@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/periods/index.js

@@ -1,6 +1,6 @@
 import {
   withPeriods
-} from "../chunk-CWCCYH34.js";
+} from "../chunk-YZQOGE2L.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -12,20 +12,20 @@ import {
   loadPeriods,
   periodExclusiveUpperBound,
   validatePeriodName
-} from "../chunk-IUKGIB2Q.js";
+} from "../chunk-XTHCN77N.js";
 import "../chunk-GHVIKOHT.js";
-import "../chunk-WNA6T3MA.js";
+import "../chunk-VRBTNCM4.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-MSVY7ULZ.js";
-import "../chunk-XHD3L3JO.js";
-import "../chunk-Z5YFRMG5.js";
-import "../chunk-XQ7UYPVN.js";
-import "../chunk-6MWUANRF.js";
-import "../chunk-2KOSJTMU.js";
+import "../chunk-WQIYTNJV.js";
+import "../chunk-W4TCUGQR.js";
+import "../chunk-A4FXFAKF.js";
+import "../chunk-IY23KFNZ.js";
+import "../chunk-N6WF5PKC.js";
+import "../chunk-6HY2X62D.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AUR7MRHA.js";
-import "../chunk-UNJU345Q.js";
-import "../chunk-CU62BBRB.js";
+import "../chunk-HOONYZY2.js";
+import "../chunk-VCTXU4AT.js";
+import "../chunk-W2OG6JOL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   PERIODS_COLLECTION,

package/dist/pod/index.js

@@ -4,7 +4,7 @@ import {
   createPodStore,
   wrapBundleStore,
   wrapPodStore
-} from "../chunk-S6AQXDN4.js";
+} from "../chunk-YTGDPCPW.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -18,26 +18,27 @@ import {
   readNoydbBundle,
   readNoydbBundleHeader,
   readPod,
+  readPodCover,
   readPodHeader,
   resetBrotliSupportCache,
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-Q2KVKTC2.js";
-import "../chunk-KNXN47MO.js";
+} from "../chunk-FXZDAV62.js";
+import "../chunk-XUW3PXHU.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-XHD3L3JO.js";
-import "../chunk-Z5YFRMG5.js";
-import "../chunk-XQ7UYPVN.js";
-import "../chunk-6MWUANRF.js";
-import "../chunk-2KOSJTMU.js";
+import "../chunk-W4TCUGQR.js";
+import "../chunk-A4FXFAKF.js";
+import "../chunk-IY23KFNZ.js";
+import "../chunk-N6WF5PKC.js";
+import "../chunk-6HY2X62D.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AUR7MRHA.js";
-import "../chunk-UNJU345Q.js";
-import "../chunk-CU62BBRB.js";
+import "../chunk-HOONYZY2.js";
+import "../chunk-VCTXU4AT.js";
+import "../chunk-W2OG6JOL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   COMPRESSION_BROTLI,
@@ -56,6 +57,7 @@ export {
   readNoydbBundle,
   readNoydbBundleHeader,
   readPod,
+  readPodCover,
   readPodHeader,
   resetBrotliSupportCache,
   validateBundleHeader,

package/dist/policy-YDLCOX4P.js

@@ -0,0 +1,41 @@
+import {
+  DEFAULT_FRESHNESS_MS,
+  PERSONAL_POLICY,
+  STRICT_POLICY,
+  checkGate,
+  createNoydbPolicy,
+  describeGate,
+  mergePolicy
+} from "./chunk-T3GY65MA.js";
+import {
+  META_COLLECTION,
+  POLICY_RECORD_ID,
+  loadVaultPolicy,
+  saveVaultPolicy
+} from "./chunk-XDIAFPUM.js";
+import "./chunk-VCTXU4AT.js";
+import {
+  ManagedRecoveryNotEnrolledError,
+  PolicyDeniedError,
+  RecoveryNotEnrolledError,
+  RecoveryProfileNotImplementedError
+} from "./chunk-W2OG6JOL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DEFAULT_FRESHNESS_MS,
+  META_COLLECTION,
+  ManagedRecoveryNotEnrolledError,
+  PERSONAL_POLICY,
+  POLICY_RECORD_ID,
+  PolicyDeniedError,
+  RecoveryNotEnrolledError,
+  RecoveryProfileNotImplementedError,
+  STRICT_POLICY,
+  checkGate,
+  createNoydbPolicy,
+  describeGate,
+  loadVaultPolicy,
+  mergePolicy,
+  saveVaultPolicy
+};
+//# sourceMappingURL=policy-YDLCOX4P.js.map

