@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.6

package/dist/{chunk-EEZCB74X.js → chunk-EWPS35AR.js}

@@ -1,15 +1,18 @@
+import {
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-YGMREQAK.js";
 import {
   loadVaultPolicy
-} from "./chunk-QMZ5A6FQ.js";
+} from "./chunk-M7W2KYTL.js";
 import {
   jsonSchemaToFields
 } from "./chunk-VYYM3MEN.js";
 import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-X3MWEFPT.js";
+  resolveStaleOnRead
+} from "./chunk-5ABOFAHN.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
@@ -20,12 +23,9 @@ import {
   hashFields,
   validateSatelliteDeclaration
 } from "./chunk-522MBPE5.js";
-import {
-  resolveStaleOnRead
-} from "./chunk-XUFAFHQM.js";
 import {
   loadFence
-} from "./chunk-M6QA2KK2.js";
+} from "./chunk-44Y3P5U6.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
@@ -34,35 +34,28 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-HAPY7WFP.js";
+} from "./chunk-3TZUC4WS.js";
 import {
   derivePersistedSchema,
   isZod4Schema
 } from "./chunk-SEU6QHH4.js";
-import {
-  isBaseLive,
-  liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
 import {
   CustodyApi,
   NO_CARGO,
-  NO_CUSTODY
-} from "./chunk-L2CAWCQL.js";
+  NO_CUSTODY,
+  runDrainBarrier
+} from "./chunk-3S2YNMUS.js";
 import {
   resolveManagedSecret,
   saveSealedSecret
-} from "./chunk-OHV6T5JB.js";
+} from "./chunk-6SSWOUUS.js";
 import {
-  ServiceBus,
-  WriteHookRegistry,
-  assertCanExport,
-  assertCanImport,
-  canExport,
-  canImport
-} from "./chunk-IGLU4ME7.js";
+  isBaseLive,
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
 import {
-  runDrainBarrier
-} from "./chunk-AFAPBZAA.js";
+  NO_SYNC
+} from "./chunk-EP5L47XV.js";
 import {
   NO_ATTESTATION
 } from "./chunk-GTNRMJYH.js";
@@ -70,15 +63,24 @@ import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-YZNKFYDC.js";
+} from "./chunk-ZM72UO3Y.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-FTCGEUOY.js";
+} from "./chunk-HDF5R2K6.js";
 import {
   NO_PORTABILITY
 } from "./chunk-OWLZONGX.js";
+import {
+  NO_PERIODS
+} from "./chunk-IUATR5UE.js";
+import {
+  NO_SHADOW
+} from "./chunk-SMY5X46Z.js";
+import {
+  NO_SNAPSHOTS
+} from "./chunk-NIKO2BBZ.js";
 import {
   TxContext,
   bestEffortRevert,
@@ -111,25 +113,29 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-7BIJS6II.js";
+} from "./chunk-JTIPVW4J.js";
+import {
+  lazy
+} from "./chunk-5D2ALSM5.js";
 import {
   OverlayedCollection
 } from "./chunk-PWWWMRT7.js";
 import {
-  NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-HQKRZIX6.js";
+} from "./chunk-MPPWL64H.js";
 import {
   EXPORT_AUDIT_COLLECTION,
+  NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-J5TEU77Q.js";
+} from "./chunk-LN3MQFUE.js";
 import {
   LazyQuery,
+  NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-BY5YBSXA.js";
+} from "./chunk-GQT6J4FJ.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -137,13 +143,22 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-QMMOMBH6.js";
+} from "./chunk-XZHEOSQ2.js";
+import {
+  NO_REDUCE
+} from "./chunk-YMUFFJCO.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
+import {
+  NO_CRDT
+} from "./chunk-PVEWA2DU.js";
+import {
+  NO_CONSENT
+} from "./chunk-PEOZ34EM.js";
 import {
   dictCollectionName
-} from "./chunk-K7BADAOS.js";
+} from "./chunk-C2V7AJO2.js";
 import {
   NO_I18N,
   getAtPath,
@@ -151,9 +166,8 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-JN3SGXJE.js";
+} from "./chunk-JOCMXSR2.js";
 import {
-  installViaBinder,
   isViaInstalled,
   viaBinder
 } from "./chunk-ZUDAK436.js";
@@ -161,13 +175,21 @@ import {
   NO_TEAM,
   enrollAuthenticator,
   findAuthenticator,
+  hasRecoveryEnrolled,
+  hasStrongRecoveryEnrolled,
+  loadPaperRecoveryEntries,
+  loadShamirRecoveryEntries,
+  mintPaperRecoveryEntry,
+  mintShamirRecoveryEntry,
   recoverSecret,
   recoverUser,
   removeAuthenticator,
   rotateSecret,
+  savePaperRecoveryEntries,
+  saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-FIP7KI2P.js";
+} from "./chunk-M4GO4ZJK.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -175,26 +197,18 @@ import {
   createOwnerKeyring,
   ensureCollectionDEK,
   hasAccess,
