@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.5

package/dist/{chunk-W7TCXZWU.js → chunk-EEZCB74X.js}

@@ -1,3 +1,6 @@
+import {
+  loadVaultPolicy
+} from "./chunk-QMZ5A6FQ.js";
 import {
   jsonSchemaToFields
 } from "./chunk-VYYM3MEN.js";
@@ -6,23 +9,23 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-NOT7XA7Q.js";
-import {
-  loadVaultPolicy
-} from "./chunk-QDNVHA2F.js";
+} from "./chunk-X3MWEFPT.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-IUIVDVXM.js";
+} from "./chunk-MUPZ6IZX.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-L4OA7G5T.js";
+} from "./chunk-522MBPE5.js";
+import {
+  resolveStaleOnRead
+} from "./chunk-XUFAFHQM.js";
 import {
   loadFence
-} from "./chunk-JA5B3SLH.js";
+} from "./chunk-M6QA2KK2.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
@@ -31,11 +34,11 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-JW3XCZA2.js";
+} from "./chunk-HAPY7WFP.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-EDC6MLXV.js";
+} from "./chunk-SEU6QHH4.js";
 import {
   isBaseLive,
   liveBaseIdSet
@@ -44,11 +47,11 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-U73LHVPF.js";
+} from "./chunk-L2CAWCQL.js";
 import {
   resolveManagedSecret,
-  saveSealedPassphrase
-} from "./chunk-BCOKZC4B.js";
+  saveSealedSecret
+} from "./chunk-OHV6T5JB.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -56,35 +59,35 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-WEC3JGBA.js";
+} from "./chunk-IGLU4ME7.js";
 import {
   runDrainBarrier
-} from "./chunk-KMONEHDJ.js";
+} from "./chunk-AFAPBZAA.js";
 import {
   NO_ATTESTATION
-} from "./chunk-XW7NWO4A.js";
+} from "./chunk-GTNRMJYH.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-IZX3WZBF.js";
+} from "./chunk-YZNKFYDC.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-5KI3REO3.js";
+} from "./chunk-FTCGEUOY.js";
 import {
   NO_PORTABILITY
-} from "./chunk-GYB2QK5H.js";
+} from "./chunk-OWLZONGX.js";
 import {
   TxContext,
   bestEffortRevert,
   revertExecuted
-} from "./chunk-FLHOTGOO.js";
+} from "./chunk-QVGEVZ5F.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-E2R5NRZD.js";
+} from "./chunk-Z4D3YGAB.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -105,27 +108,28 @@ import {
   resolveLabelFromMap,
   resolveRollupDeleteIntents,
   runGraphDispatchWave,
+  selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-HGVFJL63.js";
+} from "./chunk-7BIJS6II.js";
 import {
   OverlayedCollection
-} from "./chunk-2ITLQZV5.js";
+} from "./chunk-PWWWMRT7.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-4X6DJZHY.js";
+} from "./chunk-HQKRZIX6.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-2KL6NDD4.js";
+} from "./chunk-J5TEU77Q.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-CGPO3ZYB.js";
+} from "./chunk-BY5YBSXA.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -133,13 +137,13 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-JIMEB4C6.js";
+} from "./chunk-QMMOMBH6.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
 import {
   dictCollectionName
-} from "./chunk-BZEPJJOK.js";
+} from "./chunk-K7BADAOS.js";
 import {
   NO_I18N,
   getAtPath,
@@ -147,23 +151,23 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-XGVDLQJE.js";
+} from "./chunk-JN3SGXJE.js";
 import {
   installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-STR7WBOB.js";
+} from "./chunk-ZUDAK436.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
   findAuthenticator,
-  recoverPassphrase,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
-  rotatePassphrase,
+  rotateSecret,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-QUIG6BZT.js";
+} from "./chunk-FIP7KI2P.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -176,11 +180,11 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-WJDYZP3U.js";
+} from "./chunk-3LJYHE7S.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-7B4GPCX7.js";
+} from "./chunk-6RPWILRH.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -190,7 +194,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-3O62PVDW.js";
+} from "./chunk-CJVEAVYH.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -200,11 +204,11 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-F4COUZLL.js";
+} from "./chunk-TMR64XPL.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-VEX6G3YL.js";
+} from "./chunk-P4NUJVWL.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -212,10 +216,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-NM4LVUXH.js";
+} from "./chunk-PTT2NB46.js";
 import {
   sha256Hex
-} from "./chunk-JLHKBAFY.js";
+} from "./chunk-RWW3I3PO.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -224,10 +228,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-OWE4BNTM.js";
+} from "./chunk-I2XEBEEF.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-J3VW4J4E.js";
+} from "./chunk-7LP7FFJ2.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -238,20 +242,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-PEY6ZTCF.js";
+} from "./chunk-GEEJPID6.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-QXPOEAKR.js";
+} from "./chunk-SC4JLMZI.js";
 import {
   encrypt
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-5BHNQNBI.js";
+} from "./chunk-YTW6ZIPD.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -260,7 +264,6 @@ import {
   ClassifiedVerifyError,
   ConflictError,
   DebugPlaintextError,
-  DerivationCapExceededError,
   DictKeyInUseError,
   ElevationExpiredError,
   FieldNotQueryableError,
@@ -291,7 +294,7 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 
 // src/via/blob/binding.ts
 async function eraseBlobs(ctx, cfg) {
@@ -573,7 +576,7 @@ function resolveStrategies(options) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-3AELCZ4Y.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-P3IU5JHD.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -1844,79 +1847,6 @@ function buildDescription(input) {
   };
 }
 
-// src/with-formula/derivations/stale.ts
-var _staleByRegistry = /* @__PURE__ */ new WeakMap();
-var keyFor = (source, sourceId) => `${source}/${sourceId}`;
-async function markStale(registry, strategy, sourceId) {
-  let map = _staleByRegistry.get(registry);
-  if (!map) {
-    map = /* @__PURE__ */ new Map();
-    _staleByRegistry.set(registry, map);
-  }
-  const k = keyFor(strategy.source, sourceId);
-  let set = map.get(k);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    map.set(k, set);
-  }
-  set.add(strategy);
-}
-async function resolveStaleOnRead(accessor, outputCollection, id) {
-  const registry = accessor.registry();
-  const producers = registry.strategiesProducingOutput(outputCollection);
-  if (producers.length === 0) return;
-  const map = _staleByRegistry.get(registry);
-  if (!map) return;
-  let DerivationExecutor = null;
-  for (const { spec, strategyHash } of producers) {
-    const k = keyFor(spec.source, id);
-    const pending = map.get(k);
-    if (!pending || !pending.has(spec)) continue;
-    const sourceColl = accessor.getCollection(spec.source);
-    const source = await sourceColl.get(id);
-    if (!source) {
-      pending.delete(spec);
-      continue;
-    }
-    const sourceWithId = { ...source, id };
-    if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
-    }
-    const ctx = { vault: accessor.getReadOnlyFacade() };
-    const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
-    for (const key of Object.keys(spec.outputs)) {
-      const out = result.outputs[key];
-      if (!out) continue;
-      if (out.kind === "failed") {
-        const err = out.error;
-        if (spec.strict) {
-          throw err;
-        }
-        console.warn(
-          `[derivation] lazy output "${key}" for source "${spec.source}" id="${id}" failed:`,
-          err
-        );
-        continue;
-      }
-      if (out.kind === "array") {
-        console.warn(
-          `[derivation] unexpected array-shape output "${key}" in lazy resolve path; array-shape derivations require lifecycle: "eager".`
-        );
-        continue;
-      }
-      const outSpec = spec.outputs[key];
-      if (!outSpec) continue;
-      const outputColl = accessor.getCollection(outSpec.collection);
-      if (out.skipped === true) {
-        await outputColl._internalDelete(id, accessor.getActiveTxContext());
-        continue;
-      }
-      await outputColl.put(id, out.value);
-    }
-    pending.delete(spec);
-  }
-}
-
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -2383,20 +2313,11 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-WZNKRLCY.js")).evalComputedFields;
+  fn ??= (await import("./computed-33DRJDOC.js")).evalComputedFields;
   return fn;
 }
 
 // src/kernel/collection.ts
-function selfWriteFieldEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-  try {
-    return JSON.stringify(a) === JSON.stringify(b);
-  } catch {
-    return false;
-  }
-}
 var fallbackWarned = /* @__PURE__ */ new Set();
 function warnOnceFallback(adapterName) {
   if (fallbackWarned.has(adapterName)) return;
@@ -3169,7 +3090,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-MXN66IIH.js");
+    const { verifyDigestField } = await import("./verify-5X37OXRY.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3375,7 +3296,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3631,6 +3552,103 @@ var Collection = class {
     return clone;
   }
   /** @internal Untracked put body — call {@link put}, not this. */
+  /**
+   * Decode a prior envelope's CRDT state, or `undefined` when there is no
+   * usable prior: no envelope, a shredded body decrypting to `null`, or a
+   * payload that is not a CRDT state. The `lww-map` and `rga` branches each
+   * carried a copy, byte-identical apart from the cast (#842).