package/dist/port/as/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @noy-db/hub/as — the as-* exporter family port.
+ *
+ * An export-format package (`as-csv`, `as-xlsx`, `as-json`, `as-noydb`
+ * bundle, `as-sql`, …) binds ONLY to this subpath: the shared import/merge
+ * diff primitive (`diffVault`/`VaultDiff`, ungated shared infra — see
+ * `with-cargo/vault-diff.ts`) plus the `.noydb` pod read/write primitives
+ * (`writePod`/`readPod`/`readPodHeader`, always-on infra — see
+ * `with-pod/index.ts`) and the `Vault` handle type those primitives close
+ * over.
+ *
+ * LAYER PORT (not a kernel spine port): this file lives at `src/port/as/`, a
+ * sibling of the other family ports, not the kernel spine. It may import
+ * `with-*` services directly — same tier as `with-cargo`/`with-pod`
+ * themselves — because `scripts/check-architecture.mjs`'s port-layering
+ * check only restricts port→port imports; it never restricted a port's
+ * with-* service imports in the first place.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export { diffVault } from '../../with-cargo/vault-diff.js';
+export type { VaultDiff } from '../../with-cargo/vault-diff.js';
+export { writePod, readPod, readPodHeader } from '../../with-pod/index.js';
+export type { WritePodOptions, NoydbPodHeader } from '../../with-pod/index.js';
+export type { Vault } from '../../kernel/vault.js';

package/dist/port/at/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @noy-db/hub/at — the at-* sealing family port.
+ *
+ * A sealing-key provider (`at-env`, `at-aws-kms`, `at-gcp-kms`, …) binds
+ * ONLY to this subpath: the `SealingKeyProvider` contract concrete
+ * providers implement to seal/unseal a hub-generated random passphrase
+ * for managed-passphrase mode. Its two methods (`seal`/`unseal`) close
+ * over only `Uint8Array`/`Promise`/`string` — no additional option or
+ * result types to re-export.
+ *
+ * NOTE: `SealingKeyProvider` is implemented in `with-party/team/*` (the
+ * managed-passphrase service), not the kernel spine proper — same
+ * precedent as `@noy-db/hub/ui` re-exporting from `with-shape/introspection`.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export type { SealingKeyProvider } from '../../with-party/team/managed-passphrase.js';

package/dist/port/by/default-provider.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lazy factory for the store-backed default {@link CoordinationProvider}.
+ * `with-shape/schema-update` is service-layer code the kernel spine may not
+ * statically import — the dynamic `import()` below is the port-layering
+ * law's sanctioned escape hatch for this exact case.
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+export type { CoordinationProvider } from './types.js';
+export declare function createDefaultCoordinationProvider(store: NoydbStore): Promise<import("../../with-shape/schema-update/store-coordination-provider.js").StoreCoordinationProvider>;

package/dist/port/by/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @noy-db/hub/by — the coordination port for `by-*` transports (the `by-*`
+ * family port).
+ *
+ * A session-share transport (`by-tabs`, `by-peer`) binds ONLY to this
+ * subpath: the drain-barrier coordination contract for the schema-fence
+ * cutover. `@klum-db/lobby` drives the same port through the `Noydb` handle
+ * without ever naming a `by-*` package. `StoreCoordinationProvider` (the
+ * store-backed default implementation) lives in `with-shape/schema-update`
+ * — its only consumer — and is intentionally NOT exported here.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit
+ * and tsup's per-entry bundling keeps class identity stable across subpaths.
+ * Supersedes the (already-deprecated) coordination re-exports on `/kernel`.
+ */
+export { isQuorum, runDrainBarrier } from './types.js';
+export type { CoordinationProvider, WriterPresence, FenceState, DrainBarrierOptions, } from './types.js';

