@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.6

package/dist/{chunk-W7TCXZWU.js → chunk-EWPS35AR.js}

@@ -1,28 +1,31 @@
-import {
-  jsonSchemaToFields
-} from "./chunk-VYYM3MEN.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-NOT7XA7Q.js";
+} from "./chunk-YGMREQAK.js";
 import {
   loadVaultPolicy
-} from "./chunk-QDNVHA2F.js";
+} from "./chunk-M7W2KYTL.js";
+import {
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
+import {
+  resolveStaleOnRead
+} from "./chunk-5ABOFAHN.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-IUIVDVXM.js";
+} from "./chunk-MUPZ6IZX.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-L4OA7G5T.js";
+} from "./chunk-522MBPE5.js";
 import {
   loadFence
-} from "./chunk-JA5B3SLH.js";
+} from "./chunk-44Y3P5U6.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
@@ -31,60 +34,62 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-JW3XCZA2.js";
+} from "./chunk-3TZUC4WS.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-EDC6MLXV.js";
-import {
-  isBaseLive,
-  liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
+} from "./chunk-SEU6QHH4.js";
 import {
   CustodyApi,
   NO_CARGO,
-  NO_CUSTODY
-} from "./chunk-U73LHVPF.js";
+  NO_CUSTODY,
+  runDrainBarrier
+} from "./chunk-3S2YNMUS.js";
 import {
   resolveManagedSecret,
-  saveSealedPassphrase
-} from "./chunk-BCOKZC4B.js";
+  saveSealedSecret
+} from "./chunk-6SSWOUUS.js";
 import {
-  ServiceBus,
-  WriteHookRegistry,
-  assertCanExport,
-  assertCanImport,
-  canExport,
-  canImport
-} from "./chunk-WEC3JGBA.js";
+  isBaseLive,
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
 import {
-  runDrainBarrier
-} from "./chunk-KMONEHDJ.js";
+  NO_SYNC
+} from "./chunk-EP5L47XV.js";
 import {
   NO_ATTESTATION
-} from "./chunk-XW7NWO4A.js";
+} from "./chunk-GTNRMJYH.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-IZX3WZBF.js";
+} from "./chunk-ZM72UO3Y.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-5KI3REO3.js";
+} from "./chunk-HDF5R2K6.js";
 import {
   NO_PORTABILITY
-} from "./chunk-GYB2QK5H.js";
+} from "./chunk-OWLZONGX.js";
+import {
+  NO_PERIODS
+} from "./chunk-IUATR5UE.js";
+import {
+  NO_SHADOW
+} from "./chunk-SMY5X46Z.js";
+import {
+  NO_SNAPSHOTS
+} from "./chunk-NIKO2BBZ.js";
 import {
   TxContext,
   bestEffortRevert,
   revertExecuted
-} from "./chunk-FLHOTGOO.js";
+} from "./chunk-QVGEVZ5F.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-E2R5NRZD.js";
+} from "./chunk-Z4D3YGAB.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -105,27 +110,32 @@ import {
   resolveLabelFromMap,
   resolveRollupDeleteIntents,
   runGraphDispatchWave,
+  selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-HGVFJL63.js";
+} from "./chunk-JTIPVW4J.js";
+import {
+  lazy
+} from "./chunk-5D2ALSM5.js";
 import {
   OverlayedCollection
-} from "./chunk-2ITLQZV5.js";
+} from "./chunk-PWWWMRT7.js";
 import {
-  NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-4X6DJZHY.js";
+} from "./chunk-MPPWL64H.js";
 import {
   EXPORT_AUDIT_COLLECTION,
+  NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-2KL6NDD4.js";
+} from "./chunk-LN3MQFUE.js";
 import {
   LazyQuery,
+  NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-CGPO3ZYB.js";
+} from "./chunk-GQT6J4FJ.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -133,13 +143,22 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-JIMEB4C6.js";
+} from "./chunk-XZHEOSQ2.js";
+import {
+  NO_REDUCE
+} from "./chunk-YMUFFJCO.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
+import {
+  NO_CRDT
+} from "./chunk-PVEWA2DU.js";
+import {
+  NO_CONSENT
+} from "./chunk-PEOZ34EM.js";
 import {
   dictCollectionName
-} from "./chunk-BZEPJJOK.js";
+} from "./chunk-C2V7AJO2.js";
 import {
   NO_I18N,
   getAtPath,
@@ -147,23 +166,30 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-XGVDLQJE.js";
+} from "./chunk-JOCMXSR2.js";
 import {
-  installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-STR7WBOB.js";
+} from "./chunk-ZUDAK436.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
   findAuthenticator,
-  recoverPassphrase,
+  hasRecoveryEnrolled,
+  hasStrongRecoveryEnrolled,
+  loadPaperRecoveryEntries,
+  loadShamirRecoveryEntries,
+  mintPaperRecoveryEntry,
+  mintShamirRecoveryEntry,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
-  rotatePassphrase,
+  rotateSecret,
+  savePaperRecoveryEntries,
+  saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-QUIG6BZT.js";
+} from "./chunk-M4GO4ZJK.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -171,26 +197,18 @@ import {
   createOwnerKeyring,
   ensureCollectionDEK,
   hasAccess,
+  hasExportCapability,
+  hasImportCapability,
   hasWritePermission,
   isSecretBearingReservedCollection,
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-WJDYZP3U.js";
+} from "./chunk-ZDFU34XY.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-7B4GPCX7.js";
-import {
-  hasRecoveryEnrolled,
-  hasStrongRecoveryEnrolled,
-  loadPaperRecoveryEntries,
-  loadShamirRecoveryEntries,
-  mintPaperRecoveryEntry,
-  mintShamirRecoveryEntry,
-  savePaperRecoveryEntries,
-  saveShamirRecoveryEntries
-} from "./chunk-3O62PVDW.js";
+} from "./chunk-7IQWHYL2.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -200,22 +218,28 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-F4COUZLL.js";
+} from "./chunk-TMR64XPL.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-VEX6G3YL.js";
+} from "./chunk-P4NUJVWL.js";
+import {
+  NO_SESSION
+} from "./chunk-VKQCVU2Z.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
+import {
+  NO_HISTORY
+} from "./chunk-AFHQATY4.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-NM4LVUXH.js";
+} from "./chunk-PTT2NB46.js";
 import {
   sha256Hex
-} from "./chunk-JLHKBAFY.js";
+} from "./chunk-2BVW754E.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -224,10 +248,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-OWE4BNTM.js";
+} from "./chunk-AZXEOEQK.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-J3VW4J4E.js";
+} from "./chunk-7LP7FFJ2.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -238,20 +262,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-PEY6ZTCF.js";
+} from "./chunk-MMVQ3SUO.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-QXPOEAKR.js";
+} from "./chunk-KCZAFDP5.js";
 import {
   encrypt
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-5BHNQNBI.js";
+} from "./chunk-DOZFU7OZ.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -260,11 +284,12 @@ import {
   ClassifiedVerifyError,
   ConflictError,
   DebugPlaintextError,
-  DerivationCapExceededError,
   DictKeyInUseError,
   ElevationExpiredError,
+  ExportCapabilityError,
   FieldNotQueryableError,
   ForgetStrategyNotConfiguredError,
+  ImportCapabilityError,
   IndexWriteFailureError,
   InvalidKeyError,
   KeyringCorruptError,
@@ -291,234 +316,18 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-IGM563N5.js";
-
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
-// src/with-audit/consent/strategy.ts
-var NO_CONSENT = {
-  async write() {
-  },
-  async read() {
-    return [];
-  }
-};
-
-// src/with-commit/crdt/strategy.ts
-var NOT_ENABLED = new Error(
-  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
-);
-var NO_CRDT = {
-  buildLwwMapState() {
-    throw NOT_ENABLED;
-  },
-  buildRgaState() {
-    throw NOT_ENABLED;
-  },
-  mergeCrdtStates() {
-    throw NOT_ENABLED;
-  },
-  resolveCrdtSnapshot() {
-    throw NOT_ENABLED;
-  }
-};
-
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-// src/with-lookup/indexing/strategy.ts
-var NO_INDEXING = {
-  createState() {
-    return DISABLED_STATE;
-  }
-};
-var DISABLED_STATE = {
-  isEnabled: false,
-  getEagerIndexes: () => null,
-  getPersistedIndexes: () => null
-};
-
-// src/with-audit/periods/strategy.ts
-var NOT_ENABLED2 = new Error(
-  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-);
-var NO_PERIODS = {
-  async loadPeriods() {
-    return [];
-  },
-  async chainAnchor() {
-    return { priorPeriodHash: "" };
-  },
-  assertTsWritable() {
-  },
-  validatePeriodName() {
-    throw NOT_ENABLED2;
-  },
-  async appendPeriodLedgerEntry() {
-    throw NOT_ENABLED2;
-  }
-};
-
-// src/with-party/session/strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
-  );
-}
-var NO_SESSION = {
-  validateSessionPolicy() {
-    throw notEnabled2("sessionPolicy");
-  },
-  createEnforcer() {
-    throw notEnabled2("session policy enforcement");
-  },
-  revokeAllSessions() {
-  }
-};
-
-// src/with-fork/shadow/strategy.ts
-var NOT_ENABLED3 = new Error(
-  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-);
-var NO_SHADOW = {
-  buildFrame() {
-    throw NOT_ENABLED3;
-  }
-};
-
-// src/with-fork/snapshots/strategy.ts
-var NOT_ENABLED4 = new Error(
-  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
-);
-var NO_SNAPSHOTS = {
-  async snapshot() {
-    throw NOT_ENABLED4;
-  },
-  async listSnapshots() {
-    throw NOT_ENABLED4;
-  },
-  async restoreSnapshot() {
-    throw NOT_ENABLED4;
-  },
-  async autoSnapshot() {
-    throw NOT_ENABLED4;
-  }
-};
-
-// src/with-party/team/sync-strategy.ts
-function notEnabled3(op) {
-  return new Error(
-    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
-  );
-}
-var NO_SYNC = {
-  buildSyncEngine() {
-    throw notEnabled3("SyncEngine");
-  },
-  buildSyncTransaction() {
-    throw notEnabled3("SyncTransaction");
-  },
-  buildPresence() {
-    throw notEnabled3("collection.presence()");
-  }
-};
+} from "./chunk-6SYOHUHM.js";
 
 // src/with-commit/tx/strategy.ts
-var NOT_ENABLED5 = new Error(
