@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/kernel/validation.d.ts

@@ -1,8 +1,8 @@
 /**
- * Passphrase validation — phrase format (per the three-tier session-tiers
+ * Secret validation — phrase format (per the three-tier session-tiers
  * design, locked 2026-05-04).
  *
- * Passphrases are **phrases**: multiple simple words, easy to remember,
+ * Secrets are **phrases**: multiple simple words, easy to remember,
  * structurally constrained so a weak choice cannot silently collapse the
  * security floor. The format is intentionally narrow: lowercase letters
  * and single spaces only, no punctuation, no symbols, no digits.
@@ -12,17 +12,17 @@
  * - Per-word minimum: 3 characters (excludes "a", "is", "of").
  * - Adjacent repeats rejected ("the the").
  *
- * The hub runs validation default-on at every passphrase ingress
- * (`createOwnerKeyring`, `grant`, `rotatePassphrase`); test fixtures and
- * CLI scripts override via `{ allowWeakPassphrase: true }`.
+ * The hub runs validation default-on at every secret ingress
+ * (`createOwnerKeyring`, `grant`, `rotateSecret`); test fixtures and
+ * CLI scripts override via `{ allowWeakSecret: true }`.
  *
  * @module
  */
 import { NoydbError } from './errors.js';
 /** All reasons a phrase can be rejected. */
-export type WeakPassphraseReason = 'empty' | 'invalid-chars' | 'leading-or-trailing-space' | 'double-space' | 'too-few-words' | 'word-too-short' | 'repeated-adjacent';
-/** Per-vault knobs. Aligns with `VaultPolicy.passphrase`. */
-export interface PassphrasePolicy {
+export type WeakSecretReason = 'empty' | 'invalid-chars' | 'leading-or-trailing-space' | 'double-space' | 'too-few-words' | 'word-too-short' | 'repeated-adjacent';
+/** Per-vault knobs. Aligns with `VaultPolicy.secret`. */
+export interface SecretPolicy {
     /** Minimum number of words. Default 6. Strict policy uses 8. */
     readonly minWords?: number;
     /** Minimum characters per word. Default 3. */
@@ -42,7 +42,7 @@ export interface PassphrasePolicy {
      * // Thai + English mix with digits permitted
      * pattern: /^[\p{L}0-9 ]+( [\p{L}0-9 ]+)*$/u
      *
-     * // Allow uppercase + hyphens (passphrase-with-hyphens style)
+     * // Allow uppercase + hyphens (secret-with-hyphens style)
      * pattern: /^[A-Za-z]+([- ][A-Za-z]+)*$/
      * ```
      *
@@ -55,7 +55,7 @@ export interface PassphrasePolicy {
     readonly pattern?: RegExp;
     /**
      * Replace ALL validation entirely with a custom function. When set,
-     * none of the other PassphrasePolicy fields apply — the consumer
+     * none of the other SecretPolicy fields apply — the consumer
      * owns every rule (word splitting, character classes, entropy
      * thresholds, allowlist/denylist). Use sparingly; this is the
      * escape hatch for domain-specific phrase formats:
@@ -64,50 +64,50 @@ export interface PassphrasePolicy {
      *   - BIP-39 seed phrases (24 words, fixed wordlist, etc.)
      *   - Organization-specific HR password policies
      *
-     * The returned `PassphraseValidationResult` is what
-     * {@link assertStrongPassphrase} dispatches on — `ok: true` accepts;
-     * `ok: false` throws `WeakPassphraseError` with the supplied reason.
+     * The returned `SecretValidationResult` is what
+     * {@link assertStrongSecret} dispatches on — `ok: true` accepts;
+     * `ok: false` throws `WeakSecretError` with the supplied reason.
      *
      */
-    readonly customValidator?: (phrase: string) => PassphraseValidationResult;
+    readonly customValidator?: (phrase: string) => SecretValidationResult;
 }
 /** Result of a check. Discriminated union — compile-time exhaustive. */
-export type PassphraseValidationResult = {
+export type SecretValidationResult = {
     readonly ok: true;
     readonly words: number;
 } | {
     readonly ok: false;
-    readonly reason: WeakPassphraseReason;
+    readonly reason: WeakSecretReason;
     readonly minimum?: number;
     readonly got?: number;
 };
 /**
- * Thrown by `assertStrongPassphrase()` and by every hub ingress
- * point (`createOwnerKeyring`, `grant`, `rotatePassphrase`) when a
+ * Thrown by `assertStrongSecret()` and by every hub ingress
+ * point (`createOwnerKeyring`, `grant`, `rotateSecret`) when a
  * supplied phrase fails the structural rules above.
