@noy-db/hub 0.3.0 → 0.4.0-pre.1

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-MEFJPTZ4.js";
+} from "../chunk-JRBNCUNT.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-BIOUI4HL.js";
+import "../chunk-W2OG6JOL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-KGWTNEQD.js");
+      const { GuardExecutor } = await import("../executor-KGNLJD6M.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-BIOUI4HL.js";
+} from "../chunk-W2OG6JOL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-ZASTRNPR.js → verify-26Y5GNMK.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-HB3RFQSC.js";
+} from "./chunk-IY23KFNZ.js";
 import {
   dualReadSealedSlot
-} from "./chunk-JKJOGPZN.js";
+} from "./chunk-N6WF5PKC.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-CIE2BASH.js";
+} from "./chunk-HOONYZY2.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-BIOUI4HL.js";
+} from "./chunk-W2OG6JOL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-ZASTRNPR.js.map
+//# sourceMappingURL=verify-26Y5GNMK.js.map

package/dist/via/i18n/policy.d.ts

@@ -32,7 +32,7 @@ export type OnMissing = 'substitute' | 'null' | 'throw';
  * - `join`       — a joined record expanded onto a row.
  * - `mv`         — materialized-view input.
  * - `derivation` — derivation input.
- * - `export`     — bundle/public-envelope export.
+ * - `export`     — bundle/cover export.
  */
 export type Layer = 'read' | 'guard' | 'join' | 'mv' | 'derivation' | 'export';
 /** Field-level policy: a single scalar, or a per-layer map. */

package/dist/{walk-SVNDIZ62.js → walk-XS3PKM6I.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-W22IKJE2.js";
+} from "./chunk-BOKIKJJB.js";
 import {
   loadPersistedSchema
-} from "./chunk-VZRODIM3.js";
-import "./chunk-XDYREZWE.js";
-import "./chunk-7DSTRQIJ.js";
-import "./chunk-HB3RFQSC.js";
-import "./chunk-JKJOGPZN.js";
-import "./chunk-5M5DVGV7.js";
+} from "./chunk-F6T6L2UK.js";
+import "./chunk-DVUZMT2W.js";
+import "./chunk-WEYZTLXN.js";
+import "./chunk-IY23KFNZ.js";
+import "./chunk-N6WF5PKC.js";
+import "./chunk-6HY2X62D.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-CIE2BASH.js";
-import "./chunk-JNAI2HN2.js";
-import "./chunk-BIOUI4HL.js";
+import "./chunk-HOONYZY2.js";
+import "./chunk-LSASLXGC.js";
+import "./chunk-W2OG6JOL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-SVNDIZ62.js.map
+//# sourceMappingURL=walk-XS3PKM6I.js.map

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-6QTNZJBS.js";
-import "../chunk-J2ZX2XUV.js";
-import "../chunk-4JBYV75E.js";
-import "../chunk-XDYREZWE.js";
-import "../chunk-7DSTRQIJ.js";
-import "../chunk-HB3RFQSC.js";
-import "../chunk-JKJOGPZN.js";
-import "../chunk-5M5DVGV7.js";
+} from "../chunk-PT37L5DV.js";
+import "../chunk-3SV2EPMN.js";
+import "../chunk-PK6QCH2C.js";
+import "../chunk-DVUZMT2W.js";
+import "../chunk-WEYZTLXN.js";
+import "../chunk-IY23KFNZ.js";
+import "../chunk-N6WF5PKC.js";
+import "../chunk-6HY2X62D.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-CIE2BASH.js";
-import "../chunk-JNAI2HN2.js";
-import "../chunk-BIOUI4HL.js";
+import "../chunk-HOONYZY2.js";
+import "../chunk-LSASLXGC.js";
+import "../chunk-W2OG6JOL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/with-audit/periods/periods.d.ts

