@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/pod/index.js

@@ -4,7 +4,7 @@ import {
   createPodStore,
   wrapBundleStore,
   wrapPodStore
-} from "../chunk-S6AQXDN4.js";
+} from "../chunk-RZ5SVOYR.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -23,21 +23,21 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-Q2KVKTC2.js";
-import "../chunk-KNXN47MO.js";
+} from "../chunk-FHS2HQSH.js";
+import "../chunk-X3YYQWOQ.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-XHD3L3JO.js";
-import "../chunk-Z5YFRMG5.js";
-import "../chunk-XQ7UYPVN.js";
-import "../chunk-6MWUANRF.js";
-import "../chunk-2KOSJTMU.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AUR7MRHA.js";
-import "../chunk-UNJU345Q.js";
-import "../chunk-CU62BBRB.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   COMPRESSION_BROTLI,

package/dist/policy-Z3RUAIY2.js

@@ -0,0 +1,41 @@
+import {
+  DEFAULT_FRESHNESS_MS,
+  PERSONAL_POLICY,
+  STRICT_POLICY,
+  checkGate,
+  createNoydbPolicy,
+  describeGate,
+  mergePolicy
+} from "./chunk-ERJ7FU55.js";
+import {
+  META_COLLECTION,
+  POLICY_RECORD_ID,
+  loadVaultPolicy,
+  saveVaultPolicy
+} from "./chunk-CRI4OUV4.js";
+import "./chunk-JNAI2HN2.js";
+import {
+  ManagedRecoveryNotEnrolledError,
+  PolicyDeniedError,
+  RecoveryNotEnrolledError,
+  RecoveryProfileNotImplementedError
+} from "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DEFAULT_FRESHNESS_MS,
+  META_COLLECTION,
+  ManagedRecoveryNotEnrolledError,
+  PERSONAL_POLICY,
+  POLICY_RECORD_ID,
+  PolicyDeniedError,
+  RecoveryNotEnrolledError,
+  RecoveryProfileNotImplementedError,
+  STRICT_POLICY,
+  checkGate,
+  createNoydbPolicy,
+  describeGate,
+  loadVaultPolicy,
+  mergePolicy,
+  saveVaultPolicy
+};
+//# sourceMappingURL=policy-Z3RUAIY2.js.map

package/dist/port/as/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @noy-db/hub/as — the as-* exporter family port.
+ *
+ * An export-format package (`as-csv`, `as-xlsx`, `as-json`, `as-noydb`
+ * bundle, `as-sql`, …) binds ONLY to this subpath: the shared import/merge
+ * diff primitive (`diffVault`/`VaultDiff`, ungated shared infra — see
+ * `with-cargo/vault-diff.ts`) plus the `.noydb` pod read/write primitives
+ * (`writePod`/`readPod`/`readPodHeader`, always-on infra — see
+ * `with-pod/index.ts`) and the `Vault` handle type those primitives close
+ * over.
+ *
+ * LAYER PORT (not a kernel spine port): this file lives at `src/port/as/`, a
+ * sibling of the other family ports, not the kernel spine. It may import
+ * `with-*` services directly — same tier as `with-cargo`/`with-pod`
+ * themselves — because `scripts/check-architecture.mjs`'s port-layering
+ * check only restricts port→port imports; it never restricted a port's
+ * with-* service imports in the first place.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export { diffVault } from '../../with-cargo/vault-diff.js';
+export type { VaultDiff } from '../../with-cargo/vault-diff.js';
+export { writePod, readPod, readPodHeader } from '../../with-pod/index.js';
+export type { WritePodOptions, NoydbPodHeader } from '../../with-pod/index.js';
+export type { Vault } from '../../kernel/vault.js';