+   */
+  async #decodePriorCrdtState(envelope) {
+    if (!envelope) return void 0;
+    const prevJson = await this.codec.decryptJsonString(envelope);
+    if (prevJson === null) return void 0;
+    const prevParsed = JSON.parse(prevJson);
+    if (prevParsed === null || typeof prevParsed !== "object" || !("_crdt" in prevParsed)) {
+      return void 0;
+    }
+    return prevParsed;
+  }
+  /**
+   * Record a write on the active transaction so a mid-batch failure rolls it
+   * back. Four sites in the derivation/MV dispatch hand-built this literal (#842).
+   */
+  #trackPut(txCtx, collectionName, id, priorEnvelope) {
+    txCtx._executed.push({
+      op: { type: "put", vaultName: this.vault, collectionName, id },
+      priorEnvelope
+    });
+  }
+  /**
+   * Snapshot the PRIOR version into history, emit, and prune.
+   *
+   * Deliberately does NOT carry `source` from the current write — a history
+   * entry describes the version being replaced, not the one replacing it.
+   *
+   * Kept OUT of {@link #commitWriteTail} because the two paths call it at
+   * different points: the normal path snapshots BEFORE `adapter.put` (so a
+   * history failure leaves no write behind), while the CRDT path must merge
+   * and persist first to resolve the prior record at all. Folding it into the
+   * tail would silently reorder one of them (#842).
+   */
+  async #savePriorHistory(id, prior, cek, vdigCtx) {
+    if (this.historyConfig.enabled === false) return;
+    await this.strategies.history.saveHistory(
+      this.adapter,
+      this.vault,
+      this.name,
+      id,
+      await this.codec.encryptRecord(prior.record, prior.version, cek, void 0, void 0, vdigCtx, id)
+    );
+    this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: prior.version });
+    if (this.historyConfig.maxVersions) {
+      await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+    }
+  }
+  /**
+   * Everything both write paths do once the envelope is on the adapter:
+   * classified marker, embedding sidecar, ledger append, cache/index
+   * maintenance, and the mutation event that drives derivation dispatch.
+   *
+   * The CRDT branch used to re-implement all of it, and in doing so skipped
+   * `_ensureClassifiedMarker`, the unique-constraint upsert and
+   * `_toCacheableRecord` (#835). All three were unreachable — each blocked by
+   * a config-time refusal on CRDT collections — but only by accident of what
+   * that copy happened to omit. One tail makes the divergence unrepresentable
+   * rather than merely unreachable; on a CRDT collection the extra steps are
+   * provably no-ops (classified/unique + crdt are refused at construction, and
+   * a CRDT body never produces a `_sealed` slot, so `_toCacheableRecord` is
+   * the identity).
+   */
+  async #commitWriteTail(args) {
+    const { id, envelope, version, indexed, event, prior, reason } = args;
+    await this._ensureClassifiedMarker();
+    if (this.embeddings) {
+      await this.strategies.search.embedOnWrite(this.searchContext(), id, indexed, version);
+    }
+    if (this.ledger) {
+      const appendInput = {
+        op: "put",
+        collection: this.name,
+        id,
+        version,
+        actor: this.keyring.userId,
+        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
+      };
+      if (prior) appendInput.delta = this.strategies.history.computePatch(indexed, prior.record);
+      if (reason !== void 0) appendInput.reason = reason;
+      await this.ledger.append(appendInput);
+    }
+    const cacheable = await this._toCacheableRecord(indexed, envelope, id);
+    if (this.lazy && this.lru) {
+      this.lru.set(id, { record: cacheable, version }, estimateRecordBytes(indexed));
+      await this.maintainPersistedIndexesOnPut(id, indexed, prior ? prior.record : null, version);
+    } else {
+      this.cache.set(id, { record: cacheable, version });
+      this.indexes?.upsert(id, indexed, prior ? prior.record : null);
+      this.uniqueConstraints?.upsert(id, indexed, prior?.record);
+    }
+    await this._onRecordMutated(id, "put", "local-write", { record: event, version });
+  }
   async _putInternal(id, record, options) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
@@ -3679,28 +3697,10 @@ var Collection = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       let crdtState;
       if (this.crdtMode === "lww-map") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
         crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
         crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
@@ -3712,39 +3712,18 @@ var Collection = class {
       const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
-      if (existingResolved && this.historyConfig.enabled !== false) {
-        await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
-        this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
-        if (this.historyConfig.maxVersions) {
-          await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-        }
-      }
-      if (this.ledger) {
-        const appendInput = {
-          op: "put",
-          collection: this.name,
-          id,
-          version: version2,
-          actor: this.keyring.userId,
-          payloadHash: await this.strategies.history.envelopePayloadHash(envelope2)
-        };
-        if (existingResolved) appendInput.delta = this.strategies.history.computePatch(resolvedRecord, existingResolved.record);
-        if (options?.reason !== void 0) appendInput.reason = options.reason;
-        await this.ledger.append(appendInput);
+      if (existingResolved) {
+        await this.#savePriorHistory(id, existingResolved, cek2, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
       }
-      if (this.lazy && this.lru) {
-        this.lru.set(id, { record: resolvedRecord, version: version2 }, estimateRecordBytes(resolvedRecord));
-        await this.maintainPersistedIndexesOnPut(
-          id,
-          resolvedRecord,
-          existingResolved ? existingResolved.record : null,
-          version2
-        );
-      } else {
-        this.cache.set(id, { record: resolvedRecord, version: version2 });
-        this.indexes?.upsert(id, resolvedRecord, existingResolved ? existingResolved.record : null);
-      }
-      await this._onRecordMutated(id, "put", "local-write", { record, version: version2 });
+      await this.#commitWriteTail({
+        id,
+        envelope: envelope2,
+        version: version2,
+        indexed: resolvedRecord,
+        event: record,
+        prior: existingResolved,
+        reason: options?.reason
+      });
       return;
     }
     let existing;
@@ -3774,47 +3753,19 @@ var Collection = class {
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    if (existing && this.historyConfig.enabled !== false) {
-      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
-      this.emitter.emit("history:save", {
-        vault: this.vault,
-        collection: this.name,
-        id,
-        version: existing.version
-      });
-      if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-    }
+    if (existing) await this.#savePriorHistory(id, existing, cek, vdigCtx);
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
     await this.adapter.put(this.vault, this.name, id, envelope);
     this.markerIds.delete(id);
-    await this._ensureClassifiedMarker();
-    if (this.embeddings) {
-      await this.strategies.search.embedOnWrite(this.searchContext(), id, record, version);
-    }
-    if (this.ledger) {
-      const appendInput = {
-        op: "put",
-        collection: this.name,
-        id,
-        version,
-        actor: this.keyring.userId,
-        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
-      };
-      if (existing) {
-        appendInput.delta = this.strategies.history.computePatch(record, existing.record);
-      }
-      if (options?.reason !== void 0) appendInput.reason = options.reason;
-      await this.ledger.append(appendInput);
-    }
-    if (this.lazy && this.lru) {
-      this.lru.set(id, { record: await this._toCacheableRecord(record, envelope, id), version }, estimateRecordBytes(record));
-      await this.maintainPersistedIndexesOnPut(id, record, existing ? existing.record : null, version);
-    } else {
-      this.cache.set(id, { record: await this._toCacheableRecord(record, envelope, id), version });
-      this.indexes?.upsert(id, record, existing ? existing.record : null);
-      this.uniqueConstraints?.upsert(id, record, existing?.record);
-    }
-    await this._onRecordMutated(id, "put", "local-write", { record, version });
+    await this.#commitWriteTail({
+      id,
+      envelope,
+      version,
+      indexed: record,
+      event: record,
+      prior: existing,
+      reason: options?.reason
+    });
   }
   /**
    * Fire registered MV strategies whose dependency set includes this
@@ -3831,34 +3782,8 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const incoming = record;
-    if (incoming && typeof incoming === "object" && "_materializedFrom" in incoming) return;