+var NOT_ENABLED = new Error(
   'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
 );
 var NO_TX = {
   async runTransaction(_db, _fn, _options, _txInvariants) {
-    throw NOT_ENABLED5;
+    throw NOT_ENABLED;
   },
   async runDryRun() {
-    throw NOT_ENABLED5;
+    throw NOT_ENABLED;
   }
 };
 
@@ -532,7 +341,7 @@ var NO_ARCHIVE = {
 
 // src/port/with/strategies.ts
 var STRATEGY_DEFAULTS = {
-  aggregate: NO_AGGREGATE,
+  reduce: NO_REDUCE,
   archive: NO_ARCHIVE,
   attestation: NO_ATTESTATION,
   blob: NO_BLOBS,
@@ -573,10 +382,61 @@ function resolveStrategies(options) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-3AELCZ4Y.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-DX5HECK3.js");
   return new StoreCoordinationProvider(store);
 }
 
+// src/port/with/collection-registries.ts
+function populateCollectionRegistries(r, collectionName, options, effectiveViaFields) {
+  if (options?.refs) {
+    r.refRegistry.register(collectionName, options.refs);
+  }
+  if (effectiveViaFields.i18nFields) {
+    r.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
+  }
+  if (options?.blobFields) {
+    r.blobFieldsRegistry.set(collectionName, options.blobFields);
+  }
+  if (options?.archive) {
+    r.archiveRegistry.set(collectionName, options.archive);
+  }
+  if (options?.attestation !== void 0) {
+    r.attestation.register(collectionName, options.attestation);
+  }
+  if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
+    const dictFieldMap = {};
+    const staticFieldMap = {};
+    for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
+      if (isStaticDictDescriptor(desc)) {
+        staticFieldMap[field] = desc;
+        r.staticDictNames.add(desc.name);
+        r.staticByName.set(desc.name, desc);
+      } else {
+        dictFieldMap[field] = desc.name;
+      }
+    }
+    const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
+    Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
+    for (const [field, desc] of lookupCompat.staticEntries) {
+      staticFieldMap[field] = desc;
+      r.staticDictNames.add(desc.name);
+      r.staticByName.set(desc.name, desc);
+    }
+    if (Object.keys(dictFieldMap).length > 0) {
+      r.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
+      for (const dictName of new Set(Object.values(dictFieldMap))) {
+        r.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
+      }
+    }
+    if (Object.keys(staticFieldMap).length > 0) {
+      r.staticDescriptorByField.set(collectionName, staticFieldMap);
+    }
+  }
+  if ((options?.schemaUpdate?.length ?? 0) > 0) {
+    r.schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
+  }
+}
+
 // src/kernel/via/pipeline.ts
 var ViaPipeline = class _ViaPipeline {
   constructor(bindings, taint) {
@@ -1844,79 +1704,6 @@ function buildDescription(input) {
   };
 }
 
-// src/with-formula/derivations/stale.ts
-var _staleByRegistry = /* @__PURE__ */ new WeakMap();
-var keyFor = (source, sourceId) => `${source}/${sourceId}`;
-async function markStale(registry, strategy, sourceId) {
-  let map = _staleByRegistry.get(registry);
-  if (!map) {
-    map = /* @__PURE__ */ new Map();
-    _staleByRegistry.set(registry, map);
-  }
-  const k = keyFor(strategy.source, sourceId);
-  let set = map.get(k);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    map.set(k, set);
-  }
-  set.add(strategy);
-}
-async function resolveStaleOnRead(accessor, outputCollection, id) {
-  const registry = accessor.registry();
-  const producers = registry.strategiesProducingOutput(outputCollection);
-  if (producers.length === 0) return;
-  const map = _staleByRegistry.get(registry);
-  if (!map) return;
-  let DerivationExecutor = null;
-  for (const { spec, strategyHash } of producers) {
-    const k = keyFor(spec.source, id);
-    const pending = map.get(k);
-    if (!pending || !pending.has(spec)) continue;
-    const sourceColl = accessor.getCollection(spec.source);
-    const source = await sourceColl.get(id);
-    if (!source) {
-      pending.delete(spec);
-      continue;
-    }
-    const sourceWithId = { ...source, id };
-    if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
-    }
-    const ctx = { vault: accessor.getReadOnlyFacade() };
-    const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
-    for (const key of Object.keys(spec.outputs)) {
-      const out = result.outputs[key];
-      if (!out) continue;
-      if (out.kind === "failed") {
-        const err = out.error;
-        if (spec.strict) {
-          throw err;
-        }
-        console.warn(
-          `[derivation] lazy output "${key}" for source "${spec.source}" id="${id}" failed:`,
-          err
-        );
-        continue;
-      }
-      if (out.kind === "array") {
-        console.warn(
-          `[derivation] unexpected array-shape output "${key}" in lazy resolve path; array-shape derivations require lifecycle: "eager".`
-        );
-        continue;
-      }
-      const outSpec = spec.outputs[key];
-      if (!outSpec) continue;
-      const outputColl = accessor.getCollection(outSpec.collection);
-      if (out.skipped === true) {
-        await outputColl._internalDelete(id, accessor.getActiveTxContext());
-        continue;
-      }
-      await outputColl.put(id, out.value);
-    }
-    pending.delete(spec);
-  }
-}
-
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -2381,22 +2168,12 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var fn = null;
+var loadComputed = lazy(() => import("./computed-33DRJDOC.js"));
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-WZNKRLCY.js")).evalComputedFields;
-  return fn;
+  return (await loadComputed()).evalComputedFields;
 }
 
 // src/kernel/collection.ts
-function selfWriteFieldEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-  try {
-    return JSON.stringify(a) === JSON.stringify(b);
-  } catch {
-    return false;
-  }
-}
 var fallbackWarned = /* @__PURE__ */ new Set();
 function warnOnceFallback(adapterName) {
   if (fallbackWarned.has(adapterName)) return;
@@ -3169,7 +2946,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-MXN66IIH.js");
+    const { verifyDigestField } = await import("./verify-5X37OXRY.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3375,7 +3152,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-BJO2WIN7.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3631,6 +3408,103 @@ var Collection = class {
     return clone;
   }
   /** @internal Untracked put body — call {@link put}, not this. */
+  /**
+   * Decode a prior envelope's CRDT state, or `undefined` when there is no
+   * usable prior: no envelope, a shredded body decrypting to `null`, or a
+   * payload that is not a CRDT state. The `lww-map` and `rga` branches each
+   * carried a copy, byte-identical apart from the cast (#842).
+   */
+  async #decodePriorCrdtState(envelope) {
+    if (!envelope) return void 0;
+    const prevJson = await this.codec.decryptJsonString(envelope);
+    if (prevJson === null) return void 0;
+    const prevParsed = JSON.parse(prevJson);
+    if (prevParsed === null || typeof prevParsed !== "object" || !("_crdt" in prevParsed)) {
+      return void 0;
+    }
+    return prevParsed;
+  }
+  /**
+   * Record a write on the active transaction so a mid-batch failure rolls it
+   * back. Four sites in the derivation/MV dispatch hand-built this literal (#842).
+   */
+  #trackPut(txCtx, collectionName, id, priorEnvelope) {
+    txCtx._executed.push({
+      op: { type: "put", vaultName: this.vault, collectionName, id },
+      priorEnvelope
+    });
+  }
+  /**
+   * Snapshot the PRIOR version into history, emit, and prune.
+   *
+   * Deliberately does NOT carry `source` from the current write — a history
+   * entry describes the version being replaced, not the one replacing it.
+   *
+   * Kept OUT of {@link #commitWriteTail} because the two paths call it at
+   * different points: the normal path snapshots BEFORE `adapter.put` (so a
+   * history failure leaves no write behind), while the CRDT path must merge
+   * and persist first to resolve the prior record at all. Folding it into the
+   * tail would silently reorder one of them (#842).
+   */
+  async #savePriorHistory(id, prior, cek, vdigCtx) {
+    if (this.historyConfig.enabled === false) return;
+    await this.strategies.history.saveHistory(
+      this.adapter,
+      this.vault,
+      this.name,
+      id,
+      await this.codec.encryptRecord(prior.record, prior.version, cek, void 0, void 0, vdigCtx, id)
+    );
+    this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: prior.version });
+    if (this.historyConfig.maxVersions) {
+      await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+    }
+  }
+  /**
+   * Everything both write paths do once the envelope is on the adapter:
+   * classified marker, embedding sidecar, ledger append, cache/index
+   * maintenance, and the mutation event that drives derivation dispatch.
+   *
+   * The CRDT branch used to re-implement all of it, and in doing so skipped
+   * `_ensureClassifiedMarker`, the unique-constraint upsert and
+   * `_toCacheableRecord` (#835). All three were unreachable — each blocked by
+   * a config-time refusal on CRDT collections — but only by accident of what
+   * that copy happened to omit. One tail makes the divergence unrepresentable
+   * rather than merely unreachable; on a CRDT collection the extra steps are
+   * provably no-ops (classified/unique + crdt are refused at construction, and
+   * a CRDT body never produces a `_sealed` slot, so `_toCacheableRecord` is
+   * the identity).
