@noy-db/hub 0.4.0-pre.3 → 0.4.0-pre.5

package/dist/materialized-views/index.js

@@ -1,44 +1,44 @@
 import {
   withMaterializedView
-} from "../chunk-OOTTXUNV.js";
+} from "../chunk-DYZ5CCVM.js";
 import {
   MaterializedViewExecutor
-} from "../chunk-QYJIOWKN.js";
-import "../chunk-HGVFJL63.js";
+} from "../chunk-YZN6NRTR.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
   canonicalizeQueryPlan,
   computeQueryHash,
   summarizeQueryPlan
-} from "../chunk-DEQ2JTBR.js";
+} from "../chunk-TNATF3HB.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-3XVOLB75.js";
-import "../chunk-OGFPMCSP.js";
-import "../chunk-JIMEB4C6.js";
+} from "../chunk-CKUYQO2P.js";
+import "../chunk-7BIJS6II.js";
+import "../chunk-SBOHNJUD.js";
+import "../chunk-QMMOMBH6.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-BZEPJJOK.js";
-import "../chunk-XGVDLQJE.js";
-import "../chunk-STR7WBOB.js";
-import "../chunk-JLHKBAFY.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+import "../chunk-K7BADAOS.js";
+import "../chunk-JN3SGXJE.js";
+import "../chunk-ZUDAK436.js";
+import "../chunk-RWW3I3PO.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError,
   MaterializedViewTooLargeError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MaterializedViewConfigError,

package/dist/noydb-BNDGEK5X.js

@@ -0,0 +1,71 @@
+import {
+  Noydb,
+  createNoydb
+} from "./chunk-EEZCB74X.js";
+import "./chunk-QMZ5A6FQ.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-X3MWEFPT.js";
+import "./chunk-MUPZ6IZX.js";
+import "./chunk-522MBPE5.js";
+import "./chunk-XUFAFHQM.js";
+import "./chunk-M6QA2KK2.js";
+import "./chunk-HAPY7WFP.js";
+import "./chunk-SEU6QHH4.js";
+import "./chunk-GYGLAVCX.js";
+import "./chunk-L2CAWCQL.js";
+import "./chunk-OHV6T5JB.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-IGLU4ME7.js";
+import "./chunk-AFAPBZAA.js";
+import "./chunk-GTNRMJYH.js";
+import "./chunk-YZNKFYDC.js";
+import "./chunk-FTCGEUOY.js";
+import "./chunk-OWLZONGX.js";
+import "./chunk-7ICV4ASA.js";
+import "./chunk-GHVIKOHT.js";
+import "./chunk-QVGEVZ5F.js";
+import "./chunk-Z4D3YGAB.js";
+import "./chunk-7BIJS6II.js";
+import "./chunk-PWWWMRT7.js";
+import "./chunk-HQKRZIX6.js";
+import "./chunk-SBOHNJUD.js";
+import "./chunk-J5TEU77Q.js";
+import "./chunk-BY5YBSXA.js";
+import "./chunk-KPZS5QAQ.js";
+import "./chunk-NO272T7Q.js";
+import "./chunk-QMMOMBH6.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-WQN5SM7P.js";
+import "./chunk-K7BADAOS.js";
+import "./chunk-JN3SGXJE.js";
+import "./chunk-ZUDAK436.js";
+import "./chunk-FIP7KI2P.js";
+import "./chunk-3LJYHE7S.js";
+import "./chunk-6RPWILRH.js";
+import "./chunk-CJVEAVYH.js";
+import "./chunk-VQNJ7UZL.js";
+import "./chunk-TMR64XPL.js";
+import "./chunk-LC7DSMHR.js";
+import "./chunk-P4NUJVWL.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-5ATANZSW.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-PTT2NB46.js";
+import "./chunk-RWW3I3PO.js";
+import "./chunk-I2XEBEEF.js";
+import "./chunk-7LP7FFJ2.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  Noydb,
+  createNoydb
+};
+//# sourceMappingURL=noydb-BNDGEK5X.js.map