+  hasExportCapability,
+  hasImportCapability,
   hasWritePermission,
   isSecretBearingReservedCollection,
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-3LJYHE7S.js";
+} from "./chunk-ZDFU34XY.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-6RPWILRH.js";
-import {
-  hasRecoveryEnrolled,
-  hasStrongRecoveryEnrolled,
-  loadPaperRecoveryEntries,
-  loadShamirRecoveryEntries,
-  mintPaperRecoveryEntry,
-  mintShamirRecoveryEntry,
-  savePaperRecoveryEntries,
-  saveShamirRecoveryEntries
-} from "./chunk-CJVEAVYH.js";
+} from "./chunk-7IQWHYL2.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -209,9 +223,15 @@ import {
   NO_BROKER,
   buildCredentialBrokerHandle
 } from "./chunk-P4NUJVWL.js";
+import {
+  NO_SESSION
+} from "./chunk-VKQCVU2Z.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
+import {
+  NO_HISTORY
+} from "./chunk-AFHQATY4.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
@@ -219,7 +239,7 @@ import {
 } from "./chunk-PTT2NB46.js";
 import {
   sha256Hex
-} from "./chunk-RWW3I3PO.js";
+} from "./chunk-2BVW754E.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -228,7 +248,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-I2XEBEEF.js";
+} from "./chunk-AZXEOEQK.js";
 import {
   NO_SEALED_RECORD
 } from "./chunk-7LP7FFJ2.js";
@@ -242,20 +262,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-MMVQ3SUO.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-SC4JLMZI.js";
+} from "./chunk-KCZAFDP5.js";
 import {
   encrypt
 } from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-DOZFU7OZ.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -266,8 +286,10 @@ import {
   DebugPlaintextError,
   DictKeyInUseError,
   ElevationExpiredError,
+  ExportCapabilityError,
   FieldNotQueryableError,
   ForgetStrategyNotConfiguredError,
+  ImportCapabilityError,
   IndexWriteFailureError,
   InvalidKeyError,
   KeyringCorruptError,
@@ -296,232 +318,16 @@ import {
   ValidationError
 } from "./chunk-6SYOHUHM.js";
 
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
-// src/with-audit/consent/strategy.ts
-var NO_CONSENT = {
-  async write() {
-  },
-  async read() {
-    return [];
-  }
-};
-
-// src/with-commit/crdt/strategy.ts
-var NOT_ENABLED = new Error(
-  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
-);
-var NO_CRDT = {
-  buildLwwMapState() {
-    throw NOT_ENABLED;
-  },
-  buildRgaState() {
-    throw NOT_ENABLED;
-  },
-  mergeCrdtStates() {
-    throw NOT_ENABLED;
-  },
-  resolveCrdtSnapshot() {
-    throw NOT_ENABLED;
-  }
-};
-
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-// src/with-lookup/indexing/strategy.ts
-var NO_INDEXING = {
-  createState() {
-    return DISABLED_STATE;
-  }
-};
-var DISABLED_STATE = {
-  isEnabled: false,
-  getEagerIndexes: () => null,
-  getPersistedIndexes: () => null
-};
-
-// src/with-audit/periods/strategy.ts
-var NOT_ENABLED2 = new Error(
-  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-);
-var NO_PERIODS = {
-  async loadPeriods() {
-    return [];
-  },
-  async chainAnchor() {
-    return { priorPeriodHash: "" };
-  },
-  assertTsWritable() {
-  },
-  validatePeriodName() {
-    throw NOT_ENABLED2;
-  },
-  async appendPeriodLedgerEntry() {
-    throw NOT_ENABLED2;
-  }
-};
-
-// src/with-party/session/strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
-  );
-}
-var NO_SESSION = {
-  validateSessionPolicy() {
-    throw notEnabled2("sessionPolicy");
-  },
-  createEnforcer() {
-    throw notEnabled2("session policy enforcement");
-  },
-  revokeAllSessions() {
-  }
-};
-
-// src/with-fork/shadow/strategy.ts
-var NOT_ENABLED3 = new Error(
-  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-);
-var NO_SHADOW = {
-  buildFrame() {
-    throw NOT_ENABLED3;
-  }
-};
-
-// src/with-fork/snapshots/strategy.ts
-var NOT_ENABLED4 = new Error(
-  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
-);
-var NO_SNAPSHOTS = {
-  async snapshot() {
-    throw NOT_ENABLED4;
-  },
-  async listSnapshots() {
-    throw NOT_ENABLED4;
-  },
-  async restoreSnapshot() {
-    throw NOT_ENABLED4;
-  },
-  async autoSnapshot() {
-    throw NOT_ENABLED4;
-  }
-};
-
-// src/with-party/team/sync-strategy.ts