  */
-export declare class WeakPassphraseError extends NoydbError {
-    readonly reason: WeakPassphraseReason;
+export declare class WeakSecretError extends NoydbError {
+    readonly reason: WeakSecretReason;
     readonly suggestion: string;
-    constructor(reason: WeakPassphraseReason, suggestion: string);
+    constructor(reason: WeakSecretReason, suggestion: string);
 }
 /**
  * Inspect a phrase against the format rules and return a structured
  * verdict. Never throws — callers either branch on `ok` or pass the
- * result to {@link assertStrongPassphrase} for the throwing flavour.
+ * result to {@link assertStrongSecret} for the throwing flavour.
  */
-export declare function validatePassphrase(s: string, opts?: PassphrasePolicy): PassphraseValidationResult;
+export declare function validateSecret(s: string, opts?: SecretPolicy): SecretValidationResult;
 /**
- * Throw {@link WeakPassphraseError} when the phrase fails. Used by
- * `createOwnerKeyring`, `grant`, and `rotatePassphrase` at ingress.
+ * Throw {@link WeakSecretError} when the phrase fails. Used by
+ * `createOwnerKeyring`, `grant`, and `rotateSecret` at ingress.
  *
- * Pass `{ allowWeakPassphrase: true }` to bypass — intended for test
+ * Pass `{ allowWeakSecret: true }` to bypass — intended for test
  * fixtures, CLI scripts, and dev environments. The override never
  * loosens the cryptographic key derivation; it only relaxes the
  * structural-strength gate.
  */
-export declare function assertStrongPassphrase(s: string, opts?: PassphrasePolicy & {
-    allowWeakPassphrase?: boolean;
+export declare function assertStrongSecret(s: string, opts?: SecretPolicy & {
+    allowWeakSecret?: boolean;
 }): void;
 /**
  * Estimate the entropy of a phrase, given the EFF 7,776-word list as
@@ -117,14 +117,14 @@ export declare function assertStrongPassphrase(s: string, opts?: PassphrasePolic
  * estimates aren't comparable to phrase entropy, and surfacing 0 makes
  * weak inputs visible in any UI that displays an entropy meter.
  */
-export declare function estimateEntropy(passphrase: string): number;
+export declare function estimateEntropy(secret: string): number;
 /**
  * Internal compatibility shim. Older code paths used the throwing
- * `validatePassphrase(s)` directly; some still do via re-exports. Routes
- * to the new `assertStrongPassphrase` so the contract holds for both
+ * `validateSecret(s)` directly; some still do via re-exports. Routes
+ * to the new `assertStrongSecret` so the contract holds for both
  * shapes during the transition. New code should call
- * {@link assertStrongPassphrase} directly.
+ * {@link assertStrongSecret} directly.
