@noy-db/hub 0.4.0-pre.1 → 0.4.0-pre.3

package/dist/{chunk-3PF6CRDT.js → chunk-LUH2MPEF.js}

@@ -1,6 +1,3 @@
-import {
-  loadVaultPolicy
-} from "./chunk-CBSY2N76.js";
 import {
   jsonSchemaToFields
 } from "./chunk-VYYM3MEN.js";
@@ -9,20 +6,23 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-HPUWOVR7.js";
+} from "./chunk-NOT7XA7Q.js";
+import {
+  loadVaultPolicy
+} from "./chunk-QDNVHA2F.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-RTEK4C4I.js";
+} from "./chunk-IUIVDVXM.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-2PCAVW2I.js";
+} from "./chunk-L4OA7G5T.js";
 import {
   loadFence
-} from "./chunk-KUIB4B5Q.js";
+} from "./chunk-JA5B3SLH.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
@@ -31,23 +31,24 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-BMQWTQZ4.js";
+} from "./chunk-J6U4BOKP.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-BOKIKJJB.js";
+} from "./chunk-EDC6MLXV.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
-import {
-  NO_PORTABILITY
-} from "./chunk-M75ZZHSR.js";
 import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-O7WJ47EF.js";
+} from "./chunk-SN75YVM5.js";
+import {
+  resolveManagedSecret,
+  saveSealedPassphrase
+} from "./chunk-BCOKZC4B.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -55,35 +56,35 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-PT37L5DV.js";
+} from "./chunk-WEC3JGBA.js";
 import {
   runDrainBarrier
-} from "./chunk-ISMV2QVG.js";
-import {
-  OverlayedCollection
-} from "./chunk-5WZXVULX.js";
+} from "./chunk-KMONEHDJ.js";
 import {
   NO_ATTESTATION
-} from "./chunk-S6Q37VGE.js";
+} from "./chunk-XW7NWO4A.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-UBNCR3YK.js";
+} from "./chunk-IZX3WZBF.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-DDATL6PU.js";
+} from "./chunk-N4A3DCBT.js";
+import {
+  NO_PORTABILITY
+} from "./chunk-GYB2QK5H.js";
 import {
   TxContext,
   bestEffortRevert,
   revertExecuted
-} from "./chunk-JRBNCUNT.js";
+} from "./chunk-FLHOTGOO.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-3ELCWU56.js";
+} from "./chunk-E2R5NRZD.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -106,22 +107,25 @@ import {
   runGraphDispatchWave,
   touchFor,
   updateReferencingRecords
-} from "./chunk-MTQPRQHB.js";
+} from "./chunk-HGVFJL63.js";
+import {
+  OverlayedCollection
+} from "./chunk-2ITLQZV5.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-A5BDDEXK.js";
+} from "./chunk-GU5AYA2Q.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-2P7EGNKF.js";
+} from "./chunk-2KL6NDD4.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-VEALDPHW.js";
+} from "./chunk-CGPO3ZYB.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -129,17 +133,13 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-TAGR72IR.js";
+} from "./chunk-JIMEB4C6.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
-import {
-  resolveManagedSecret,
-  saveSealedPassphrase
-} from "./chunk-LB6OH6K2.js";
 import {
   dictCollectionName
-} from "./chunk-IRQY7IR5.js";
+} from "./chunk-BZEPJJOK.js";
 import {
   NO_I18N,
   getAtPath,
@@ -147,12 +147,12 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-GULTLPFB.js";
+} from "./chunk-XGVDLQJE.js";
 import {
   installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-JVBO4SZL.js";
+} from "./chunk-STR7WBOB.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -163,7 +163,24 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-LOF2W3JU.js";
+} from "./chunk-UBF7HTOR.js";
+import {
+  assertKeyringOpenAllowed,
+  buildRecipientKeyringFile,
+  changeSecret,
+  createOwnerKeyring,
+  ensureCollectionDEK,
+  hasAccess,
+  hasWritePermission,
+  isSecretBearingReservedCollection,
+  listUsers,
+  loadKeyring,
+  updateKeyringIdentity
+} from "./chunk-WJDYZP3U.js";
+import {
+  persistDirectoryConfig,
+  readDirectoryConfig
+} from "./chunk-7B4GPCX7.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -173,7 +190,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-2MUZ3LY6.js";
+} from "./chunk-3O62PVDW.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -183,28 +200,11 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-2IALOXZS.js";
-import {
-  assertKeyringOpenAllowed,
-  buildRecipientKeyringFile,
-  changeSecret,
-  createOwnerKeyring,
-  ensureCollectionDEK,
-  hasAccess,
-  hasWritePermission,
-  isSecretBearingReservedCollection,
-  listUsers,
-  loadKeyring,
-  updateKeyringIdentity
-} from "./chunk-3SV2EPMN.js";
-import {
-  persistDirectoryConfig,
-  readDirectoryConfig
-} from "./chunk-PK6QCH2C.js";
+} from "./chunk-F4COUZLL.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-SMIRGMS7.js";
+} from "./chunk-VEX6G3YL.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -212,10 +212,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-DRWBEDYO.js";
+} from "./chunk-NM4LVUXH.js";
 import {
   sha256Hex
-} from "./chunk-RM2XV574.js";
+} from "./chunk-JLHKBAFY.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -224,10 +224,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-KWVJAOIN.js";
+} from "./chunk-OWE4BNTM.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-RDXW3OBQ.js";
+} from "./chunk-J3VW4J4E.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -238,20 +238,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-DVUZMT2W.js";