-function notEnabled3(op) {
-  return new Error(
-    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
-  );
-}
-var NO_SYNC = {
-  buildSyncEngine() {
-    throw notEnabled3("SyncEngine");
-  },
-  buildSyncTransaction() {
-    throw notEnabled3("SyncTransaction");
-  },
-  buildPresence() {
-    throw notEnabled3("collection.presence()");
-  }
-};
-
 // src/with-commit/tx/strategy.ts
-var NOT_ENABLED5 = new Error(
+var NOT_ENABLED = new Error(
   'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
 );
 var NO_TX = {
   async runTransaction(_db, _fn, _options, _txInvariants) {
-    throw NOT_ENABLED5;
+    throw NOT_ENABLED;
   },
   async runDryRun() {
-    throw NOT_ENABLED5;
+    throw NOT_ENABLED;
   }
 };
 
@@ -535,7 +341,7 @@ var NO_ARCHIVE = {
 
 // src/port/with/strategies.ts
 var STRATEGY_DEFAULTS = {
-  aggregate: NO_AGGREGATE,
+  reduce: NO_REDUCE,
   archive: NO_ARCHIVE,
   attestation: NO_ATTESTATION,
   blob: NO_BLOBS,
@@ -576,10 +382,61 @@ function resolveStrategies(options) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-P3IU5JHD.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-DX5HECK3.js");
   return new StoreCoordinationProvider(store);
 }
 
+// src/port/with/collection-registries.ts
+function populateCollectionRegistries(r, collectionName, options, effectiveViaFields) {
+  if (options?.refs) {
+    r.refRegistry.register(collectionName, options.refs);
+  }
+  if (effectiveViaFields.i18nFields) {
+    r.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
+  }
+  if (options?.blobFields) {
+    r.blobFieldsRegistry.set(collectionName, options.blobFields);
+  }
+  if (options?.archive) {
+    r.archiveRegistry.set(collectionName, options.archive);
+  }
+  if (options?.attestation !== void 0) {
+    r.attestation.register(collectionName, options.attestation);
+  }
+  if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
+    const dictFieldMap = {};
+    const staticFieldMap = {};
+    for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
+      if (isStaticDictDescriptor(desc)) {
+        staticFieldMap[field] = desc;
+        r.staticDictNames.add(desc.name);
+        r.staticByName.set(desc.name, desc);
+      } else {
+        dictFieldMap[field] = desc.name;
+      }
+    }
+    const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
+    Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
+    for (const [field, desc] of lookupCompat.staticEntries) {
+      staticFieldMap[field] = desc;
+      r.staticDictNames.add(desc.name);
+      r.staticByName.set(desc.name, desc);
+    }
+    if (Object.keys(dictFieldMap).length > 0) {
+      r.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
+      for (const dictName of new Set(Object.values(dictFieldMap))) {
+        r.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
+      }
+    }
+    if (Object.keys(staticFieldMap).length > 0) {
+      r.staticDescriptorByField.set(collectionName, staticFieldMap);
+    }
+  }
+  if ((options?.schemaUpdate?.length ?? 0) > 0) {
+    r.schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
+  }
+}
+
 // src/kernel/via/pipeline.ts
 var ViaPipeline = class _ViaPipeline {
   constructor(bindings, taint) {
@@ -2311,10 +2168,9 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var fn = null;
+var loadComputed = lazy(() => import("./computed-33DRJDOC.js"));
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-33DRJDOC.js")).evalComputedFields;
-  return fn;
+  return (await loadComputed()).evalComputedFields;
 }
 
 // src/kernel/collection.ts
@@ -3296,7 +3152,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
+      const { resolveStaleMVOnRead } = await import("./stale-BJO2WIN7.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3782,7 +3638,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-SMXUO7W5.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-V5MSMQYX.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3955,7 +3811,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-PKQQFDBT.js");