package/dist/on/index.js

@@ -1,15 +1,15 @@
 import {
   mintPaperRecoveryEntry
-} from "../chunk-3O62PVDW.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-CJVEAVYH.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   mintPaperRecoveryEntry

package/dist/overlay-views/index.js

@@ -1,18 +1,18 @@
 import {
   withOverlayedView
-} from "../chunk-2JZ763FV.js";
+} from "../chunk-D4LAJ737.js";
 import {
   OverlayedCollection
-} from "../chunk-2ITLQZV5.js";
+} from "../chunk-PWWWMRT7.js";
 import {
   OverlayedViewRegistry
-} from "../chunk-ITI3SJRB.js";
+} from "../chunk-ZX5FNWH7.js";
 import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayIdMismatchError,
   OverlayNameCollisionError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   OverlayBaseIsVirtualError,

package/dist/periods/index.js

@@ -1,13 +1,13 @@
 import {
   withPeriods
-} from "../chunk-GS3Q2KOZ.js";
+} from "../chunk-QBOQI6PG.js";
 import {
   appendPeriodLedgerEntry,
   assertTsWritable,
   chainAnchor,
   loadPeriods,
   validatePeriodName
-} from "../chunk-KR5EGWI4.js";
+} from "../chunk-7ICV4ASA.js";
 import "../chunk-GHVIKOHT.js";
 import {
   PERIODS_COLLECTION,
@@ -15,19 +15,19 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "../chunk-F4COUZLL.js";
-import "../chunk-ZJGZDOQO.js";
+} from "../chunk-TMR64XPL.js";
+import "../chunk-5ATANZSW.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-JLHKBAFY.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+import "../chunk-RWW3I3PO.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   PERIODS_COLLECTION,

package/dist/pod/index.js

@@ -4,7 +4,7 @@ import {
   createPodStore,
   wrapBundleStore,
   wrapPodStore
-} from "../chunk-YHPUDB7Q.js";
+} from "../chunk-OWOT7CFC.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -25,20 +25,20 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-MEKAMERX.js";
-import "../chunk-BVZGNMVM.js";
+} from "../chunk-YCAJDK4O.js";
+import "../chunk-YFFEF6HR.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   BackupCorruptedError,
   BackupLedgerError,
@@ -46,7 +46,7 @@ import {
   BundleSealMismatchError,
   BundleVersionConflictError,
   PodVersionConflictError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BackupCorruptedError,

package/dist/{policy-EAXSJNOT.js → policy-IY2YEA3A.js}

@@ -6,20 +6,20 @@ import {
   createNoydbPolicy,
   describeGate,
   mergePolicy
-} from "./chunk-UEO5CHOP.js";
+} from "./chunk-JAMDDLIM.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-QDNVHA2F.js";
-import "./chunk-5BHNQNBI.js";
+} from "./chunk-QMZ5A6FQ.js";
+import "./chunk-YTW6ZIPD.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
   RecoveryNotEnrolledError,
   RecoveryProfileNotImplementedError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_FRESHNESS_MS,
@@ -38,4 +38,4 @@ export {
   mergePolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=policy-EAXSJNOT.js.map
+//# sourceMappingURL=policy-IY2YEA3A.js.map