+} from "./chunk-PEY6ZTCF.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-WEYZTLXN.js";
+} from "./chunk-QXPOEAKR.js";
 import {
   encrypt
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-5P5AAXYA.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-LSASLXGC.js";
+} from "./chunk-5BHNQNBI.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -291,11 +291,11 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-IGM563N5.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-APODTV4W.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-3AELCZ4Y.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -1705,7 +1705,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-XGIS6CR7.js"));
+      ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -2056,6 +2056,11 @@ function resolveCollectionConfig(opts) {
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
+  if (opts.sensitive && opts.sensitive.length > 0 && opts.crdt) {
+    throw new Error(
+      `Collection "${opts.name}": sensitive (structural group-encryption) is not supported on CRDT collections \u2014 the CRDT write path bypasses per-field sealing, so the fields would be stored in the ordinary encrypted body with no \`_sealed\` slot and no per-field key. Use a non-CRDT collection for sealed fields.`
+    );
+  }
   if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0 && Object.keys(opts.blobFields).length > 0 && opts.perRecordKeys !== true) {
     throw new UnsupportedTierCompositionError(
       "blobs",
@@ -2248,7 +2253,7 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-DSMPXG2Y.js")).evalComputedFields;
+  fn ??= (await import("./computed-WZNKRLCY.js")).evalComputedFields;
   return fn;
 }
 
@@ -3052,7 +3057,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-26Y5GNMK.js");
+    const { verifyDigestField } = await import("./verify-MXN66IIH.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3258,7 +3263,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-FJED42DM.js");
+      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3727,7 +3732,7 @@ var Collection = class {
         if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-AXE4XMLT.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3737,7 +3742,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-FJED42DM.js");
+          staleHelpers = await import("./stale-4UNPHWOU.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3941,7 +3946,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-XGIS6CR7.js"));
+        ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3961,7 +3966,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WDYQ77VB.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -4319,7 +4324,7 @@ var Collection = class {
           continue;
         }
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-WDYQ77VB.js");
+          helpers = await import("./fanout-sidecar-HJV3A7PM.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -4356,7 +4361,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-AXE4XMLT.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
         }
         const rr = await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -4369,7 +4374,7 @@ var Collection = class {
         residueDeclined.push(...rr.residueDeclined);
       } else {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-FJED42DM.js");
+          staleHelpers = await import("./stale-4UNPHWOU.js");
         }
         const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
         deleted += inv.deleted;
@@ -4396,7 +4401,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-FJED42DM.js");
+      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5549,14 +5554,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-WQVIJAW2.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-7S5IEP6Q.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-WQVIJAW2.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-7S5IEP6Q.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -6390,6 +6395,9 @@ var VaultPeriods = class {
       };
     }
     await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
+    if (collection === PERIODS_COLLECTION && this.deps.onDirty) {
+      await this.deps.onDirty(collection, key, "put", envelope._v);
+    }
     return envelope;
   }
   /** Generic reserved-collection reader — serves `_period_freezes` companion reads. */
@@ -6978,7 +6986,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-QK22TDEX.js").then(
+  const load = () => engine ??= import("./link-set-GNGGCFI4.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7516,7 +7524,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-JVTMJ6OW.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-A7HCFBP5.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8287,7 +8295,9 @@ var Vault = class {
       collection: (name) => this.collection(name),
       purgeDeleteMarkers: (before) => this._purgeDeleteMarkers(before),
       archiveRecords: (before) => this._archiveClosedPeriod(before),
-      purgeTargets: (before) => this._purgePeriodTargets(before)
+      purgeTargets: (before) => this._purgePeriodTargets(before),
+      // #822: push symmetry for the period summaries — see writeReserved.