  *
  * @internal
  */
-export declare function legacyAssertPassphrase(s: string): void;
+export declare function legacyAssertSecret(s: string): void;

package/dist/kernel/vault.d.ts

@@ -1,86 +1,58 @@
-import type { NoydbStore, EncryptedEnvelope, HistoryConfig, ExportStreamOptions, ExportChunk, CollectionConflictResolver, CrossTierAccessEvent, TierMode, Role, VaultUserApi } from './types.js';
+import type { OpenCollectionOptions } from '../port/with/collection-options.js';
+import type { StrategyBag } from '../port/with/strategies.js';
+import type { NoydbStore, EncryptedEnvelope, HistoryConfig, ExportStreamOptions, ExportChunk, CollectionConflictResolver, CrossTierAccessEvent, Role, VaultUserApi, CollectionShape, SensitiveOf, IndexedOf, MoneyOf } from './types.js';
 import type { Noydb } from './noydb.js';
 import type { IssueDelegationOptions, DelegationToken } from '../with-party/team/delegation.js';
 import { Collection } from './collection.js';
-import type { CacheOptions } from './collection.js';
 import type { JoinableSource } from './query/index.js';
 import type { OnDirtyCallback } from './collection.js';
 import type { UnlockedKeyring, BundleRecipient } from '../with-party/team/keyring.js';
-import { type PortabilityStrategy } from '../with-audit/portability/strategy.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
-import type { MaterializedViewStrategyHandle } from '../with-formula/materialized-views/types.js';
+import type { MaterializedViewStrategy } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewRegistry } from '../with-formula/overlay-views/registry.js';
-import type { OverlayedViewStrategyHandle } from '../with-formula/overlay-views/types.js';
+import type { OverlayedViewStrategy } from '../with-formula/overlay-views/types.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
-import type { ExportFormat, KeyringFile, SensitiveOpt, IndexFieldName, IndexDefFor, MoneyFieldsOpt } from './types.js';
+import type { ExportFormat, KeyringFile } from './types.js';
 import { ElevatedHandle } from '../with-commit/tx/elevated-handle.js';
 import type { NoydbEventEmitter } from './events.js';
-import type { StandardSchemaV1 } from './schema.js';
-import type { BlobStrategy } from '../port/with/blob-strategy.js';
 import type { ObjectProjection } from '../with-shape/blobs/object-projection.js';
-import type { ArchiveStrategy } from '../with-fork/archive/index.js';
-import type { ArchivePolicy, ArchiveResult, ArchiveRunOptions } from '../with-fork/archive/index.js';
+import type { ArchiveResult, ArchiveRunOptions } from '../with-fork/archive/index.js';
 import { type SequenceHandle, type FormattedSequenceHandle, type SequenceOptions } from '../with-commit/sequence/index.js';
-import { type SequenceStrategy } from '../with-commit/sequence/strategy.js';
 import { type Assignment } from '../with-commit/numbering/index.js';
 import type { DeferredNumberingConfig } from '../with-commit/numbering/descriptor.js';
-import type { IndexStrategy } from '../with-lookup/indexing/strategy.js';
-import type { LazyStrategy } from '../port/with/lazy-strategy.js';
-import type { AggregateStrategy } from '../with-lookup/aggregate/strategy.js';
-import type { CrdtStrategy } from './types.js';
-import type { TiersStrategy, TierMoveResult } from '../with-audit/tiers/strategy.js';
-import type { SearchStrategy } from '../with-lookup/search/strategy.js';
+import type { TierMoveResult } from '../with-audit/tiers/strategy.js';
 import { type CargoStrategy } from '../with-cargo/strategy.js';
-import { type BrokerStrategy, type CredentialBrokerHandle } from '../port/with/broker-strategy.js';
+import { type CredentialBrokerHandle } from '../port/with/broker-strategy.js';
 import type { LedgerStore } from '../with-commit/history/ledger/store.js';
 import type { VaultInstant } from '../with-commit/history/time-machine.js';
-import { type HistoryStrategy } from '../with-commit/history/strategy.js';
-import { type ForgetStrategy, type ForgetResult } from '../with-audit/forget/strategy.js';
+import { type ForgetResult } from '../with-audit/forget/strategy.js';
 import { type SubjectRef } from '../with-audit/forget/subject-index.js';
 import type { VaultFrame } from '../with-fork/shadow/vault-frame.js';
-import { type ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { ConsentContext, ConsentAuditEntry, ConsentAuditFilter, ConsentOp } from '../with-audit/consent/consent.js';
