander: (names: readonly string[]) => readonly string[]): void;
     constructor(opts: {
         local: NoydbStore;
         remote: NoydbStore;

package/dist/with-shape/satellites/fanout.d.ts

@@ -7,10 +7,11 @@
  *
  * Both legs are driven through `Collection.put`/`.delete` (encryption,
  * ledger, history, cache, sync-dirty, change-emit all fire normally); only
- * the REVERT writes go straight to the raw adapter, mirroring
- * `revertExecuted` (`with-commit/tx/transaction.ts:610`) — re-implemented
- * locally rather than imported, since with-commit is a gated service this
- * always-on satellite path must not depend on.
+ * the REVERT writes go straight to the raw adapter, via the shared
+ * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`) also used by
+ * `revertExecuted` (`with-commit/tx/transaction.ts`) — a neutral kernel-level
+ * home so this always-on satellite path can share the revert shape without
+ * depending on with-commit, a gated service.
  *
  * `deps.base()`/`deps.satellite()` may return either a raw `Collection` or
  * one of this package's proxies (`makeSatelliteProxy` / `makeBaseProxy`) —

package/dist/with-shape/satellites/migrate-cek.d.ts

@@ -0,0 +1,26 @@
+/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */
+export interface SatelliteCekMigrationTarget {
+    /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */
+    getConfig(): {
+        readonly perRecordKeys?: boolean;
+    } | undefined;
+    _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>;
+}
+export interface SatelliteCekMigrationResult {
+    /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */
+    readonly migrated: number;
+}
+/**
+ * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be
+ * a collection handle already opened with `perRecordKeys: true` — see the
+ * file header for how the caller gets one past R-S7. Throws
+ * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in
+ * per-record-CEK mode — see the file header's mode-assertion note.
+ * Idempotent/resumable: safe to call again after a partial failure. NOT
+ * fenced against concurrent writers — see the file header's no-quiesce
+ * precondition; run this before the collection serves traffic.
+ *
+ * @param name The satellite collection's name — used only for the error
+ *   message below; identical to what the caller passed to `vault.collection()`.
+ */
+export declare function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult>;

package/dist/with-shape/satellites/types.d.ts

@@ -11,6 +11,17 @@ export interface PairingMarker {
     readonly base: string;
     readonly fieldsHash: string;
     readonly joined?: string | undefined;
+    /**
+     * Lifetime epoch (#597) — an opaque, stable-per-collection-lifetime stamp
+     * minted the first time this marker is persisted and carried forward
+     * unchanged by every later re-declare of the SAME collection. Optional:
+     * markers persisted before this field existed have none. Deliberately
+     * excluded from `satelliteMarkersEqual` — see that function's comment.
+     * ADDITIVE ONLY today: there is no delete-collection API, so a stale
+     * marker on a reused name is unreachable; the epoch-MISMATCH rejection
+     * this would enable is a deferred follow-up once name reuse is possible.
+     */
+    readonly epoch?: string;
 }
 /**
  * The full-record handle — deliberately NARROW (spec § The model): never a

package/dist/withdraw-accessible-FMN4LPJZ.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-NEYKOESM.js";
+import "./chunk-QF5LGMSV.js";
+import "./chunk-PH7G7ZI7.js";
+import "./chunk-FJTWLQV3.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-FMN4LPJZ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.3.0-pre.11",
+  "version": "0.3.0-pre.12",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -192,14 +192,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.3.0-pre.11"
+    "@noy-db/attestation": "0.3.0-pre.12"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.3.0-pre.11"
+    "@noy-db/on-shamir": "0.3.0-pre.12"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"