@noy-db/hub 0.4.0-pre.1 → 0.4.0-pre.11

package/dist/indexing/index.js

@@ -2,17 +2,18 @@ import {
   COMPOSITE_DELIMITER,
   IDX_PREFIX,
   LazyQuery,
+  NO_INDEXING,
   PersistedCollectionIndex,
   compositeKey,
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-VEALDPHW.js";
+} from "../chunk-L3YYLT4E.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-W2OG6JOL.js";
+import "../chunk-QZWTRENR.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/indexing/active.ts
@@ -68,6 +69,7 @@ export {
   CollectionIndexes,
   IDX_PREFIX,
   LazyQuery,
+  NO_INDEXING,
   PersistedCollectionIndex,
   compositeKey,
   decodeIdxId,

package/dist/indexing/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-lookup/indexing/active.ts"],"sourcesContent":["/**\n * Active indexing strategy factory. Calling `withIndexing()` returns\n * an `IndexStrategy` whose `createState` constructs a real\n * `CollectionIndexes` (eager) or `PersistedCollectionIndex` (lazy)\n * per Collection, depending on the collection's `prefetch` mode and\n * its declared `IndexDef[]`.\n *\n * This module is only reachable through the `@noy-db/hub/indexing`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { CollectionIndexes } from './eager-indexes.js'\nimport type { IndexDef } from './eager-indexes.js'\nimport { PersistedCollectionIndex } from './persisted-indexes.js'\nimport type { IndexStrategy, IndexState } from './strategy.js'\n\n/**\n * Build the default indexing strategy. Pass into\n * `createNoydb({ indexStrategy: withIndexing() })` to light up the\n * eager-mode `==/in` fast-path on `.query()` and the full lazy-mode\n * `.lazyQuery()` + rebuild / reconcile / auto-reconcile surface.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withIndexing } from '@noy-db/hub/indexing'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   indexStrategy: withIndexing(),\n * })\n * ```\n */\nexport function withIndexing(): IndexStrategy {\n  return {\n    createState({ defs, lazy }) {\n      if (lazy) {\n        const persisted = new PersistedCollectionIndex()\n        declareAll(persisted, defs)\n        return makeLazyState(persisted)\n      }\n      const eager = new CollectionIndexes()\n      for (const def of defs) {\n        if (typeof def === 'string') {\n          eager.declare(def)\n        } else if (Array.isArray(def)) {\n          for (const f of def as readonly string[]) eager.declare(f)\n        } else {\n          for (const f of (def as { fields: readonly string[] }).fields) eager.declare(f)\n        }\n      }\n      return makeEagerState(eager)\n    },\n  }\n}\n\nfunction declareAll(persisted: PersistedCollectionIndex, defs: readonly IndexDef[]): void {\n  for (const def of defs) {\n    if (typeof def === 'string') {\n      persisted.declare(def)\n    } else {\n      const fields = Array.isArray(def) ? (def as readonly string[]) : (def as { fields: readonly string[] }).fields\n      // #698: decompose a composite into its component single-field indexes\n      // (like the eager branch above), so a composite-only declaration still\n      // provides the single-field driver the #696 Via-covered fall-through\n      // and single-field queries need. The composite mirror is kept for the\n      // multi-field fast path.\n      for (const f of fields) persisted.declare(f)\n      persisted.declareComposite(fields)\n    }\n  }\n}\n\nfunction makeEagerState(eager: CollectionIndexes): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => eager,\n    getPersistedIndexes: () => null,\n  }\n}\n\nfunction makeLazyState(persisted: PersistedCollectionIndex): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => null,\n    getPersistedIndexes: () => persisted,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkCO,SAAS,eAA8B;AAC5C,SAAO;AAAA,IACL,YAAY,EAAE,MAAM,KAAK,GAAG;AAC1B,UAAI,MAAM;AACR,cAAM,YAAY,IAAI,yBAAyB;AAC/C,mBAAW,WAAW,IAAI;AAC1B,eAAO,cAAc,SAAS;AAAA,MAChC;AACA,YAAM,QAAQ,IAAI,kBAAkB;AACpC,iBAAW,OAAO,MAAM;AACtB,YAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAM,QAAQ,GAAG;AAAA,QACnB,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,qBAAW,KAAK,IAA0B,OAAM,QAAQ,CAAC;AAAA,QAC3D,OAAO;AACL,qBAAW,KAAM,IAAsC,OAAQ,OAAM,QAAQ,CAAC;AAAA,QAChF;AAAA,MACF;AACA,aAAO,eAAe,KAAK;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,WAAqC,MAAiC;AACxF,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAU,QAAQ,GAAG;AAAA,IACvB,OAAO;AACL,YAAM,SAAS,MAAM,QAAQ,GAAG,IAAK,MAA6B,IAAsC;AAMxG,iBAAW,KAAK,OAAQ,WAAU,QAAQ,CAAC;AAC3C,gBAAU,iBAAiB,MAAM;AAAA,IACnC;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAsC;AAC5D,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,WAAiD;AACtE,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-lookup/indexing/active.ts"],"sourcesContent":["/**\n * Active indexing strategy factory. Calling `withIndexing()` returns\n * an `IndexingStrategy` whose `createState` constructs a real\n * `CollectionIndexes` (eager) or `PersistedCollectionIndex` (lazy)\n * per Collection, depending on the collection's `prefetch` mode and\n * its declared `IndexDef[]`.