-import { type ConsentStrategy } from '../with-audit/consent/strategy.js';
-import { type PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import { type RefDescriptor, type RefViolation } from './refs.js';
-import type { DictionaryHandle, DictionaryOptions, DictKeyDescriptor, StaticDictDescriptor } from '../port/with/i18n-strategy.js';
-import { // #653
-type LookupDescriptor } from '../port/with/lookup-strategy.js';
+import type { DictionaryHandle, DictionaryOptions } from '../port/with/i18n-strategy.js';
 import { type LinkSpec, type LinkSetHandle } from '../with-shape/links/names.js';
-import type { EmbeddingDescriptor } from '../with-lookup/embeddings/index.js';
-import type { ComputedFields } from '../with-formula/computed/index.js';
-import { type I18nStrategy, type I18nTextDescriptor } from '../port/with/i18n-strategy.js';
-import { type ViaFieldSpec } from './via/compose.js';
 import { ViaGraph } from './via/graph.js';
 import { type RollupDeleteIntent } from './via/dispatch.js';
-import { type SyncStrategy } from '../with-party/team/sync-strategy.js';
 import type { GuardRegistry } from '../with-audit/guards/registry.js';
-import type { GuardStrategyHandleAny } from '../with-audit/guards/types.js';
+import type { GuardStrategyAny } from '../with-audit/guards/types.js';
 import type { ReadOnlyVaultFacade } from '../with-audit/guards/read-only-facade.js';
 import type { DerivationRegistry } from '../with-formula/derivations/registry.js';
-import type { DerivationStrategyHandle } from '../with-formula/derivations/types.js';
-import type { ConflictPolicy } from './types.js';
-import type { CrdtMode } from '../with-commit/crdt/crdt.js';
+import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
 import { type PeriodRecord, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
 import { type EnclaveKey } from './enclave/index.js';
-import type { RecipientSealer } from '../with-party/team/managed-passphrase.js';
+import type { RecipientSealer } from '../with-party/team/managed-secret.js';
 import { type ExportBlobsOptions, type ExportBlobsHandle } from '../with-shape/blobs/export-blobs.js';
-import { type BlobFieldsConfig, type CompactRunOptions, type CompactionResult } from '../with-shape/blobs/blob-compaction.js';
+import { type CompactRunOptions, type CompactionResult } from '../with-shape/blobs/blob-compaction.js';
 import { type IssueMagicLinkGrantOptions, type MagicLinkGrantRecord } from '../with-party/team/magic-link-grant.js';
 import { CustodyApi } from '../with-party/custody/index.js';
 import { SchemaFenceController } from '../with-shape/schema-update/fence-controller.js';
 import { type FenceDoc } from '../with-shape/schema-update/fence.js';
-import type { SchemaUpdateStrategy } from '../with-shape/schema-update/types.js';
-import type { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
-import { type AttestationStrategy } from '../with-audit/attestation/vault-facade.js';
-import { type SealedRecordStrategy } from '../with-audit/sealed-record/strategy.js';
+import type { RevocationList } from '@noy-db/attestation';
 import type { DumpSchemaOptions, VaultSchemaSnapshot, SchemaIntrospection } from '../with-shape/introspection/types.js';
 import type { VaultIntrospectState } from '../with-shape/introspection/walk.js';
-import type { FieldMeta } from '../with-shape/introspection/field-meta.js';
-import type { CollectionMeta, VaultMeta } from '../with-shape/introspection/meta.js';
-import { type ClassifiedEntry, type ClassifiedStrategy } from '../port/with/classified-strategy.js';
-/** A vault (tenant namespace) containing collections. */
+import type { VaultMeta } from '../with-shape/introspection/meta.js';
 export declare class Vault {
     #private;
     private readonly adapter;
@@ -99,36 +71,20 @@ export declare class Vault {
     private readonly syncAdapter;
     private readonly getPurgeableTargets;
     private readonly historyConfig;
-    /** tree-shake seam for the optional blob service; `undefined` means "blobs are off for this
-     *  vault" — every `collection.blob(id)` call throws with a pointer at `@noy-db/hub/blobs`. */
-    private readonly blobStrategy;
+    /**
+     * Every opt-in service, resolved once by `createNoydb` (#838). Shared by
+     * reference with the owning `Noydb` and with every `Collection` this vault
+     * opens, so all three always agree about which services are enabled.