package/dist/port/at/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @noy-db/hub/at — the at-* sealing family port.
+ *
+ * A sealing-key provider (`at-env`, `at-aws-kms`, `at-gcp-kms`, …) binds
+ * ONLY to this subpath: the `SealingKeyProvider` contract concrete
+ * providers implement to seal/unseal a hub-generated random passphrase
+ * for managed-passphrase mode. Its two methods (`seal`/`unseal`) close
+ * over only `Uint8Array`/`Promise`/`string` — no additional option or
+ * result types to re-export.
+ *
+ * NOTE: `SealingKeyProvider` is implemented in `with-party/team/*` (the
+ * managed-passphrase service), not the kernel spine proper — same
+ * precedent as `@noy-db/hub/ui` re-exporting from `with-shape/introspection`.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export type { SealingKeyProvider } from '../../with-party/team/managed-passphrase.js';

package/dist/port/by/default-provider.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lazy factory for the store-backed default {@link CoordinationProvider}.
+ * `with-shape/schema-update` is service-layer code the kernel spine may not
+ * statically import — the dynamic `import()` below is the port-layering
+ * law's sanctioned escape hatch for this exact case.
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+export type { CoordinationProvider } from './types.js';
+export declare function createDefaultCoordinationProvider(store: NoydbStore): Promise<import("../../with-shape/schema-update/store-coordination-provider.js").StoreCoordinationProvider>;

package/dist/port/by/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @noy-db/hub/by — the coordination port for `by-*` transports (the `by-*`
+ * family port).
+ *
+ * A session-share transport (`by-tabs`, `by-peer`) binds ONLY to this
+ * subpath: the drain-barrier coordination contract for the schema-fence
+ * cutover. `@klum-db/lobby` drives the same port through the `Noydb` handle
+ * without ever naming a `by-*` package. `StoreCoordinationProvider` (the
+ * store-backed default implementation) lives in `with-shape/schema-update`
+ * — its only consumer — and is intentionally NOT exported here.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit
+ * and tsup's per-entry bundling keeps class identity stable across subpaths.
+ * Supersedes the (already-deprecated) coordination re-exports on `/kernel`.
+ */
+export { isQuorum, runDrainBarrier } from './types.js';
+export type { CoordinationProvider, WriterPresence, FenceState, DrainBarrierOptions, } from './types.js';

package/dist/port/by/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Kernel coordination port — the injected `CoordinationProvider` seam for the
+ * schema-fence drain-barrier.
+ *
+ * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
+ * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)
+ * drives it through the `Noydb` handle without ever naming a `by-*` package.
+ * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.
+ *
+ * This module carries only the port TYPES plus two pure-ish helpers:
+ * {@link isQuorum} (a pure quorum predicate extracted from the legacy
+ * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol
+ * the migration cutover and klum both call).
+ *
+ * @module
+ */
+import type { Unsubscribe } from '../with/write-hooks.js';
+/** Vault fence state (the existing FenceDoc shape). */
+export interface FenceState {
+    readonly currentSchemaVersion: number;
+    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
+}
+/** A writer's presence + ack, tagged with the session that owns it. */
+export interface WriterPresence {
+    /** = today's clientId (one per tab/peer). */
+    readonly writerId: string;
+    /** Groups one user's writers across vaults (consolidation is klum's job). */
+    readonly sessionId: string;
+    readonly lastSeen: number;
+    readonly quiescedAtVersion: number | null;
+}
+/** Session-addressable drain-barrier coordination transport. Per-vault ops. */
+export interface CoordinationProvider {
+    /** orchestrator → all writers */
+    setFence(vault: string, fence: FenceState): Promise<void>;
+    /**
+     * Fresh one-shot fence read for the write-path gate (`assertWritable`).
+     * A direct read (not a cached `observeFence` snapshot) avoids a staleness
+     * window and keeps the timing-sensitive cutover gate exact. The store
+     * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
+     */
+    readFence(vault: string): Promise<FenceState>;
+    /** writer observes fence changes (default: poll-emit; by-*: push) */
+    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
+    /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
+    reportPresence(vault: string, p: WriterPresence): Promise<void>;
+    /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
+    observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe;
+    /** orchestrator one-shot snapshot of reachable writers (quorum input) */
+    reachableWriters(vault: string, o: {
+        staleMs: number;
+        now: number;
+    }): Promise<readonly WriterPresence[]>;
+}
+/**
+ * Pure quorum predicate: true when every writer (other than `excludeWriterId`)
+ * has acked at exactly `generation`. An empty set is trivially a quorum.
+ *
+ * Extracted from the legacy `activeQuiesced` store-polling check so the
+ * migration cutover, the store default provider, and `by-*` real-time
+ * providers all share one definition of "everyone has drained".
+ */
+export declare function isQuorum(writers: readonly WriterPresence[], generation: number, excludeWriterId?: string): boolean;
+/** Inputs for {@link runDrainBarrier}. */
+export interface DrainBarrierOptions {
+    readonly vault: string;
+    readonly generation: number;
+    readonly writerId: string;
+    readonly onFlush: () => Promise<void>;
+    readonly staleMs: number;
+    readonly quiesceTimeoutMs: number;
+    readonly now: () => number;
+    /** Optional seam (mainly for deterministic tests) run before each poll tick. */
+    readonly onPoll?: () => Promise<void>;
+}
+/**
+ * The reusable drain-barrier protocol shared by the migration cutover and klum:
+ *
+ *   drain self → setFence(draining) → await quorum (presence push + isQuorum,
+ *   polling as a fallback, or timeout) → run() → release-by-caller.
+ *
+ * Resolves once every reachable writer (excluding `writerId`) has quiesced at
+ * `generation`, at which point `run` is invoked exactly once. Rejects with
+ * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
+ */
+export declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;