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return;
-    let executor = null;
-    let staleHelpers = null;
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
-        }
-        await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-      } else if (mode === "lazy") {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-4UNPHWOU.js");
-        }
-        staleHelpers.markMVStale(registry, reg.spec.name);
-      }
-    }
+    const { dispatchMaterializedViews } = await import("./dispatch-SMXUO7W5.js");
+    return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
    * Fire registered derivation strategies for this source collection.
@@ -3946,6 +3871,32 @@ var Collection = class {
     return out;
   }
   /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
+  /** What `with-formula/materialized-views/dispatch.ts` needs from this collection (#842). */
+  #mvDispatchCtx(materializedViewSource) {
+    return {
+      materializedViewSource,
+      collectionName: this.name,
+      dispatchCtx: (source) => this.#dispatchCtx(source)
+    };
+  }
+  /**
+   * What `with-formula/derivations/dispatch.ts` needs from this collection (#842).
+   *
+   * The return type is inferred, not annotated: importing `DerivationDeleteCtx`
+   * would be a STATIC spine→service import, which `port-layering` rejects even
+   * when it is type-only — the guard scans import statements, not their
+   * erasure. The dynamic `import()` at the call site still types the argument.
+   */
+  #derivationDeleteCtx(derivationSource) {
+    return {
+      derivationSource,
+      collectionName: this.name,
+      adapter: this.adapter,
+      vault: this.vault,
+      getDEK: this.getDEK,
+      storeCiphertext: this.storeCiphertext
+    };
+  }
   #dispatchCtx(source) {
     return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.ledger, this.keyring.userId) };
   }
@@ -3971,11 +3922,7 @@ var Collection = class {
     const patched = { ...base, [field]: newValue };
     const txCtx = this.derivationSource.getActiveTxContext();
     if (txCtx !== null) {
-      const prior = await this.adapter.get(this.vault, into, parentId);
-      txCtx._executed.push({
-        op: { type: "put", vaultName: this.vault, collectionName: into, id: parentId },
-        priorEnvelope: prior
-      });
+      this.#trackPut(txCtx, into, parentId, await this.adapter.get(this.vault, into, parentId));
     }
     return putDerivedOutput(intoColl, parentId, patched, this.#dispatchCtx(source));
   }
@@ -4008,150 +3955,14 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const incoming = this.via ? this.via.canonicalizeStored(record) : record;
-    if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return;
-    let DerivationExecutor = null;
-    for (const { spec, strategyHash } of strategies) {
-      const mode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
-      if (spec.rollup) {
-        if (mode !== "eager") continue;
-        let parentId;
-        if (this.name === spec.rollup.from) {
-          const kv = incoming[spec.rollup.key];
-          parentId = typeof kv === "string" || typeof kv === "number" ? String(kv) : null;
-        } else {
-          parentId = id;
-        }
-        if (parentId !== null) await this.recomputeRollup(spec, parentId, { collection: this.name, id }, wave);
-        continue;
-      }
-      const isSource = spec.source === this.name;
-      const isSibling = !isSource && (spec.sources?.includes(this.name) ?? false);
-      const trigger = !isSource && !isSibling ? spec.triggerBy?.find((t) => t.collection === this.name) : void 0;
-      const runs = [];
-      if (isSource) {
-        runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version });
-      } else if (isSibling) {
-        const p = await this.derivationSource.getCollection(spec.source).get(id);
-        if (p !== null && p !== void 0) {
-          const raw = await this.derivationSource.getCollection(spec.source)._getStoredRecord(id);
-          runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 });
-        }
-      } else if (trigger) {
-        const srcColl = this.derivationSource.getCollection(spec.source);
-        const ids = await srcColl._findMatchingIds(trigger.on, id);
-        if (trigger.maxFanout !== void 0 && ids.length > trigger.maxFanout) {
-          throw new DerivationCapExceededError(`triggerBy ${this.name}\u2192${spec.source}`, ids.length, trigger.maxFanout);
-        }
-        for (const sid of ids) {
-          const raw = await srcColl._getStoredRecord(sid);
-          if (raw === null) continue;
-          runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 });
-        }
-      }
-      if (runs.length === 0) continue;
-      if (mode !== "eager") {
-        for (const run of runs) await markStale(registry, spec, run.runId);
-        continue;
-      }
-      if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
-      }
-      for (const run of runs) {
-        const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
-        const outCtx = this.#dispatchCtx({ collection: spec.source, id: run.runId });
-        const result = await DerivationExecutor.run(spec, run.input, run.version, strategyHash, ctx);
-        for (const key of Object.keys(spec.outputs)) {
-          const out = result.outputs[key];
-          if (!out) continue;
-          if (out.kind === "failed") {
-            const err = out.error;
-            if (spec.strict) throw err;
-            console.warn(`[derivation] output "${key}" for source "${spec.source}" id="${run.runId}" failed:`, err);
-            continue;
-          }
-          const outSpec = spec.outputs[key];
-          if (!outSpec) continue;
-          const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-          const txCtx = this.derivationSource.getActiveTxContext();
-          if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
-            const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
-            const prevKeys = new Set(prior?.keys ?? []);
-            const newKeysList = out.entries.map((e) => e.key);
-            const newKeysSet = new Set(newKeysList);
-            for (const k of prevKeys) {
-              if (newKeysSet.has(k)) continue;
-              await outputCollection._internalDelete(k, txCtx);
-            }
-            for (const entry of out.entries) {
-              if (txCtx !== null) {
-                const priorEnvelope = await this.adapter.get(this.vault, outSpec.collection, entry.key);
-                txCtx._executed.push({
-                  op: {
-                    type: "put",
-                    vaultName: this.vault,
-                    collectionName: outSpec.collection,
-                    id: entry.key
-                  },
-                  priorEnvelope
-                });
-              }
-              await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: "derived" });
-            }
-            await saveFanoutSidecar(this.adapter, this.vault, {
-              source: spec.source,
-              sourceId: run.runId,
-              outputKey: key,
-              outputCollection: outSpec.collection,
-              keys: newKeysList
-            }, this.getDEK, this.storeCiphertext);
-            continue;
-          }
-          if (out.skipped === true) {
-            await outputCollection._internalDelete(run.runId, txCtx);
-            continue;
-          }
-          if (outSpec.shape === "record" && outSpec.denorm !== void 0 && outSpec.collection === spec.source) {
-            const value = out.value;
-            const patched = { ...run.base };
-            let changed = false;
-            for (const f of outSpec.denorm) {
-              if (!selfWriteFieldEqual(run.base[f], value[f])) {
-                patched[f] = value[f];
-                changed = true;
-              }
-            }
-            if (!changed) continue;
-            if (txCtx !== null) {
-              const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-              txCtx._executed.push({
-                op: { type: "put", vaultName: this.vault, collectionName: outSpec.collection, id: run.runId },
-                priorEnvelope: prior
-              });
-            }
-            await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: "derived" });
-            continue;
-          }
-          if (txCtx !== null) {
-            const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-            txCtx._executed.push({
-              op: {
-                type: "put",
-                vaultName: this.vault,
-                collectionName: outSpec.collection,
-                id: run.runId
-              },
-              priorEnvelope: prior
-            });
-          }
-          await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: "derived" });
-        }
-      }
-    }
+    const { dispatchDerivations } = await import("./dispatch-PKQQFDBT.js");
+    return dispatchDerivations({