+     */
+    private readonly strategies;
     private readonly objectStore;
-    /** Cold-storage archival strategy (the archive target store). */
-    private readonly archiveStrategy;
     /** Per-collection record archival policies. Indexed by collection name. */
     private readonly archiveRegistry;
-    private readonly indexStrategy;
-    private readonly lazyStrategy;
-    private readonly aggregateStrategy;
-    private readonly crdtStrategy;
-    private readonly tiersStrategy;
-    private readonly searchStrategy;
-    /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
-     *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
-    readonly cargoStrategy: CargoStrategy;
-    private readonly brokerStrategy;
-    private readonly sealedRecordStrategy;
-    private readonly portabilityStrategy;
-    private readonly sequenceStrategy;
-    private readonly consentStrategy;
     private readonly periods;
     private readonly linksEnforcer;
-    private readonly shadowStrategy;
-    private readonly historyStrategy;
-    private readonly forgetStrategy;
-    private readonly i18nStrategy;
-    private readonly syncStrategy;
-    private readonly classifiedStrategy;
+    /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
+     *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
+    get cargoStrategy(): CargoStrategy;
     /** Per-vault guard registry; `null` until `_initGuards()` runs (or for vaults that never register
      *  one) — the runtime class is dynamic-imported on demand to keep it out of the floor bundle. */
     private guardRegistry;
@@ -177,7 +133,7 @@ export declare class Vault {
      * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
      */
     readonly custody: CustodyApi;
-    /** Re-derives an UnlockedKeyring from the adapter using the active user's passphrase; called by
+    /** Re-derives an UnlockedKeyring from the adapter using the active user's secret; called by
      *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
      *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
     private readonly reloadKeyring;
@@ -317,31 +273,15 @@ export declare class Vault {
          * `undefined` => every `collection.blob(id)` throws with a pointer
          * at `@noy-db/hub/blobs`.
          */
-        blobStrategy?: BlobStrategy | undefined;
+        /**
+         * Every opt-in service, already resolved by `createNoydb` (#838). Not
+         * optional: a Vault cannot be built without it, which is what makes the
+         * partially-populated construction path of #834 unrepresentable.
+         */
+        strategies: StrategyBag;
         objectStore?: ObjectProjection | undefined;
-        archiveStrategy?: ArchiveStrategy | undefined;
-        indexStrategy?: IndexStrategy | undefined;
-        lazyStrategy?: LazyStrategy | undefined;
-        aggregateStrategy?: AggregateStrategy | undefined;
-        crdtStrategy?: CrdtStrategy | undefined;
-        tiersStrategy?: TiersStrategy | undefined;
-        searchStrategy?: SearchStrategy | undefined;
-        cargoStrategy?: CargoStrategy | undefined;
-        brokerStrategy?: BrokerStrategy | undefined;
-        consentStrategy?: ConsentStrategy | undefined;
-        periodsStrategy?: PeriodsStrategy | undefined;
-        shadowStrategy?: ShadowStrategy | undefined;
-        historyStrategy?: HistoryStrategy | undefined;
-        i18nStrategy?: I18nStrategy | undefined;
-        syncStrategy?: SyncStrategy | undefined;
-        guardStrategies?: ReadonlyArray<GuardStrategyHandleAny> | undefined;
+        guardStrategies?: ReadonlyArray<GuardStrategyAny> | undefined;
         numberingConfigs?: ReadonlyArray<DeferredNumberingConfig> | undefined;
-        forgetStrategy?: ForgetStrategy | undefined;
-        attestationStrategy?: AttestationStrategy | undefined;
-        classifiedStrategy?: ClassifiedStrategy | undefined;
-        sealedRecordStrategy?: SealedRecordStrategy | undefined;
-        portabilityStrategy?: PortabilityStrategy | undefined;
-        sequenceStrategy?: SequenceStrategy | undefined;
         /** Vault-level descriptive metadata — set once at construction (first-wins). */
         meta?: VaultMeta | undefined;
     });
@@ -386,131 +326,7 @@ export declare class Vault {
     /** Assembles {@link ViaReconcileVaultCtx} — the plain structural bag the #664 `via/reconcile.ts`
      *  dispatch reads/writes — from this vault's OWN privates, rather than passing `this` itself. */
     private _viaReconcileCtx;