+    const { dispatchDerivations } = await import("./dispatch-SPMYNXNW.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4232,7 +4088,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-PKQQFDBT.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-SPMYNXNW.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4246,7 +4102,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-SMXUO7W5.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-V5MSMQYX.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4266,7 +4122,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
+      const { resolveStaleMVOnRead } = await import("./stale-BJO2WIN7.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4518,7 +4374,7 @@ var Collection = class {
       ...this.defaultLocale !== void 0 ? { defaultLocale: this.defaultLocale } : {},
       ...resolver.resolveDictSource ? { resolveDictSource: (field) => resolver.resolveDictSource(leftCollection, field) } : {}
     } : void 0;
-    return new Query(source, void 0, joinContext, this.strategies.aggregate);
+    return new Query(source, void 0, joinContext, this.strategies.reduce);
   }
   /**
    * Subscribe to every put/delete on this collection. Returns an
@@ -5419,14 +5275,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-52P3D72W.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-SVDRXLD3.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-52P3D72W.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-SVDRXLD3.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5597,6 +5453,64 @@ var Collection = class {
   }
 };
 
+// src/port/with/capabilities.ts
+function assertCanExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanExport: plaintext tier requires a format");
+    }
+    if (!hasExportCapability(keyring, "plaintext", format)) {
+      throw new ExportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasExportCapability(keyring, "bundle")) {
+    throw new ExportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function assertCanImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanImport: plaintext tier requires a format");
+    }
+    if (!hasImportCapability(keyring, "plaintext", format)) {
+      throw new ImportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasImportCapability(keyring, "bundle")) {
+    throw new ImportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function canExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasExportCapability(keyring, "plaintext", format);
+  }
+  return hasExportCapability(keyring, "bundle");
+}
+function canImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasImportCapability(keyring, "plaintext", format);
+  }
+  return hasImportCapability(keyring, "bundle");
+}
+
 // src/with-commit/tx/elevated-handle.ts
 var ELEVATION_AUDIT_COLLECTION = "_elevation_audit";
 var ElevatedHandle = class {
@@ -6811,7 +6725,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-ZU4E5J5S.js").then(
+  const load = () => engine ??= import("./link-set-XVZY2ODC.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7294,7 +7208,7 @@ var SatelliteRegistry = class {
     if (reason !== void 0) throw new SatelliteConfigError(reason);
   }
   /** Per-base async mutex: chains sections on a stored promise tail. */
-  async withPairLock(base, fn2) {
+  async withPairLock(base, fn) {
     const tail = this.locks.get(base) ?? Promise.resolve();
     let release;
     const gate = new Promise((res) => {
@@ -7303,7 +7217,7 @@ var SatelliteRegistry = class {
     this.locks.set(base, tail.then(() => gate));
     await tail;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       release();
     }
@@ -7349,7 +7263,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-XIAHB6KF.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-5VHHVFJY.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8245,6 +8159,22 @@ var Vault = class {
       enforceStaticDictOnPut: (collectionName, record) => this.enforceStaticDictOnPut(collectionName, record)
     };
   }
+  /** The registries `populateCollectionRegistries` writes into (#841). */
+  #registries() {
+    return {
+      refRegistry: this.refRegistry,
+      i18nFieldRegistry: this.i18nFieldRegistry,
+      blobFieldsRegistry: this.blobFieldsRegistry,
+      archiveRegistry: this.archiveRegistry,
+      attestation: this.attestation,
+      dictKeyFieldRegistry: this.dictKeyFieldRegistry,
