@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.6

package/dist/team/index.js

@@ -5,25 +5,32 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-EW4HFWGJ.js";
+} from "../chunk-EPME33Y4.js";
 import {
   NO_TEAM,
+  burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
   isMagicLinkGrantExpired,
   listMagicLinkGrants,
+  loadPaperRecoveryEntries,
   magicLinkGrantRecordId,
+  mintPaperRecoveryEntry,
+  mintWrappedDeksBlob,
   readMagicLinkGrantRecord,
-  recoverPassphrase,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
   revokeMagicLinkGrant,
-  rotatePassphrase,
+  rotateSecret,
+  savePaperRecoveryEntries,
+  unwrapDeksFromBlob,
+  unwrapDeksFromPaperEntry,
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-QUIG6BZT.js";
+} from "../chunk-M4GO4ZJK.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -41,36 +48,27 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-WJDYZP3U.js";
-import "../chunk-7B4GPCX7.js";
-import {
-  burnPaperRecoveryEntry,
-  loadPaperRecoveryEntries,
-  mintPaperRecoveryEntry,
-  mintWrappedDeksBlob,
-  savePaperRecoveryEntries,
-  unwrapDeksFromBlob,
-  unwrapDeksFromPaperEntry
-} from "../chunk-3O62PVDW.js";
+} from "../chunk-ZDFU34XY.js";
+import "../chunk-7IQWHYL2.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-QAFWRGVD.js";
+} from "../chunk-ZHMUFYZF.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-F4COUZLL.js";
-import "../chunk-MSO2C3KG.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+import "../chunk-TMR64XPL.js";
+import "../chunk-LC7DSMHR.js";
+import "../chunk-MMVQ3SUO.js";
+import "../chunk-KCZAFDP5.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-DOZFU7OZ.js";
 import {
   TeamNotEnabledError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,
@@ -108,12 +106,12 @@ export {
   persistKeyring,
   putCredential,
   readMagicLinkGrantRecord,
-  recoverPassphrase,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
   revoke,
   revokeMagicLinkGrant,
-  rotatePassphrase,
+  rotateSecret,
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry,

package/dist/tiers/index.js

@@ -11,19 +11,19 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-5KI3REO3.js";
-import "../chunk-MSO2C3KG.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-HDF5R2K6.js";
+import "../chunk-LC7DSMHR.js";
+import "../chunk-MMVQ3SUO.js";
+import "../chunk-KCZAFDP5.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-DOZFU7OZ.js";
 import {
   TiersNotEnabledError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,12 +3,16 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-FLHOTGOO.js";
+} from "../chunk-QVGEVZ5F.js";
+import {
+  lazy
+} from "../chunk-5D2ALSM5.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
+var loadGuardExecutor = lazy(() => import("../executor-OHET7TF7.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {
@@ -44,7 +48,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-WQQRU6DO.js");
+      const { GuardExecutor } = await loadGuardExecutor();
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/tx/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/tx/dry-run.ts","../../src/with-commit/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection._putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../../kernel/noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\nimport type { GuardExecutor as GuardExecutorType } from '../../with-audit/guards/executor.js'\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection._putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = (await import('../../with-audit/guards/executor.js')) as { GuardExecutor: typeof GuardExecutorType }\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TxStrategy } from './strategy.js'\nimport type { TransactionInvariant } from './invariants.js'\n\n/**\n * Options for {@link withTransactions}. Currently only commit-time\n * changeset `invariants` (see {@link TransactionInvariant}).\n */\nexport interface TransactionStrategyOptions {\n  /**\n   * Commit-time set-level invariants run over the changeset on every\n   * commit (ordinary AND amendment). See {@link TransactionInvariant}.\n   */\n  invariants?: ReadonlyArray<TransactionInvariant>\n}\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ txStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n *\n * Supply `{ invariants }` to register commit-time changeset invariants —\n * set-level constraints that fire after the writes commit and revert the\n * transaction on a throw. Unlike `amendment.invariant`, these run for\n * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.\n */\nexport function withTransactions(opts?: TransactionStrategyOptions): TxStrategy {\n  const invariants = opts?.invariants ?? []\n  return {\n    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),\n    runDryRun,\n  }\n}\n"],"mappings":";;;;;;;;;;;AAiCA,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAK,MAAM,OAAO,yBAAqC;AAC7E,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;AClEO,SAAS,iBAAiB,MAA+C;AAC9E,QAAM,aAAa,MAAM,cAAc,CAAC;AACxC,SAAO;AAAA,IACL,gBAAgB,CAAC,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,SAAS,UAAU;AAAA,IAC/E;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/tx/dry-run.ts","../../src/with-commit/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection._putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../../kernel/noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadGuardExecutor = lazy(() => import('../../with-audit/guards/executor.js'))\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection._putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = await loadGuardExecutor()\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TxStrategy } from './strategy.js'\nimport type { TransactionInvariant } from './invariants.js'\n\n/**\n * Options for {@link withTransactions}. Currently only commit-time\n * changeset `invariants` (see {@link TransactionInvariant}).\n */\nexport interface TransactionStrategyOptions {\n  /**\n   * Commit-time set-level invariants run over the changeset on every\n   * commit (ordinary AND amendment). See {@link TransactionInvariant}.\n   */\n  invariants?: ReadonlyArray<TransactionInvariant>\n}\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ txStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n *\n * Supply `{ invariants }` to register commit-time changeset invariants —\n * set-level constraints that fire after the writes commit and revert the\n * transaction on a throw. Unlike `amendment.invariant`, these run for\n * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.\n */\nexport function withTransactions(opts?: TransactionStrategyOptions): TxStrategy {\n  const invariants = opts?.invariants ?? []\n  return {\n    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),\n    runDryRun,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,IAAM,oBAAoB,KAAK,MAAM,OAAO,yBAAqC,CAAC;AAuBlF,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAI,MAAM,kBAAkB;AAClD,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;ACtEO,SAAS,iBAAiB,MAA+C;AAC9E,QAAM,aAAa,MAAM,cAAc,CAAC;AACxC,SAAO;AAAA,IACL,gBAAgB,CAAC,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,SAAS,UAAU;AAAA,IAC/E;AAAA,EACF;AACF;","names":[]}