+   */
+  async #commitWriteTail(args) {
+    const { id, envelope, version, indexed, event, prior, reason } = args;
+    await this._ensureClassifiedMarker();
+    if (this.embeddings) {
+      await this.strategies.search.embedOnWrite(this.searchContext(), id, indexed, version);
+    }
+    if (this.ledger) {
+      const appendInput = {
+        op: "put",
+        collection: this.name,
+        id,
+        version,
+        actor: this.keyring.userId,
+        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
+      };
+      if (prior) appendInput.delta = this.strategies.history.computePatch(indexed, prior.record);
+      if (reason !== void 0) appendInput.reason = reason;
+      await this.ledger.append(appendInput);
+    }
+    const cacheable = await this._toCacheableRecord(indexed, envelope, id);
+    if (this.lazy && this.lru) {
+      this.lru.set(id, { record: cacheable, version }, estimateRecordBytes(indexed));
+      await this.maintainPersistedIndexesOnPut(id, indexed, prior ? prior.record : null, version);
+    } else {
+      this.cache.set(id, { record: cacheable, version });
+      this.indexes?.upsert(id, indexed, prior ? prior.record : null);
+      this.uniqueConstraints?.upsert(id, indexed, prior?.record);
+    }
+    await this._onRecordMutated(id, "put", "local-write", { record: event, version });
+  }
   async _putInternal(id, record, options) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
@@ -3679,28 +3553,10 @@ var Collection = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       let crdtState;
       if (this.crdtMode === "lww-map") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
         crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
         crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
@@ -3712,39 +3568,18 @@ var Collection = class {
       const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
-      if (existingResolved && this.historyConfig.enabled !== false) {
-        await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
-        this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
-        if (this.historyConfig.maxVersions) {
-          await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-        }
-      }
-      if (this.ledger) {
-        const appendInput = {
-          op: "put",
-          collection: this.name,
-          id,
-          version: version2,
-          actor: this.keyring.userId,
-          payloadHash: await this.strategies.history.envelopePayloadHash(envelope2)
-        };
-        if (existingResolved) appendInput.delta = this.strategies.history.computePatch(resolvedRecord, existingResolved.record);
-        if (options?.reason !== void 0) appendInput.reason = options.reason;
-        await this.ledger.append(appendInput);
-      }
-      if (this.lazy && this.lru) {
-        this.lru.set(id, { record: resolvedRecord, version: version2 }, estimateRecordBytes(resolvedRecord));
-        await this.maintainPersistedIndexesOnPut(
-          id,
-          resolvedRecord,
-          existingResolved ? existingResolved.record : null,
-          version2
-        );
-      } else {
-        this.cache.set(id, { record: resolvedRecord, version: version2 });
-        this.indexes?.upsert(id, resolvedRecord, existingResolved ? existingResolved.record : null);
+      if (existingResolved) {
+        await this.#savePriorHistory(id, existingResolved, cek2, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
       }
-      await this._onRecordMutated(id, "put", "local-write", { record, version: version2 });
+      await this.#commitWriteTail({
+        id,
+        envelope: envelope2,
+        version: version2,
+        indexed: resolvedRecord,
+        event: record,
+        prior: existingResolved,
+        reason: options?.reason
+      });
       return;
     }
     let existing;
@@ -3774,47 +3609,19 @@ var Collection = class {
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    if (existing && this.historyConfig.enabled !== false) {
-      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
-      this.emitter.emit("history:save", {
-        vault: this.vault,
-        collection: this.name,
-        id,
-        version: existing.version
-      });
-      if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-    }
+    if (existing) await this.#savePriorHistory(id, existing, cek, vdigCtx);
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
     await this.adapter.put(this.vault, this.name, id, envelope);
     this.markerIds.delete(id);
-    await this._ensureClassifiedMarker();
-    if (this.embeddings) {
-      await this.strategies.search.embedOnWrite(this.searchContext(), id, record, version);
-    }
-    if (this.ledger) {
-      const appendInput = {
-        op: "put",
-        collection: this.name,
-        id,
-        version,
-        actor: this.keyring.userId,
-        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
-      };
-      if (existing) {
-        appendInput.delta = this.strategies.history.computePatch(record, existing.record);
-      }
-      if (options?.reason !== void 0) appendInput.reason = options.reason;
-      await this.ledger.append(appendInput);
-    }
-    if (this.lazy && this.lru) {
-      this.lru.set(id, { record: await this._toCacheableRecord(record, envelope, id), version }, estimateRecordBytes(record));
-      await this.maintainPersistedIndexesOnPut(id, record, existing ? existing.record : null, version);
-    } else {
-      this.cache.set(id, { record: await this._toCacheableRecord(record, envelope, id), version });
-      this.indexes?.upsert(id, record, existing ? existing.record : null);
-      this.uniqueConstraints?.upsert(id, record, existing?.record);
-    }
-    await this._onRecordMutated(id, "put", "local-write", { record, version });
+    await this.#commitWriteTail({
+      id,
+      envelope,
+      version,
+      indexed: record,
+      event: record,
+      prior: existing,
+      reason: options?.reason
+    });
   }
   /**
    * Fire registered MV strategies whose dependency set includes this
@@ -3831,34 +3638,8 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const incoming = record;
-    if (incoming && typeof incoming === "object" && "_materializedFrom" in incoming) return;
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return;
-    let executor = null;
-    let staleHelpers = null;
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
-        }
-        await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-      } else if (mode === "lazy") {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-4UNPHWOU.js");
-        }
-        staleHelpers.markMVStale(registry, reg.spec.name);
-      }
-    }
+    const { dispatchMaterializedViews } = await import("./dispatch-V5MSMQYX.js");
+    return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
    * Fire registered derivation strategies for this source collection.
@@ -3946,6 +3727,32 @@ var Collection = class {
     return out;
   }
   /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
+  /** What `with-formula/materialized-views/dispatch.ts` needs from this collection (#842). */
+  #mvDispatchCtx(materializedViewSource) {
+    return {
+      materializedViewSource,
+      collectionName: this.name,
+      dispatchCtx: (source) => this.#dispatchCtx(source)
+    };
+  }
+  /**
+   * What `with-formula/derivations/dispatch.ts` needs from this collection (#842).
+   *
+   * The return type is inferred, not annotated: importing `DerivationDeleteCtx`
+   * would be a STATIC spine→service import, which `port-layering` rejects even
+   * when it is type-only — the guard scans import statements, not their
+   * erasure. The dynamic `import()` at the call site still types the argument.
+   */
+  #derivationDeleteCtx(derivationSource) {
+    return {
+      derivationSource,
+      collectionName: this.name,
+      adapter: this.adapter,
+      vault: this.vault,
+      getDEK: this.getDEK,
+      storeCiphertext: this.storeCiphertext
+    };
+  }
   #dispatchCtx(source) {
     return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.ledger, this.keyring.userId) };
   }
@@ -3971,11 +3778,7 @@ var Collection = class {
     const patched = { ...base, [field]: newValue };
     const txCtx = this.derivationSource.getActiveTxContext();
     if (txCtx !== null) {
-      const prior = await this.adapter.get(this.vault, into, parentId);
-      txCtx._executed.push({
-        op: { type: "put", vaultName: this.vault, collectionName: into, id: parentId },
-        priorEnvelope: prior
-      });
+      this.#trackPut(txCtx, into, parentId, await this.adapter.get(this.vault, into, parentId));
     }
     return putDerivedOutput(intoColl, parentId, patched, this.#dispatchCtx(source));
   }
@@ -4008,150 +3811,14 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const incoming = this.via ? this.via.canonicalizeStored(record) : record;
-    if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return;
-    let DerivationExecutor = null;
-    for (const { spec, strategyHash } of strategies) {
-      const mode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
-      if (spec.rollup) {
-        if (mode !== "eager") continue;
-        let parentId;
-        if (this.name === spec.rollup.from) {
-          const kv = incoming[spec.rollup.key];
-          parentId = typeof kv === "string" || typeof kv === "number" ? String(kv) : null;
-        } else {
-          parentId = id;
-        }
-        if (parentId !== null) await this.recomputeRollup(spec, parentId, { collection: this.name, id }, wave);
-        continue;
-      }
-      const isSource = spec.source === this.name;
-      const isSibling = !isSource && (spec.sources?.includes(this.name) ?? false);
-      const trigger = !isSource && !isSibling ? spec.triggerBy?.find((t) => t.collection === this.name) : void 0;
-      const runs = [];
-      if (isSource) {
-        runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version });
-      } else if (isSibling) {
-        const p = await this.derivationSource.getCollection(spec.source).get(id);
-        if (p !== null && p !== void 0) {
-          const raw = await this.derivationSource.getCollection(spec.source)._getStoredRecord(id);
-          runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 });
-        }
-      } else if (trigger) {
-        const srcColl = this.derivationSource.getCollection(spec.source);
-        const ids = await srcColl._findMatchingIds(trigger.on, id);
-        if (trigger.maxFanout !== void 0 && ids.length > trigger.maxFanout) {
-          throw new DerivationCapExceededError(`triggerBy ${this.name}\u2192${spec.source}`, ids.length, trigger.maxFanout);
-        }
-        for (const sid of ids) {
-          const raw = await srcColl._getStoredRecord(sid);
-          if (raw === null) continue;
-          runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 });
-        }
-      }
-      if (runs.length === 0) continue;
-      if (mode !== "eager") {
-        for (const run of runs) await markStale(registry, spec, run.runId);
-        continue;
-      }
-      if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
-      }
-      for (const run of runs) {
-        const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
-        const outCtx = this.#dispatchCtx({ collection: spec.source, id: run.runId });
-        const result = await DerivationExecutor.run(spec, run.input, run.version, strategyHash, ctx);
-        for (const key of Object.keys(spec.outputs)) {
-          const out = result.outputs[key];
-          if (!out) continue;
-          if (out.kind === "failed") {
-            const err = out.error;
-            if (spec.strict) throw err;
-            console.warn(`[derivation] output "${key}" for source "${spec.source}" id="${run.runId}" failed:`, err);
-            continue;
-          }
-          const outSpec = spec.outputs[key];
-          if (!outSpec) continue;
-          const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-          const txCtx = this.derivationSource.getActiveTxContext();
-          if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
-            const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
-            const prevKeys = new Set(prior?.keys ?? []);
-            const newKeysList = out.entries.map((e) => e.key);
-            const newKeysSet = new Set(newKeysList);
-            for (const k of prevKeys) {
-              if (newKeysSet.has(k)) continue;
-              await outputCollection._internalDelete(k, txCtx);
-            }
-            for (const entry of out.entries) {
-              if (txCtx !== null) {
-                const priorEnvelope = await this.adapter.get(this.vault, outSpec.collection, entry.key);
-                txCtx._executed.push({
-                  op: {
-                    type: "put",
-                    vaultName: this.vault,
-                    collectionName: outSpec.collection,
-                    id: entry.key
-                  },
-                  priorEnvelope
-                });
-              }
-              await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: "derived" });
-            }
-            await saveFanoutSidecar(this.adapter, this.vault, {
-              source: spec.source,
-              sourceId: run.runId,
-              outputKey: key,
-              outputCollection: outSpec.collection,
-              keys: newKeysList
-            }, this.getDEK, this.storeCiphertext);
-            continue;
-          }
-          if (out.skipped === true) {
-            await outputCollection._internalDelete(run.runId, txCtx);
-            continue;
-          }
-          if (outSpec.shape === "record" && outSpec.denorm !== void 0 && outSpec.collection === spec.source) {
-            const value = out.value;
-            const patched = { ...run.base };
-            let changed = false;
-            for (const f of outSpec.denorm) {
-              if (!selfWriteFieldEqual(run.base[f], value[f])) {
-                patched[f] = value[f];
-                changed = true;
-              }
-            }
-            if (!changed) continue;
-            if (txCtx !== null) {
-              const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-              txCtx._executed.push({
-                op: { type: "put", vaultName: this.vault, collectionName: outSpec.collection, id: run.runId },
-                priorEnvelope: prior
-              });
-            }
-            await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: "derived" });
-            continue;
-          }
-          if (txCtx !== null) {
-            const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-            txCtx._executed.push({
-              op: {
-                type: "put",
-                vaultName: this.vault,
-                collectionName: outSpec.collection,
-                id: run.runId
-              },
-              priorEnvelope: prior
-            });
-          }
-          await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: "derived" });
-        }
-      }
-    }
+    const { dispatchDerivations } = await import("./dispatch-SPMYNXNW.js");
+    return dispatchDerivations({
+      ...this.#derivationDeleteCtx(this.derivationSource),
+      via: this.via,
+      recomputeRollup: (spec, parentId, source, w) => this.recomputeRollup(spec, parentId, source, w),
+      dispatchCtx: (source) => this.#dispatchCtx(source),
+      trackPut: (txCtx, collectionName, rid, prior) => this.#trackPut(txCtx, collectionName, rid, prior)
+    }, id, record, version, wave);
   }
   /**
    * Delete a record by ID. Runs inside the hub's write-queue tracker
@@ -4421,33 +4088,8 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return 0;
-    let helpers = null;
-    const txCtx = this.derivationSource.getActiveTxContext();
-    let erased = 0;
-    for (const { spec } of strategies) {
-      for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
-        if (outSpec.shape === "record") {
-          if (eraseRecordShapeToo && spec.source === this.name && outSpec.collection !== this.name) {
-            if (await this.derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1;
-          }
-          continue;
-        }
-        if (helpers === null) {
-          helpers = await import("./fanout-sidecar-HJV3A7PM.js");
-        }
-        const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
-        if (!sidecar) continue;
-        const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-        for (const derivedId of sidecar.keys) {
-          if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1;
-        }
-        await helpers.deleteFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey);
-      }
-    }
-    return erased;
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-SPMYNXNW.js");
+    return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
    * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
@@ -4460,41 +4102,8 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    let executor = null;
-    let staleHelpers = null;
-    let deleted = 0;
-    const residueUndecodable = [];
-    const residueDeclined = [];
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
-        }
-        const rr = await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-        deleted += rr.deleted;
-        residueUndecodable.push(...rr.residueUndecodable);
-        residueDeclined.push(...rr.residueDeclined);
-      } else {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-4UNPHWOU.js");
-        }
-        const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
-        deleted += inv.deleted;
-        residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
-        residueDeclined.push(...inv.residueDeclined.map((rid) => `${reg.outputCollection}:${rid}`));
-      }
-    }
-    return { deleted, residueUndecodable, residueDeclined };
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-V5MSMQYX.js");
+    return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
    * List all records in the collection.