package/dist/port/in/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @noy-db/hub/in — the in-* framework family port (types only).
+ *
+ * A framework binding (`in-react`, `in-nuxt`, `in-vue`, `in-pinia`,
+ * `in-tanstack-query`, `in-ai`, …) binds ONLY to this subpath: the handle
+ * types it wraps (`Noydb`, `Vault`, `Collection`, `Query`, `LiveQuery`) plus
+ * the change-event shape it observes (`ChangeEvent`). Type-only — a
+ * framework binding always receives a live instance from `createNoydb()`/
+ * `openVault()`/`collection()` via the root barrel or `@noy-db/hub/cargo`;
+ * this port exists so its wrapper types can name the shapes without
+ * importing the whole hub surface.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export type { Noydb } from '../../kernel/noydb.js';
+export type { Vault } from '../../kernel/vault.js';
+export type { Collection } from '../../kernel/collection.js';
+export type { Query } from '../../kernel/query/builder.js';
+export type { LiveQuery } from '../../kernel/query/live.js';
+export type { ChangeEvent } from '../../kernel/types.js';

package/dist/port/on/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @noy-db/hub/on — the on-* unlock family port.
+ *
+ * An unlock / auth primitive (`on-password`, `on-webauthn`, `on-oidc`,
+ * `on-totp`, `on-shamir`, `on-recovery`, …) binds ONLY to this subpath: the
+ * paper-recovery mint primitive plus the keyring/role/permission/rewrap/
+ * enroll shapes those packages read and write. `on-recovery` already
+ * consumes `mintPaperRecoveryEntry`/`PaperRecoveryEntry` from the root
+ * barrel (`@noy-db/hub`); this subpath is the stable, named port onto the
+ * same values, mirroring `@noy-db/hub/cargo`.
+ *
+ * NOTE: these primitives are implemented in `with-party/team/*` (the
+ * multi-user keyring service), not in the kernel spine proper — same
+ * precedent as `@noy-db/hub/ui` re-exporting from `with-shape/introspection`.
+ * The port-layering check only restricts kernel *spine* files (and
+ * port-to-port imports) from reaching into a `with-*` service statically;
+ * a port itself may.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export { mintPaperRecoveryEntry } from '../../with-party/team/recovery.js';
+export type { PaperRecoveryEntry } from '../../with-party/team/recovery.js';
+export type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+export type { Role, Permissions } from '../../kernel/types.js';
+export type { SlotRewrapContext } from '../../with-party/team/rotate-recover.js';
+export type { EnrollAuthenticatorOptions } from '../../with-party/team/authenticators.js';