+      staticDictNames: this.staticDictNames,
+      staticByName: this.staticByName,
+      staticDescriptorByField: this.staticDescriptorByField,
+      reservedLookupCollections: this.reservedLookupCollections,
+      schemaUpdateNames: this.#schemaUpdateNames
+    };
+  }
   collection(collectionName, options) {
     const overlayRegistry = this.overlayedViewRegistry;
     if (overlayRegistry !== null && overlayRegistry.isOverlay(collectionName)) {
@@ -8278,8 +8208,8 @@ var Vault = class {
         registerPoisonHook: (hook) => {
           this.noydb._writeHooks.onBeforeWrite(hook);
         },
-        forEachSyncEngine: (fn2) => {
-          this.noydb._forEachSyncEngine(this.name, fn2);
+        forEachSyncEngine: (fn) => {
+          this.noydb._forEachSyncEngine(this.name, fn);
         }
       }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
     }
@@ -8296,60 +8226,14 @@ var Vault = class {
       });
     }
     if (!coll) {
-      if (options?.refs) {
-        this.refRegistry.register(collectionName, options.refs);
-      }
-      if (effectiveViaFields.i18nFields) {
-        this.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
-      }
-      if (options?.blobFields) {
-        this.blobFieldsRegistry.set(collectionName, options.blobFields);
-      }
-      if (options?.archive) {
-        this.archiveRegistry.set(collectionName, options.archive);
-      }
-      if (options?.attestation !== void 0) {
-        this.attestation.register(collectionName, options.attestation);
-      }
-      if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
-        const dictFieldMap = {};
-        const staticFieldMap = {};
-        for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
-          if (isStaticDictDescriptor(desc)) {
-            staticFieldMap[field] = desc;
-            this.staticDictNames.add(desc.name);
-            this.staticByName.set(desc.name, desc);
-          } else {
-            dictFieldMap[field] = desc.name;
-          }
-        }
-        const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
-        Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
-        for (const [field, desc] of lookupCompat.staticEntries) {
-          staticFieldMap[field] = desc;
-          this.staticDictNames.add(desc.name);
-          this.staticByName.set(desc.name, desc);
-        }
-        if (Object.keys(dictFieldMap).length > 0) {
-          this.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
-          for (const dictName of new Set(Object.values(dictFieldMap))) {
-            this.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
-          }
-        }
-        if (Object.keys(staticFieldMap).length > 0) {
-          this.staticDescriptorByField.set(collectionName, staticFieldMap);
-        }
-      }
-      if ((options?.schemaUpdate?.length ?? 0) > 0) {
-        this.#schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
-      }
+      populateCollectionRegistries(this.#registries(), collectionName, options, effectiveViaFields);
       let schemaUpdateGate;
       if (options?.persistJsonSchema === true && options.schema !== void 0 && (options.schemaUpdate?.length ?? 0) > 0) {
         const validator = options.schema;
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-HB4TQZSV.js");
+          const { persistSchemaIfNeeded } = await import("./register-CEX7R7NE.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8498,7 +8382,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-HB4TQZSV.js")).persistSchemaIfNeeded({
+            await (await import("./register-CEX7R7NE.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9685,7 +9569,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-JOFO7RAH.js"),
+      import("./registry-EWIB5NTI.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9717,7 +9601,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-6BMBFEXT.js");
+    const { MaterializedViewRegistry } = await import("./registry-DIKMRXUC.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9789,14 +9673,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-SHYLIBOM.js");