@@ -4513,7 +4122,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-BJO2WIN7.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4765,7 +4374,7 @@ var Collection = class {
       ...this.defaultLocale !== void 0 ? { defaultLocale: this.defaultLocale } : {},
       ...resolver.resolveDictSource ? { resolveDictSource: (field) => resolver.resolveDictSource(leftCollection, field) } : {}
     } : void 0;
-    return new Query(source, void 0, joinContext, this.strategies.aggregate);
+    return new Query(source, void 0, joinContext, this.strategies.reduce);
   }
   /**
    * Subscribe to every put/delete on this collection. Returns an
@@ -5666,14 +5275,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-7S5IEP6Q.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-SVDRXLD3.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-7S5IEP6Q.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-SVDRXLD3.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5844,6 +5453,64 @@ var Collection = class {
   }
 };
 
+// src/port/with/capabilities.ts
+function assertCanExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanExport: plaintext tier requires a format");
+    }
+    if (!hasExportCapability(keyring, "plaintext", format)) {
+      throw new ExportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasExportCapability(keyring, "bundle")) {
+    throw new ExportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function assertCanImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanImport: plaintext tier requires a format");
+    }
+    if (!hasImportCapability(keyring, "plaintext", format)) {
+      throw new ImportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasImportCapability(keyring, "bundle")) {
+    throw new ImportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function canExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasExportCapability(keyring, "plaintext", format);
+  }
+  return hasExportCapability(keyring, "bundle");
+}
+function canImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasImportCapability(keyring, "plaintext", format);
+  }
+  return hasImportCapability(keyring, "bundle");
+}
+
 // src/with-commit/tx/elevated-handle.ts
 var ELEVATION_AUDIT_COLLECTION = "_elevation_audit";
 var ElevatedHandle = class {
@@ -7058,7 +6725,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-GNGGCFI4.js").then(
+  const load = () => engine ??= import("./link-set-XVZY2ODC.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7541,7 +7208,7 @@ var SatelliteRegistry = class {
     if (reason !== void 0) throw new SatelliteConfigError(reason);
   }
   /** Per-base async mutex: chains sections on a stored promise tail. */
-  async withPairLock(base, fn2) {
+  async withPairLock(base, fn) {
     const tail = this.locks.get(base) ?? Promise.resolve();
     let release;
     const gate = new Promise((res) => {
@@ -7550,7 +7217,7 @@ var SatelliteRegistry = class {
     this.locks.set(base, tail.then(() => gate));
     await tail;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       release();
     }
@@ -7596,7 +7263,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-A7HCFBP5.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-5VHHVFJY.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8113,6 +7780,43 @@ var VaultAttestation = class {
 };
 
 // src/kernel/vault.ts
+var COLLECTION_PASSTHROUGH_KEYS = [
+  "indexes",
+  "reconcileOnOpen",
+  "prefetch",
+  "cache",
+  "schema",
+  "conflictPolicy",
+  "crdt",
+  "deterministicFields",
+  "acknowledgeDeterministicRisk",
+  "acknowledgeEquatableRisk",
+  "sensitive",
+  "perRecordKeys",
+  "provenance",
+  "ramCiphertext",
+  "tiers",
+  "tierMode",
+  "blobTierPolicy",
+  "i18nFields",
+  "embeddings",
+  "textIndexes",
+  "warmIndexOnOpen",
+  "textIndexPersist",
+  "moneyFields",
+  "viaFields",
+  "computed",
+  "classifiedFields",
+  "fieldMeta",
+  "meta"
+];
+function copyDefined(dst, src, keys) {
+  if (src === void 0) return;
+  for (const key of keys) {
+    const value = src[key];
+    if (value !== void 0) dst[key] = value;
+  }
+}
 var Vault = class {
   adapter;
   /** The vault's name as passed to `openVault()`. Stable for the instance lifetime. */
@@ -8194,7 +7898,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
    */
   custody;
-  /** Re-derives an UnlockedKeyring from the adapter using the active user's passphrase; called by
+  /** Re-derives an UnlockedKeyring from the adapter using the active user's secret; called by
    *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
    *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
   reloadKeyring;
@@ -8455,6 +8159,22 @@ var Vault = class {
       enforceStaticDictOnPut: (collectionName, record) => this.enforceStaticDictOnPut(collectionName, record)
     };
   }
+  /** The registries `populateCollectionRegistries` writes into (#841). */
+  #registries() {
+    return {
+      refRegistry: this.refRegistry,
+      i18nFieldRegistry: this.i18nFieldRegistry,
+      blobFieldsRegistry: this.blobFieldsRegistry,
+      archiveRegistry: this.archiveRegistry,
+      attestation: this.attestation,
+      dictKeyFieldRegistry: this.dictKeyFieldRegistry,
+      staticDictNames: this.staticDictNames,
+      staticByName: this.staticByName,
+      staticDescriptorByField: this.staticDescriptorByField,
+      reservedLookupCollections: this.reservedLookupCollections,
+      schemaUpdateNames: this.#schemaUpdateNames
+    };
+  }
   collection(collectionName, options) {
     const overlayRegistry = this.overlayedViewRegistry;
     if (overlayRegistry !== null && overlayRegistry.isOverlay(collectionName)) {
@@ -8488,8 +8208,8 @@ var Vault = class {
         registerPoisonHook: (hook) => {
           this.noydb._writeHooks.onBeforeWrite(hook);
         },
-        forEachSyncEngine: (fn2) => {
-          this.noydb._forEachSyncEngine(this.name, fn2);
+        forEachSyncEngine: (fn) => {
+          this.noydb._forEachSyncEngine(this.name, fn);
         }
       }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
     }
@@ -8506,60 +8226,14 @@ var Vault = class {
       });
     }
     if (!coll) {
-      if (options?.refs) {
-        this.refRegistry.register(collectionName, options.refs);
-      }
-      if (effectiveViaFields.i18nFields) {
-        this.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
-      }
-      if (options?.blobFields) {
-        this.blobFieldsRegistry.set(collectionName, options.blobFields);
-      }
-      if (options?.archive) {
-        this.archiveRegistry.set(collectionName, options.archive);
-      }
-      if (options?.attestation !== void 0) {
-        this.attestation.register(collectionName, options.attestation);
-      }
-      if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
-        const dictFieldMap = {};
-        const staticFieldMap = {};
-        for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
-          if (isStaticDictDescriptor(desc)) {
-            staticFieldMap[field] = desc;
-            this.staticDictNames.add(desc.name);
-            this.staticByName.set(desc.name, desc);
-          } else {
-            dictFieldMap[field] = desc.name;
-          }
-        }
-        const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
-        Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
-        for (const [field, desc] of lookupCompat.staticEntries) {
-          staticFieldMap[field] = desc;
-          this.staticDictNames.add(desc.name);
-          this.staticByName.set(desc.name, desc);
-        }
-        if (Object.keys(dictFieldMap).length > 0) {
-          this.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
-          for (const dictName of new Set(Object.values(dictFieldMap))) {
-            this.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
-          }
-        }
-        if (Object.keys(staticFieldMap).length > 0) {
-          this.staticDescriptorByField.set(collectionName, staticFieldMap);
-        }
-      }
-      if ((options?.schemaUpdate?.length ?? 0) > 0) {
-        this.#schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
-      }
+      populateCollectionRegistries(this.#registries(), collectionName, options, effectiveViaFields);
       let schemaUpdateGate;
       if (options?.persistJsonSchema === true && options.schema !== void 0 && (options.schemaUpdate?.length ?? 0) > 0) {
         const validator = options.schema;
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-YBMRLZLO.js");
+          const { persistSchemaIfNeeded } = await import("./register-CEX7R7NE.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8640,26 +8314,7 @@ var Vault = class {
           }
         } : {}
       };
-      if (options?.indexes !== void 0) collOpts.indexes = options.indexes;
-      if (options?.reconcileOnOpen !== void 0) collOpts.reconcileOnOpen = options.reconcileOnOpen;
-      if (options?.prefetch !== void 0) collOpts.prefetch = options.prefetch;
-      if (options?.cache !== void 0) collOpts.cache = options.cache;
-      if (options?.schema !== void 0) collOpts.schema = options.schema;
-      if (options?.conflictPolicy !== void 0) collOpts.conflictPolicy = options.conflictPolicy;
-      if (options?.crdt !== void 0) collOpts.crdt = options.crdt;
-      if (options?.deterministicFields !== void 0) {
-        collOpts.deterministicFields = options.deterministicFields;
-      }
-      if (options?.acknowledgeDeterministicRisk !== void 0) {
-        collOpts.acknowledgeDeterministicRisk = options.acknowledgeDeterministicRisk;
-      }
-      if (options?.acknowledgeEquatableRisk !== void 0) {
-        collOpts.acknowledgeEquatableRisk = options.acknowledgeEquatableRisk;
-      }
-      if (options?.sensitive !== void 0) {
-        collOpts.sensitive = options.sensitive;
-      }
-      if (options?.perRecordKeys !== void 0) collOpts.perRecordKeys = options.perRecordKeys;
+      copyDefined(collOpts, options, COLLECTION_PASSTHROUGH_KEYS);
       const subjectKey = this.strategies.forget.subjects[collectionName];
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
@@ -8674,22 +8329,8 @@ var Vault = class {
           if (value !== void 0 && value !== null) await this._addSubjectRef(coerceSubjectId(value), { collection: collectionName, id });
         };
       }
-      if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
-      if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
-      if (options?.tiers !== void 0) collOpts.tiers = options.tiers;
-      if (options?.tierMode !== void 0) collOpts.tierMode = options.tierMode;
-      if (options?.blobTierPolicy !== void 0) collOpts.blobTierPolicy = options.blobTierPolicy;
       collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