-    collection<T, S extends keyof T & string = never, Q extends keyof T & string = never, M extends keyof T & string = never>(collectionName: string, options?: {
-        indexes?: readonly IndexDefFor<IndexFieldName<T, S, Q>>[];
-        /** — auto-reconcile policy for persisted-index drift. */
-        reconcileOnOpen?: 'off' | 'dry-run' | 'auto';
-        prefetch?: boolean;
-        cache?: CacheOptions;
-        schema?: StandardSchemaV1<unknown, T>;
-        refs?: Record<string, RefDescriptor>;
-        /** — declare i18nText fields for locale-aware reads. */
-        i18nFields?: Record<string, I18nTextDescriptor>;
-        /** — embedding config for write-time vector derivation + semantic retrieval. */
-        embeddings?: EmbeddingDescriptor;
-        /** — string fields exposed to client-side `retrieve()`. */
-        textIndexes?: readonly IndexFieldName<T, S>[];
-        /** — pre-build the lexical index on open (eager-only). */
-        warmIndexOnOpen?: boolean;
-        /** — persist the lexical index as an opaque encrypted blob at `_ftindex/<name>`. */
-        textIndexPersist?: boolean;
-        /** — declare dictKey / staticDict fields for label resolution on reads. */
-        dictKeyFields?: Record<string, DictKeyDescriptor | StaticDictDescriptor>;
-        /** — declare lookup() / enumOf() / dict() fields (#650 Task 2 — the 'lookup' via binding's three tiers). */
-        lookupFields?: Record<string, LookupDescriptor>;
-        /** Consumer-neutral per-field descriptors (label/unit/semanticType/sensitivity…). See collection.describe(). */
-        fieldMeta?: Record<string, FieldMeta>;
-        /** The collection's own descriptive metadata (label/description/icon). See collection.describe(). */
-        meta?: CollectionMeta;
-        /** — declare money() fields for currency-safe decimal storage/formatting. */
-        moneyFields?: MoneyFieldsOpt<T, M>;
-        viaFields?: Record<string, ViaFieldSpec>;
-        /** — declare computed scalar fields, evaluated on write (schema-owned). Each entry may be
-         *  a plain `(record) => value` function, OR `{ fn, deps }` to declare source fields for
-         *  taint propagation (#638 Task 7 — supersedes the retired `computedDeps` option). */
-        computed?: ComputedFields<T>;
-        /** — declare classified() sensitive-field descriptors. See the classified-fields spec. */
-        classifiedFields?: Record<string, ClassifiedEntry>;
-        /** — per-collection conflict resolution policy. */
-        conflictPolicy?: ConflictPolicy<T>;
-        /** — CRDT mode for collaborative editing without conflicts. */
-        crdt?: CrdtMode;
-        /**
-         * declare deterministic-encryption fields for blind
-         * equality search. See `Collection` constructor docs for the full
-         * trade-off. Requires `acknowledgeDeterministicRisk: true`.
-         */
-        deterministicFields?: readonly IndexFieldName<T, S>[];
-        /** — explicit ack that deterministic encryption leaks equality. */
-        acknowledgeDeterministicRisk?: boolean;
-        /** — explicit ack for the classified `equatable` knob (R8 door). Required
-         *  when any classified field declares `equatable: true`. */
-        acknowledgeEquatableRisk?: boolean;
-        /**
-         * — structural group-encryption. Fields sealed into their own
-         * `_sealed[field]` envelope slot (per-field key), kept out of the open
-         * `_data` blob. Default-off; byte-identical output when absent.
-         */
-        sensitive?: SensitiveOpt<T, S>;
-        /**
-         * — per-record content-encryption keys. When `true`, every record
-         * body is encrypted under a fresh per-record CEK wrapped under the
-         * collection DEK (`_cek`), stable across versions. Foundation for
-         * per-record erasure / record-scoped sealing. Off by
-         * default; non-adopting collections take the legacy path unchanged.
-         */
-        perRecordKeys?: boolean;
-        satelliteOf?: string;
-        fields?: readonly string[];
-        joined?: string;
-        /**
-         * Per-record provenance tracking. When `true`, `put()` calls that
-         * supply a `source` option stamp `_source` / `_sourceTs` onto the
-         * unencrypted envelope metadata. Off by default.
-         */
-        provenance?: boolean;
-        /**
-         * declarative blob retention / TTL policy per slot
-         * name. Values are `{ retainDays?, evictWhen? }`. Evaluated only
-         * when `vault.compact()` runs.