package/dist/port/at/index.d.ts

@@ -3,16 +3,16 @@
  *
  * A sealing-key provider (`at-env`, `at-aws-kms`, `at-gcp-kms`, …) binds
  * ONLY to this subpath: the `SealingKeyProvider` contract concrete
- * providers implement to seal/unseal a hub-generated random passphrase
- * for managed-passphrase mode. Its two methods (`seal`/`unseal`) close
+ * providers implement to seal/unseal a hub-generated random secret
+ * for managed-secret mode. Its two methods (`seal`/`unseal`) close
  * over only `Uint8Array`/`Promise`/`string` — no additional option or
  * result types to re-export.
  *
  * NOTE: `SealingKeyProvider` is implemented in `with-party/team/*` (the
- * managed-passphrase service), not the kernel spine proper — same
+ * managed-secret service), not the kernel spine proper — same
  * precedent as `@noy-db/hub/ui` re-exporting from `with-shape/introspection`.
  *
  * Named re-exports only (no `export *`) so the published surface is explicit and
  * tsup's per-entry bundling keeps class identity stable across subpaths.
  */
-export type { SealingKeyProvider } from '../../with-party/team/managed-passphrase.js';
+export type { SealingKeyProvider } from '../../with-party/team/managed-secret.js';

package/dist/port/with/archive-strategy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Strategy seam between the kernel spine and the optional archive service
+ * (#838 — precedent: `port/with/blob-strategy.ts`). Lives on the `/with`
+ * port so `Vault` can hold the `NO_ARCHIVE` default without a
+ * spine→service static import.
+ *
+ * `archiveStrategy` was the one service with no NO-op stub: the spine held
+ * it as `ArchiveStrategy | undefined` and hand-rolled a null gate before
+ * every use. That made it the sole exception to the strategy-bag's "every
+ * key always resolves" rule (#838), so the stub exists to remove the
+ * exception rather than to add a capability.
+ *
+ * `ArchiveStrategy`'s only member is a live cold `NoydbStore`, and there is
+ * no meaningful no-op store — so the stub throws on access instead of
+ * standing in. That reproduces the previous gate exactly: `_archiveContext()`
+ * read `strategy.store` immediately after its null check, so the throw lands
+ * in the same call with the same message.
+ *
+ * The `ArchiveStrategy` import is TYPE-ONLY and therefore erased — importing
+ * it does not pull `with-fork/archive/index.js`'s runtime re-exports of the
+ * relocation engine.
+ *
+ * @internal
+ */
+import type { ArchiveStrategy } from '../../with-fork/archive/index.js';
+/**
+ * The un-opted-in archive strategy. Reading `.store` throws with a pointer
+ * at the `withArchive()` factory — the archive service has no degraded mode
+ * to fall back to.
+ */
+export declare const NO_ARCHIVE: ArchiveStrategy;