package/dist/port/to/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @noy-db/hub/to — the stable store-adapter contract (the `to-*` family port).
+ *
+ * A storage backend (a `to-*` package) binds ONLY to this subpath: the
+ * ciphertext-facing slice of the hub. It carries the 6-method `NoydbStore`
+ * contract (plus its optional extension methods), the envelope / snapshot / op
+ * types a store passes through, the store-facing error classes, and the
+ * `NoydbPodStore` contract (plus `PodVersionConflictError`) for pod stores
+ * such as `to-drive` and `to-icloud`. Mirrors the `@noy-db/hub/cargo` seam
+ * used by klum-db and the `by-*` transports.
+ *
+ * Supersedes `@noy-db/hub/adapter`, which has been retired (coordinated
+ * removal; consumers migrated to this subpath).
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export type { NoydbStore, NoydbBundleStore, NoydbPodStore, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
+export { ConflictError, NetworkError, StoreCapabilityError, BundleVersionConflictError, PodVersionConflictError, } from '../../kernel/errors.js';

package/dist/port/ui/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * **@noy-db/hub/ui** — the narrow, stable seam for the `collection.describe()`
+ * output contract that `@noy-db/ui` (and `@noy-db/ui-nuxt`) bind to *instead of* the
+ * whole `@noy-db/hub` root barrel.
+ *
+ * It re-exports ONLY the describe()-output type contract: the `CollectionDescription`
+ * envelope, its `DescribedField` element, the async `DescribeOptions`, and the
+ * descriptive-metadata building blocks (`CollectionMeta`, `FieldMeta`, `SemanticType`).
+ * Type-only — `describe()` itself is a method on `Collection`, reached via the root
+ * barrel / `/cargo`. These same names also remain exported from the root barrel
+ * (this subpath is purely additive); ui can migrate to the narrow seam on its own
+ * schedule. Treat it as a contract — additive changes only; removals are breaking.
+ *
+ * The pre-existing `./describe` subpath has been retired (coordinated removal;
+ * consumers migrated to `/ui`).
+ *
+ * @packageDocumentation
+ */
+export type { CollectionDescription, DescribedField, DescribeOptions, } from '../../with-shape/introspection/describe.js';
+export type { CollectionMeta } from '../../with-shape/introspection/meta.js';
+export type { FieldMeta, SemanticType } from '../../with-shape/introspection/field-meta.js';