-         */
-        blobFields?: BlobFieldsConfig<T>;
-        blobTierPolicy?: 'isolate' | 'dedup';
-        /** — declarative record archival policy: `{ archiveWhen, legalHold? }`. Evaluated when `vault.archive()` runs. */
-        archive?: ArchivePolicy<T>;
-        /** — declared tiers for this collection. */
-        tiers?: readonly number[];
-        /**  — how lower-tier reads see above-tier records. */
-        tierMode?: TierMode;
-        /**
-         * Opt-in persisted JSON Schema. When `true` AND a Zod `schema` is
-         * provided, hub derives a JSON Schema via `zod-to-json-schema`
-         * (optional peer-dep) and writes an encrypted snapshot to
-         * `_schemas/<collectionName>`. Re-runs on every open; hash-skip
-         * avoids write churn when the schema is unchanged.
-         *
-         * Default: `false`. Non-Zod Standard Schema validators receive a
-         * stub envelope flagging the kind without a JSON Schema body.
-         *
-         * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
-         */
-        persistJsonSchema?: boolean;
-        /**
-         * Ordered schema-update strategies. On a detected schema
-         * change, evaluated in order; the first non-`allow` decision wins.
-         * A `reject` is enforced at the write path (`put`/`delete` throw).
-         * Requires `persistJsonSchema: true` (detection needs the baseline).
-         */
-        schemaUpdate?: readonly SchemaUpdateStrategy[];
-        /** — declare the per-field schema for document attestation (issue side). */
-        attestation?: AttestationFieldSchema;
-        /**
-         * Per-collection history & tamper-ledger scoping. Overrides the
-         * vault-wide `history` config for THIS collection only (wholesale, not
-         * merged). `enabled: false` suppresses per-record snapshots for this
-         * collection; `ledger: false` excludes its writes from the vault-wide
-         * hash-chained tamper ledger. Lets you confine version snapshots +
-         * tamper-evidence to the few collections where they carry legal weight,
-         * without paying snapshot + ledger-entry-per-write across operational /
-         * derived collections. Defaults to the vault-wide `history` config.
-         */
-        historyConfig?: HistoryConfig;
-        /**
-         * Opt-in: keep the working set encrypted in RAM, decrypting on read (future phase).
-         * Default false — the working set is plaintext.
-         */
-        ramCiphertext?: boolean;
-    }): Collection<T, S, Q, M>;
+    collection<T, O extends CollectionShape<T> = Record<never, never>>(collectionName: string, options?: OpenCollectionOptions<T, SensitiveOf<T, O>, IndexedOf<T, O>, MoneyOf<T, O>>): Collection<T, SensitiveOf<T, O>, IndexedOf<T, O>, MoneyOf<T, O>>;
     /** Full-record handle for a satellite pair registered with `joined:` (spec #591). Narrow type — not a Collection. */
     joined<T extends Record<string, unknown>>(name: string): JoinedHandle<T>;
     /**
@@ -750,7 +566,7 @@ export declare class Vault {
      * is re-keyed for distinct recipients.
      *
      * Each recipient becomes its own `KeyringFile` sealed with that
-     * recipient's passphrase. The DEKs wrapped into each slot are
+     * recipient's secret. The DEKs wrapped into each slot are
      * exactly those the recipient's role + permissions justify, and
      * never wider than the source keyring's own DEK set
      * (privilege-escalation check).
@@ -1022,7 +838,7 @@ export declare class Vault {
      * stay decryptable; migrate, then re-forget) and `blobResidueCollections` (blob attachments, keyed
      * off a separate `_blob` DEK, out of scope here).
      *
-     * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
+     * @throws ForgetStrategyNotConfiguredError when no `withForget` was set.
      */
     forget(subjectId: string): Promise<ForgetResult>;
     /**
@@ -1102,7 +918,7 @@ export declare class Vault {
      * accessor `_getReadOnlyFacade()` (called from the tx amendment
      * runner) stays synchronous.
      */
-    _initGuards(handles: ReadonlyArray<GuardStrategyHandleAny>): Promise<void>;
+    _initGuards(handles: ReadonlyArray<GuardStrategyAny>): Promise<void>;
     /**
      * @internal — The gate handler in Noydb.#registerGuardGate calls into
      * this. Returns `null` for vaults that never registered any guard
@@ -1118,7 +934,7 @@ export declare class Vault {
      * bundle for consumers that don't use derivations. Throws
      * `DerivationCycleError` if a cycle is detected after registration.