package/dist/port/by/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Kernel coordination port — the injected `CoordinationProvider` seam for the
+ * schema-fence drain-barrier.
+ *
+ * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
+ * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)
+ * drives it through the `Noydb` handle without ever naming a `by-*` package.
+ * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.
+ *
+ * This module carries only the port TYPES plus two pure-ish helpers:
+ * {@link isQuorum} (a pure quorum predicate extracted from the legacy
+ * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol
+ * the migration cutover and klum both call).
+ *
+ * @module
+ */
+import type { Unsubscribe } from '../with/write-hooks.js';
+/** Vault fence state (the existing FenceDoc shape). */
+export interface FenceState {
+    readonly currentSchemaVersion: number;
+    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
+}
+/** A writer's presence + ack, tagged with the session that owns it. */
+export interface WriterPresence {
+    /** = today's clientId (one per tab/peer). */
+    readonly writerId: string;
+    /** Groups one user's writers across vaults (consolidation is klum's job). */
+    readonly sessionId: string;
+    readonly lastSeen: number;
+    readonly quiescedAtVersion: number | null;
+}
+/** Session-addressable drain-barrier coordination transport. Per-vault ops. */
+export interface CoordinationProvider {
+    /** orchestrator → all writers */
+    setFence(vault: string, fence: FenceState): Promise<void>;
+    /**
+     * Fresh one-shot fence read for the write-path gate (`assertWritable`).
+     * A direct read (not a cached `observeFence` snapshot) avoids a staleness
+     * window and keeps the timing-sensitive cutover gate exact. The store
+     * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
+     */
+    readFence(vault: string): Promise<FenceState>;
+    /** writer observes fence changes (default: poll-emit; by-*: push) */
+    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
+    /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
+    reportPresence(vault: string, p: WriterPresence): Promise<void>;
+    /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
+    observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe;
+    /** orchestrator one-shot snapshot of reachable writers (quorum input) */
+    reachableWriters(vault: string, o: {
+        staleMs: number;
+        now: number;
+    }): Promise<readonly WriterPresence[]>;
+}
+/**
+ * Pure quorum predicate: true when every writer (other than `excludeWriterId`)
+ * has acked at exactly `generation`. An empty set is trivially a quorum.
+ *
+ * Extracted from the legacy `activeQuiesced` store-polling check so the
+ * migration cutover, the store default provider, and `by-*` real-time
+ * providers all share one definition of "everyone has drained".
+ */
+export declare function isQuorum(writers: readonly WriterPresence[], generation: number, excludeWriterId?: string): boolean;
+/** Inputs for {@link runDrainBarrier}. */
+export interface DrainBarrierOptions {
+    readonly vault: string;
+    readonly generation: number;
+    readonly writerId: string;
+    readonly onFlush: () => Promise<void>;
+    readonly staleMs: number;
+    readonly quiesceTimeoutMs: number;
+    readonly now: () => number;
+    /** Optional seam (mainly for deterministic tests) run before each poll tick. */
+    readonly onPoll?: () => Promise<void>;
+}
+/**
+ * The reusable drain-barrier protocol shared by the migration cutover and klum:
+ *
+ *   drain self → setFence(draining) → await quorum (presence push + isQuorum,
+ *   polling as a fallback, or timeout) → run() → release-by-caller.
+ *
+ * Resolves once every reachable writer (excluding `writerId`) has quiesced at
+ * `generation`, at which point `run` is invoked exactly once. Rejects with
+ * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
+ */
+export declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;

package/dist/port/in/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @noy-db/hub/in — the in-* framework family port (types only).
+ *
+ * A framework binding (`in-react`, `in-nuxt`, `in-vue`, `in-pinia`,
+ * `in-tanstack-query`, `in-ai`, …) binds ONLY to this subpath: the handle
+ * types it wraps (`Noydb`, `Vault`, `Collection`, `Query`, `LiveQuery`) plus
+ * the change-event shape it observes (`ChangeEvent`). Type-only — a
+ * framework binding always receives a live instance from `createNoydb()`/
+ * `openVault()`/`collection()` via the root barrel or `@noy-db/hub/cargo`;
+ * this port exists so its wrapper types can name the shapes without
+ * importing the whole hub surface.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export type { Noydb } from '../../kernel/noydb.js';
+export type { Vault } from '../../kernel/vault.js';
+export type { Collection } from '../../kernel/collection.js';
+export type { Query } from '../../kernel/query/builder.js';
+export type { LiveQuery } from '../../kernel/query/live.js';
+export type { ChangeEvent } from '../../kernel/types.js';