+      ...this.#derivationDeleteCtx(this.derivationSource),
+      via: this.via,
+      recomputeRollup: (spec, parentId, source, w) => this.recomputeRollup(spec, parentId, source, w),
+      dispatchCtx: (source) => this.#dispatchCtx(source),
+      trackPut: (txCtx, collectionName, rid, prior) => this.#trackPut(txCtx, collectionName, rid, prior)
+    }, id, record, version, wave);
   }
   /**
    * Delete a record by ID. Runs inside the hub's write-queue tracker
@@ -4421,33 +4232,8 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return 0;
-    let helpers = null;
-    const txCtx = this.derivationSource.getActiveTxContext();
-    let erased = 0;
-    for (const { spec } of strategies) {
-      for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
-        if (outSpec.shape === "record") {
-          if (eraseRecordShapeToo && spec.source === this.name && outSpec.collection !== this.name) {
-            if (await this.derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1;
-          }
-          continue;
-        }
-        if (helpers === null) {
-          helpers = await import("./fanout-sidecar-HJV3A7PM.js");
-        }
-        const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
-        if (!sidecar) continue;
-        const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-        for (const derivedId of sidecar.keys) {
-          if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1;
-        }
-        await helpers.deleteFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey);
-      }
-    }
-    return erased;
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-PKQQFDBT.js");
+    return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
    * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
@@ -4460,41 +4246,8 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    let executor = null;
-    let staleHelpers = null;
-    let deleted = 0;
-    const residueUndecodable = [];
-    const residueDeclined = [];
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
-        }
-        const rr = await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-        deleted += rr.deleted;
-        residueUndecodable.push(...rr.residueUndecodable);
-        residueDeclined.push(...rr.residueDeclined);
-      } else {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-4UNPHWOU.js");
-        }
-        const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
-        deleted += inv.deleted;
-        residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
-        residueDeclined.push(...inv.residueDeclined.map((rid) => `${reg.outputCollection}:${rid}`));
-      }
-    }
-    return { deleted, residueUndecodable, residueDeclined };
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-SMXUO7W5.js");
+    return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
    * List all records in the collection.
@@ -4513,7 +4266,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5666,14 +5419,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-7S5IEP6Q.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-52P3D72W.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-7S5IEP6Q.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-52P3D72W.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -7058,7 +6811,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-GNGGCFI4.js").then(
+  const load = () => engine ??= import("./link-set-ZU4E5J5S.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7596,7 +7349,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-A7HCFBP5.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-XIAHB6KF.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8113,6 +7866,43 @@ var VaultAttestation = class {
 };
 
 // src/kernel/vault.ts
+var COLLECTION_PASSTHROUGH_KEYS = [
+  "indexes",
+  "reconcileOnOpen",
+  "prefetch",
+  "cache",
+  "schema",
+  "conflictPolicy",
+  "crdt",
+  "deterministicFields",
+  "acknowledgeDeterministicRisk",
+  "acknowledgeEquatableRisk",
+  "sensitive",
+  "perRecordKeys",
+  "provenance",
+  "ramCiphertext",
+  "tiers",
+  "tierMode",
+  "blobTierPolicy",
+  "i18nFields",
+  "embeddings",
+  "textIndexes",
+  "warmIndexOnOpen",
+  "textIndexPersist",
+  "moneyFields",
+  "viaFields",
+  "computed",
+  "classifiedFields",
+  "fieldMeta",
+  "meta"
+];
+function copyDefined(dst, src, keys) {
+  if (src === void 0) return;
+  for (const key of keys) {
+    const value = src[key];
+    if (value !== void 0) dst[key] = value;
+  }
+}
 var Vault = class {
   adapter;
   /** The vault's name as passed to `openVault()`. Stable for the instance lifetime. */
@@ -8194,7 +7984,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
    */
   custody;
-  /** Re-derives an UnlockedKeyring from the adapter using the active user's passphrase; called by
+  /** Re-derives an UnlockedKeyring from the adapter using the active user's secret; called by
    *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
    *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
   reloadKeyring;
@@ -8559,7 +8349,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-YBMRLZLO.js");
+          const { persistSchemaIfNeeded } = await import("./register-HB4TQZSV.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8640,26 +8430,7 @@ var Vault = class {
           }
         } : {}
       };
-      if (options?.indexes !== void 0) collOpts.indexes = options.indexes;
-      if (options?.reconcileOnOpen !== void 0) collOpts.reconcileOnOpen = options.reconcileOnOpen;
-      if (options?.prefetch !== void 0) collOpts.prefetch = options.prefetch;
-      if (options?.cache !== void 0) collOpts.cache = options.cache;
-      if (options?.schema !== void 0) collOpts.schema = options.schema;
-      if (options?.conflictPolicy !== void 0) collOpts.conflictPolicy = options.conflictPolicy;
-      if (options?.crdt !== void 0) collOpts.crdt = options.crdt;
-      if (options?.deterministicFields !== void 0) {
-        collOpts.deterministicFields = options.deterministicFields;
-      }
-      if (options?.acknowledgeDeterministicRisk !== void 0) {
-        collOpts.acknowledgeDeterministicRisk = options.acknowledgeDeterministicRisk;
-      }
-      if (options?.acknowledgeEquatableRisk !== void 0) {
-        collOpts.acknowledgeEquatableRisk = options.acknowledgeEquatableRisk;
-      }
-      if (options?.sensitive !== void 0) {
-        collOpts.sensitive = options.sensitive;
-      }
-      if (options?.perRecordKeys !== void 0) collOpts.perRecordKeys = options.perRecordKeys;
+      copyDefined(collOpts, options, COLLECTION_PASSTHROUGH_KEYS);
       const subjectKey = this.strategies.forget.subjects[collectionName];
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
@@ -8674,22 +8445,8 @@ var Vault = class {
           if (value !== void 0 && value !== null) await this._addSubjectRef(coerceSubjectId(value), { collection: collectionName, id });
         };
       }
-      if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
-      if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
-      if (options?.tiers !== void 0) collOpts.tiers = options.tiers;
-      if (options?.tierMode !== void 0) collOpts.tierMode = options.tierMode;
-      if (options?.blobTierPolicy !== void 0) collOpts.blobTierPolicy = options.blobTierPolicy;
       collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
       if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
-      if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
-      if (options?.embeddings !== void 0) collOpts.embeddings = options.embeddings;
-      if (options?.textIndexes !== void 0) collOpts.textIndexes = options.textIndexes;
-      if (options?.warmIndexOnOpen !== void 0) collOpts.warmIndexOnOpen = options.warmIndexOnOpen;
-      if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
-      if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
-      if (options?.viaFields !== void 0) collOpts.viaFields = options.viaFields;
-      if (options?.computed !== void 0) collOpts.computed = options.computed;
-      if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
       if (effectiveViaFields.dictKeyFields !== void 0 || effectiveViaFields.lookupFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
@@ -8723,10 +8480,6 @@ var Vault = class {
       if (effectiveViaFields.i18nFields !== void 0 && this.translateText) {
         collOpts.autoTranslateHook = this.translateText;
       }
-      if (options?.fieldMeta !== void 0) {
-        collOpts.fieldMeta = options.fieldMeta;
-      }
-      if (options?.meta !== void 0) collOpts.meta = options.meta;
       if (options?.refs !== void 0) {
         collOpts.declaredRefs = this.refRegistry.getOutbound(collectionName);
       }
@@ -8745,7 +8498,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-YBMRLZLO.js")).persistSchemaIfNeeded({
+            await (await import("./register-HB4TQZSV.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9243,7 +8996,7 @@ var Vault = class {
    * is re-keyed for distinct recipients.