+    const { MaterializedViewExecutor } = await import("./executor-SVHAJZ4A.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-NBROTA66.js");
+    const { clearMVStaleFully } = await import("./stale-BJO2WIN7.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9836,7 +9720,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WWXVHHUH.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HRMHC34B.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -9991,11 +9875,11 @@ var Vault = class {
    *
    *.
    */
-  async withConsent(ctx, fn2) {
+  async withConsent(ctx, fn) {
     const prior = this.consentContext;
     this.consentContext = ctx;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       this.consentContext = prior;
     }
@@ -10063,7 +9947,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-EV7LKJPH.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10085,7 +9969,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-EV7LKJPH.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10333,7 +10217,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-E3OVLBFR.js");
+    const { dumpVaultSchema } = await import("./walk-JXMWKKQW.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10468,7 +10352,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-5BSNJREH.js");
+    const { readCover } = await import("./cover-ADBCTIKN.js");
     return readCover(this.adapter, this.name, opts);
   }
   /**
@@ -10483,7 +10367,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-YCHAC575.js");
+    const { dumpVault } = await import("./backup-USYSNCYM.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10535,7 +10419,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-YCHAC575.js");
+    const { loadVault } = await import("./backup-USYSNCYM.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10567,7 +10451,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-YCHAC575.js");
+    const { verifyBackupIntegrity } = await import("./backup-USYSNCYM.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10785,7 +10669,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-YCHAC575.js");
+    const { exportVaultJSON } = await import("./backup-USYSNCYM.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10862,10 +10746,10 @@ var WriteQueueTracker = class {
    * (success or failure). The fn's resolved value is returned; a thrown
    * error is re-thrown after the queue is decremented.
    */
-  async track(fn2) {
+  async track(fn) {
     this.begin();
     try {
-      const value = await fn2();
+      const value = await fn();
       this.settle();
       return value;
     } catch (error) {
@@ -10888,6 +10772,183 @@ var WriteQueueTracker = class {
   }
 };
 
+// src/port/with/write-hooks.ts
+var WriteHookRegistry = class {
+  #before = [];
+  #after = [];
+  #suppressed = false;
+  /** True while handlers are running — used by the write path to skip nested firing. */
+  get suppressed() {
+    return this.#suppressed;
+  }
+  /** True when any hook is registered (cheap gate for the write path). */
+  get hasHandlers() {
+    return this.#before.length > 0 || this.#after.length > 0;
+  }
+  onBeforeWrite(handler) {
+    this.#before.push(handler);
+    return () => {
+      const i = this.#before.indexOf(handler);
+      if (i >= 0) this.#before.splice(i, 1);
+    };
+  }
+  onAfterWrite(handler) {
+    this.#after.push(handler);
+    return () => {
+      const i = this.#after.indexOf(handler);
+      if (i >= 0) this.#after.splice(i, 1);
+    };
+  }
+  /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
+  async runBefore(event) {
+    if (this.#before.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#before.slice()) await h(event);
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+  /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
+  async runAfter(event) {
+    if (this.#after.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#after.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] onAfterWrite handler failed for ${event.collection}/${event.docId}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+};
+
+// src/port/with/service-bus.ts
+var ServiceBus = class {
+  #handlers = /* @__PURE__ */ new Map();
+  #gateHandlers = /* @__PURE__ */ new Map();