package/dist/port/with/blob-strategy.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Strategy seam between core Collection and the optional blob service
+ * (#629 Task 7 — moved out of `with-shape/blobs/strategy.ts`, precedent:
+ * `port/with/classified-strategy.ts`/`i18n-strategy.ts`). Lives on the
+ * `/with` port (the one seam the kernel spine may import statically) so
+ * `Collection`/`Vault` can hold the `NO_BLOBS` default without a
+ * spine→service static import.
+ *
+ * Core imports `BlobStrategy` as a TYPE-ONLY symbol and `NO_BLOBS` as a
+ * minimal runtime stub. Neither pulls in the heavy `BlobSet` / chunk /
+ * MIME machinery — those only arrive when the consumer explicitly
+ * imports `@noy-db/hub/blobs` (see `via/blob/index.ts` →
+ * `withBlobs()` factory).
+ *
+ * This file is intentionally tiny so the bundler keeps it in the graph
+ * without dragging everything else in.
+ *
+ * @internal
+ */
+import type { BlobSet } from '../../with-shape/blobs/blob-set.js';
+import type { NoydbStore } from '../../kernel/types.js';
+import type { ObjectProjection } from '../../with-shape/blobs/object-projection.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+/**
+ * Args forwarded by `Collection.blob(id)` to the active strategy's
+ * `openSlot`. The strategy is responsible for returning a live
+ * `BlobSet` bound to the given record.
+ *
+ * @internal
+ */
+export interface BlobStrategyOpenArgs {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly collection: string;
+    readonly recordId: string;
+    readonly getDEK: (collectionName: string) => Promise<EnclaveKey>;
+    readonly encrypted: boolean;
+    readonly userId: string;
+    /**
+     * Collection opts into per-record keys (`perRecordKeys`), so its blobs are
+     * erasable: new uploads mint a per-blob content CEK (crypto-shreddable at
+     * `refCount → 0`). Off → legacy shared-`_blob`-DEK chunks. See the per-blob
+     * CEK design spec.
+     */
+    readonly erasableBlobs?: boolean;
+    /**
+     * Collection has `tiers` active (#724 I1 completion). Combined with
+     * `erasableBlobs` false, a content write is refused —
+     * `UnsupportedTierCompositionError` — since a legacy blob has no
+     * per-blob `_cek` and can never be tier-isolated on elevate/demote.
+     */
+    readonly tiersActive?: boolean;
+    /**
+     * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).
+     * Blobs are then written as a single un-gzipped object (one base64 chunk) so
+     * the stored object is directly recoverable with native tools (`base64 -d`),
+     * matching the directly-inspectable record layout. Dev-only — see the
+     * plaintext/debug-store-mode design.
+     */
+    readonly debugPlaintext?: boolean;
+    /**
+     * Object projection for `external` blob fields (`createNoydb({ objectStore })`).
+     * When present, fields declared `external` in `blobFields` route their raw
+     * bytes here instead of the encrypted-chunk path.
+     */
+    readonly objectStore?: ObjectProjection;
+    /** Per-collection blob field policies — used to resolve `external` / `public`. */
+    readonly blobFields?: BlobFieldsConfig;
+    /**
+     * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`
+     * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/
+     * `demote` run before any tier `getDEK` call — rather than relying on a bare
+     * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it
+     * is not itself a gate). Omitted only by a construction path that never calls
+     * `atTier()`.
+     */
+    readonly keyring?: UnlockedKeyring;
+}
+/**
+ * The seam interface. `@internal` — do not build public APIs on this
+ * shape; it can evolve freely until blobs are extracted into their
+ * own package, at which point it will be promoted to public.
+ *
+ * @internal
+ */
+export interface BlobStrategy {
+    openSlot(args: BlobStrategyOpenArgs): BlobSet;
+}
+/**
+ * Default strategy for collections that did not opt into blob storage.
+ * Every operation surfaces an actionable error that points the caller
+ * at the opt-in path.
+ *
+ * @internal
+ */
+export declare const NO_BLOBS: BlobStrategy;