    *
    * Each recipient becomes its own `KeyringFile` sealed with that
-   * recipient's passphrase. The DEKs wrapped into each slot are
+   * recipient's secret. The DEKs wrapped into each slot are
    * exactly those the recipient's role + permissions justify, and
    * never wider than the source keyring's own DEK set
    * (privilege-escalation check).
@@ -9932,7 +9685,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-ZULMLCJK.js"),
+      import("./registry-JOFO7RAH.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9964,7 +9717,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-4V4YQCXJ.js");
+    const { MaterializedViewRegistry } = await import("./registry-6BMBFEXT.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9989,7 +9742,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-3LXKNXWI.js");
+    const { OverlayedViewRegistry } = await import("./registry-7CZWF3EQ.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -10036,14 +9789,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-YORMIBWV.js");
+    const { MaterializedViewExecutor } = await import("./executor-SHYLIBOM.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-4UNPHWOU.js");
+    const { clearMVStaleFully } = await import("./stale-NBROTA66.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10056,7 +9809,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-TEZYRDN3.js");
+    const { DerivationExecutor } = await import("./executor-FCJEH3FU.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10083,7 +9836,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WWXVHHUH.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10310,10 +10063,10 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
-        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
+        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
       );
     }
     const targetKek = this.keyring.kek;
@@ -10332,7 +10085,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10580,7 +10333,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-H4YE52S2.js");
+    const { dumpVaultSchema } = await import("./walk-E3OVLBFR.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10715,7 +10468,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-B5MY43CK.js");
+    const { readCover } = await import("./cover-5BSNJREH.js");
     return readCover(this.adapter, this.name, opts);
   }
   /**
@@ -10730,7 +10483,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-JL2GOTYQ.js");
+    const { dumpVault } = await import("./backup-YCHAC575.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10782,7 +10535,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-JL2GOTYQ.js");
+    const { loadVault } = await import("./backup-YCHAC575.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10814,7 +10567,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-JL2GOTYQ.js");
+    const { verifyBackupIntegrity } = await import("./backup-YCHAC575.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -11032,7 +10785,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-JL2GOTYQ.js");
+    const { exportVaultJSON } = await import("./backup-YCHAC575.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11720,8 +11473,8 @@ async function describeAuthConfig(store, vault) {
   const lines = [];
   lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
   lines.push("");
-  lines.push("Tier 1 \u2014 Passphrase (master)");
-  lines.push(`  Phrase format: ${policy.passphrase?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.passphrase?.minWordLength ?? 3} chars/word`);
+  lines.push("Tier 1 \u2014 Secret (master)");
+  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
   lines.push("  Strength validator: enforced (override available for tests only)");
   lines.push("");
   lines.push("Tier 2 \u2014 Authenticate (routine login)");
@@ -11732,7 +11485,7 @@ async function describeAuthConfig(store, vault) {
   lines.push("  Method: PIN (per-app configurable)");
   lines.push("");
   lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
-  lines.push("Managed-passphrase mode: off (post-1.0)");
+  lines.push("Managed-secret mode: off (post-1.0)");
   lines.push("");
   lines.push("Sensitive-action gates:");
   for (const [gate, gp] of Object.entries(policy.gates)) {
@@ -11745,7 +11498,7 @@ async function diagramAuthConfig(store, vault) {
   const lines = [];
   lines.push("flowchart TB");
   lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
-  lines.push('  tier1["Tier 1<br/>Passphrase"]');
+  lines.push('  tier1["Tier 1<br/>Secret"]');
   lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
   lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
   lines.push("  vault --> tier1");
@@ -11819,7 +11572,7 @@ function describeGatePolicy(gp) {
 }
 function defaultPolicySnapshot() {
   return {
-    passphrase: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
+    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
     gates: {}
   };
 }
@@ -11969,7 +11722,7 @@ var TeamFacade = class {
    * ```ts
    * import { enrollWebAuthn } from '@noy-db/on-webauthn'
    *
-   * await db.enrollWebAuthn('demo', async (keyring) => {
+   * await db.team.enrollWebAuthn('demo', async (keyring) => {
    *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
    *   return {
    *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
@@ -11998,7 +11751,7 @@ var TeamFacade = class {
     const slotOptions = await ceremony(keyring);
     if (slotOptions.method !== "webauthn") {
       throw new ValidationError(
-        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.enrollAuthenticator() for non-webauthn methods.`
+        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.team.enrollAuthenticator() for non-webauthn methods.`
       );
     }
     const credentialId = slotOptions.meta.credentialId;
@@ -12076,44 +11829,44 @@ var TeamFacade = class {
   }
   // ─── Tier-1 change flows ────────────────────────────────────────
   /**
-   * Rotate the user's passphrase (user remembers old). Validates the
-   * new phrase against the configured `passphrase` policy, runs the
-   * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+   * Rotate the user's secret (user remembers old). Validates the
+   * new phrase against the configured `secret` policy, runs the
+   * `rotate-secret` gate, then re-derives + re-wraps every DEK.
    *
    * Tier-2 authenticator slots are dropped — each slot wraps the old
    * KEK and would need its derivation key to be re-presented. Re-enrol
    * via `db.enrollAuthenticator` after rotation.
    *
-   * @throws `WeakPassphraseError` on a weak new phrase.
+   * @throws `WeakSecretError` on a weak new phrase.
    * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
-   * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+   * @throws `InvalidKeyError` when `oldSecret` is wrong.