package/dist/port/with/collection-options.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Options for `Vault.collection()` — opening or declaring a collection (#841).
+ *
+ * ## Why this lives on the port
+ *
+ * The shape references descriptor types owned by services — `EmbeddingDescriptor`
+ * (`with-lookup`), `ComputedFields` (`with-formula`), `FieldMeta` (`with-shape`) —
+ * so it cannot sit in `kernel/`: `port-layering` forbids the spine from
+ * statically importing a `with-*` service, and the grandfathered lists are
+ * frozen per file. `port/with/` is the seam that exists for exactly this, and
+ * port files may reach services freely — the same reasoning that placed the
+ * strategy table here in #838.
+ *
+ * @internal
+ */
+import type { CacheOptions } from '../../kernel/collection.js';
+import type { RefDescriptor } from '../../kernel/refs.js';
+import type { StandardSchemaV1 } from '../../kernel/schema.js';
+import type { ConflictPolicy, HistoryConfig, IndexDefFor, IndexFieldName, MoneyFieldsOpt, SensitiveOpt, TierMode } from '../../kernel/types.js';
+import type { ViaFieldSpec } from '../../kernel/via/compose.js';
+import type { ClassifiedEntry } from '../../port/with/classified-strategy.js';
+import type { CrdtMode } from '../../with-commit/crdt/crdt.js';
+import type { ComputedFields } from '../../with-formula/computed/index.js';
+import type { EmbeddingDescriptor } from '../../with-lookup/embeddings/index.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
+import type { FieldMeta } from '../../with-shape/introspection/field-meta.js';
+import type { CollectionMeta } from '../../with-shape/introspection/meta.js';
+import type { DictKeyDescriptor, I18nTextDescriptor, StaticDictDescriptor } from './i18n-strategy.js';
+import type { LookupDescriptor } from '../../via/lookup/descriptor.js';
+import type { ArchivePolicy } from '../../with-fork/archive/index.js';
+import type { SchemaUpdateStrategy } from '../../with-shape/schema-update/types.js';
+import type { AttestationFieldSchema } from '@noy-db/attestation';
+/**
+ * Options for {@link Vault.collection} — opening or declaring a collection.
+ *
+ * Extracted from a 124-line inline literal (#841). Naming it lets consumers
+ * annotate a call, lets `describe()` reuse the shape, and means a new option
+ * is one edit here rather than an edit buried in the middle of a 534-line
+ * method.
+ *
+ * Named `OpenCollectionOptions`, not `CollectionOptions` as the issue
+ * suggested, to keep a clear gap from the existing `CollectionOpts` in
+ * `collection-config.ts` — that one is the `Collection` CONSTRUCTOR's input,
+ * built from this one. A one-character difference between two adjacent
+ * config types is exactly the wart #844 is about.
+ */
+export interface OpenCollectionOptions<T, S extends keyof T & string = never, Q extends keyof T & string = never, M extends keyof T & string = never> {
+    indexes?: readonly IndexDefFor<IndexFieldName<T, S, Q>>[];
+    /** — auto-reconcile policy for persisted-index drift. */
+    reconcileOnOpen?: 'off' | 'dry-run' | 'auto';
+    prefetch?: boolean;
+    cache?: CacheOptions;
+    schema?: StandardSchemaV1<unknown, T>;
+    refs?: Record<string, RefDescriptor>;
+    /** — declare i18nText fields for locale-aware reads. */
+    i18nFields?: Record<string, I18nTextDescriptor>;
+    /** — embedding config for write-time vector derivation + semantic retrieval. */
+    embeddings?: EmbeddingDescriptor;
+    /** — string fields exposed to client-side `retrieve()`. */
+    textIndexes?: readonly IndexFieldName<T, S>[];
+    /** — pre-build the lexical index on open (eager-only). */
+    warmIndexOnOpen?: boolean;
+    /** — persist the lexical index as an opaque encrypted blob at `_ftindex/<name>`. */
+    textIndexPersist?: boolean;
+    /** — declare dictKey / staticDict fields for label resolution on reads. */
+    dictKeyFields?: Record<string, DictKeyDescriptor | StaticDictDescriptor>;
+    /** — declare lookup() / enumOf() / dict() fields (#650 Task 2 — the 'lookup' via binding's three tiers). */
+    lookupFields?: Record<string, LookupDescriptor>;
+    /** Consumer-neutral per-field descriptors (label/unit/semanticType/sensitivity…). See collection.describe(). */
+    fieldMeta?: Record<string, FieldMeta>;
+    /** The collection's own descriptive metadata (label/description/icon). See collection.describe(). */
+    meta?: CollectionMeta;
+    /** — declare money() fields for currency-safe decimal storage/formatting. */
+    moneyFields?: MoneyFieldsOpt<T, M>;
+    viaFields?: Record<string, ViaFieldSpec>;
+    /** — declare computed scalar fields, evaluated on write (schema-owned). Each entry may be