package/dist/port/on/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @noy-db/hub/on — the on-* unlock family port.
+ *
+ * An unlock / auth primitive (`on-password`, `on-webauthn`, `on-oidc`,
+ * `on-totp`, `on-shamir`, `on-recovery`, …) binds ONLY to this subpath: the
+ * paper-recovery mint primitive plus the keyring/role/permission/rewrap/
+ * enroll shapes those packages read and write. `on-recovery` already
+ * consumes `mintPaperRecoveryEntry`/`PaperRecoveryEntry` from the root
+ * barrel (`@noy-db/hub`); this subpath is the stable, named port onto the
+ * same values, mirroring `@noy-db/hub/cargo`.
+ *
+ * NOTE: these primitives are implemented in `with-party/team/*` (the
+ * multi-user keyring service), not in the kernel spine proper — same
+ * precedent as `@noy-db/hub/ui` re-exporting from `with-shape/introspection`.
+ * The port-layering check only restricts kernel *spine* files (and
+ * port-to-port imports) from reaching into a `with-*` service statically;
+ * a port itself may.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export { mintPaperRecoveryEntry } from '../../with-party/team/recovery.js';
+export type { PaperRecoveryEntry } from '../../with-party/team/recovery.js';
+export type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+export type { Role, Permissions } from '../../kernel/types.js';
+export type { SlotRewrapContext } from '../../with-party/team/rotate-recover.js';
+export type { EnrollAuthenticatorOptions } from '../../with-party/team/authenticators.js';

package/dist/port/to/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @noy-db/hub/to — the stable store-adapter contract (the `to-*` family port).
+ *
+ * A storage backend (a `to-*` package) binds ONLY to this subpath: the
+ * ciphertext-facing slice of the hub. It carries the 6-method `NoydbStore`
+ * contract (plus its optional extension methods), the envelope / snapshot / op
+ * types a store passes through, the store-facing error classes, and the
+ * `NoydbPodStore` contract (plus `PodVersionConflictError`) for pod stores
+ * such as `to-drive` and `to-icloud`. Mirrors the `@noy-db/hub/cargo` seam
+ * used by klum-db and the `by-*` transports.
+ *
+ * Supersedes `@noy-db/hub/adapter`, which has been retired (coordinated
+ * removal; consumers migrated to this subpath).
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit and
+ * tsup's per-entry bundling keeps class identity stable across subpaths.
+ */
+export type { NoydbStore, NoydbBundleStore, NoydbPodStore, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
+export { ConflictError, NetworkError, StoreCapabilityError, BundleVersionConflictError, PodVersionConflictError, } from '../../kernel/errors.js';

package/dist/port/ui/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * **@noy-db/hub/ui** — the narrow, stable seam for the `collection.describe()`
+ * output contract that `@noy-db/ui` (and `@noy-db/ui-nuxt`) bind to *instead of* the
+ * whole `@noy-db/hub` root barrel.
+ *
+ * It re-exports ONLY the describe()-output type contract: the `CollectionDescription`
+ * envelope, its `DescribedField` element, the async `DescribeOptions`, and the
+ * descriptive-metadata building blocks (`CollectionMeta`, `FieldMeta`, `SemanticType`).
+ * Type-only — `describe()` itself is a method on `Collection`, reached via the root
+ * barrel / `/cargo`. These same names also remain exported from the root barrel
+ * (this subpath is purely additive); ui can migrate to the narrow seam on its own
+ * schedule. Treat it as a contract — additive changes only; removals are breaking.
+ *
+ * The pre-existing `./describe` subpath has been retired (coordinated removal;
+ * consumers migrated to `/ui`).
+ *
+ * @packageDocumentation
+ */
+export type { CollectionDescription, DescribedField, DescribeOptions, } from '../../with-shape/introspection/describe.js';
+export type { CollectionMeta } from '../../with-shape/introspection/meta.js';
+export type { FieldMeta, SemanticType } from '../../with-shape/introspection/field-meta.js';