\n *\n * This module is only reachable through the `@noy-db/hub/indexing`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { CollectionIndexes } from './eager-indexes.js'\nimport type { IndexDef } from './eager-indexes.js'\nimport { PersistedCollectionIndex } from './persisted-indexes.js'\nimport type { IndexingStrategy, IndexState } from './strategy.js'\n\n/**\n * Build the default indexing strategy. Pass into\n * `createNoydb({ indexingStrategy: withIndexing() })` to light up the\n * eager-mode `==/in` fast-path on `.query()` and the full lazy-mode\n * `.lazyQuery()` + rebuild / reconcile / auto-reconcile surface.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withIndexing } from '@noy-db/hub/indexing'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   indexingStrategy: withIndexing(),\n * })\n * ```\n */\nexport function withIndexing(): IndexingStrategy {\n  return {\n    createState({ defs, lazy }) {\n      if (lazy) {\n        const persisted = new PersistedCollectionIndex()\n        declareAll(persisted, defs)\n        return makeLazyState(persisted)\n      }\n      const eager = new CollectionIndexes()\n      for (const def of defs) {\n        if (typeof def === 'string') {\n          eager.declare(def)\n        } else if (Array.isArray(def)) {\n          for (const f of def as readonly string[]) eager.declare(f)\n        } else {\n          for (const f of (def as { fields: readonly string[] }).fields) eager.declare(f)\n        }\n      }\n      return makeEagerState(eager)\n    },\n  }\n}\n\nfunction declareAll(persisted: PersistedCollectionIndex, defs: readonly IndexDef[]): void {\n  for (const def of defs) {\n    if (typeof def === 'string') {\n      persisted.declare(def)\n    } else {\n      const fields = Array.isArray(def) ? (def as readonly string[]) : (def as { fields: readonly string[] }).fields\n      // #698: decompose a composite into its component single-field indexes\n      // (like the eager branch above), so a composite-only declaration still\n      // provides the single-field driver the #696 Via-covered fall-through\n      // and single-field queries need. The composite mirror is kept for the\n      // multi-field fast path.\n      for (const f of fields) persisted.declare(f)\n      persisted.declareComposite(fields)\n    }\n  }\n}\n\nfunction makeEagerState(eager: CollectionIndexes): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => eager,\n    getPersistedIndexes: () => null,\n  }\n}\n\nfunction makeLazyState(persisted: PersistedCollectionIndex): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => null,\n    getPersistedIndexes: () => persisted,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkCO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,EAAE,MAAM,KAAK,GAAG;AAC1B,UAAI,MAAM;AACR,cAAM,YAAY,IAAI,yBAAyB;AAC/C,mBAAW,WAAW,IAAI;AAC1B,eAAO,cAAc,SAAS;AAAA,MAChC;AACA,YAAM,QAAQ,IAAI,kBAAkB;AACpC,iBAAW,OAAO,MAAM;AACtB,YAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAM,QAAQ,GAAG;AAAA,QACnB,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,qBAAW,KAAK,IAA0B,OAAM,QAAQ,CAAC;AAAA,QAC3D,OAAO;AACL,qBAAW,KAAM,IAAsC,OAAQ,OAAM,QAAQ,CAAC;AAAA,QAChF;AAAA,MACF;AACA,aAAO,eAAe,KAAK;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,WAAqC,MAAiC;AACxF,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAU,QAAQ,GAAG;AAAA,IACvB,OAAO;AACL,YAAM,SAAS,MAAM,QAAQ,GAAG,IAAK,MAA6B,IAAsC;AAMxG,iBAAW,KAAK,OAAQ,WAAU,QAAQ,CAAC;AAC3C,gBAAU,iBAAiB,MAAM;AAAA,IACnC;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAsC;AAC5D,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,WAAiD;AACtE,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;","names":[]}

package/dist/introspection/index.js

@@ -0,0 +1,28 @@
+import {
+  dumpVaultSchema
+} from "../chunk-3V3XR4S4.js";
+import {
+  applyListProjection
+} from "../chunk-VG2ZSFYD.js";
+import {
+  jsonSchemaToFields
+} from "../chunk-VYYM3MEN.js";
+import "../chunk-6ZNSB3H6.js";
+import "../chunk-Y2NBBT6K.js";
+import "../chunk-DMH3VZU5.js";
+import "../chunk-G2JUIDFA.js";
+import "../chunk-W3L64Y3J.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-AKKRXT23.js";
+import "../chunk-QBAC3GXA.js";
+import "../chunk-QZWTRENR.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  applyListProjection,
+  dumpVaultSchema,
+  jsonSchemaToFields
+};
+//# sourceMappingURL=index.js.map

package/dist/issue-FCKN5O6C.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-DZ2JXHWK.js";
+import "./chunk-CI32CAFS.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-QBAC3GXA.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-FCKN5O6C.js.map

package/dist/kernel/best-effort-revert.d.ts

@@ -30,7 +30,7 @@
  *
  * @internal — implementation-sharing only, not part of the public surface.