@@ -146,14 +146,7 @@
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/index.js';
-/** The reserved collection name holding closed-period metadata. */
-export declare const PERIODS_COLLECTION = "_periods";
-/** Sibling of {@link PERIODS_COLLECTION} holding freeze companions (#604). */
-export declare const PERIOD_FREEZES_COLLECTION = "_period_freezes";
-/** Sibling of {@link PERIODS_COLLECTION} holding archive companions (#613). */
-export declare const PERIOD_ARCHIVES_COLLECTION = "_period_archives";
-/** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */
-export declare const PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, } from './window.js';
 /**
  * Companion record recording that a closed period was frozen (its delete
  * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},
@@ -196,14 +189,6 @@ export interface PeriodTargetPurgeRecord {
     readonly purgedBy: string;
     readonly targets: readonly TargetPurgeCount[];
 }
-/**
- * Exclusive upper bound for a period's delete-marker purge window (#604).
- * Markers carry no business date (empty body), only write-time `_ts`, so freeze
- * purges markers with `_ts < bound`, `bound` being the instant just after the
- * period's inclusive `endDate`: a date-only `endDate` seals through end-of-day
- * → next midnight; a full-timestamp `endDate` seals through that instant → +1ms.
- */
-export declare function periodExclusiveUpperBound(endDate: string): string;
 /**
  * Stored record for one closed or opened accounting period. One entry
  * per period, keyed by `name` in the reserved `_periods` collection.

package/dist/with-audit/periods/window.d.ts

@@ -0,0 +1,16 @@
+/** The reserved collection name holding closed-period metadata. */
+export declare const PERIODS_COLLECTION = "_periods";
+/** Sibling of {@link PERIODS_COLLECTION} holding freeze companions (#604). */
+export declare const PERIOD_FREEZES_COLLECTION = "_period_freezes";
+/** Sibling of {@link PERIODS_COLLECTION} holding archive companions (#613). */
+export declare const PERIOD_ARCHIVES_COLLECTION = "_period_archives";
+/** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */
+export declare const PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+/**
+ * Exclusive upper bound for a period's delete-marker purge window (#604).
+ * Markers carry no business date (empty body), only write-time `_ts`, so freeze
+ * purges markers with `_ts < bound`, `bound` being the instant just after the
+ * period's inclusive `endDate`: a date-only `endDate` seals through end-of-day
+ * → next midnight; a full-timestamp `endDate` seals through that instant → +1ms.
+ */
+export declare function periodExclusiveUpperBound(endDate: string): string;

package/dist/with-cargo/index.d.ts

@@ -26,6 +26,12 @@ export { withCargo } from './active.js';
 export { NO_CARGO } from './strategy.js';
 export type { CargoStrategy } from './strategy.js';
 export { CargoNotEnabledError } from '../kernel/errors.js';
+export { extractPartition } from './extract-partition.js';
+export { walkClosure } from './walk-closure.js';
+export { describeExtraction } from './describe-extraction.js';
+export { decryptExtractedPartition } from './decrypt-partition.js';
+export type { ExtractionPreview } from './describe-extraction.js';
+export type { DecryptedRecord } from './decrypt-partition.js';
 export type { WriteHook } from '../port/with/write-hooks.js';
 export type { WriteQueue } from '../kernel/write-queue.js';
 export type { WriteConflict } from '../kernel/types.js';

package/dist/with-formula/materialized-views/dependency-analyzer.d.ts

@@ -56,3 +56,18 @@ export declare function summarizeQueryPlan(query: Query<any>): string;
  * `map` semantics change non-equivalently.
  */
 export declare function summarizeUnionPlan<T extends Record<string, unknown>>(spec: MaterializedViewStrategy<T>): string;
+/**
+ * Canonical string description of a projection MV's plan (#810), used
+ * as input to `computeQueryHash`.
+ *
+ * Leg descriptors ARE sorted (contrast with UNION arm order): every
+ * leg attaches under a distinct `as` alias, forward legs are
+ * one-to-one attachments and collect legs are independent
+ * hash-grouped passes, so declaration order never changes the
+ * materialized rows — a pure reorder must NOT force a refresh.
+ *
+ * The projection `map` is NOT fingerprinted (identical limitation as
+ * the UNION arm `map`); consumers must bump the MV's `name` when
+ * `map` semantics change non-equivalently.
+ */
+export declare function summarizeProjectionPlan<T extends Record<string, unknown>>(spec: MaterializedViewStrategy<T>): string;