      */
-    _initDerivations(handles: ReadonlyArray<DerivationStrategyHandle>): Promise<void>;
+    _initDerivations(handles: ReadonlyArray<DerivationStrategy>): Promise<void>;
     /**
      * @internal — consumed by `Collection.put` at write-time. Returns
      * `null` for vaults that never registered any derivation strategy.
@@ -1133,7 +949,7 @@ export declare class Vault {
      * the MV service out of the floor bundle (mirrors the derivation lazy-import pattern).
      * Throws `MaterializedViewCycleError` if a cycle is detected.
      */
-    _initMaterializedViews(handles: ReadonlyArray<MaterializedViewStrategyHandle>): Promise<void>;
+    _initMaterializedViews(handles: ReadonlyArray<MaterializedViewStrategy>): Promise<void>;
     /**
      * @internal — consumed by `Collection.put` at write-time. Returns
      * `null` for vaults that never registered any MV strategy.
@@ -1145,7 +961,7 @@ export declare class Vault {
      * validates against the MV registry for name/base/overlay collisions.
      * Throws on validation failure.
      */
-    _initOverlayedViews(handles: ReadonlyArray<OverlayedViewStrategyHandle>): Promise<void>;
+    _initOverlayedViews(handles: ReadonlyArray<OverlayedViewStrategy>): Promise<void>;
     /**
      * @internal — consumed by `Vault.collection()`. Returns `null` for
      * vaults with no overlays registered.
@@ -1519,10 +1335,6 @@ export declare class Vault {
     getCover(opts?: {
         readonly locale?: string;
     }): Promise<Cover | undefined>;
-    /** @deprecated Use {@link Vault.getCover} (#799 rename). */
-    getPublicEnvelope(opts?: {
-        readonly locale?: string;
-    }): Promise<Cover | undefined>;
     /**
      * Dump vault as a verifiable encrypted JSON backup string.
      *

package/dist/kernel/via/dispatch.d.ts

@@ -192,4 +192,11 @@ export declare function forgetDerivedFanout(vault: VaultLike, ref: {
     readonly collection: string;
     readonly id: string;
 }, envelope: EncryptedEnvelope | null, stats: ForgetFanoutStats, lookupCompareKeys: ReadonlyMap<string, string | undefined>): Promise<void>;
+/**
+ * Value-equality for a single self-write reverse-denorm field. Scalars
+ * compare by identity; objects by canonical JSON (denorm values should be
+ * deterministically shaped). Used as the cycle guard — when every denorm
+ * field already matches, no write is issued and the self-write recursion ends.
+ */
+export declare function selfWriteFieldEqual(a: unknown, b: unknown): boolean;
 export {};

package/dist/{ledger-PTK7XZYT.js → ledger-6XBEVWYP.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-VRBTNCM4.js";
+} from "./chunk-ABS7FMMD.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-WQIYTNJV.js";
-import "./chunk-W4TCUGQR.js";
-import "./chunk-A4FXFAKF.js";
-import "./chunk-IY23KFNZ.js";
-import "./chunk-N6WF5PKC.js";
-import "./chunk-6HY2X62D.js";
+} from "./chunk-IXTSNGYY.js";
+import "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-HOONYZY2.js";
-import "./chunk-VCTXU4AT.js";
-import "./chunk-W2OG6JOL.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-QBAC3GXA.js";
+import "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LEDGER_COLLECTION,
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-PTK7XZYT.js.map
+//# sourceMappingURL=ledger-6XBEVWYP.js.map

package/dist/liberate-CYUOS4NC.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-H2GPHUZD.js";
+import "./chunk-FQZ6XTQ7.js";
+import "./chunk-I5GEJX3R.js";
+import "./chunk-X45JYIAY.js";
+import "./chunk-LNPUSMZL.js";
+import "./chunk-TUXQSFHZ.js";
+import "./chunk-BLCWSJLN.js";
+import "./chunk-JJZGIE4U.js";
+import "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-QBAC3GXA.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-CYUOS4NC.js.map