  */
-import type { EncryptedEnvelope } from './types.js';
+import type { EncryptedEnvelope, StoreCapabilities, TxOp } from './types.js';
 /** One already-executed write a revert pass needs to unwind. */
 export interface BestEffortRevertLeg {
     readonly vaultName: string;
@@ -43,6 +43,14 @@ export interface BestEffortRevertLeg {
 export interface BestEffortRevertAdapter {
     put(vaultName: string, collectionName: string, id: string, envelope: EncryptedEnvelope): Promise<void>;
     delete(vaultName: string, collectionName: string, id: string): Promise<void>;
+    /**
+     * Optional storage-layer transaction (#886). When the store declares
+     * `txAtomic`, the whole revert is submitted as ONE operation instead of a
+     * per-leg loop, so a crash mid-revert can no longer leave the vault
+     * half-unwound.
+     */
+    tx?(ops: readonly TxOp[]): Promise<void>;
+    readonly capabilities?: StoreCapabilities;
 }
 /**
  * Revert `executed` in reverse order via the raw adapter, best-effort.

package/dist/kernel/collection-config.d.ts

@@ -17,6 +17,7 @@
  * signature can't be exposed via a method without breaking `Collection<T>`
  * assignability to `Collection<unknown>`).
  */
+import type { StrategyBag } from '../port/with/strategies.js';
 import type { NoydbStore, ConflictPolicy, CollectionConflictResolver, HistoryConfig, TierMode, CrossTierAccessEvent, VdigFieldPolicy } from './types.js';
 import type { EnclaveKey } from './enclave/index.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
@@ -29,24 +30,15 @@ import type { SchemaFenceController } from '../with-shape/schema-update/fence-co
 import type { StandardSchemaV1 } from './schema.js';
 import type { LedgerStore } from '../with-commit/history/ledger/index.js';
 import type { CrdtMode } from '../with-commit/crdt/crdt.js';
-import type { CrdtStrategy } from './types.js';
-import { type HistoryStrategy } from '../with-commit/history/strategy.js';
-import { type I18nStrategy } from '../port/with/i18n-strategy.js';
-import { type SyncStrategy } from '../with-party/team/sync-strategy.js';
-import { type BlobStrategy } from '../port/with/blob-strategy.js';
-import { type AggregateStrategy } from '../with-lookup/aggregate/strategy.js';
-import { type TiersStrategy } from '../with-audit/tiers/strategy.js';
-import { type SearchStrategy } from '../with-lookup/search/strategy.js';
 import type { ObjectProjection } from '../with-shape/blobs/object-projection.js';
 import type { BlobFieldsConfig } from '../with-shape/blobs/blob-compaction.js';
-import type { IndexStrategy } from '../with-lookup/indexing/strategy.js';
 import type { IndexDef } from '../with-lookup/indexing/eager-indexes.js';
 import type { I18nTextDescriptor, DictKeyDescriptor, StaticDictDescriptor, DictionaryHandle } from '../port/with/i18n-strategy.js';
 import type { LookupDescriptor, MaterializedBacking } from '../port/with/lookup-strategy.js';
 import type { ComputedFields, ComputedFn, ComputedFieldEntry } from '../with-formula/computed/index.js';
 import type { RollupDeleteIntent } from './via/dispatch.js';
 import '../port/with/computed-strategy.js';
-import { type ClassifiedEntry, type ResolvedClassified, type ClassifiedGuardCtx, type ClassifiedStrategy, type ClassifiedViaConfig } from '../port/with/classified-strategy.js';
+import { type ClassifiedEntry, type ResolvedClassified, type ClassifiedGuardCtx, type ClassifiedViaConfig } from '../port/with/classified-strategy.js';
 import type { FieldRef, Grain } from './via/graph.js';
 import type { FieldMeta } from '../with-shape/introspection/field-meta.js';
 import type { CollectionMeta } from '../with-shape/introspection/meta.js';
@@ -60,7 +52,6 @@ import type { TxContext } from '../with-commit/tx/transaction.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
 import type { MVQueryContext } from '../with-formula/materialized-views/types.js';
 import type { Collection, OnDirtyCallback, CacheOptions } from './collection.js';
-import type { LazyStrategy } from '../port/with/lazy-strategy.js';
 import { ViaPipeline } from './via/pipeline.js';
 import { type ViaBinding, type ViaDescriptor } from './via/index.js';
 import { type ViaFieldSpec } from './via/compose.js';
@@ -74,6 +65,14 @@ export interface CollectionOpts<T> {
     name: string;
     keyring: UnlockedKeyring;
     encrypted: boolean;
+    /**
+     * Every opt-in service, resolved once by `createNoydb` (#838). Replaces the
+     * eleven optional `*Strategy` fields this interface used to declare, each of
+     * which re-applied a `?? NO_*` default that had already been applied
+     * upstream. Each entry is a tree-shake seam: an un-opted-in service holds
+     * its `NO_*` stub, so the real machinery never reaches the bundle.