package/dist/with-formula/materialized-views/index.d.ts

@@ -5,7 +5,7 @@ export { analyzeDependencies, summarizeQueryPlan } from './dependency-analyzer.j
 export { computeQueryHash, canonicalizeQueryPlan } from './query-hash.js';
 export { markMVStale, resolveStaleMVOnRead, isMVStale, clearMVStale } from './stale.js';
 export type { MVStaleAccessor } from './stale.js';
-export type { MaterializedViewStrategy, MaterializedViewStrategyHandle, MaterializedViewOutput, MaterializedFromMeta, UnionSource, UnionArmJoin, } from './types.js';
+export type { MaterializedViewStrategy, MaterializedViewStrategyHandle, MaterializedViewOutput, MaterializedFromMeta, UnionSource, UnionArmJoin, ProjectionSpec, ProjectionJoinLeg, } from './types.js';
 export type { RegisteredMV } from './registry.js';
 export type { MVExecutorAccessor, RefreshResult } from './executor.js';
 export { MaterializedViewCycleError, MaterializedViewConfigError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, } from '../../kernel/errors.js';

package/dist/with-formula/materialized-views/registry.d.ts

@@ -40,6 +40,20 @@ export declare class MaterializedViewRegistry {
     private readonly _byName;
     /** Keyed by dependency source-collection → MVs that depend on it. */
     private readonly _bySource;
+    /**
+     * Projection MVs (#810) whose forward-leg ref() targets could not be
+     * resolved at registration time. A forward leg names only the FK
+     * FIELD; its dependency is the field's ref() TARGET, declared on the
+     * source collection — but registration runs at vault open, BEFORE
+     * user code declares collections (and their refs). Constructing the
+     * source collection here to look them up would be worse: a later
+     * `vault.collection(source, { refs })` call only registers refs on a
+     * cache miss, so an early construction would silently drop them.
+     * Instead each entry carries a non-constructive ref-registry probe;
+     * `mvsForSource` retries on every dispatch until every forward
+     * target has resolved (see `_resolvePendingForwardDeps`).
+     */
+    private readonly _pendingForwardDeps;
     /**
      * Register an MV. Invokes `spec.query()` once at registration time to
      * read the plan + join context; the resulting `Query<T>` is discarded
@@ -56,6 +70,21 @@ export declare class MaterializedViewRegistry {
     }): Promise<void>;
     /** All MVs that depend on `source`, in registration order. */
     mvsForSource(source: string): ReadonlyArray<RegisteredMV>;
+    /**
+     * Retry ref() resolution for every pending projection forward leg
+     * (#810). A field resolves once its source collection's refs have
+     * been declared; the target then folds into the owning MV's
+     * dependency set and `_bySource`, so subsequent writes to it
+     * dispatch a refresh. Idempotent and cheap — the pending list
+     * empties as fields resolve, and `mvsForSource` skips the call
+     * entirely once it's empty.
+     *
+     * Late-resolved targets do NOT retro-feed `edges()` — the cycle
+     * pass runs once at vault open, before refs exist. A cycle routed
+     * exclusively through a forward leg is therefore not detected at
+     * open (collect + source edges, the literal names, are).
+     */
+    private _resolvePendingForwardDeps;
     /** Single MV by name, or `undefined`. */
     byName(name: string): RegisteredMV | undefined;
     /** Iterate over every registered MV. */