+     *  a plain `(record) => value` function, OR `{ fn, deps }` to declare source fields for
+     *  taint propagation (#638 Task 7 — supersedes the retired `computedDeps` option). */
+    computed?: ComputedFields<T>;
+    /** — declare classified() sensitive-field descriptors. See the classified-fields spec. */
+    classifiedFields?: Record<string, ClassifiedEntry>;
+    /** — per-collection conflict resolution policy. */
+    conflictPolicy?: ConflictPolicy<T>;
+    /** — CRDT mode for collaborative editing without conflicts. */
+    crdt?: CrdtMode;
+    /**
+     * declare deterministic-encryption fields for blind
+     * equality search. See `Collection` constructor docs for the full
+     * trade-off. Requires `acknowledgeDeterministicRisk: true`.
+     */
+    deterministicFields?: readonly IndexFieldName<T, S>[];
+    /** — explicit ack that deterministic encryption leaks equality. */
+    acknowledgeDeterministicRisk?: boolean;
+    /** — explicit ack for the classified `equatable` knob (R8 door). Required
+     *  when any classified field declares `equatable: true`. */
+    acknowledgeEquatableRisk?: boolean;
+    /**
+     * — structural group-encryption. Fields sealed into their own
+     * `_sealed[field]` envelope slot (per-field key), kept out of the open
+     * `_data` blob. Default-off; byte-identical output when absent.
+     */
+    sensitive?: SensitiveOpt<T, S>;
+    /**
+     * — per-record content-encryption keys. When `true`, every record
+     * body is encrypted under a fresh per-record CEK wrapped under the
+     * collection DEK (`_cek`), stable across versions. Foundation for
+     * per-record erasure / record-scoped sealing. Off by
+     * default; non-adopting collections take the legacy path unchanged.
+     */
+    perRecordKeys?: boolean;
+    satelliteOf?: string;
+    fields?: readonly string[];
+    joined?: string;
+    /**
+     * Per-record provenance tracking. When `true`, `put()` calls that
+     * supply a `source` option stamp `_source` / `_sourceTs` onto the
+     * unencrypted envelope metadata. Off by default.
+     */
+    provenance?: boolean;
+    /**
+     * declarative blob retention / TTL policy per slot
+     * name. Values are `{ retainDays?, evictWhen? }`. Evaluated only
+     * when `vault.compact()` runs.
+     */
+    blobFields?: BlobFieldsConfig<T>;
+    blobTierPolicy?: 'isolate' | 'dedup';
+    /** — declarative record archival policy: `{ archiveWhen, legalHold? }`. Evaluated when `vault.archive()` runs. */
+    archive?: ArchivePolicy<T>;
+    /** — declared tiers for this collection. */
+    tiers?: readonly number[];
+    /**  — how lower-tier reads see above-tier records. */
+    tierMode?: TierMode;
+    /**
+     * Opt-in persisted JSON Schema. When `true` AND a Zod `schema` is
+     * provided, hub derives a JSON Schema via `zod-to-json-schema`
+     * (optional peer-dep) and writes an encrypted snapshot to
+     * `_schemas/<collectionName>`. Re-runs on every open; hash-skip
+     * avoids write churn when the schema is unchanged.
+     *
+     * Default: `false`. Non-Zod Standard Schema validators receive a
+     * stub envelope flagging the kind without a JSON Schema body.
+     *
+     * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+     */
+    persistJsonSchema?: boolean;
+    /**
+     * Ordered schema-update strategies. On a detected schema
+     * change, evaluated in order; the first non-`allow` decision wins.
+     * A `reject` is enforced at the write path (`put`/`delete` throw).
+     * Requires `persistJsonSchema: true` (detection needs the baseline).
+     */
+    schemaUpdate?: readonly SchemaUpdateStrategy[];
+    /** — declare the per-field schema for document attestation (issue side). */
+    attestation?: AttestationFieldSchema;
+    /**
+     * Per-collection history & tamper-ledger scoping. Overrides the
+     * vault-wide `history` config for THIS collection only (wholesale, not
+     * merged). `enabled: false` suppresses per-record snapshots for this
+     * collection; `ledger: false` excludes its writes from the vault-wide
+     * hash-chained tamper ledger. Lets you confine version snapshots +
+     * tamper-evidence to the few collections where they carry legal weight,
+     * without paying snapshot + ledger-entry-per-write across operational /
+     * derived collections. Defaults to the vault-wide `history` config.
+     */
+    historyConfig?: HistoryConfig;
+    /**
+     * Opt-in: keep the working set encrypted in RAM, decrypting on read (future phase).
+     * Default false — the working set is plaintext.
+     */
+    ramCiphertext?: boolean;
+}