package/dist/port/with/broker-strategy.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Credential-broker strategy seam (#479, credential-broker spec §5). Lives
+ * on the `/with` port (the one seam the kernel spine may import statically)
+ * so `Vault` can hold the `NO_BROKER` floor default without a spine→service
+ * static import — the same idiom as `port/with/team-strategy.ts`.
+ *
+ * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/
+ * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods
+ * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of
+ * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)
+ * keeps it in its own closure and injects it into the richer
+ * {@link BrokerSeedCtx} it passes to the `_broker` seed ops
+ * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor
+ * default) never builds a ctx — every method throws first.
+ * @internal
+ */
+import type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+/** Construction-time options for `withBroker(config)` (spec §5 client surface). */
+export interface BrokerConfig {
+    /**
+     * Stable id; part of the HKDF info tag AND the proof canonical. MUST be
+     * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`
+     * across two endpoints enables a cross-endpoint relay.
+     */
+    readonly brokerId: string;
+    /** https broker base URL; its origin is bound into the proof MAC (F4). */
+    readonly endpoint: string;
+    /** Dev-backend session token for `/enroll` (spec decision 1). */
+    readonly attestation?: (() => string | Promise<string>) | undefined;
+    /** DI for tests / non-window runtimes. */
+    readonly fetch?: typeof fetch | undefined;
+    /** Refresh margin in ms, default 60_000. */
+    readonly skewMs?: number | undefined;
+}
+/**
+ * Per-call context a {@link BrokerStrategy} method needs: the seed API's
+ * `store`/`vault`/`keyring`.
+ */
+export interface BrokerCtx {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly keyring: UnlockedKeyring;
+}
+/**
+ * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops
+ * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`
+ * (`with-party/broker/active.ts`) builds this by injecting its closed-over
+ * `config` into the port-level `BrokerCtx` it receives — the port interface
+ * itself never carries `config`.
+ */
+export interface BrokerSeedCtx extends BrokerCtx {
+    readonly config: BrokerConfig;
+}
+/** The vault-bound handle `vault.broker()` returns (spec §5). */
+export interface CredentialBrokerHandle {
+    /** Generate+persist the `_broker` seed (idempotent), register its proof key. */
+    enroll(): Promise<void>;
+    /** Rotate the seed + re-register (revokes the old proof key after a grace window). */
+    rotate(): Promise<void>;
+    /** Single-flight, per-profile cache of a `StoreCredentialSource`. */
+    credentialSource(profile?: string): StoreCredentialSource;
+}
+/** The opt-in strategy contract `withBroker(config)` implements. */
+export interface BrokerStrategy {
+    enroll(ctx: BrokerCtx): Promise<void>;
+    rotate(ctx: BrokerCtx): Promise<void>;
+    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource;
+}
+/**
+ * No-op stub — the floor default. Every broker operation throws
+ * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`
+ * (from `@noy-db/hub/broker`) in `createNoydb()`.
+ * @internal
+ */
+export declare const NO_BROKER: BrokerStrategy;
+/**
+ * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`
+ * returns — factored out of `kernel/vault.ts` to keep that file's footprint
+ * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a
+ * thunk, not a snapshot: the active keyring can change after `vault.load()`,
+ * so each handle method re-reads it fresh at call time.
+ */
+export declare function buildCredentialBrokerHandle(strategy: BrokerStrategy, store: NoydbStore, vault: string, getKeyring: () => UnlockedKeyring): CredentialBrokerHandle;

package/dist/port/with/capabilities.d.ts

@@ -0,0 +1,31 @@
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+import type { ExportFormat } from '../../kernel/types.js';
+/**
+ * Authorize an `@noy-db/as-*` export against the keyring's `exportCapability`.
+ * Throws `ExportCapabilityError` if the keyring is not authorised.
+ *
+ * - plaintext tier requires a `format`; defaults to empty for every role.
+ * - bundle tier defaults to on for owner/admin, off for others.
+ */
+export declare function assertCanExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
+/**
+ * Authorize an `@noy-db/as-*` import against the keyring's `importCapability`.
+ * Throws `ImportCapabilityError` if the keyring is not authorised.
+ *
+ * - plaintext tier requires a `format`; default-closed for every role.
+ * - bundle tier is default-closed for every role, including owner — import is
+ *   more dangerous than export (corrupts vs leaks).
+ */
+export declare function assertCanImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
+/**
+ * Read-only accessor for the keyring's export capability, with role-based
+ * defaults resolved. Useful for UI affordances (grey out the export button if
+ * no capability) without throwing.
+ */
+export declare function canExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;
+/**
+ * Read-only accessor for the keyring's import capability. UI affordance —
+ * returns false in every default-closed case (every role with no explicit
+ * `importCapability` grant).
+ */
+export declare function canImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;

package/dist/port/with/classified-marker.d.ts

@@ -0,0 +1,9 @@
+/**
+ * C-A/R10 config-drift marker store I/O — re-exported here (not
+ * `via/classified/config-drift.js` directly) so `Collection`'s
+ * dynamic `import()` in `_ensureClassifiedMarker`/`_classifiedMarkerDigestOnly`
+ * stays lazy while satisfying via-layering (#629 Task 6: the kernel spine
+ * may not name a `via/classified/*` path, not even inside a dynamic
+ * import specifier).
+ */
+export { persistClassifiedMarkerForFields, readClassifiedMarkerDigestOnly } from '../../via/classified/config-drift.js';