package/dist/with-formula/materialized-views/types.d.ts

@@ -118,6 +118,68 @@ export interface UnionArmJoin {
     /** Planner strategy override. `undefined` → auto-select. */
     readonly strategy?: JoinStrategy;
 }
+/**
+ * Projection-form registration (#810): one output row per record of a
+ * primary `source` collection, enriched with forward FK legs and
+ * reverse one-to-many "collect" legs BEFORE `map` shapes the MV row.
+ * The niwat federated read-model shape — a bill row carrying its
+ * client lookup plus the receipt / application / credit-note sets
+ * that point back at it.
+ */
+export interface ProjectionSpec<TRow extends Record<string, unknown>> {
+    /** Primary collection. One output row per primary record (unless {@link map} omits). */
+    readonly source: string;
+    /** Join legs attached to each primary row BEFORE {@link map} runs. */
+    readonly joins: ReadonlyArray<ProjectionJoinLeg>;
+    /**
+     * Pure projection: primary row + leg attachments → MV row. Called
+     * once per primary record at materialization time, AFTER every leg
+     * has attached under its `as` alias.
+     *
+     * Returning `null` or `undefined` **omits** the primary record from
+     * the materialized output entirely (same contract as the UNION arm
+     * `map`) — filtering lives here; there is no `where` on the
+     * projection form.
+     */
+    readonly map: (row: Record<string, unknown>) => TRow | null | undefined;
+}
+/**
+ * One join leg of a projection MV. Discriminated by the presence of
+ * `collect` (reverse leg) vs `field` (forward leg); `as` aliases must
+ * be unique across legs and non-empty.
+ *
+ * - **Forward FK leg** — identical shape + machinery as
+ *   {@link UnionArmJoin} / `Query.join()`: resolves a `ref()`-declared
+ *   FK on the projection source into an attached right-side record
+ *   (record | null) under `as`.
+ * - **Reverse "collect" leg** — every row of `collect` whose `on`
+ *   field references the primary record's id, attached as a
+ *   possibly-empty ARRAY under `as`. `on` must carry a `ref()`
+ *   declared on the `collect` collection targeting the projection
+ *   `source` — checked at first materialization (parity with
+ *   join-time ref errors). `maxRows` here is a PER-PRIMARY-ROW
+ *   fan-out ceiling (default: the join default); exceeding it throws
+ *   `JoinTooLargeError`.
+ */
+export type ProjectionJoinLeg = {
+    /** FK field on the projection source (must have a `ref()` declared). */
+    readonly field: string;
+    /** Alias under which the resolved right-side record attaches. */
+    readonly as: string;
+    /** Per-side row ceiling override. `undefined` → the join default. */
+    readonly maxRows?: number;
+    /** Planner strategy override. `undefined` → auto-select. */
+    readonly strategy?: JoinStrategy;
+} | {
+    /** Sibling collection to collect from. */
+    readonly collect: string;
+    /** FK field on `collect` (`ref()` targeting the projection source required). */
+    readonly on: string;
+    /** Alias under which the collected array attaches. */
+    readonly as: string;
+    /** Per-primary-row fan-out ceiling. `undefined` → the join default. */
+    readonly maxRows?: number;
+};
 /**
  * Registration shape passed to `withMaterializedView()`.
  *
@@ -167,6 +229,25 @@ export interface MaterializedViewStrategy<TRow extends Record<string, unknown>>
      * {@link sources} is ignored.
      */
     unionSources?: ReadonlyArray<UnionSource<TRow>>;
+    /**
+     * Projection-form registration (#810): one output row per primary
+     * record of `projection.source`, enriched with forward FK legs and
+     * reverse one-to-many "collect" legs before `projection.map` shapes
+     * the MV row. Post-map {@link groupBy} + {@link aggregate} are
+     * supported exactly as in UNION mode.
+     *
+     * Mutually exclusive with {@link query} and {@link unionSources} —
+     * a strategy must declare exactly one of the three forms.
+     * Registration throws `MaterializedViewConfigError` otherwise.
+     *
+     * Dependencies are all AUTO: `{source} ∪ forward ref() targets ∪
+     * collect collections` (explicit {@link sources} remains additive).
+     * Forward targets resolve from the source collection's `ref()`
+     * declarations; those are declared by user code AFTER the vault
+     * opens (registration time), so the registry folds them into the
+     * dependency set on the first MV dispatch that finds them declared.
+     */
+    projection?: ProjectionSpec<TRow>;
     /**
      * Group-key field(s) for UNION mode. Applied to the
      * concatenated mapped-row stream from {@link unionSources} before

package/dist/with-formula/materialized-views/with-materialized-view.d.ts

@@ -7,18 +7,22 @@ import type { MaterializedViewStrategy, MaterializedViewStrategyHandle } from '.
  * user `onDelete` guards on the output collection aren't tripped by
  * housekeeping.
  *
- * Two registration modes:
+ * Three registration modes:
  *   - **single-source** — declare `query: (db) => Query<TRow>`; the
  *     dependency analyzer derives source collections from the plan.
  *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`
  *     plus optional `groupBy` + `aggregate`; the executor reads each
  *     arm, maps to the unified row shape, concatenates, then groups
  *     and aggregates.
+ *   - **projection** (#810) — declare `projection: { source, joins,
+ *     map }`; one output row per primary record, enriched with
+ *     forward FK legs and reverse "collect" legs before `map` runs.
  *
- * The two modes are mutually exclusive — exactly one of `query` /
- * `unionSources` must be set at registration time.
+ * The three modes are mutually exclusive — exactly one of `query` /
+ * `unionSources` / `projection` must be set at registration time.
  *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md (single-source v2)
- * and docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION).
+ * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md (single-source v2),
+ * docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION),
+ * and docs/superpowers/specs/2026-07-25-join-projection-mv-design.md (projection).
  */
 export declare function withMaterializedView<TRow extends Record<string, unknown>>(spec: MaterializedViewStrategy<TRow>): MaterializedViewStrategyHandle;