+     */
+    strategies: StrategyBag;
     /**
      * Opt-in: keep the working set encrypted in RAM, decrypting on read (future phase).
      * Default false — the working set is plaintext.
@@ -113,13 +112,6 @@ export interface CollectionOpts<T> {
      * back to an unconditional store read on re-create.
      */
     tabCoordinated?: (() => boolean) | undefined;
-    /**
-     * tree-shake seam. When omitted, `collection.blob(id)` throws
-     * with a pointer at the `@noy-db/hub/blobs` subpath. When set (via
-     * `createNoydb({ blobStrategy: blobs() })`), blob storage is live.
-     * `@internal` by virtue of `BlobStrategy` being `@internal`.
-     */
-    blobStrategy?: BlobStrategy | undefined;
     objectStore?: ObjectProjection | undefined;
     blobFields?: BlobFieldsConfig | undefined;
     /**
@@ -132,26 +124,6 @@ export interface CollectionOpts<T> {
      * decryptable at rest under the flat `_blob` DEK (documented residue).
      */
     blobTierPolicy?: 'isolate' | 'dedup' | undefined;
-    aggregateStrategy?: AggregateStrategy | undefined;
-    crdtStrategy?: CrdtStrategy | undefined;
-    /**
-     * tree-shake seam — strategy for optional history/ledger/
-     * time-machine. When omitted, history snapshots and ledger appends
-     * become silent no-ops (data still writes); the read APIs
-     * (`history`, `getVersion`, `revert`, `diff`, `clearHistory`,
-     * `pruneRecordHistory`) throw with a pointer at `@noy-db/hub/history`.
-     */
-    historyStrategy?: HistoryStrategy | undefined;
-    i18nStrategy?: I18nStrategy | undefined;
-    syncStrategy?: SyncStrategy | undefined;
-    /**
-     * tree-shake seam. When omitted, indexing is off for this
-     * collection — every `.lazyQuery()` call throws, `.rebuildIndexes()`
-     * is a no-op, and `indexes: [...]` declarations are ignored. Enable
-     * by passing `withIndexing()` from `@noy-db/hub/indexing` at
-     * `createNoydb` time.
-     */
-    indexStrategy?: IndexStrategy | undefined;
     indexes?: IndexDef[] | undefined;
     /**
      * Auto-reconcile behavior for persisted-index drift on lazy-mode
@@ -183,12 +155,6 @@ export interface CollectionOpts<T> {
      * unbounded lazy cache defeats the purpose.
      */
     cache?: CacheOptions | undefined;
-    /**
-     * Lazy service seam (#267) — supplies the bounded-LRU working-set cache
-     * when `prefetch: false`. Omitted → the deprecated IMPLICIT_LAZY
-     * back-compat default (identical behavior + one-time warn).
-     */
-    lazyStrategy?: LazyStrategy | undefined;
     /**
      * Optional Standard Schema v1 validator (Zod, Valibot, ArkType,
      * Effect Schema, etc.). When set, every `put()` is validated before
@@ -262,7 +228,7 @@ export interface CollectionOpts<T> {
     classifiedFields?: Record<string, ClassifiedEntry> | undefined;
     /**
      * The forget-cascade subject key for this collection (from
-     * `withForgetCascade({ subjects })`), plumbed by the Vault. Consumed by the
+     * `withForget({ subjects })`), plumbed by the Vault. Consumed by the
      * classified refusal matrix (R4: a digest-only field cannot be the subject key).
      */
     subjectKeyField?: string | undefined;
@@ -274,8 +240,6 @@ export interface CollectionOpts<T> {
      * `undefined` when no forget strategy declares this collection (no-op).
      */
     addSubjectRef?: ((id: string, record: unknown) => Promise<void>) | undefined;
-    /** — tree-shake seam for `collection.reveal()`. Defaults to `NO_CLASSIFIED`. */
-    classifiedStrategy?: ClassifiedStrategy | undefined;
     /**
      * async callback that resolves a dict key to its label
      * for a given locale. Provided by the Vault.
@@ -433,20 +397,6 @@ export interface CollectionOpts<T> {
      * throw). Tier 0 is implicit and always available.