    */
-  async rotatePassphrase(vault, input, factors) {
-    if (this.deps.options.passphraseMode === "managed") {
+  async rotateSecret(vault, input, factors) {
+    if (this.deps.options.secretMode === "managed") {
       throw new PolicyDeniedError(
-        "rotate-passphrase",
+        "rotate-secret",
         "disabled",
         { minTier: 1, enabled: false },
-        "Managed-passphrase mode (#14): the passphrase is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed passphrase."
+        "Managed-secret mode (#14): the secret is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed secret."
       );
     }
-    await this.deps.checkGate(vault, "rotate-passphrase", factors);
+    await this.deps.checkGate(vault, "rotate-secret", factors);
     const userId = this.deps.options.user;
-    const next = await rotatePassphrase(this.deps.options.store, vault, userId, input);
+    const next = await rotateSecret(this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
   }
   /**
-   * Reset the passphrase using a recovery proof (user forgot the old).
+   * Reset the secret using a recovery proof (user forgot the old).
    * Currently supports the `'paper'` profile end-to-end; the
    * other profiles throw {@link RecoveryProfileNotImplementedError}.
    *
    * Burns the used recovery entry on success.
    */
-  async recoverPassphrase(vault, input, factors) {
-    await this.deps.checkGate(vault, "recover-passphrase", factors);
+  async recoverSecret(vault, input, factors) {
+    await this.deps.checkGate(vault, "recover-secret", factors);
     const userId = this.deps.options.user;
     const entriesBeforeRecovery = await loadPaperRecoveryEntries(this.deps.options.store, vault);
-    const next = await recoverPassphrase(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
+    const next = await recoverSecret(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
     const rotateRemaining = input.rotateRemainingCodes ?? true;
     const remainingAfterBurn = Math.max(0, entriesBeforeRecovery.length - 1);
@@ -12135,15 +11888,15 @@ var TeamFacade = class {
   }
   /**
    * Deliberate paper-recovery-code regeneration. User knows their
-   * passphrase but wants a fresh sheet — they lost the printout or
+   * secret but wants a fresh sheet — they lost the printout or
    * suspect compromise of the off-site copy.
    *
-   * Symmetric to {@link rotatePassphrase} for the recovery profile:
+   * Symmetric to {@link rotateSecret} for the recovery profile:
    * gated, audit-trackable, ergonomic. Replaces (not appends) the
    * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
    *
    * Gated by the `rotate-recovery` policy gate:
-   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the secret
    *     suffices, matching the lower-level flow's bar.
    *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
    *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
@@ -12163,13 +11916,13 @@ var TeamFacade = class {
    *
    * @example Default count + show-once UI
    * ```ts
-   * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+   * const { newCodes } = await db.team.rotateRecovery('acme', { profile: 'paper' })
    * showCodesToUser(newCodes)
    * ```
    *
    * @example STRICT-policy site with TOTP factor proof
    * ```ts
-   * await db.rotateRecovery(
+   * await db.team.rotateRecovery(
    *   'acme',
    *   { profile: 'paper', count: 10 },
    *   { factors: [{ kind: 'totp', proof: '123456' }] },
@@ -12193,7 +11946,7 @@ var TeamFacade = class {
     const existing = await loadPaperRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
+        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
       );
     }
     const keyring = await this.getKeyring(vault);
@@ -12215,7 +11968,7 @@ var TeamFacade = class {
     const existing = await loadShamirRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
+        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
       );
     }
     let targetEntryId;
@@ -12252,7 +12005,7 @@ var TeamFacade = class {
    * **Atomic create-and-enroll for managed-mode vaults.**
    *
    * Bootstraps a managed-mode vault and enrolls strong recovery in
-   * a single ceremony. Under `passphraseMode: 'managed'`, every
+   * a single ceremony. Under `secretMode: 'managed'`, every
    * `openVault` call requires a strong recovery profile (Shamir
    * today) to be enrolled — otherwise it throws
    * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
@@ -12271,11 +12024,11 @@ var TeamFacade = class {
    * ```ts
    * const db = await createNoydb({
    *   store, user: 'alice',
-   *   passphraseMode: 'managed',
+   *   secretMode: 'managed',
    *   sealingKey: macosKeychainSealingProvider({ ... }),
    * })
    *
-   * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+   * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
    *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
    * })
    * for (const r of recoveryEnrollments) {
@@ -12292,11 +12045,11 @@ var TeamFacade = class {
         "openVaultAndEnrollRecovery: at least one recovery enrollment is required."
       );
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const hasStrong = opts.recovery.some((r) => r.profile === "shamir");
       if (!hasStrong) {
         throw new ValidationError(
-          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user passphrase to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
+          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user secret to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
         );
       }
     }
@@ -12311,7 +12064,7 @@ var TeamFacade = class {
     for (const enrollment of opts.recovery) {
       recoveryEnrollments.push(await this.enrollRecovery(vault, enrollment));
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const policy = this.deps.policyCache.get(vault);
       if (policy) {
         await this.deps.assertRecoveryEnrolled(vault, policy);
@@ -12320,20 +12073,20 @@ var TeamFacade = class {
     return { vault: vaultHandle, recoveryEnrollments };
   }
   /**
-   * **Recovery flow under managed-passphrase mode.**
+   * **Recovery flow under managed-secret mode.**
    *
-   * Replaces the sealed passphrase of a managed-mode vault with a
+   * Replaces the sealed secret of a managed-mode vault with a
    * fresh 256-bit random, sealed under the configured
-   * `SealingKeyProvider`. The user never sees the new passphrase.
+   * `SealingKeyProvider`. The user never sees the new secret.
    *
    * Internally:
    *   1. Verify the recovery proof (Shamir today) and unwrap the
    *      DEK set.
-   *   2. Mint a fresh 256-bit random as the new effective passphrase.
+   *   2. Mint a fresh 256-bit random as the new effective secret.
    *   3. Rewrap the DEK set under a fresh KEK derived from the new
-   *      passphrase (via the existing `recoverPassphrase` path).
+   *      secret (via the existing `recoverSecret` path).
    *   4. Seal the random bytes under the provider and overwrite
-   *      `_meta/sealed-passphrase`.
+   *      `_meta/sealed-secret`.
    *   5. Drop the keyring cache so the next operation re-derives.
    *
    * The vault's strong-recovery enrollment is preserved across
@@ -12341,40 +12094,40 @@ var TeamFacade = class {
    *
    * @throws ValidationError if the Noydb instance is not in managed mode.
    */
-  async recoverManagedPassphrase(vault, options) {
-    if (this.deps.options.passphraseMode !== "managed") {
+  async recoverManagedSecret(vault, options) {
+    if (this.deps.options.secretMode !== "managed") {
       throw new ValidationError(
-        "recoverManagedPassphrase: this method only applies to vaults opened in managed-passphrase mode. For standard mode, use db.recoverPassphrase."
+        "recoverManagedSecret: this method only applies to vaults opened in managed-secret mode. For standard mode, use db.recoverSecret."
       );
     }
     const provider = this.deps.options.sealingKey;
     if (!provider) {
       throw new ValidationError(
-        'recoverManagedPassphrase: createNoydb({ passphraseMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed passphrase cannot be persisted.'
+        'recoverManagedSecret: createNoydb({ secretMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed secret cannot be persisted.'