package/dist/with-party/directory/cover/custom.d.ts

@@ -0,0 +1,34 @@
+import type { Cover, JsonValue, ResolvedCoverSchema } from './types.js';
+/**
+ * Validate the owner-supplied `custom` input: the field must be a
+ * plain object, every key must match {@link CUSTOM_KEY_PATTERN}, and
+ * every value must be JSON-serializable (no functions, `undefined`,
+ * symbols, bigints, or cycles) within the depth cap. `null` is
+ * accepted — it is the delete-this-namespace directive and never
+ * persists. Throws `ValidationError` on the first violation.
+ */
+export declare function validateCustomInput(custom: Record<string, JsonValue>): void;
+/**
+ * Namespace-level patch merge for `setCover`: provided namespaces
+ * replace their previous value, absent namespaces are preserved, and
+ * an explicit `null` deletes that namespace (so `null` never persists
+ * as a namespace value). A whole-`custom`-absent patch preserves the
+ * previous custom, consistent with the other cover fields. Rationale:
+ * framework A must never need read-modify-write of framework B's data.
+ *
+ * Returns a spreadable fragment — `{ custom }` when the merge leaves
+ * at least one namespace, `{}` when it leaves none (the field is
+ * dropped from the persisted document rather than stored empty).
+ */
+export declare function mergeCustom(existing: Record<string, JsonValue> | undefined, patch: Record<string, JsonValue> | undefined): {
+    custom: Record<string, JsonValue>;
+} | Record<string, never>;
+/**
+ * Post-merge size caps — validates the WOULD-BE-PERSISTED document
+ * (after the namespace merge), so a small patch can't tip the stored
+ * cover over a cap unnoticed. `maxCoverBytes` bounds the entire
+ * serialized document, which also closes the unbounded locale-map
+ * key-count hole for `name` / `description`. Sizes are measured as
+ * `JSON.stringify` length. Throws `ValidationError` on violation.
+ */
+export declare function validateCoverSize(cover: Cover, schema: ResolvedCoverSchema): void;

package/dist/with-party/directory/cover/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cover service — barrel export. (Formerly "public envelope"; the
+ * old names remain as deprecated aliases for one pre-release window.)
+ *
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
+ *
+ * @module
+ */
+export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, } from './types.js';
+export { COVER_FIELDS, DEFAULT_COVER_SCHEMA, resolveSchema, } from './types.js';
+export type { SetCoverInput } from './schema.js';
+export { validateCoverInput, isCover } from './schema.js';
+export { mergeCustom, validateCoverSize } from './custom.js';
+export { loadCover, saveCover, readCover, resolveLocale, pickLocale, COVER_RECORD_ID, } from './storage.js';
+export type { PublicEnvelope, PublicEnvelopeText, PublicEnvelopeSchema, PublicEnvelopeField, ResolvedPublicEnvelopeSchema, } from './types.js';
+export { PUBLIC_ENVELOPE_FIELDS, DEFAULT_PUBLIC_ENVELOPE_SCHEMA, } from './types.js';
+export type { SetPublicEnvelopeInput } from './schema.js';
+export { validatePublicEnvelopeInput, isPublicEnvelope } from './schema.js';
+export { loadPublicEnvelope, savePublicEnvelope, readPublicEnvelope, PUBLIC_ENVELOPE_RECORD_ID, } from './storage.js';