      */
     tiers?: readonly number[] | undefined;
-    /**
-     * tree-shake seam — strategy for the collection-level tier operations
-     * (`putAtTier`/`getAtTier`/`listAtTier`/`elevate`/`demote`). When omitted,
-     * every tier operation throws `TiersNotEnabledError`. Enable by passing
-     * `withTiers()` from `@noy-db/hub/tiers` at `createNoydb` time.
-     */
-    tiersStrategy?: TiersStrategy | undefined;
-    /**
-     * Search / retrieval capability strategy. When omitted, a collection's
-     * `search`/`retrieve`/`similarTo`/`warmIndex`/`flushIndex` methods and the
-     * embedding write-hook throw `SearchNotEnabledError`. Enable by passing
-     * `withSearch()` from `@noy-db/hub` at `createNoydb` time.
-     */
-    searchStrategy?: SearchStrategy | undefined;
     /**
      * what a lower-tier caller sees for above-tier
      * records. Default `'invisibility'`.
@@ -702,14 +652,9 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     writeHooks: WriteHookRegistry | undefined;
     subsystemBus: ServiceBus | undefined;
     activeTxId: (() => string | null) | undefined;
-    blobStrategy: BlobStrategy;
+    strategies: StrategyBag;
     objectStore: ObjectProjection | undefined;
     blobFields: BlobFieldsConfig | undefined;
-    aggregateStrategy: AggregateStrategy;
-    crdtStrategy: CrdtStrategy;
-    historyStrategy: HistoryStrategy;
-    i18nStrategy: I18nStrategy;
-    syncStrategy: SyncStrategy;
     reconcileOnOpen: "auto" | "off" | "dry-run";
     getDEK: (collectionName: string) => Promise<EnclaveKey>;
     onDirty: OnDirtyCallback | undefined;
@@ -742,7 +687,6 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     moneyFields: Record<string, ViaDescriptor> | undefined;
     classified: ResolvedClassified | undefined;
     classifiedGuardCtx: ClassifiedGuardCtx;
-    classifiedStrategy: ClassifiedStrategy;
     computed: ComputedFields | undefined;
     computedEdges: readonly GraphEdge[];
     viaDepsEdges: readonly GraphEdge[];
@@ -794,8 +738,6 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
         collectDelete(collection: string, id: string, intents: readonly RollupDeleteIntent[]): void;
     } | undefined;
     tiers: Set<number> | null;
-    tiersStrategy: TiersStrategy;
-    searchStrategy: SearchStrategy;
     tierMode: TierMode;
     blobTierPolicy: "isolate" | "dedup";
     onCrossTierAccess: ((event: CrossTierAccessEvent) => void) | undefined;

package/dist/kernel/collection.d.ts

@@ -24,7 +24,7 @@ import type { RetrieveOptions, RetrieveHit } from '../with-lookup/search/retriev
 import { type CollectionDescription, type DescribeOptions } from '../with-shape/introspection/describe.js';
 import type { CollectionConfig } from '../with-shape/introspection/types.js';
 import { type LruStats } from './cache/index.js';
-import type { PresenceHandle } from '../with-party/team/presence.js';
+import type { PresenceHandle } from '../with-sync/presence.js';
 import type { BlobSet } from '../with-shape/blobs/blob-set.js';
 import type { TxContext } from '../with-commit/tx/transaction.js';
 import { type CollectionOpts } from './collection-config.js';
@@ -96,24 +96,19 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /** True when the caller explicitly provided a `historyConfig` option (vs. inheriting the vault default). */
     private readonly historyConfigExplicit;
     /**
-     * tree-shake seam — the strategy that backs `collection.blob(id)`.
-     * Defaults to `NO_BLOBS`, a ~10-line stub that throws with an actionable
-     * message. Consumers opt into real blob storage by importing
-     * `{ blobs }` from `@noy-db/hub/blobs` and passing the returned
-     * strategy to `createNoydb({ blobStrategy: blobs() })`. With the
-     * default stub, none of the BlobSet / chunk / MIME-magic machinery
-     * reaches the bundle.
+     * Every opt-in service, resolved once by `createNoydb` (#838) and shared by
+     * reference with the owning `Vault` and `Noydb`.
+     *
+     * Each entry is a tree-shake seam. An un-opted-in service resolves to its
+     * `NO_*` stub — a tiny module that throws with an actionable message —
+     * so, for example, none of the BlobSet / chunk / MIME-magic machinery
+     * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
+     * passes `blobsStrategy: blobs()` to `createNoydb`.
      */
-    private readonly blobStrategy;
+    private readonly strategies;
     private readonly objectStore;
     private readonly blobFields;
     private readonly blobTierPolicy;
-    private readonly aggregateStrategy;
-    private readonly crdtStrategy;
-    private readonly tiersStrategy;
-    private readonly searchStrategy;
-    private readonly historyStrategy;
-    private readonly syncStrategy;
     private readonly cache;
     private hydrated;
     /**
@@ -146,7 +141,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly lru;
     /**
      * tree-shake seam — per-Collection indexing state. Owned by the
-     * `IndexStrategy` passed through from `createNoydb({ indexStrategy })`.