package/dist/port/with/blob-strategy.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Strategy seam between core Collection and the optional blob service
+ * (#629 Task 7 — moved out of `with-shape/blobs/strategy.ts`, precedent:
+ * `port/with/classified-strategy.ts`/`i18n-strategy.ts`). Lives on the
+ * `/with` port (the one seam the kernel spine may import statically) so
+ * `Collection`/`Vault` can hold the `NO_BLOBS` default without a
+ * spine→service static import.
+ *
+ * Core imports `BlobStrategy` as a TYPE-ONLY symbol and `NO_BLOBS` as a
+ * minimal runtime stub. Neither pulls in the heavy `BlobSet` / chunk /
+ * MIME machinery — those only arrive when the consumer explicitly
+ * imports `@noy-db/hub/blobs` (see `via/blob/index.ts` →
+ * `withBlobs()` factory).
+ *
+ * This file is intentionally tiny so the bundler keeps it in the graph
+ * without dragging everything else in.
+ *
+ * @internal
+ */
+import type { BlobSet } from '../../with-shape/blobs/blob-set.js';
+import type { NoydbStore } from '../../kernel/types.js';
+import type { ObjectProjection } from '../../with-shape/blobs/object-projection.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+/**
+ * Args forwarded by `Collection.blob(id)` to the active strategy's
+ * `openSlot`. The strategy is responsible for returning a live
+ * `BlobSet` bound to the given record.
+ *
+ * @internal
+ */
+export interface BlobStrategyOpenArgs {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly collection: string;
+    readonly recordId: string;
+    readonly getDEK: (collectionName: string) => Promise<EnclaveKey>;
+    readonly encrypted: boolean;
+    readonly userId: string;
+    /**
+     * Collection opts into per-record keys (`perRecordKeys`), so its blobs are
+     * erasable: new uploads mint a per-blob content CEK (crypto-shreddable at
+     * `refCount → 0`). Off → legacy shared-`_blob`-DEK chunks. See the per-blob
+     * CEK design spec.
+     */
+    readonly erasableBlobs?: boolean;
+    /**
+     * Collection has `tiers` active (#724 I1 completion). Combined with
+     * `erasableBlobs` false, a content write is refused —
+     * `UnsupportedTierCompositionError` — since a legacy blob has no
+     * per-blob `_cek` and can never be tier-isolated on elevate/demote.
+     */
+    readonly tiersActive?: boolean;
+    /**
+     * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).
+     * Blobs are then written as a single un-gzipped object (one base64 chunk) so
+     * the stored object is directly recoverable with native tools (`base64 -d`),
+     * matching the directly-inspectable record layout. Dev-only — see the
+     * plaintext/debug-store-mode design.
+     */
+    readonly debugPlaintext?: boolean;
+    /**
+     * Object projection for `external` blob fields (`createNoydb({ objectStore })`).
+     * When present, fields declared `external` in `blobFields` route their raw
+     * bytes here instead of the encrypted-chunk path.
+     */
+    readonly objectStore?: ObjectProjection;
+    /** Per-collection blob field policies — used to resolve `external` / `public`. */
+    readonly blobFields?: BlobFieldsConfig;
+    /**
+     * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`
+     * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/
+     * `demote` run before any tier `getDEK` call — rather than relying on a bare
+     * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it
+     * is not itself a gate). Omitted only by a construction path that never calls
+     * `atTier()`.
+     */
+    readonly keyring?: UnlockedKeyring;
+}
+/**
+ * The seam interface. `@internal` — do not build public APIs on this
+ * shape; it can evolve freely until blobs are extracted into their
+ * own package, at which point it will be promoted to public.
+ *
+ * @internal
+ */
+export interface BlobStrategy {
+    openSlot(args: BlobStrategyOpenArgs): BlobSet;
+}
+/**
+ * Default strategy for collections that did not opt into blob storage.
+ * Every operation surfaces an actionable error that points the caller
+ * at the opt-in path.
+ *
+ * @internal
+ */
+export declare const NO_BLOBS: BlobStrategy;