       if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
-      if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
-      if (options?.embeddings !== void 0) collOpts.embeddings = options.embeddings;
-      if (options?.textIndexes !== void 0) collOpts.textIndexes = options.textIndexes;
-      if (options?.warmIndexOnOpen !== void 0) collOpts.warmIndexOnOpen = options.warmIndexOnOpen;
-      if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
-      if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
-      if (options?.viaFields !== void 0) collOpts.viaFields = options.viaFields;
-      if (options?.computed !== void 0) collOpts.computed = options.computed;
-      if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
       if (effectiveViaFields.dictKeyFields !== void 0 || effectiveViaFields.lookupFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
@@ -8723,10 +8364,6 @@ var Vault = class {
       if (effectiveViaFields.i18nFields !== void 0 && this.translateText) {
         collOpts.autoTranslateHook = this.translateText;
       }
-      if (options?.fieldMeta !== void 0) {
-        collOpts.fieldMeta = options.fieldMeta;
-      }
-      if (options?.meta !== void 0) collOpts.meta = options.meta;
       if (options?.refs !== void 0) {
         collOpts.declaredRefs = this.refRegistry.getOutbound(collectionName);
       }
@@ -8745,7 +8382,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-YBMRLZLO.js")).persistSchemaIfNeeded({
+            await (await import("./register-CEX7R7NE.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9243,7 +8880,7 @@ var Vault = class {
    * is re-keyed for distinct recipients.
    *
    * Each recipient becomes its own `KeyringFile` sealed with that
-   * recipient's passphrase. The DEKs wrapped into each slot are
+   * recipient's secret. The DEKs wrapped into each slot are
    * exactly those the recipient's role + permissions justify, and
    * never wider than the source keyring's own DEK set
    * (privilege-escalation check).
@@ -9932,7 +9569,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-ZULMLCJK.js"),
+      import("./registry-EWIB5NTI.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9964,7 +9601,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-4V4YQCXJ.js");
+    const { MaterializedViewRegistry } = await import("./registry-DIKMRXUC.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9989,7 +9626,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-3LXKNXWI.js");
+    const { OverlayedViewRegistry } = await import("./registry-7CZWF3EQ.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -10036,14 +9673,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-YORMIBWV.js");
+    const { MaterializedViewExecutor } = await import("./executor-SVHAJZ4A.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-4UNPHWOU.js");
+    const { clearMVStaleFully } = await import("./stale-BJO2WIN7.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10056,7 +9693,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-TEZYRDN3.js");
+    const { DerivationExecutor } = await import("./executor-FCJEH3FU.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10083,7 +9720,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HRMHC34B.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10238,11 +9875,11 @@ var Vault = class {
    *
    *.
    */
-  async withConsent(ctx, fn2) {
+  async withConsent(ctx, fn) {
     const prior = this.consentContext;
     this.consentContext = ctx;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       this.consentContext = prior;
     }
@@ -10310,10 +9947,10 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-EV7LKJPH.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
-        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
+        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
       );
     }
     const targetKek = this.keyring.kek;
@@ -10332,7 +9969,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-EV7LKJPH.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10580,7 +10217,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-H4YE52S2.js");
+    const { dumpVaultSchema } = await import("./walk-JXMWKKQW.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10715,7 +10352,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-B5MY43CK.js");
+    const { readCover } = await import("./cover-ADBCTIKN.js");
     return readCover(this.adapter, this.name, opts);
   }
   /**
@@ -10730,7 +10367,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-JL2GOTYQ.js");
+    const { dumpVault } = await import("./backup-USYSNCYM.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10782,7 +10419,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-JL2GOTYQ.js");
+    const { loadVault } = await import("./backup-USYSNCYM.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10814,7 +10451,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-JL2GOTYQ.js");
+    const { verifyBackupIntegrity } = await import("./backup-USYSNCYM.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -11032,7 +10669,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-JL2GOTYQ.js");
+    const { exportVaultJSON } = await import("./backup-USYSNCYM.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11109,10 +10746,10 @@ var WriteQueueTracker = class {
    * (success or failure). The fn's resolved value is returned; a thrown
    * error is re-thrown after the queue is decremented.
    */
-  async track(fn2) {
+  async track(fn) {
     this.begin();
     try {
-      const value = await fn2();
+      const value = await fn();
       this.settle();
       return value;
     } catch (error) {
@@ -11135,6 +10772,183 @@ var WriteQueueTracker = class {
   }
 };
 
+// src/port/with/write-hooks.ts
+var WriteHookRegistry = class {
+  #before = [];
+  #after = [];
+  #suppressed = false;
+  /** True while handlers are running — used by the write path to skip nested firing. */
+  get suppressed() {
+    return this.#suppressed;
+  }
+  /** True when any hook is registered (cheap gate for the write path). */
+  get hasHandlers() {
+    return this.#before.length > 0 || this.#after.length > 0;
+  }
+  onBeforeWrite(handler) {
+    this.#before.push(handler);
+    return () => {
+      const i = this.#before.indexOf(handler);
+      if (i >= 0) this.#before.splice(i, 1);
+    };
+  }
+  onAfterWrite(handler) {
+    this.#after.push(handler);
+    return () => {
+      const i = this.#after.indexOf(handler);
+      if (i >= 0) this.#after.splice(i, 1);
+    };
+  }
+  /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
+  async runBefore(event) {
+    if (this.#before.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#before.slice()) await h(event);
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+  /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
+  async runAfter(event) {
+    if (this.#after.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#after.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] onAfterWrite handler failed for ${event.collection}/${event.docId}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+};
+
+// src/port/with/service-bus.ts
+var ServiceBus = class {
+  #handlers = /* @__PURE__ */ new Map();
+  #gateHandlers = /* @__PURE__ */ new Map();
+  #depth = 0;
+  /** Register a handler for an observe point. Returns an unsubscribe fn. */
+  register(point, handler) {
+    let arr = this.#handlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#handlers.set(point, arr);
+    }
+    arr.push(handler);
+    return () => {
+      const a = this.#handlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(handler);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any handler is registered for the point. */
+  hasHandlers(point) {
+    const a = this.#handlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True while one or more dispatches are in flight. Backed by a depth counter
+   * so that two concurrent async dispatches (`Promise.all([put('a'), put('b')])`
+   * each captured `busAfterPut=true` at their respective put() tops while depth
+   * was 0) both proceed independently — the counter stays > 0 until BOTH finish,
+   * so any nested write attempted by a handler still sees `dispatching === true`
+   * and is suppressed by the write-path gate in `collection.ts`
+   * (`busAfterPut = hasHandlers('afterPut') && !dispatching`). Re-entrancy
+   * suppression lives exclusively on that write-path gate; concurrent independent
+   * dispatches must not drop each other's events.
+   */
+  get dispatching() {
+    return this.#depth > 0;
+  }
+  /**
+   * Dispatch in registration order, awaited. Per-handler errors are warned, not
+   * thrown — an observe handler must never abort a completed write. A
+   * re-entrancy guard suppresses nested firing so a handler that itself writes
+   * cannot loop (same rationale as WriteHookRegistry.#suppressed).
+   */
+  async dispatch(point, event) {
+    const a = this.#handlers.get(point);
+    if (!a || a.length === 0) return;
+    this.#depth++;
+    try {
+      for (const h of a.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] service observe handler failed at ${point}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#depth--;
+    }
+  }
+  /**
+   * Register a write-gating handler. A throw from the handler ABORTS the
+   * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+   * the `needsPrior` prior-read declaration (#267).
+   */
+  registerGate(point, handler, opts) {
+    let arr = this.#gateHandlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#gateHandlers.set(point, arr);
+    }
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    arr.push(entry);
+    return () => {
+      const a = this.#gateHandlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(entry);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any gate handler is registered for the point. */
+  hasGateHandlers(point) {
+    const a = this.#gateHandlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True when at least one gate handler at `point` needs the prior record
+   * (the default). False when the point has no handlers or every handler
+   * registered with `needsPrior: false` — the write path then skips the
+   * prior-read before dispatching (#267 prior-read elision).
+   */
+  gateNeedsPrior(point) {
+    const a = this.#gateHandlers.get(point);
+    if (!a) return false;
+    return a.some((e) => e.needsPrior);
+  }
+  /**
+   * Run gate handlers in registration order, awaited. Unlike `dispatch`
+   * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
+   * write before it reaches the store. The first throw stops the remaining
+   * handlers (fail-fast). This is the seam guards/periods migrate onto.