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-MXN66IIH.js → verify-5X37OXRY.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-LLVW4V7R.js";
+} from "./chunk-5WLDZZ6S.js";
 import {
   dualReadSealedSlot
-} from "./chunk-M25ZIEB2.js";
+} from "./chunk-5HSSTOOG.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-MXN66IIH.js.map
+//# sourceMappingURL=verify-5X37OXRY.js.map

package/dist/via/blob/index.d.ts

@@ -36,3 +36,5 @@ export { runCompaction, BLOB_EVICTION_AUDIT_COLLECTION } from '../../with-shape/
 export type { BlobFieldsConfig, BlobFieldPolicy, BlobEvictionEntry, CompactRunOptions, CompactionResult, CompactionContext, } from '../../with-shape/blobs/blob-compaction.js';
 export { createExportBlobsHandle, ExportBlobsAbortedError, EXPORT_AUDIT_COLLECTION, } from '../../with-shape/blobs/export-blobs.js';
 export type { ExportBlobsOptions, ExportedBlob, ExportBlobsHandle, ExportBlobsAuditEntry, } from '../../with-shape/blobs/export-blobs.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_BLOBS } from '../../port/with/blob-strategy.js';

package/dist/via/i18n/core.d.ts

@@ -110,7 +110,7 @@ export interface I18nTextOptions {
      * the lenient `'substitute'`). The `mv` layer fires for materialized views
      * that declare `{ i18nLocale, i18nFields }` — UNION (group-key i18n fields
      * resolve before the unified-row bucketing) and query-form (resolved in
-     * `GroupedAggregation.run` before `groupAndReduce`); grouping a raw i18n field
+     * `GroupedReduction.run` before `groupAndReduce`); grouping a raw i18n field
      * without a locale throws. The `join` layer resolves a joined right-side i18n
      * field to the query locale (`toArray({ locale })` or the vault default; raw
      * when locale-less). The `export` layer fires for