+      onDirty: this.onDirty
     });
     this.linksEnforcer = new VaultLinks({
       refRegistry: this.refRegistry,
@@ -8510,7 +8520,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-X462DNDM.js");
+          const { persistSchemaIfNeeded } = await import("./register-YBMRLZLO.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8709,7 +8719,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-X462DNDM.js")).persistSchemaIfNeeded({
+            await (await import("./register-YBMRLZLO.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9332,7 +9342,9 @@ var Vault = class {
       deleteSlot: async (name, id, slotName) => {
         const coll = this.collection(name);
         await coll.blob(id).delete(slotName);
-      }
+      },
+      dropLocalCache: async (name, id, slotName) => this.collection(name).blob(id).dropLocalCache(slotName)
+      // #808: budget pass drops device-local external cache copies
     }, options);
   }
   /**
@@ -9894,7 +9906,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-3XMCT7MQ.js"),
+      import("./registry-ZULMLCJK.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9926,7 +9938,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-KHD2I3M2.js");
+    const { MaterializedViewRegistry } = await import("./registry-4V4YQCXJ.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9951,7 +9963,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-NPOWJHC4.js");
+    const { OverlayedViewRegistry } = await import("./registry-3LXKNXWI.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9998,14 +10010,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-AXE4XMLT.js");
+    const { MaterializedViewExecutor } = await import("./executor-YORMIBWV.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-FJED42DM.js");
+    const { clearMVStaleFully } = await import("./stale-4UNPHWOU.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10018,7 +10030,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-XGIS6CR7.js");
+    const { DerivationExecutor } = await import("./executor-TEZYRDN3.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10045,7 +10057,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WDYQ77VB.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10272,7 +10284,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-A5A75KQO.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -10294,7 +10306,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-A5A75KQO.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10542,7 +10554,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-XS3PKM6I.js");
+    const { dumpVaultSchema } = await import("./walk-H4YE52S2.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10677,13 +10689,9 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-B5SJDHR3.js");
+    const { readCover } = await import("./cover-B5MY43CK.js");
     return readCover(this.adapter, this.name, opts);
   }
-  /** @deprecated Use {@link Vault.getCover} (#799 rename). */
-  async getPublicEnvelope(opts = {}) {
-    return this.getCover(opts);
-  }
   /**
    * Dump vault as a verifiable encrypted JSON backup string.
    *
@@ -10696,7 +10704,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-LU2DTZTI.js");
+    const { dumpVault } = await import("./backup-JL2GOTYQ.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10748,7 +10756,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-LU2DTZTI.js");
+    const { loadVault } = await import("./backup-JL2GOTYQ.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10780,7 +10788,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-LU2DTZTI.js");
+    const { verifyBackupIntegrity } = await import("./backup-JL2GOTYQ.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10998,7 +11006,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-LU2DTZTI.js");
+    const { exportVaultJSON } = await import("./backup-JL2GOTYQ.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -12869,7 +12877,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-KGNLJD6M.js");
+      const { GuardExecutor } = await import("./executor-WQQRU6DO.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13102,85 +13110,25 @@ var Noydb = class {
     this.vaultCache.set(name, comp);
     return comp;
   }
-  /** Synchronous vault access (must call openVault first, or auto-opens). */
+  /**
+   * Synchronous access to an ALREADY-OPEN vault.