       );
     }
     const randomBytes = new Uint8Array(32);
     globalThis.crypto.getRandomValues(randomBytes);
     let binary = "";
     for (let i = 0; i < randomBytes.length; i++) binary += String.fromCharCode(randomBytes[i]);
-    const newPassphrase = btoa(binary);
+    const newSecret = btoa(binary);
     try {
       const sealed = await provider.seal(randomBytes);
-      await recoverPassphrase(
+      await recoverSecret(
         this.deps.options.shamirRecovery,
         this.deps.options.store,
         vault,
         this.deps.options.user,
         {
-          newPassphrase,
+          newSecret,
           recoveryProof: options.recoveryProof,
-          // The new passphrase IS 256 bits of random; policy gates on
+          // The new secret IS 256 bits of random; policy gates on
           // length/entropy don't apply.
-          allowWeakPassphrase: true,
-          ...options.passphrasePolicy !== void 0 ? { passphrasePolicy: options.passphrasePolicy } : {}
+          allowWeakSecret: true,
+          ...options.secretPolicy !== void 0 ? { secretPolicy: options.secretPolicy } : {}
         }
       );
-      await saveSealedPassphrase(this.deps.options.store, vault, {
+      await saveSealedSecret(this.deps.options.store, vault, {
         providerId: provider.id,
         sealed
       });
@@ -12385,7 +12138,7 @@ var TeamFacade = class {
   }
   /**
    * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
-   * a fresh temp passphrase in a single store write. Closes the
+   * a fresh temp secret in a single store write. Closes the
    * partial-failure window (the previous compose-from-primitives
    * pattern was `db.revoke + db.grant`, two writes — if the issuer
    * cancelled between them the target was locked out entirely).
@@ -12404,17 +12157,17 @@ var TeamFacade = class {
    * recovery / TOTP / email-OTP factor proof at the moment of
    * recovery, so the issuer affirmatively re-asserts identity.
    *
-   * The recipient should call `db.rotatePassphrase` on first session
+   * The recipient should call `db.rotateSecret` on first session
    * to choose their own phrase — the temp acts as a single-use
    * bridge.
    *
    * ```ts
-   * await db.recoverUser('acme', {
+   * await db.team.recoverUser('acme', {
    *   userId: 'bob',
-   *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+   *   secret: 'temporary-correct-horse-battery-staple-printer',
    * }, { factors: [{ kind: 'recovery' }] })
    * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-   * // and immediately calls db.rotatePassphrase to set his own.
+   * // and immediately calls db.rotateSecret to set his own.
    * ```
    *
    * @throws `NoAccessError` when no keyring exists for the target.
@@ -12440,17 +12193,17 @@ var TeamFacade = class {
    * The hub wraps the user's DEK set (not the KEK) under a code-derived
    * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
    * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
-   * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+   * pair it with `db.team.getKeyring(vault)` to obtain the live DEK set:
    *
    * ```ts
    * import { mintPaperRecoveryEntry } from '@noy-db/hub'
    *
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
    * const entries = await Promise.all(
    *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
    * )
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * showCodesToUser(codes)
    * ```
    *
@@ -12461,7 +12214,7 @@ var TeamFacade = class {
    * ```ts
    * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
    * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * ```
    */
   async enrollRecovery(vault, enrollment) {
@@ -12561,7 +12314,7 @@ var TeamFacade = class {
    * and no `secret` / `getKeyring` is configured.
    *
    * ```ts
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * // keyring.deks: Map<collection, CryptoKey>
    * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
    * // keyring.role / .permissions / .authenticators
@@ -12638,7 +12391,7 @@ var Noydb = class {
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
   /**
-   * Per-vault active session tier — defaults to `1` after a passphrase
+   * Per-vault active session tier — defaults to `1` after a secret
    * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
    * {@link checkGate} to evaluate `gate.minTier`.
    */
@@ -12686,7 +12439,23 @@ var Noydb = class {
   policyManager;
   /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
   policyCheckGate;
-  team;
+  /**
+   * Credential and multi-user operations — enrolment, secret rotation,
+   * recovery, quick-unlock (#846).
+   *
+   * Public because 23 methods on this class did nothing but restate a
+   * TeamFacade signature and forward to it, so every signature had to be
+   * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+   * reads the same and has one source of truth.
+   *
+   * A getter, not a field, so it appears in the prototype-based kernel API
+   * manifest — an instance field is invisible to it (the same reason
+   * `custodyStrategy` became one in #838).
+   */
+  get team() {
+    return this.#team;
+  }
+  #team;
   /**
    * Currently-running multi-record transaction, set by
    * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -12748,7 +12517,7 @@ var Noydb = class {
         this.vaultCache.delete(vault);
       }
     });
-    this.team = new TeamFacade({
+    this.#team = new TeamFacade({
       options: this.options,
       keyringCache: this.keyringCache,
       activeTier: this.activeTier,
@@ -12850,7 +12619,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-WQQRU6DO.js");
+      const { GuardExecutor } = await import("./executor-OHET7TF7.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13235,9 +13004,9 @@ var Noydb = class {
    *
    * The walk is a two-step pipeline: first ask the adapter for the
    * universe of compartments it stores, then for each one attempt to
-   * load the calling user's keyring with the in-memory passphrase.
+   * load the calling user's keyring with the in-memory secret.
    * Compartments where the user has no keyring file (`NoAccessError`)
-   * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+   * or where the secret doesn't unwrap (`InvalidKeyError`) are
    * silently dropped from the result — the existence of those
    * compartments is **not** confirmed in the return value.
    *
@@ -13258,15 +13027,15 @@ var Noydb = class {
    * **Known edge case.** A vault whose keyring file
    * happens to have an empty wrapped-DEKs map (because the owner
    * granted access before any collection was created) will pass the
-   * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+   * `loadKeyring` probe with *any* secret — there are no DEKs to
    * unwrap, so the integrity-checked unwrap that normally rejects
-   * wrong passphrases never runs. The result is that an unrelated
+   * wrong secrets never runs. The result is that an unrelated
    * principal who happens to know the user-id and the vault
    * name can show up in `listAccessibleVaults()` as having
    * access to that empty vault. They cannot read any actual
    * data (their DEK set is empty), so this is a metadata leak
    * (vault name + user-id), not a content leak. Hardening this
-   * via a passphrase canary in the keyring file is a deferred
+   * via a secret canary in the keyring file is a deferred
    * follow-up.
    *
    * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -13307,7 +13076,7 @@ var Noydb = class {
     }
     if (!this.options.secret) {
       throw new ValidationError(
-        "Noydb.listAccessibleVaults(): a secret (passphrase) is required when encryption is enabled."
+        "Noydb.listAccessibleVaults(): a secret (secret) is required when encryption is enabled."
       );
     }
     const minRank = ROLE_RANK[options.minRole ?? "client"];
@@ -13446,21 +13215,21 @@ var Noydb = class {
     return store.resolveBackend ? store.resolveBackend(vaultId) : this.options.store;
   }
   /**
-   * Change the current user's passphrase for a vault.
+   * Change the current user's secret for a vault.
    *
-   * Validates the new passphrase against the strength rules. Pass
-   * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-   * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+   * Validates the new secret against the strength rules. Pass
+   * `{ allowWeakSecret: true }` to skip — typically only useful for
+   * fixtures and migrations. Pass a `SecretPolicy` to override the
    * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
    */
-  async changeSecret(vault, newPassphrase, options) {
+  async changeSecret(vault, newSecret, options) {
     this.checkPolicyOperation(vault, "changeSecret");
     const keyring = await this._getKeyringInternal(vault);
     const updated = await changeSecret(
       this.options.store,
       vault,
       keyring,
-      newPassphrase,
+      newSecret,
       options
     );
     this.keyringCache.set(vault, updated);
@@ -13941,7 +13710,7 @@ var Noydb = class {
    * denial; resolves with `void` on success.