package/dist/via/i18n/index.d.ts

@@ -19,3 +19,5 @@ export type { ScriptWarning } from './script.js';
 export { withI18n } from './active.js';
 export type { I18nStrategy } from './strategy.js';
 export { ReservedCollectionNameError, DictKeyMissingError, DictKeyInUseError, MissingTranslationError, LocaleNotSpecifiedError, TranslatorNotConfiguredError, ScriptViolationError, StaticDictReadonlyError, UnknownDictCodeError, } from '../../kernel/errors.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_I18N } from '../../port/with/i18n-strategy.js';

package/dist/via/money/money-reducer.d.ts

@@ -22,7 +22,7 @@
  * exactly like the generic reducers they replace.
  */
 import type { MoneyDescriptor } from './descriptor.js';
-import type { AggregateSpec } from '../../with-lookup/aggregate/aggregation.js';
+import type { ReduceSpec } from '../../with-lookup/reduce/reduction.js';
 export type FxRates = Record<string, number | string>;
 /**
  * Rewrite any `sum` / `min` / `max` reducer over a declared money field
@@ -30,4 +30,4 @@ export type FxRates = Record<string, number | string>;
  * reducers over non-money fields) pass through unchanged. Returns a new
  * spec; the input is not mutated.
  */
-export declare function wrapMoneyReducers(spec: AggregateSpec, moneyFields: Record<string, MoneyDescriptor>): AggregateSpec;
+export declare function wrapMoneyReducers(spec: ReduceSpec, moneyFields: Record<string, MoneyDescriptor>): ReduceSpec;

package/dist/{walk-H4YE52S2.js → walk-JXMWKKQW.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-EDC6MLXV.js";
+} from "./chunk-SEU6QHH4.js";
 import {
   loadPersistedSchema
-} from "./chunk-IGAIOGCN.js";
-import "./chunk-PEY6ZTCF.js";
-import "./chunk-QXPOEAKR.js";
-import "./chunk-LLVW4V7R.js";
-import "./chunk-M25ZIEB2.js";
-import "./chunk-5BB3N4KU.js";
+} from "./chunk-32467U5J.js";
+import "./chunk-MMVQ3SUO.js";
+import "./chunk-KCZAFDP5.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-5P5AAXYA.js";
-import "./chunk-5BHNQNBI.js";
-import "./chunk-IGM563N5.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-DOZFU7OZ.js";
+import "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-H4YE52S2.js.map
+//# sourceMappingURL=walk-JXMWKKQW.js.map

package/dist/with-audit/consent/index.d.ts

@@ -12,3 +12,5 @@ export { withConsent } from './active.js';
 export type { ConsentStrategy } from './strategy.js';
 export { CONSENT_AUDIT_COLLECTION, writeConsentEntry, loadConsentEntries, } from './consent.js';
 export type { ConsentContext, ConsentOp, ConsentAuditEntry, ConsentAuditFilter, } from './consent.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_CONSENT } from './strategy.js';

package/dist/with-audit/periods/index.d.ts

@@ -16,3 +16,5 @@ export { withPeriods } from './active.js';
 export type { PeriodsStrategy } from './strategy.js';
 export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, } from './periods.js';
 export type { PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_PERIODS } from './strategy.js';

package/dist/with-audit/portability/export-accessible.d.ts

@@ -7,7 +7,7 @@
  * Reuses the existing bundle machinery: the access boundary is the caller's DEK
  * set (operator/client → `keyring.permissions`; owner/admin/viewer → all), so a
  * record outside the caller's keys can never enter the bundle. Re-keying to a
- * new owner reuses `writePod`'s `exportPassphrase` shorthand.
+ * new owner reuses `writePod`'s `exportSecret` shorthand.
  */
 import type { Vault } from '../../kernel/vault.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
@@ -22,16 +22,16 @@ export declare function resolveAccessibleCollections(keyring: UnlockedKeyring, s
 } | undefined, writableOnly?: boolean): string[] | undefined;
 /** Produce a (optionally re-keyed, scoped) `.noydb` bundle — no audit. */
 export declare function buildAccessibleBundle(vault: Vault, collections: string[] | undefined, reKey: {
-    passphrase: string;
+    secret: string;
 } | undefined, compression?: 'auto' | 'brotli' | 'gzip' | 'none'): Promise<Uint8Array>;
 export interface ExportAccessibleOptions {
     /**
      * Re-key the bundle so it is independently openable by a new owner with this
-     * passphrase (the receiving firm / the client themselves). Omit to inherit
+     * secret (the receiving firm / the client themselves). Omit to inherit
      * the source keyring (personal backup).
      */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
     /** Narrow the export to a subset of the caller's accessible collections. */
     readonly scope?: {