+   *
+   * Note: gate handlers are validators that read, not write. A gate handler
+   * that writes back into the same collection would re-enter the write path
+   * and re-dispatch this point; loop-suppression for that case is deferred to
+   * the migration slice (contract: gate handlers must not perform writes that
+   * re-trigger their own point).
+   */
+  async dispatchGate(point, event) {
+    const a = this.#gateHandlers.get(point);
+    if (!a || a.length === 0) return;
+    for (const e of a.slice()) {
+      await e.fn(event);
+    }
+  }
+};
+
 // src/with-party/tab-coordination.ts
 var TabCoordinator = class {
   tabId;
@@ -11197,13 +11011,13 @@ var TabCoordinator = class {
     const out = [self, ...[...this.#peers.values()].filter((p) => p.lastSeen >= cutoff)];
     return out.sort((a, b) => a.tabId.localeCompare(b.tabId));
   }
-  onTabRoleChange(fn2) {
-    this.#roleHandlers.add(fn2);
-    return () => this.#roleHandlers.delete(fn2);
+  onTabRoleChange(fn) {
+    this.#roleHandlers.add(fn);
+    return () => this.#roleHandlers.delete(fn);
   }
-  onActiveTabsChange(fn2) {
-    this.#tabsHandlers.add(fn2);
-    return () => this.#tabsHandlers.delete(fn2);
+  onActiveTabsChange(fn) {
+    this.#tabsHandlers.add(fn);
+    return () => this.#tabsHandlers.delete(fn);
   }
   dispose() {
     if (this.#disposed) return;
@@ -11720,8 +11534,8 @@ async function describeAuthConfig(store, vault) {
   const lines = [];
   lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
   lines.push("");
-  lines.push("Tier 1 \u2014 Passphrase (master)");
-  lines.push(`  Phrase format: ${policy.passphrase?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.passphrase?.minWordLength ?? 3} chars/word`);
+  lines.push("Tier 1 \u2014 Secret (master)");
+  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
   lines.push("  Strength validator: enforced (override available for tests only)");
   lines.push("");
   lines.push("Tier 2 \u2014 Authenticate (routine login)");
@@ -11732,7 +11546,7 @@ async function describeAuthConfig(store, vault) {
   lines.push("  Method: PIN (per-app configurable)");
   lines.push("");
   lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
-  lines.push("Managed-passphrase mode: off (post-1.0)");
+  lines.push("Managed-secret mode: off (post-1.0)");
   lines.push("");
   lines.push("Sensitive-action gates:");
   for (const [gate, gp] of Object.entries(policy.gates)) {
@@ -11745,7 +11559,7 @@ async function diagramAuthConfig(store, vault) {
   const lines = [];
   lines.push("flowchart TB");
   lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
-  lines.push('  tier1["Tier 1<br/>Passphrase"]');
+  lines.push('  tier1["Tier 1<br/>Secret"]');
   lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
   lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
   lines.push("  vault --> tier1");
@@ -11819,7 +11633,7 @@ function describeGatePolicy(gp) {
 }
 function defaultPolicySnapshot() {
   return {
-    passphrase: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
+    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
     gates: {}
   };
 }
@@ -11877,8 +11691,9 @@ var TeamFacade = class {
   async runRotate(engine, vault, collections) {
     this.deps.checkPolicyOperation(vault, "rotate");
     const keyring = await this.deps.getKeyringInternal(vault);
-    await engine(this.deps.options.store, vault, keyring, collections);
+    const result = await engine(this.deps.options.store, vault, keyring, collections);
     this.deps.keyringCache.set(vault, keyring);
+    return result;
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
@@ -11969,7 +11784,7 @@ var TeamFacade = class {
    * ```ts
    * import { enrollWebAuthn } from '@noy-db/on-webauthn'
    *
-   * await db.enrollWebAuthn('demo', async (keyring) => {
+   * await db.team.enrollWebAuthn('demo', async (keyring) => {
    *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
    *   return {
    *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
@@ -11998,7 +11813,7 @@ var TeamFacade = class {
     const slotOptions = await ceremony(keyring);
     if (slotOptions.method !== "webauthn") {
       throw new ValidationError(
-        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.enrollAuthenticator() for non-webauthn methods.`
+        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.team.enrollAuthenticator() for non-webauthn methods.`
       );
     }
     const credentialId = slotOptions.meta.credentialId;
@@ -12076,44 +11891,44 @@ var TeamFacade = class {
   }
   // ─── Tier-1 change flows ────────────────────────────────────────
   /**
-   * Rotate the user's passphrase (user remembers old). Validates the
-   * new phrase against the configured `passphrase` policy, runs the
-   * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+   * Rotate the user's secret (user remembers old). Validates the
+   * new phrase against the configured `secret` policy, runs the
+   * `rotate-secret` gate, then re-derives + re-wraps every DEK.
    *
    * Tier-2 authenticator slots are dropped — each slot wraps the old
    * KEK and would need its derivation key to be re-presented. Re-enrol
    * via `db.enrollAuthenticator` after rotation.
    *
-   * @throws `WeakPassphraseError` on a weak new phrase.
+   * @throws `WeakSecretError` on a weak new phrase.
    * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
-   * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+   * @throws `InvalidKeyError` when `oldSecret` is wrong.
    */
-  async rotatePassphrase(vault, input, factors) {
-    if (this.deps.options.passphraseMode === "managed") {
+  async rotateSecret(vault, input, factors) {
+    if (this.deps.options.secretMode === "managed") {
       throw new PolicyDeniedError(
-        "rotate-passphrase",
+        "rotate-secret",
         "disabled",
         { minTier: 1, enabled: false },
-        "Managed-passphrase mode (#14): the passphrase is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed passphrase."
+        "Managed-secret mode (#14): the secret is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed secret."
       );
     }
-    await this.deps.checkGate(vault, "rotate-passphrase", factors);
+    await this.deps.checkGate(vault, "rotate-secret", factors);
     const userId = this.deps.options.user;
-    const next = await rotatePassphrase(this.deps.options.store, vault, userId, input);
+    const next = await rotateSecret(this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
   }
   /**
-   * Reset the passphrase using a recovery proof (user forgot the old).
+   * Reset the secret using a recovery proof (user forgot the old).
    * Currently supports the `'paper'` profile end-to-end; the
    * other profiles throw {@link RecoveryProfileNotImplementedError}.
    *
    * Burns the used recovery entry on success.
    */
-  async recoverPassphrase(vault, input, factors) {
-    await this.deps.checkGate(vault, "recover-passphrase", factors);
+  async recoverSecret(vault, input, factors) {
+    await this.deps.checkGate(vault, "recover-secret", factors);
     const userId = this.deps.options.user;
     const entriesBeforeRecovery = await loadPaperRecoveryEntries(this.deps.options.store, vault);
-    const next = await recoverPassphrase(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
+    const next = await recoverSecret(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
     const rotateRemaining = input.rotateRemainingCodes ?? true;
     const remainingAfterBurn = Math.max(0, entriesBeforeRecovery.length - 1);
@@ -12135,15 +11950,15 @@ var TeamFacade = class {
   }
   /**
    * Deliberate paper-recovery-code regeneration. User knows their
-   * passphrase but wants a fresh sheet — they lost the printout or
+   * secret but wants a fresh sheet — they lost the printout or
    * suspect compromise of the off-site copy.
    *
-   * Symmetric to {@link rotatePassphrase} for the recovery profile:
+   * Symmetric to {@link rotateSecret} for the recovery profile:
    * gated, audit-trackable, ergonomic. Replaces (not appends) the
    * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
    *
    * Gated by the `rotate-recovery` policy gate:
-   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the secret
    *     suffices, matching the lower-level flow's bar.
    *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
    *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
@@ -12163,13 +11978,13 @@ var TeamFacade = class {
    *
    * @example Default count + show-once UI
    * ```ts
-   * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+   * const { newCodes } = await db.team.rotateRecovery('acme', { profile: 'paper' })
    * showCodesToUser(newCodes)
    * ```
    *
    * @example STRICT-policy site with TOTP factor proof
    * ```ts
-   * await db.rotateRecovery(
+   * await db.team.rotateRecovery(
    *   'acme',
    *   { profile: 'paper', count: 10 },
    *   { factors: [{ kind: 'totp', proof: '123456' }] },
@@ -12193,7 +12008,7 @@ var TeamFacade = class {
     const existing = await loadPaperRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
+        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
       );
     }
     const keyring = await this.getKeyring(vault);
@@ -12215,7 +12030,7 @@ var TeamFacade = class {
     const existing = await loadShamirRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
+        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
       );
     }
     let targetEntryId;
@@ -12252,7 +12067,7 @@ var TeamFacade = class {
    * **Atomic create-and-enroll for managed-mode vaults.**
    *
    * Bootstraps a managed-mode vault and enrolls strong recovery in
-   * a single ceremony. Under `passphraseMode: 'managed'`, every
+   * a single ceremony. Under `secretMode: 'managed'`, every
    * `openVault` call requires a strong recovery profile (Shamir
    * today) to be enrolled — otherwise it throws
    * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
@@ -12271,11 +12086,11 @@ var TeamFacade = class {
    * ```ts
    * const db = await createNoydb({
    *   store, user: 'alice',
-   *   passphraseMode: 'managed',
+   *   secretMode: 'managed',
    *   sealingKey: macosKeychainSealingProvider({ ... }),
    * })
    *
-   * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+   * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
    *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
    * })
    * for (const r of recoveryEnrollments) {
@@ -12292,11 +12107,11 @@ var TeamFacade = class {
         "openVaultAndEnrollRecovery: at least one recovery enrollment is required."
       );
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const hasStrong = opts.recovery.some((r) => r.profile === "shamir");
       if (!hasStrong) {
         throw new ValidationError(
-          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user passphrase to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
+          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user secret to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
         );
       }
     }
@@ -12311,7 +12126,7 @@ var TeamFacade = class {
     for (const enrollment of opts.recovery) {
       recoveryEnrollments.push(await this.enrollRecovery(vault, enrollment));
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const policy = this.deps.policyCache.get(vault);
       if (policy) {
         await this.deps.assertRecoveryEnrolled(vault, policy);
@@ -12320,20 +12135,20 @@ var TeamFacade = class {
     return { vault: vaultHandle, recoveryEnrollments };
   }
   /**
-   * **Recovery flow under managed-passphrase mode.**
+   * **Recovery flow under managed-secret mode.**
    *
-   * Replaces the sealed passphrase of a managed-mode vault with a
+   * Replaces the sealed secret of a managed-mode vault with a
    * fresh 256-bit random, sealed under the configured
-   * `SealingKeyProvider`. The user never sees the new passphrase.