+     * `IndexingStrategy` passed through from `createNoydb({ indexingStrategy })`.
      * Defaults to a disabled state (both accessors return null) so the
      * `CollectionIndexes` / `PersistedCollectionIndex` / `LazyQuery`
      * classes never reach the bundle when indexing is unused.
@@ -275,12 +270,6 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
     private _markerDigestOnlyCache;
     private _markerPersisted;
-    /**
-     * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
-     * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
-     * `createNoydb()` option (opt in with `withClassified()`).
-     */
-    private readonly classifiedStrategy;
     /** Async callback provided by the Vault to open a dynamic dictionary handle (for label-map pre-computation in the search index). Only used in `resolveDictLabelMaps()`; static dicts bypass this entirely. Mutable, assign-once — see {@link _reconcileReadState} (#671 item 1). */
     private getDictionary;
     /**
@@ -676,7 +665,6 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * right back out, defeating C6.
      */
     private _toCacheableRecord;
-    /** @internal Untracked put body — call {@link put}, not this. */
     private _putInternal;
     /**
      * Fire registered MV strategies whose dependency set includes this

package/dist/kernel/enclave/crypto.d.ts

@@ -22,7 +22,7 @@
  * ## Key lifecycle
  *
  * ```
- * passphrase + salt
+ * secret + salt
  *   └─► deriveKey()       → KEK (CryptoKey, extractable: false)
  *         └─► wrapKey()   → wrapped DEK bytes  [stored in keyring]
  *         └─► unwrapKey() → DEK (CryptoKey)    [memory only during session]
@@ -46,26 +46,26 @@
  * between barrel functions (`encrypt`/`decrypt`/`wrapKey`/`unwrapKey`/…).
  */
 export type EnclaveKey = CryptoKey;
-/** Derive a KEK from a passphrase and salt using PBKDF2-SHA256. */
-export declare function deriveKey(passphrase: string, salt: Uint8Array): Promise<CryptoKey>;
+/** Derive a KEK from a secret and salt using PBKDF2-SHA256. */
+export declare function deriveKey(secret: string, salt: Uint8Array): Promise<CryptoKey>;
 /**
- * Which AES algorithm/usage a {@link derivePassphraseKey} result is for:
+ * Which AES algorithm/usage a {@link deriveSecretKey} result is for:
  * `'aes-kw'` mints a key-wrapping key (`wrapKey`/`unwrapKey`, e.g. for
  * KEK derivation); `'aes-gcm'` mints a direct encrypt/decrypt key (e.g.
  * for the wrap-DEKs primitive in `with-party/team/wrapped-deks.ts`).
  */
-export type PassphraseKeyUsage = 'aes-kw' | 'aes-gcm';
+export type SecretKeyUsage = 'aes-kw' | 'aes-gcm';
 /**
- * Derive a non-extractable AES key from a passphrase/credential and salt
+ * Derive a non-extractable AES key from a secret/credential and salt
  * via PBKDF2-SHA256, generalizing {@link deriveKey}'s AES-KW derivation to
  * also cover AES-GCM-usage keys. Callers pin their own `iterations` and
  * `keyUsage` so an existing call site's exact parameters (and thus its
  * derived-key bytes) are preserved verbatim when migrated onto this
  * shared primitive — this is call-site consolidation, not a KDF change.
  */
-export declare function derivePassphraseKey(passphrase: string, salt: Uint8Array, params: {
+export declare function deriveSecretKey(secret: string, salt: Uint8Array, params: {
     iterations: number;
-    keyUsage: PassphraseKeyUsage;
+    keyUsage: SecretKeyUsage;
 }): Promise<CryptoKey>;
 /** Generate a random AES-256-GCM data encryption key. */
 export declare function generateDEK(): Promise<CryptoKey>;

package/dist/kernel/enclave/index.d.ts

@@ -54,10 +54,10 @@
  * every consumer regardless of which enclave is wired in. noy-db's own
  * enclave supports every group, so it never throws this error.