package/dist/with-audit/portability/request-withdrawal.d.ts

@@ -15,7 +15,7 @@
  * Requests live in the reserved `_user_withdrawal_requests` namespace. The
  * record body is plaintext metadata (collection names + disposition + legal
  * basis — none secret in this trust model; the owner sees the data anyway) and
- * carries NO passphrase: the re-key passphrase is supplied by the approver at
+ * carries NO secret: the re-key secret is supplied by the approver at
  * approval time and conveyed to the requester out-of-band, so no secret is
  * stored at rest.
  */
@@ -66,9 +66,9 @@ export declare function listWithdrawalRequests(vault: Vault, opts?: {
     status?: WithdrawalRequestStatus;
 }): Promise<WithdrawalRequest[]>;
 export interface ApproveWithdrawalOptions {
-    /** Re-key the handed-back bundle to a passphrase the requester will use. */
+    /** Re-key the handed-back bundle to a secret the requester will use. */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
 }
 /**

package/dist/with-audit/portability/withdraw-accessible.d.ts

@@ -29,9 +29,9 @@ export interface FrozenSnapshotRef {
 export interface WithdrawAccessibleOptions {
     /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */
     readonly legalBasis: string;
-    /** Re-key the exported bundle to a new owner passphrase. */
+    /** Re-key the exported bundle to a new owner secret. */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
     /** Source disposition. Default 'delete'. */
     readonly disposition?: 'delete' | 'freeze';

package/dist/with-audit/sealed-record/strategy.d.ts

@@ -13,7 +13,7 @@
  * @internal
  */
 import type { SealingContext } from '../../kernel/enclave/index.js';
-import type { RecipientSealer } from '../../with-party/team/managed-passphrase.js';
+import type { RecipientSealer } from '../../with-party/team/managed-secret.js';
 export interface SealedRecordStrategy {
     sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {
         expiresAt: string;

package/dist/with-cargo/adopt-partition.d.ts

@@ -9,7 +9,7 @@
  */
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import type { NoydbStore } from '../kernel/types.js';
-import type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
+import type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
 import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
 import type { TransferSealPayload } from '../with-pod/bundle.js';
@@ -35,14 +35,14 @@ export interface CreateOwnerResult {
     readonly vaultName: string;
     readonly userId: string;
 }
-/** Standard-mode owner: recipient supplies the passphrase. */
+/** Standard-mode owner: recipient supplies the secret. */
 export interface CreateOwnerStandardOptions {
     readonly userId: string;
-    readonly passphrase: string;
+    readonly secret: string;
     readonly transferKey: Uint8Array;
 }
 /**
- * Managed-mode owner: the passphrase is minted + sealed under
+ * Managed-mode owner: the secret is minted + sealed under
  * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
  * auto-unlocks on the recipient's device. Managed mode mandates a strong
  * (Shamir) recovery profile at creation, which needs the
@@ -50,7 +50,7 @@ export interface CreateOwnerStandardOptions {
  */
 export interface CreateOwnerManagedOptions {
     readonly userId: string;
-    readonly passphraseMode: 'managed';
+    readonly secretMode: 'managed';
     readonly sealingKey: SealingKeyProvider;
     readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
     readonly shamirRecovery: ShamirRecoveryProvider;
@@ -61,8 +61,8 @@ export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManaged
  * Mint the first owner keyring on an adopted-but-unowned partition,
  * then destroy the transfer seal.
  *
- * Standard mode: the recipient supplies a passphrase. Managed mode: the
- * passphrase is minted + sealed under a `SealingKeyProvider` and a strong
+ * Standard mode: the recipient supplies a secret. Managed mode: the
+ * secret is minted + sealed under a `SealingKeyProvider` and a strong
  * (Shamir) recovery profile is enrolled — orchestrated via the existing
  * `openVaultAndEnrollRecovery` ceremony.
  *