+   * `SealingKeyProvider`. The user never sees the new secret.
    *
    * Internally:
    *   1. Verify the recovery proof (Shamir today) and unwrap the
    *      DEK set.
-   *   2. Mint a fresh 256-bit random as the new effective passphrase.
+   *   2. Mint a fresh 256-bit random as the new effective secret.
    *   3. Rewrap the DEK set under a fresh KEK derived from the new
-   *      passphrase (via the existing `recoverPassphrase` path).
+   *      secret (via the existing `recoverSecret` path).
    *   4. Seal the random bytes under the provider and overwrite
-   *      `_meta/sealed-passphrase`.
+   *      `_meta/sealed-secret`.
    *   5. Drop the keyring cache so the next operation re-derives.
    *
    * The vault's strong-recovery enrollment is preserved across
@@ -12341,40 +12156,40 @@ var TeamFacade = class {
    *
    * @throws ValidationError if the Noydb instance is not in managed mode.
    */
-  async recoverManagedPassphrase(vault, options) {
-    if (this.deps.options.passphraseMode !== "managed") {
+  async recoverManagedSecret(vault, options) {
+    if (this.deps.options.secretMode !== "managed") {
       throw new ValidationError(
-        "recoverManagedPassphrase: this method only applies to vaults opened in managed-passphrase mode. For standard mode, use db.recoverPassphrase."
+        "recoverManagedSecret: this method only applies to vaults opened in managed-secret mode. For standard mode, use db.recoverSecret."
       );
     }
     const provider = this.deps.options.sealingKey;
     if (!provider) {
       throw new ValidationError(
-        'recoverManagedPassphrase: createNoydb({ passphraseMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed passphrase cannot be persisted.'
+        'recoverManagedSecret: createNoydb({ secretMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed secret cannot be persisted.'
       );
     }
     const randomBytes = new Uint8Array(32);
     globalThis.crypto.getRandomValues(randomBytes);
     let binary = "";
     for (let i = 0; i < randomBytes.length; i++) binary += String.fromCharCode(randomBytes[i]);
-    const newPassphrase = btoa(binary);
+    const newSecret = btoa(binary);
     try {
       const sealed = await provider.seal(randomBytes);
-      await recoverPassphrase(
+      await recoverSecret(
         this.deps.options.shamirRecovery,
         this.deps.options.store,
         vault,
         this.deps.options.user,
         {
-          newPassphrase,
+          newSecret,
           recoveryProof: options.recoveryProof,
-          // The new passphrase IS 256 bits of random; policy gates on
+          // The new secret IS 256 bits of random; policy gates on
           // length/entropy don't apply.
-          allowWeakPassphrase: true,
-          ...options.passphrasePolicy !== void 0 ? { passphrasePolicy: options.passphrasePolicy } : {}
+          allowWeakSecret: true,
+          ...options.secretPolicy !== void 0 ? { secretPolicy: options.secretPolicy } : {}
         }
       );
-      await saveSealedPassphrase(this.deps.options.store, vault, {
+      await saveSealedSecret(this.deps.options.store, vault, {
         providerId: provider.id,
         sealed
       });
@@ -12385,7 +12200,7 @@ var TeamFacade = class {
   }
   /**
    * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
-   * a fresh temp passphrase in a single store write. Closes the
+   * a fresh temp secret in a single store write. Closes the
    * partial-failure window (the previous compose-from-primitives
    * pattern was `db.revoke + db.grant`, two writes — if the issuer
    * cancelled between them the target was locked out entirely).
@@ -12404,17 +12219,17 @@ var TeamFacade = class {
    * recovery / TOTP / email-OTP factor proof at the moment of
    * recovery, so the issuer affirmatively re-asserts identity.
    *
-   * The recipient should call `db.rotatePassphrase` on first session
+   * The recipient should call `db.rotateSecret` on first session
    * to choose their own phrase — the temp acts as a single-use
    * bridge.
    *
    * ```ts
-   * await db.recoverUser('acme', {
+   * await db.team.recoverUser('acme', {
    *   userId: 'bob',
-   *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+   *   secret: 'temporary-correct-horse-battery-staple-printer',
    * }, { factors: [{ kind: 'recovery' }] })
    * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-   * // and immediately calls db.rotatePassphrase to set his own.
+   * // and immediately calls db.rotateSecret to set his own.
    * ```
    *
    * @throws `NoAccessError` when no keyring exists for the target.
@@ -12440,17 +12255,17 @@ var TeamFacade = class {
    * The hub wraps the user's DEK set (not the KEK) under a code-derived
    * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
    * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
-   * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+   * pair it with `db.team.getKeyring(vault)` to obtain the live DEK set:
    *
    * ```ts
    * import { mintPaperRecoveryEntry } from '@noy-db/hub'
    *
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
    * const entries = await Promise.all(
    *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
    * )
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * showCodesToUser(codes)
    * ```
    *
@@ -12461,7 +12276,7 @@ var TeamFacade = class {
    * ```ts
    * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
    * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * ```
    */
   async enrollRecovery(vault, enrollment) {
@@ -12561,7 +12376,7 @@ var TeamFacade = class {
    * and no `secret` / `getKeyring` is configured.
    *
    * ```ts
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * // keyring.deks: Map<collection, CryptoKey>
    * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
    * // keyring.role / .permissions / .authenticators
@@ -12638,7 +12453,7 @@ var Noydb = class {
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
   /**
-   * Per-vault active session tier — defaults to `1` after a passphrase
+   * Per-vault active session tier — defaults to `1` after a secret
    * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
    * {@link checkGate} to evaluate `gate.minTier`.
    */
@@ -12686,7 +12501,23 @@ var Noydb = class {
   policyManager;
   /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
   policyCheckGate;
-  team;
+  /**
+   * Credential and multi-user operations — enrolment, secret rotation,
+   * recovery, quick-unlock (#846).
+   *
+   * Public because 23 methods on this class did nothing but restate a
+   * TeamFacade signature and forward to it, so every signature had to be
+   * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+   * reads the same and has one source of truth.
+   *
+   * A getter, not a field, so it appears in the prototype-based kernel API
+   * manifest — an instance field is invisible to it (the same reason
+   * `custodyStrategy` became one in #838).
+   */
+  get team() {
+    return this.#team;
+  }
+  #team;
   /**
    * Currently-running multi-record transaction, set by
    * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -12748,7 +12579,7 @@ var Noydb = class {
         this.vaultCache.delete(vault);
       }
     });
-    this.team = new TeamFacade({
+    this.#team = new TeamFacade({
       options: this.options,
       keyringCache: this.keyringCache,
       activeTier: this.activeTier,
@@ -12850,7 +12681,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-WQQRU6DO.js");
+      const { GuardExecutor } = await import("./executor-OHET7TF7.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13205,16 +13036,26 @@ var Noydb = class {
   /**
    * Rotate the DEKs for the given collections in a vault.
    *
-   * Generates fresh DEKs, re-encrypts every record in each collection,
-   * and re-wraps the new DEKs into every remaining user's keyring. The
-   * old DEKs become unreachable — useful as a defense-in-depth measure
-   * after a suspected key leak, or as the scheduled half of a
-   * key-rotation policy.
+   * Generates fresh DEKs and re-encrypts every record in each collection.
+   * The old DEKs become unreachable — useful as a defense-in-depth measure
+   * after a suspected key leak, or as the scheduled half of a key-rotation
+   * policy.
    *
-   * Unlike `revoke({ rotateKeys: true })`, this call does NOT remove
-   * any users — every current member keeps access, but with fresh
-   * keys. This is the "just rotate" path; the "revoke and rotate"
-   * path still lives in `revoke()`.
+   * ## Other members LOSE access to the rotated collections (#854)
+   *
+   * A member's DEKs are wrapped under that member's KEK, and a KEK derives
+   * only from that member's secret. The caller cannot derive anyone else's
+   * KEK, so re-wrapping a fresh DEK for them is impossible — that is the
+   * zero-knowledge property working as designed. Rotation therefore DROPS
+   * the rotated collections from every other member's keyring.
+   *
+   * The returned {@link RotateResult.needsRegrant} names each (member,
+   * collection) pair that was dropped. Re-run `grant()` for those pairs, or
+   * they stay locked out.
+   *
+   * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
+   * user from the vault — they keep membership and their other collections.
+   * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
    *
    * Exposed on Noydb (rather than only on the lower-level keyring
    * module) so CLI and admin tooling can trigger rotation without
@@ -13235,9 +13076,9 @@ var Noydb = class {
    *
    * The walk is a two-step pipeline: first ask the adapter for the
    * universe of compartments it stores, then for each one attempt to
-   * load the calling user's keyring with the in-memory passphrase.
+   * load the calling user's keyring with the in-memory secret.
    * Compartments where the user has no keyring file (`NoAccessError`)
-   * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+   * or where the secret doesn't unwrap (`InvalidKeyError`) are
    * silently dropped from the result — the existence of those
    * compartments is **not** confirmed in the return value.
    *
@@ -13258,15 +13099,15 @@ var Noydb = class {
    * **Known edge case.** A vault whose keyring file
    * happens to have an empty wrapped-DEKs map (because the owner
    * granted access before any collection was created) will pass the
-   * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+   * `loadKeyring` probe with *any* secret — there are no DEKs to
    * unwrap, so the integrity-checked unwrap that normally rejects
-   * wrong passphrases never runs. The result is that an unrelated
+   * wrong secrets never runs. The result is that an unrelated
    * principal who happens to know the user-id and the vault
    * name can show up in `listAccessibleVaults()` as having
    * access to that empty vault. They cannot read any actual
    * data (their DEK set is empty), so this is a metadata leak
    * (vault name + user-id), not a content leak. Hardening this
-   * via a passphrase canary in the keyring file is a deferred
+   * via a secret canary in the keyring file is a deferred
    * follow-up.
    *
    * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -13307,7 +13148,7 @@ var Noydb = class {
     }
     if (!this.options.secret) {
       throw new ValidationError(
-        "Noydb.listAccessibleVaults(): a secret (passphrase) is required when encryption is enabled."
+        "Noydb.listAccessibleVaults(): a secret (secret) is required when encryption is enabled."