package/dist/with-party/directory/cover/schema.d.ts

@@ -0,0 +1,39 @@
+import type { Cover, CoverText, JsonValue, ResolvedCoverSchema } from './types.js';
+/** Owner-supplied input — the subset of {@link Cover} the owner can set. */
+export interface SetCoverInput {
+    readonly name?: CoverText;
+    readonly description?: CoverText;
+    readonly icon?: string;
+    readonly defaultLocale?: string;
+    /**
+     * Namespace-level patch for the cover's `custom` slot (#800):
+     * provided namespaces replace their previous value, absent
+     * namespaces are preserved, an explicit `null` deletes that
+     * namespace. Requires `'custom'` in the schema's `fields` list —
+     * the `cover: true` shorthand does NOT enable it.
+     */
+    readonly custom?: Record<string, JsonValue>;
+}
+/**
+ * Validate an owner-supplied cover input against the developer's
+ * resolved schema. Throws `ValidationError` on the first violation;
+ * returns void on success.
+ *
+ * The validator is deliberately strict: every fail mode is a hard
+ * error rather than a silent drop, so the owner finds out immediately
+ * which field they oversized rather than discovering a truncated
+ * label months later.
+ */
+export declare function validateCoverInput(input: SetCoverInput, schema: ResolvedCoverSchema): void;
+/**
+ * Lightweight runtime predicate — used by the bundle header
+ * validator to recognise a cover without requiring it. (The wire
+ * discriminator keeps its frozen name: `_noydb_public: 1`.)
+ */
+export declare function isCover(x: unknown): x is Cover;
+/** @deprecated Use {@link SetCoverInput}. */
+export type SetPublicEnvelopeInput = SetCoverInput;
+/** @deprecated Use {@link validateCoverInput}. */
+export declare const validatePublicEnvelopeInput: typeof validateCoverInput;
+/** @deprecated Use {@link isCover}. */
+export declare const isPublicEnvelope: typeof isCover;

package/dist/with-party/directory/cover/storage.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Persistence helpers for `_meta/public-envelope` — the cover's
+ * frozen wire location. Mirrors the bypass-AES pattern used by
+ * `_meta/handle` and `_meta/policy` — the document is plaintext
+ * JSON, the envelope's `_iv` field is left empty.
+ *
+ * @module
+ */
+import type { NoydbStore } from '../../../kernel/types.js';
+import type { Cover } from './types.js';
+/**
+ * Reserved id for the vault-level cover record. The VALUE is frozen
+ * wire format — the record predates the #799 rename and stays at
+ * `_meta/public-envelope` so existing vaults need no migration.
+ */
+export declare const COVER_RECORD_ID = "public-envelope";
+/**
+ * Read the cover from `_meta/public-envelope`. Returns `undefined`
+ * when no cover has been persisted (fresh vault, or a vault written
+ * before the feature was enabled). Tolerates corrupted documents —
+ * a JSON parse failure surfaces as `undefined`, not a thrown error,
+ * mirroring `_meta/handle`'s contract.
+ */
+export declare function loadCover(store: NoydbStore, vault: string): Promise<Cover | undefined>;
+/** Persist the cover. Idempotent — overwrites any prior write. */
+export declare function saveCover(store: NoydbStore, vault: string, cover: Cover): Promise<void>;
+/**
+ * Public, no-key reader. Plain function, not a method on `Noydb` —
+ * the whole point is it works without an authenticated session, so
+ * a UI can show "Acme 2026 Tax Records" before unlocking.
+ *
+ * Resolves any `name` / `description` locale map through the supplied
+ * `locale` (when provided). Omitting `locale` returns the raw
+ * cover, which a multilingual picker can render as it pleases.
+ */
+export declare function readCover(store: NoydbStore, vault: string, opts?: {
+    readonly locale?: string;
+}): Promise<Cover | undefined>;
+/**
+ * Resolve the locale-map fields (`name`, `description`) of a cover
+ * to plain strings for the requested locale, falling back through
+ * `defaultLocale` and then any available translation.
+ *
+ * @internal
+ */
+export declare function resolveLocale(cover: Cover, locale: string): Cover;
+/**
+ * Resolve a `string | { [locale]: string }` value to a string for a
+ * given locale. Exported so the bundle reader can reuse it without
+ * duplicating the fallback chain.
+ *
+ * **Looser than `resolveI18nText`** — the hub's record-field resolver
+ * throws `LocaleNotSpecifiedError` when no translation matches, but
+ * label semantics deliberately prefer "show *something*" over
+ * throwing. The fallback chain is:
+ *   1. Exact `locale` match.
+ *   2. `defaultLocale` (when supplied on the cover).
+ *   3. First non-empty value in the map.
+ *   4. Empty string (only if every translation is empty — pathological).
+ *
+ * This deviation is documented in `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`.
+ */
+export declare function pickLocale(value: string | Record<string, string>, locale: string, defaultLocale: string | undefined): string;
+/** @deprecated Use {@link COVER_RECORD_ID}. */
+export declare const PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
+/** @deprecated Use {@link loadCover}. */
+export declare const loadPublicEnvelope: typeof loadCover;
+/** @deprecated Use {@link saveCover}. */
+export declare const savePublicEnvelope: typeof saveCover;
+/** @deprecated Use {@link readCover}. */
+export declare const readPublicEnvelope: typeof readCover;