package/dist/with-cargo/floor.d.ts

@@ -10,8 +10,8 @@
  * @packageDocumentation
  */
 export { readPath } from '../kernel/query/predicate.js';
-export { reduceRecords } from '../with-lookup/aggregate/aggregation.js';
-export { groupAndReduce } from '../with-lookup/aggregate/groupby.js';
+export { reduceRecords } from '../with-lookup/reduce/reduction.js';
+export { groupAndReduce } from '../with-lookup/reduce/groupby.js';
 export { generateULID } from '../with-pod/ulid.js';
 export { sha256Hex } from '../kernel/enclave/index.js';
 export { isQuorum, runDrainBarrier } from '../port/by/index.js';
@@ -26,7 +26,7 @@ export type { Operator } from '../kernel/query/predicate.js';
 export type { Query } from '../kernel/query/builder.js';
 export type { JoinStrategy } from '../kernel/query/join.js';
 export type { LiveQuery } from '../kernel/query/live.js';
-export type { AggregateResult, AggregateSpec, LiveAggregation, } from '../with-lookup/aggregate/aggregation.js';
+export type { ReduceResult, ReduceSpec, LiveReduction, } from '../with-lookup/reduce/reduction.js';
 export type { IndexDef } from '../with-lookup/indexing/eager-indexes.js';
 export type { FuseOptions } from '../with-lookup/search/fuse.js';
 export type { RetrieveHit, RetrieveOptions } from '../with-lookup/search/retrieve-types.js';

package/dist/with-cargo/index.d.ts

@@ -19,7 +19,7 @@ export { liberateVault } from '../with-party/custody/liberate.js';
 export type { LiberateOptions, LiberateResult } from '../with-party/custody/liberate.js';
 export { createDeedOwner, loadDeedMarker, isDeedVault } from '../with-party/team/deed.js';
 export type { DeedMarker } from '../with-party/team/deed.js';
-export type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
+export type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 export { diffVault } from './vault-diff.js';
 export { STATE_VAULT_NAME } from '../kernel/constants.js';
 export { withCargo } from './active.js';

package/dist/with-commit/crdt/index.d.ts

@@ -14,3 +14,5 @@ export { withCrdt } from './active.js';
 export type { CrdtStrategy } from './strategy.js';
 export { resolveCrdtSnapshot, mergeCrdtStates, buildLwwMapState, buildRgaState, } from './crdt.js';
 export type { CrdtMode, CrdtState, LwwMapState, RgaState, YjsState, } from './crdt.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_CRDT } from './strategy.js';

package/dist/with-commit/history/index.d.ts

@@ -28,3 +28,5 @@ export { computePatch, applyPatch } from './ledger/patch.js';
 export type { JsonPatch, JsonPatchOp } from './ledger/patch.js';
 export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_HISTORY } from './strategy.js';

package/dist/with-commit/history/time-machine.d.ts

@@ -5,7 +5,7 @@
  * ## Usage
  *
  * ```ts
- * const vault = await db.openVault('acme', { passphrase })
+ * const vault = await db.openVault('acme', { secret })
  * const q1End = vault.at('2026-03-31T23:59:59Z')
  * const invoice = await q1End.collection<Invoice>('invoices').get('inv-001')
  * // → the record as it stood at the close of Q1 2026
@@ -64,7 +64,7 @@ export interface VaultEngine {
     /** Vault name (the compartment). */
     readonly name: string;
     /**
-     * `true` when the vault was opened with a passphrase (the normal
+     * `true` when the vault was opened with a secret (the normal
      * case). `false` in plaintext-mode vaults (`encrypt: false`) — in
      * that case `envelope._data` is raw JSON and we skip the DEK lookup.
      */

package/dist/with-fork/shadow/index.d.ts

@@ -12,3 +12,5 @@
 export { withShadow } from './active.js';
 export type { ShadowStrategy } from './strategy.js';
 export { VaultFrame, CollectionFrame } from './vault-frame.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_SHADOW } from './strategy.js';

package/dist/with-fork/snapshots/index.d.ts

@@ -3,3 +3,5 @@ export type { WithSnapshotsOptions } from './active.js';
 export type { SnapshotStrategy, SnapshotMeta, RetentionPolicy } from './strategy.js';
 export type { SnapshotPolicy, SnapshotMode } from './policy.js';
 export { SnapshotNotFoundError } from '../../kernel/errors.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_SNAPSHOTS } from './strategy.js';