       );
     }
     const minRank = ROLE_RANK[options.minRole ?? "client"];
@@ -13382,7 +13223,7 @@ var Noydb = class {
    * })
    * ```
    */
-  async queryAcross(vaultIds, fn2, options = {}) {
+  async queryAcross(vaultIds, fn, options = {}) {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.resetSessionTimer();
     const concurrency = Math.max(1, options.concurrency ?? 1);
@@ -13396,7 +13237,7 @@ var Noydb = class {
       const task = (async () => {
         try {
           const comp = await this.openVault(vaultId, { create: options.create !== false });
-          const result = await fn2(comp);
+          const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
           results[idx] = {
@@ -13446,21 +13287,21 @@ var Noydb = class {
     return store.resolveBackend ? store.resolveBackend(vaultId) : this.options.store;
   }
   /**
-   * Change the current user's passphrase for a vault.
+   * Change the current user's secret for a vault.
    *
-   * Validates the new passphrase against the strength rules. Pass
-   * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-   * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+   * Validates the new secret against the strength rules. Pass
+   * `{ allowWeakSecret: true }` to skip — typically only useful for
+   * fixtures and migrations. Pass a `SecretPolicy` to override the
    * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
    */
-  async changeSecret(vault, newPassphrase, options) {
+  async changeSecret(vault, newSecret, options) {
     this.checkPolicyOperation(vault, "changeSecret");
     const keyring = await this._getKeyringInternal(vault);
     const updated = await changeSecret(
       this.options.store,
       vault,
       keyring,
-      newPassphrase,
+      newSecret,
       options
     );
     this.keyringCache.set(vault, updated);
@@ -13618,8 +13459,8 @@ var Noydb = class {
     }
     return engine;
   }
-  _forEachSyncEngine(vault, fn2) {
-    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn2(engine);
+  _forEachSyncEngine(vault, fn) {
+    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn(engine);
   }
   // ─── Events ────────────────────────────────────────────────────
   on(event, handler) {
@@ -13663,9 +13504,9 @@ var Noydb = class {
     return this.writeHooks.onAfterWrite(handler);
   }
   /** Subscribe to cross-tab write conflicts. Returns an unsubscribe. */
-  onWriteConflict(fn2) {
-    this.on("write:conflict", fn2);
-    return () => this.off("write:conflict", fn2);
+  onWriteConflict(fn) {
+    this.on("write:conflict", fn);
+    return () => this.off("write:conflict", fn);
   }
   /**
    * Enable same-device multi-tab coordination: primary/secondary
@@ -13739,12 +13580,12 @@ var Noydb = class {
   activeTabs() {
     return this.tabCoordinator?.activeTabs() ?? [];
   }
-  onTabRoleChange(fn2) {
-    return this.tabCoordinator?.onTabRoleChange(fn2) ?? (() => {
+  onTabRoleChange(fn) {
+    return this.tabCoordinator?.onTabRoleChange(fn) ?? (() => {
     });
   }
-  onActiveTabsChange(fn2) {
-    return this.tabCoordinator?.onActiveTabsChange(fn2) ?? (() => {
+  onActiveTabsChange(fn) {
+    return this.tabCoordinator?.onActiveTabsChange(fn) ?? (() => {
     });
   }
   /** @internal The write-hook registry, threaded into each Collection. */
@@ -13941,7 +13782,7 @@ var Noydb = class {
    * denial; resolves with `void` on success.
    *
    * @param vault    The vault whose policy applies.
-   * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+   * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
    *                 or app-defined (`app:*`).
    * @param presented Caller-supplied factor proofs.
    */
@@ -13966,12 +13807,12 @@ var Noydb = class {
    * Two enforcement modes:
    *
    * 1. **Managed-mode mandatory strong-recovery.** When
-   *    `passphraseMode === 'managed'`, the vault MUST have at least
+   *    `secretMode === 'managed'`, the vault MUST have at least
    *    one **strong** recovery profile (Shamir today). Paper alone is
    *    rejected because under managed mode the user has no memorized
-   *    passphrase, so losing the paper sheet = losing every record.
+   *    secret, so losing the paper sheet = losing every record.
    *    This check is unconditional — independent of `requireRecovery`
-   *    and the `recover-passphrase` gate.
+   *    and the `recover-secret` gate.
    *
    * 2. **Opt-in strict mandatory-recovery.** When
    *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -13985,14 +13826,14 @@ var Noydb = class {
    */
   async assertRecoveryEnrolled(vault, policy, opts) {
     const skipManaged = (opts?.skipManagedCheck ?? false) || this._skipNextManagedRecoveryCheck;
-    if (this.options.passphraseMode === "managed" && !skipManaged) {
+    if (this.options.secretMode === "managed" && !skipManaged) {
       const enrolled2 = await hasStrongRecoveryEnrolled(this.options.store, vault);
       if (!enrolled2) {
         throw new ManagedRecoveryNotEnrolledError(vault);
       }
     }
     if (this.options.requireRecovery !== true) return;
-    const gate = policy.gates["recover-passphrase"];
+    const gate = policy.gates["recover-secret"];
     if (gate?.enabled === false) return;
     const enrolled = await hasRecoveryEnrolled(this.options.store, vault);
     if (enrolled) return;
@@ -14007,34 +13848,6 @@ var Noydb = class {
     this.activeTier.set(vault, tier);
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
-  /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-  async enrollAuthenticator(vault, options, factors) {
-    return this.team.enrollAuthenticator(vault, options, factors);
-  }
-  /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-  async removeAuthenticator(vault, slotId, factors) {
-    return this.team.removeAuthenticator(vault, slotId, factors);
-  }
-  /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-  async listAuthenticators(vault) {
-    return this.team.listAuthenticators(vault);
-  }
-  /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-  async updateAuthenticator(vault, slotId, options, factors) {
-    return this.team.updateAuthenticator(vault, slotId, options, factors);
-  }
-  /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-  async enrollWebAuthn(vault, ceremony, factors) {
-    return this.team.enrollWebAuthn(vault, ceremony, factors);
-  }
-  /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-  async listWebAuthnSlots(vault) {
-    return this.team.listWebAuthnSlots(vault);
-  }
-  /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-  async unlockViaAuthenticator(vault, slotId, verify) {
-    return this.team.unlockViaAuthenticator(vault, slotId, verify);
-  }
   // ─── Cover (https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md) ──────
   /**
    * Set the owner-curated cover for a vault. Throws
@@ -14058,7 +13871,7 @@ var Noydb = class {
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-B5MY43CK.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-ADBCTIKN.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -14090,76 +13903,12 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-B5MY43CK.js");
+    const { readCover } = await import("./cover-ADBCTIKN.js");
     return readCover(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
-  /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-  async describeAuthConfig(vault) {
-    return this.team.describeAuthConfig(vault);
-  }
-  /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-  async diagramAuthConfig(vault) {
-    return this.team.diagramAuthConfig(vault);
-  }
-  /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-  async describeUserAuth(vault, userId, factors) {
-    return this.team.describeUserAuth(vault, userId, factors);
-  }
-  /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-  async describeAllUsersAuth(vault, factors) {
-    return this.team.describeAllUsersAuth(vault, factors);
-  }
   // ─── Tier-1 change flows ────────────────────────────────────────
-  /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-  async rotatePassphrase(vault, input, factors) {
-    return this.team.rotatePassphrase(vault, input, factors);
-  }
-  /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-  async recoverPassphrase(vault, input, factors) {
-    return this.team.recoverPassphrase(vault, input, factors);
-  }
-  /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-  async rotateRecovery(vault, options, factors) {
-    return this.team.rotateRecovery(vault, options, factors);
-  }
-  /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-  async openVaultAndEnrollRecovery(vault, opts) {
-    return this.team.openVaultAndEnrollRecovery(vault, opts);
-  }
-  /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-  async recoverManagedPassphrase(vault, options) {
-    return this.team.recoverManagedPassphrase(vault, options);
-  }
-  /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-  async recoverUser(vault, options, factors) {
-    return this.team.recoverUser(vault, options, factors);
-  }
-  /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-  async enrollRecovery(vault, enrollment) {
-    return this.team.enrollRecovery(vault, enrollment);
-  }
-  /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-  async listRecoveryEntries(vault) {
-    return this.team.listRecoveryEntries(vault);
-  }
   // ─── Tier-3 enroll / unlock ─────────────────────────────────────
-  /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-  async enrollUnlock(vault, state, factors) {
-    return this.team.enrollUnlock(vault, state, factors);
-  }
-  /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-  async unlockViaPin(vault, resume) {
-    return this.team.unlockViaPin(vault, resume);
-  }
-  /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-  clearQuickUnlock(vault) {
-    this.team.clearQuickUnlock(vault);
-  }
-  /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-  async getKeyring(vault) {
-    return this.team.getKeyring(vault);
-  }
   /**
    * Live-reference variant used by the hub's own code paths. Internal
    * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a
@@ -14180,7 +13929,7 @@ var Noydb = class {
     }
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
-    if (this.options.passphraseMode === "managed") {
+    if (this.options.secretMode === "managed") {
       effectiveSecret = await resolveManagedSecret(
         this.options.store,
         vault,
@@ -14190,7 +13939,7 @@ var Noydb = class {
       effectiveSecret = this.options.secret;
     }
     if (!effectiveSecret) {
-      throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+      throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
     }
     let keyring;
     try {
@@ -14204,10 +13953,10 @@ var Noydb = class {
           effectiveSecret,
           {
             // Managed mode generates 256-bit base64 strings that don't satisfy
-            // the human-passphrase strength rules (no spaces, no "words").
+            // the human-secret strength rules (no spaces, no "words").
             // Skip validation in managed mode — the entropy floor is already
             // 256 bits by construction.
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
+            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
           }
         );
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
@@ -14218,7 +13967,7 @@ var Noydb = class {
           this.options.user,
           effectiveSecret,
           {
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
+            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
           }
         );
       } else {
@@ -14256,34 +14005,34 @@ var Noydb = class {
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   const encrypted = options.encrypt !== false;
-  const managed = options.passphraseMode === "managed";
+  const managed = options.secretMode === "managed";
   if (options.secret && options.getKeyring) {
     throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
   }
   if (managed) {
     if (options.secret) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the passphrase itself. Drop `secret`.'
+        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
       );
     }
     if (options.getKeyring) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
+        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
       );
     }
     if (!options.sealingKey) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
       );
     }
   }
   if (encrypted && !managed && !options.secret && !options.getKeyring) {
-    throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-UPAT2O3M.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-5QVQX4HG.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-EAXSJNOT.js");
+    const policyModule = await import("./policy-QWGJB7P7.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14320,4 +14069,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-W7TCXZWU.js.map
+//# sourceMappingURL=chunk-EWPS35AR.js.map