package/dist/port/with/broker-strategy.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Credential-broker strategy seam (#479, credential-broker spec §5). Lives
+ * on the `/with` port (the one seam the kernel spine may import statically)
+ * so `Vault` can hold the `NO_BROKER` floor default without a spine→service
+ * static import — the same idiom as `port/with/team-strategy.ts`.
+ *
+ * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/
+ * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods
+ * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of
+ * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)
+ * keeps it in its own closure and injects it into the richer
+ * {@link BrokerSeedCtx} it passes to the `_broker` seed ops
+ * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor
+ * default) never builds a ctx — every method throws first.
+ * @internal
+ */
+import type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+/** Construction-time options for `withBroker(config)` (spec §5 client surface). */
+export interface BrokerConfig {
+    /**
+     * Stable id; part of the HKDF info tag AND the proof canonical. MUST be
+     * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`
+     * across two endpoints enables a cross-endpoint relay.
+     */
+    readonly brokerId: string;
+    /** https broker base URL; its origin is bound into the proof MAC (F4). */
+    readonly endpoint: string;
+    /** Dev-backend session token for `/enroll` (spec decision 1). */
+    readonly attestation?: (() => string | Promise<string>) | undefined;
+    /** DI for tests / non-window runtimes. */
+    readonly fetch?: typeof fetch | undefined;
+    /** Refresh margin in ms, default 60_000. */
+    readonly skewMs?: number | undefined;
+}
+/**
+ * Per-call context a {@link BrokerStrategy} method needs: the seed API's
+ * `store`/`vault`/`keyring`.
+ */
+export interface BrokerCtx {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly keyring: UnlockedKeyring;
+}
+/**
+ * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops
+ * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`
+ * (`with-party/broker/active.ts`) builds this by injecting its closed-over
+ * `config` into the port-level `BrokerCtx` it receives — the port interface
+ * itself never carries `config`.
+ */
+export interface BrokerSeedCtx extends BrokerCtx {
+    readonly config: BrokerConfig;
+}
+/** The vault-bound handle `vault.broker()` returns (spec §5). */
+export interface CredentialBrokerHandle {
+    /** Generate+persist the `_broker` seed (idempotent), register its proof key. */
+    enroll(): Promise<void>;
+    /** Rotate the seed + re-register (revokes the old proof key after a grace window). */
+    rotate(): Promise<void>;
+    /** Single-flight, per-profile cache of a `StoreCredentialSource`. */
+    credentialSource(profile?: string): StoreCredentialSource;
+}
+/** The opt-in strategy contract `withBroker(config)` implements. */
+export interface BrokerStrategy {
+    enroll(ctx: BrokerCtx): Promise<void>;
+    rotate(ctx: BrokerCtx): Promise<void>;
+    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource;
+}
+/**
+ * No-op stub — the floor default. Every broker operation throws
+ * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`
+ * (from `@noy-db/hub/broker`) in `createNoydb()`.
+ * @internal
+ */
+export declare const NO_BROKER: BrokerStrategy;
+/**
+ * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`
+ * returns — factored out of `kernel/vault.ts` to keep that file's footprint
+ * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a
+ * thunk, not a snapshot: the active keyring can change after `vault.load()`,
+ * so each handle method re-reads it fresh at call time.
+ */
+export declare function buildCredentialBrokerHandle(strategy: BrokerStrategy, store: NoydbStore, vault: string, getKeyring: () => UnlockedKeyring): CredentialBrokerHandle;

package/dist/port/with/capabilities.d.ts

@@ -0,0 +1,31 @@
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+import type { ExportFormat } from '../../kernel/types.js';
+/**
+ * Authorize an `@noy-db/as-*` export against the keyring's `exportCapability`.
+ * Throws `ExportCapabilityError` if the keyring is not authorised.
+ *
+ * - plaintext tier requires a `format`; defaults to empty for every role.
+ * - bundle tier defaults to on for owner/admin, off for others.
+ */
+export declare function assertCanExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
+/**
+ * Authorize an `@noy-db/as-*` import against the keyring's `importCapability`.
+ * Throws `ImportCapabilityError` if the keyring is not authorised.
+ *
+ * - plaintext tier requires a `format`; default-closed for every role.
+ * - bundle tier is default-closed for every role, including owner — import is
+ *   more dangerous than export (corrupts vs leaks).
+ */
+export declare function assertCanImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
+/**
+ * Read-only accessor for the keyring's export capability, with role-based
+ * defaults resolved. Useful for UI affordances (grey out the export button if
+ * no capability) without throwing.
+ */
+export declare function canExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;
+/**
+ * Read-only accessor for the keyring's import capability. UI affordance —
+ * returns false in every default-closed case (every role with no explicit
+ * `importCapability` grant).
+ */
+export declare function canImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;

package/dist/port/with/classified-marker.d.ts

@@ -0,0 +1,9 @@
+/**
+ * C-A/R10 config-drift marker store I/O — re-exported here (not
+ * `via/classified/config-drift.js` directly) so `Collection`'s
+ * dynamic `import()` in `_ensureClassifiedMarker`/`_classifiedMarkerDigestOnly`
+ * stays lazy while satisfying via-layering (#629 Task 6: the kernel spine
+ * may not name a `via/classified/*` path, not even inside a dynamic
+ * import specifier).
+ */
+export { persistClassifiedMarkerForFields, readClassifiedMarkerDigestOnly } from '../../via/classified/config-drift.js';