    *
    * @param vault    The vault whose policy applies.
-   * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+   * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
    *                 or app-defined (`app:*`).
    * @param presented Caller-supplied factor proofs.
    */
@@ -13966,12 +13735,12 @@ var Noydb = class {
    * Two enforcement modes:
    *
    * 1. **Managed-mode mandatory strong-recovery.** When
-   *    `passphraseMode === 'managed'`, the vault MUST have at least
+   *    `secretMode === 'managed'`, the vault MUST have at least
    *    one **strong** recovery profile (Shamir today). Paper alone is
    *    rejected because under managed mode the user has no memorized
-   *    passphrase, so losing the paper sheet = losing every record.
+   *    secret, so losing the paper sheet = losing every record.
    *    This check is unconditional — independent of `requireRecovery`
-   *    and the `recover-passphrase` gate.
+   *    and the `recover-secret` gate.
    *
    * 2. **Opt-in strict mandatory-recovery.** When
    *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -13985,14 +13754,14 @@ var Noydb = class {
    */
   async assertRecoveryEnrolled(vault, policy, opts) {
     const skipManaged = (opts?.skipManagedCheck ?? false) || this._skipNextManagedRecoveryCheck;
-    if (this.options.passphraseMode === "managed" && !skipManaged) {
+    if (this.options.secretMode === "managed" && !skipManaged) {
       const enrolled2 = await hasStrongRecoveryEnrolled(this.options.store, vault);
       if (!enrolled2) {
         throw new ManagedRecoveryNotEnrolledError(vault);
       }
     }
     if (this.options.requireRecovery !== true) return;
-    const gate = policy.gates["recover-passphrase"];
+    const gate = policy.gates["recover-secret"];
     if (gate?.enabled === false) return;
     const enrolled = await hasRecoveryEnrolled(this.options.store, vault);
     if (enrolled) return;
@@ -14007,34 +13776,6 @@ var Noydb = class {
     this.activeTier.set(vault, tier);
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
-  /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-  async enrollAuthenticator(vault, options, factors) {
-    return this.team.enrollAuthenticator(vault, options, factors);
-  }
-  /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-  async removeAuthenticator(vault, slotId, factors) {
-    return this.team.removeAuthenticator(vault, slotId, factors);
-  }
-  /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-  async listAuthenticators(vault) {
-    return this.team.listAuthenticators(vault);
-  }
-  /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-  async updateAuthenticator(vault, slotId, options, factors) {
-    return this.team.updateAuthenticator(vault, slotId, options, factors);
-  }
-  /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-  async enrollWebAuthn(vault, ceremony, factors) {
-    return this.team.enrollWebAuthn(vault, ceremony, factors);
-  }
-  /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-  async listWebAuthnSlots(vault) {
-    return this.team.listWebAuthnSlots(vault);
-  }
-  /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-  async unlockViaAuthenticator(vault, slotId, verify) {
-    return this.team.unlockViaAuthenticator(vault, slotId, verify);
-  }
   // ─── Cover (https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md) ──────
   /**
    * Set the owner-curated cover for a vault. Throws
@@ -14058,7 +13799,7 @@ var Noydb = class {
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-B5MY43CK.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-5BSNJREH.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -14090,76 +13831,12 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-B5MY43CK.js");
+    const { readCover } = await import("./cover-5BSNJREH.js");
     return readCover(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
-  /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-  async describeAuthConfig(vault) {
-    return this.team.describeAuthConfig(vault);
-  }
-  /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-  async diagramAuthConfig(vault) {
-    return this.team.diagramAuthConfig(vault);
-  }
-  /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-  async describeUserAuth(vault, userId, factors) {
-    return this.team.describeUserAuth(vault, userId, factors);
-  }
-  /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-  async describeAllUsersAuth(vault, factors) {
-    return this.team.describeAllUsersAuth(vault, factors);
-  }
   // ─── Tier-1 change flows ────────────────────────────────────────
-  /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-  async rotatePassphrase(vault, input, factors) {
-    return this.team.rotatePassphrase(vault, input, factors);
-  }
-  /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-  async recoverPassphrase(vault, input, factors) {
-    return this.team.recoverPassphrase(vault, input, factors);
-  }
-  /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-  async rotateRecovery(vault, options, factors) {
-    return this.team.rotateRecovery(vault, options, factors);
-  }
-  /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-  async openVaultAndEnrollRecovery(vault, opts) {
-    return this.team.openVaultAndEnrollRecovery(vault, opts);
-  }
-  /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-  async recoverManagedPassphrase(vault, options) {
-    return this.team.recoverManagedPassphrase(vault, options);
-  }
-  /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-  async recoverUser(vault, options, factors) {
-    return this.team.recoverUser(vault, options, factors);
-  }
-  /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-  async enrollRecovery(vault, enrollment) {
-    return this.team.enrollRecovery(vault, enrollment);
-  }
-  /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-  async listRecoveryEntries(vault) {
-    return this.team.listRecoveryEntries(vault);
-  }
   // ─── Tier-3 enroll / unlock ─────────────────────────────────────
-  /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-  async enrollUnlock(vault, state, factors) {
-    return this.team.enrollUnlock(vault, state, factors);
-  }
-  /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-  async unlockViaPin(vault, resume) {
-    return this.team.unlockViaPin(vault, resume);
-  }
-  /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-  clearQuickUnlock(vault) {
-    this.team.clearQuickUnlock(vault);
-  }
-  /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-  async getKeyring(vault) {
-    return this.team.getKeyring(vault);
-  }
   /**
    * Live-reference variant used by the hub's own code paths. Internal
    * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a
@@ -14180,7 +13857,7 @@ var Noydb = class {
     }
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
-    if (this.options.passphraseMode === "managed") {
+    if (this.options.secretMode === "managed") {
       effectiveSecret = await resolveManagedSecret(
         this.options.store,
         vault,
@@ -14190,7 +13867,7 @@ var Noydb = class {
       effectiveSecret = this.options.secret;
     }
     if (!effectiveSecret) {
-      throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+      throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
     }
     let keyring;
     try {
@@ -14204,10 +13881,10 @@ var Noydb = class {
           effectiveSecret,
           {
             // Managed mode generates 256-bit base64 strings that don't satisfy
-            // the human-passphrase strength rules (no spaces, no "words").
+            // the human-secret strength rules (no spaces, no "words").
             // Skip validation in managed mode — the entropy floor is already
             // 256 bits by construction.
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
+            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
           }
         );
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
@@ -14218,7 +13895,7 @@ var Noydb = class {
           this.options.user,
           effectiveSecret,
           {
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
+            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
           }
         );
       } else {
@@ -14256,34 +13933,34 @@ var Noydb = class {
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   const encrypted = options.encrypt !== false;
-  const managed = options.passphraseMode === "managed";
+  const managed = options.secretMode === "managed";
   if (options.secret && options.getKeyring) {
     throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
   }
   if (managed) {
     if (options.secret) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the passphrase itself. Drop `secret`.'
+        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
       );
     }
     if (options.getKeyring) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
+        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
       );
     }
     if (!options.sealingKey) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
       );
     }
   }
   if (encrypted && !managed && !options.secret && !options.getKeyring) {
-    throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-UPAT2O3M.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-22ES33N3.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-EAXSJNOT.js");
+    const policyModule = await import("./policy-IY2YEA3A.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14320,4 +13997,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-W7TCXZWU.js.map
+//# sourceMappingURL=chunk-EEZCB74X.js.map