  */
-export type { EnclaveKey } from './crypto.js';
+export type { EnclaveKey, EncryptResult } from './crypto.js';
 export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, } from './crypto.js';
-export { deriveKey, derivePassphraseKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
-export type { PassphraseKeyUsage } from './crypto.js';
+export { deriveKey, deriveSecretKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
+export type { SecretKeyUsage } from './crypto.js';
 export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
 export type { RewrappedBody } from './record-keys/lifecycle.js';
 export { RecordCodec } from './record-keys/record-codec.js';

package/dist/kernel/errors.d.ts

@@ -10,7 +10,7 @@
  *       ├─ Crypto errors
  *       │    ├─ DecryptionError        — AES-GCM tag failure
  *       │    ├─ TamperedError          — ciphertext modified after write
- *       │    └─ InvalidKeyError        — wrong passphrase / corrupt keyring
+ *       │    └─ InvalidKeyError        — wrong secret / corrupt keyring
  *       ├─ Access errors
  *       │    ├─ NoAccessError          — no DEK for this collection
  *       │    ├─ ReadOnlyError          — ro permission, write attempted
@@ -62,7 +62,7 @@
  *       └─ Computed field errors
  *            └─ ComputedFieldError     — computed function threw during a write
  *       └─ Erasure errors
- *            └─ ForgetStrategyNotConfiguredError — vault.forget() with no withForgetCascade
+ *            └─ ForgetStrategyNotConfiguredError — vault.forget() with no withForget
  *       ├─ Sealed-record errors (record-scoped CEK sealing)
  *       │    ├─ SealedRecordExpiredError  — sealed CEK binding past expiresAt
  *       │    ├─ SealedRecordMismatchError — CEK sealed for record A used on record B
@@ -78,9 +78,9 @@
  * import { NoydbError, InvalidKeyError, ConflictError } from '@noy-db/hub'
  *
  * try {
- *   await vault.unlock(passphrase)
+ *   await vault.unlock(secret)
  * } catch (e) {
- *   if (e instanceof InvalidKeyError) { showBadPassphraseUI(); return }
+ *   if (e instanceof InvalidKeyError) { showBadSecretUI(); return }
  *   if (e instanceof NoydbError) { logToSentry(e.code, e); return }
  *   throw e  // unexpected — re-throw
  * }
@@ -125,8 +125,8 @@ export declare class DebugReservedFieldError extends NoydbError {
 /**
  * Thrown when AES-GCM decryption fails.
  *
- * The most common cause is a wrong passphrase or a corrupted ciphertext.
- * A `DecryptionError` at the wrong passphrase level is caught internally
+ * The most common cause is a wrong secret or a corrupted ciphertext.
+ * A `DecryptionError` at the wrong secret level is caught internally
  * and re-thrown as `InvalidKeyError` — so in practice this surfaces for
  * per-record corruption rather than authentication failures.
  */
@@ -146,12 +146,12 @@ export declare class TamperedError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Thrown when key unwrapping fails, typically because the passphrase is wrong
+ * Thrown when key unwrapping fails, typically because the secret is wrong
  * or the keyring file is corrupted.
  *
  * NOYDB uses AES-KW (RFC 3394) to wrap DEKs with the KEK. If AES-KW
  * unwrapping fails, it means either the KEK was derived from the wrong
- * passphrase (PBKDF2 with 600K iterations) or the keyring bytes are
+ * secret (PBKDF2 with 600K iterations) or the keyring bytes are
  * corrupted. This is the error shown to the user on a failed unlock attempt.
  */
 export declare class InvalidKeyError extends NoydbError {
@@ -160,7 +160,7 @@ export declare class InvalidKeyError extends NoydbError {
 /**
  * Thrown when a keyring's wrapped-DEK set unwraps partially — at least
  * one DEK succeeds (proving the KEK is correct) but at least one fails.
- * The passphrase is right; the failed entries are corrupted.
+ * The secret is right; the failed entries are corrupted.
  *
  * This is distinct from {@link InvalidKeyError} so that
  * `NoydbOptions.onInvalidKey: 'reset'` does NOT fire — resetting on
@@ -273,7 +273,7 @@ export declare class ExportCapabilityError extends NoydbError {
  * Thrown when a keyring file's `expires_at` cutoff has passed.
  * Surfaced by `loadKeyring` before any DEK unwrap is attempted —
  * past the cutoff the slot refuses to open even with the right
- * passphrase. Distinct from PBKDF2 / unwrap errors so consumer code
+ * secret. Distinct from PBKDF2 / unwrap errors so consumer code
  * can show a precise "this bundle slot has expired" message instead
  * of the generic decryption-failure UX.
  *
@@ -546,6 +546,25 @@ export declare class BlobIntentPendingError extends NoydbError {
     readonly recordId: string;
     constructor(collection: string, recordId: string);
 }
+/**
+ * Thrown by a blob content read when the bytes are not available locally and
+ * cannot be fetched right now (#808 offline read taxonomy) — an `external`
+ * slot with no local cached copy while the object store is unreachable, or an
+ * internal (chunked) blob whose chunk envelopes are absent from the local
+ * store (not yet synced to this device, or evicted). The content still exists
+ * at its authoritative home — retry when online/synced, or `pin()` the slot
+ * while online to keep it readable offline. Deliberately typed (never a hang,
+ * never a silent `null`) so UIs can render "available when online".
+ *
+ * `slotName` is `undefined` when the failing read was not slot-addressed
+ * (e.g. a published-version fetch resolving chunks by eTag).