package/dist/port/with/classified-strategy.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Classified strategy seam (#629 Task 5 — moved out of
+ * `via/classified/strategy.ts`, precedent: `port/with/i18n-strategy.ts`).
+ * Lives on the `/with` port (the one seam the kernel spine may import
+ * statically) so `Collection`/`Vault` can hold the `NO_CLASSIFIED` default
+ * without a spine→service static import.
+ *
+ * This file (unlike `via/classified/**`) is NOT subject to the
+ * `via-enclave-isolation` architecture guard — it may import `EnclaveKey`
+ * from the enclave barrel freely, the same way `port/with/i18n-strategy.ts`
+ * did before #629 Task 4's DictionaryHandle cutover.
+ *
+ * The ② capability seam for classified read-egress ops (stage 1: reveal;
+ * stage 2: verify).
+ *
+ * @internal
+ */
+import type { ClassifiedFieldSpec } from '../../via/classified/descriptor.js';
+import type { EncryptedEnvelope } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+export type { ClassifiedViaConfig } from '../../via/classified/binding.js';
+export type { ClassifiedVerdict } from '../../kernel/types.js';
+import type { ClassifiedVerdict } from '../../kernel/types.js';
+export { resolveClassifiedFields, type ClassifiedEntry, type ResolvedClassified } from '../../via/classified/resolve.js';
+export { guardClassifiedCompat, type ClassifiedGuardCtx } from '../../via/classified/guards.js';
+export type { ClassifiedFieldSpec };
+export interface ClassifiedRevealCtx {
+    readonly collection: string;
+    readonly spec: ClassifiedFieldSpec;
+    /** True on an encrypted collection — false selects the plaintext-body read. */
+    readonly encrypted: boolean;
+    readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>;
+    readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>;
+    readonly getDEK: () => Promise<EnclaveKey>;
+    readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined;
+}
+export interface ClassifiedVerifyCtx {
+    readonly collection: string;
+    readonly spec: ClassifiedFieldSpec;
+    readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>;
+    readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>;
+    readonly getDEK: () => Promise<EnclaveKey>;
+    readonly now: () => number;
+    /** Group members resolved by the collection (matchGroup only). */
+    readonly groupMembers?: ReadonlyArray<{
+        readonly field: string;
+        readonly spec: ClassifiedFieldSpec;
+    }>;
+    readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined;
+}
+export interface ClassifiedStrategy {
+    reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>;
+    verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>;
+    verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>;
+    matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>, opts: {
+        readonly min: number;
+    }): Promise<{
+        readonly passed: boolean;
+    }>;
+    computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>;
+}
+export declare const NO_CLASSIFIED: ClassifiedStrategy;

package/dist/port/with/computed-strategy.d.ts

@@ -0,0 +1,19 @@
+/**
+ * computed strategy seam (#638 Task 7 — mirrors `port/with/{classified,blob}-strategy.ts`).
+ * Lives on the `/with` port (the one seam the kernel spine may import statically) so
+ * `kernel/via/compose.ts`/`kernel/collection-config.ts` can read a `via(computed(...))`
+ * descriptor's shape without a spine→`src/via/**` static import (via-layering, Check 14).
+ *
+ * Installs the computed via-binder EAGERLY — the classified/blob precedent, not money/
+ * i18n's lazy-in-factory pattern: a `computed: { field: { fn, deps, mode: 'virtual' } }`
+ * sugar entry never calls the `computed()` declaration factory at all, so lazy linking
+ * (money/i18n's `installViaBinder` call inside their own factory) would leave
+ * `viaBinder('computed')` unresolved for that path. This port module is already
+ * unconditionally imported by the kernel spine (`collection-config.ts`), so linking here
+ * guarantees the binder is installed before `compileViaBindings` ever needs it, regardless
+ * of which surface (sugar object-form or `via(computed(...))`) declared the virtual field.
+ *
+ * @internal
+ */
+import type { ComputedDescriptor } from '../../via/computed/descriptor.js';
+export type { ComputedDescriptor };