+   *
+   * Returns the instance `openVault()` produced, or throws — it never
+   * constructs. It used to fall back to building a Vault itself (once for
+   * plaintext, once for encrypted-with-cached-keyring), and those copies
+   * drifted from the real open path: the encrypted one silently omitted six
+   * strategies, so a vault reached this way threw `*NotEnabledError` for
+   * services the caller had configured (#834). Both fallbacks also skipped
+   * the async registry init and schema-fence snapshot that `openVault`
+   * performs, which a synchronous method cannot await. One construction
+   * path is the only way that divergence stays fixed.
+   */
   vault(name) {
     const cached = this.vaultCache.get(name);
     if (cached) return cached;
-    if (this.options.encrypt === false) {
-      const keyring2 = createPlaintextKeyring(this.options.user, this.options.debugPlaintext === true);
-      const comp2 = new Vault({
-        adapter: this.options.store,
-        name,
-        noydb: this,
-        keyring: keyring2,
-        encrypted: false,
-        emitter: this.emitter,
-        historyConfig: this.options.history,
-        ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
-        ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-        ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-        ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-        ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-        ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-        ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-        ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-        ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-        ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-        ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-        ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-        ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-        ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-        ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-        ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-        ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-        ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
-        ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-        forgetStrategy: this.forgetStrategy,
-        ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
-        ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
-        ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
-        ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
-        ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {}
-      });
-      this.vaultCache.set(name, comp2);
-      return comp2;
-    }
-    const keyring = this.keyringCache.get(name);
-    if (!keyring) {
-      throw new ValidationError(
-        `Vault "${name}" not opened. Use await db.openVault("${name}") first.`
-      );
-    }
-    const comp = new Vault({
-      adapter: this.options.store,
-      name,
-      noydb: this,
-      keyring,
-      encrypted: true,
-      historyConfig: this.options.history,
-      ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
-      ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-      ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-      ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-      ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-      ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-      ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-      ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-      ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-      ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-      ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-      ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-      ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-      ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-      ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-      ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
-      ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-      emitter: this.emitter
-    });
-    this.vaultCache.set(name, comp);
-    return comp;
+    throw new ValidationError(
+      `Vault "${name}" is not open. Call \`await db.openVault("${name}")\` first \u2014 vault() only returns an already-open vault, because opening involves async work (registry init, schema fence) that a sync accessor cannot do.`
+    );
   }
   /**
    * Grant access to a user for a vault.
@@ -14148,13 +14096,13 @@ var Noydb = class {
    * value, absent ones are preserved, `null` deletes (#800).
    */
   async setCover(vault, input) {
-    const coverOption = this.options.cover ?? this.options.publicEnvelope;
+    const coverOption = this.options.cover;
     if (!coverOption) {
       throw new ValidationError(
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-B5SJDHR3.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-B5MY43CK.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -14186,17 +14134,9 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-B5SJDHR3.js");
+    const { readCover } = await import("./cover-B5MY43CK.js");
     return readCover(this.options.store, vault, opts);
   }
-  /** @deprecated Use {@link Noydb.setCover} (#799 rename). */
-  async setPublicEnvelope(vault, input) {
-    return this.setCover(vault, input);
-  }
-  /** @deprecated Use {@link Noydb.getCover} (#799 rename). */
-  async getPublicEnvelope(vault, opts = {}) {
-    return this.getCover(vault, opts);
-  }
   // ─── Auth introspection ─────────────────────────────────────────
   /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
   async describeAuthConfig(vault) {
@@ -14385,9 +14325,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-IQFZJSQO.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-UPAT2O3M.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-NAHB2TUT.js");
+    const policyModule = await import("./policy-EAXSJNOT.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14424,4 +14364,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-3PF6CRDT.js.map
+//# sourceMappingURL=chunk-LUH2MPEF.js.map