+ */
+export declare class BlobOfflineError extends NoydbError {
+    readonly collection: string;
+    readonly recordId: string;
+    readonly slotName?: string;
+    constructor(collection: string, recordId: string, slotName: string | undefined, detail: string, cause?: unknown);
+}
 /**
  * Thrown when an elevated-handle operation runs after the elevation's
  * TTL expired. Reads continue at the original tier; only writes
@@ -929,14 +948,14 @@ export declare class BundleIntegrityError extends NoydbError {
 }
 /**
  * Thrown by `readPod` when the bundle carries
- * sealed per-user passphrases but no supplied `SealingKeyProvider`
+ * sealed per-user secrets but no supplied `SealingKeyProvider`
  * has a `.id` (= `pid`) matching the sealed entry's `pid`.
  *
  * Carries the failing pid + the user id so the recipient can
  * surface an actionable prompt:
  *
  * ```
- * BundleSealMismatchError: bundle carries sealed passphrase for user "alice"
+ * BundleSealMismatchError: bundle carries sealed secret for user "alice"
  *   under provider "macos-keychain:com.acme.app/alice@acme.example",
  *   but no registered provider matches that pid.
  * ```
@@ -1271,7 +1290,7 @@ export declare class CustodyNotEnabledError extends NoydbError {
  * (#267 keyring-grant → team split): enable multi-user grant/revoke/rotate
  * with `teamStrategy: withTeam()` from "@noy-db/hub/team" in createNoydb().
  * Single-user primitives (owner keyring, unlock, `listUsers`, `updateUser`,
- * passphrase rotate/recover) stay ungated.
+ * secret rotate/recover) stay ungated.
  */
 export declare class TeamNotEnabledError extends NoydbError {
     constructor(message?: string);
@@ -1367,7 +1386,7 @@ export declare class SessionNotFoundError extends NoydbError {
  *
  * The `operation` field names the specific operation that was blocked
  * (e.g. `'export'`, `'grant'`, `'rotate'`) so the caller can surface
- * a targeted prompt ("Please re-enter your passphrase to export data").
+ * a targeted prompt ("Please re-enter your secret to export data").
  */
 export declare class SessionPolicyError extends NoydbError {
     readonly operation: string;
@@ -1699,7 +1718,7 @@ export declare class VaultTemplateNotFoundError extends NoydbError {
  * record index to know which records belong to a data subject; without
  * one there is nothing to erase and a silent no-op would be a dangerous
  * false "erased" signal. Configure with
- * `forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } })`.
+ * `forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } })`.
  */
 export declare class ForgetStrategyNotConfiguredError extends NoydbError {
     constructor(message?: string);
@@ -1806,7 +1825,7 @@ export declare class PolicyDeniedError extends NoydbError {
 }
 /**
  * Raised by `createNoydb({ ... })` when the developer omits a recovery
- * profile and `recover-passphrase` is not explicitly disabled. Vaults
+ * profile and `recover-secret` is not explicitly disabled. Vaults
  * MUST have at least one recovery path enrolled before being
  * production-ready (paper, shamir, multi-channel, or admin-mediated).
  *
@@ -1816,10 +1835,10 @@ export declare class RecoveryNotEnrolledError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Raised by `openVault` when a managed-passphrase-mode vault has no
+ * Raised by `openVault` when a managed-secret-mode vault has no
  * STRONG recovery profile enrolled.
  *
- * Managed mode means the user never types a passphrase — the unlock
+ * Managed mode means the user never types a secret — the unlock
  * material lives in a `SealingKeyProvider` (`at-*` package). If that
  * provider's key is lost AND no strong recovery is enrolled, the
  * vault is irrecoverable. To prevent that footgun, managed-mode vaults
@@ -1827,11 +1846,11 @@ export declare class RecoveryNotEnrolledError extends NoydbError {
  * multi-channel / admin-mediated when those ship).
  *
  * Paper recovery alone is NOT strong under managed mode: the user has
- * no memorized passphrase to fall back on, so losing the paper sheet =
+ * no memorized secret to fall back on, so losing the paper sheet =
  * losing every record permanently.
  *
- * Bootstrap with `db.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
- * to atomically create-and-enroll, or call `db.enrollRecovery(vault, { profile: "shamir", ... })`
+ * Bootstrap with `db.team.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
+ * to atomically create-and-enroll, or call `db.team.enrollRecovery(vault, { profile: "shamir", ... })`
  * separately before re-attempting `openVault`.
  */
 export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
@@ -1839,7 +1858,7 @@ export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
     constructor(vault: string);
 }
 /**
- * Raised by `db.recoverPassphrase` / `db.enrollRecovery` /
+ * Raised by `db.recoverSecret` / `db.enrollRecovery` /
  * `db.rotateRecovery` when the developer requests a recovery profile
  * not yet wired in this hub release.
  *