+  #depth = 0;
+  /** Register a handler for an observe point. Returns an unsubscribe fn. */
+  register(point, handler) {
+    let arr = this.#handlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#handlers.set(point, arr);
+    }
+    arr.push(handler);
+    return () => {
+      const a = this.#handlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(handler);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any handler is registered for the point. */
+  hasHandlers(point) {
+    const a = this.#handlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True while one or more dispatches are in flight. Backed by a depth counter
+   * so that two concurrent async dispatches (`Promise.all([put('a'), put('b')])`
+   * each captured `busAfterPut=true` at their respective put() tops while depth
+   * was 0) both proceed independently — the counter stays > 0 until BOTH finish,
+   * so any nested write attempted by a handler still sees `dispatching === true`
+   * and is suppressed by the write-path gate in `collection.ts`
+   * (`busAfterPut = hasHandlers('afterPut') && !dispatching`). Re-entrancy
+   * suppression lives exclusively on that write-path gate; concurrent independent
+   * dispatches must not drop each other's events.
+   */
+  get dispatching() {
+    return this.#depth > 0;
+  }
+  /**
+   * Dispatch in registration order, awaited. Per-handler errors are warned, not
+   * thrown — an observe handler must never abort a completed write. A
+   * re-entrancy guard suppresses nested firing so a handler that itself writes
+   * cannot loop (same rationale as WriteHookRegistry.#suppressed).
+   */
+  async dispatch(point, event) {
+    const a = this.#handlers.get(point);
+    if (!a || a.length === 0) return;
+    this.#depth++;
+    try {
+      for (const h of a.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] service observe handler failed at ${point}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#depth--;
+    }
+  }
+  /**
+   * Register a write-gating handler. A throw from the handler ABORTS the
+   * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+   * the `needsPrior` prior-read declaration (#267).
+   */
+  registerGate(point, handler, opts) {
+    let arr = this.#gateHandlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#gateHandlers.set(point, arr);
+    }
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    arr.push(entry);
+    return () => {
+      const a = this.#gateHandlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(entry);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any gate handler is registered for the point. */
+  hasGateHandlers(point) {
+    const a = this.#gateHandlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True when at least one gate handler at `point` needs the prior record
+   * (the default). False when the point has no handlers or every handler
+   * registered with `needsPrior: false` — the write path then skips the
+   * prior-read before dispatching (#267 prior-read elision).
+   */
+  gateNeedsPrior(point) {
+    const a = this.#gateHandlers.get(point);
+    if (!a) return false;
+    return a.some((e) => e.needsPrior);
+  }
+  /**
+   * Run gate handlers in registration order, awaited. Unlike `dispatch`
+   * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
+   * write before it reaches the store. The first throw stops the remaining
+   * handlers (fail-fast). This is the seam guards/periods migrate onto.
+   *
+   * Note: gate handlers are validators that read, not write. A gate handler
+   * that writes back into the same collection would re-enter the write path
+   * and re-dispatch this point; loop-suppression for that case is deferred to
+   * the migration slice (contract: gate handlers must not perform writes that
+   * re-trigger their own point).
+   */
+  async dispatchGate(point, event) {
+    const a = this.#gateHandlers.get(point);
+    if (!a || a.length === 0) return;
+    for (const e of a.slice()) {
+      await e.fn(event);
+    }
+  }
+};
+
 // src/with-party/tab-coordination.ts
 var TabCoordinator = class {
   tabId;
@@ -10950,13 +11011,13 @@ var TabCoordinator = class {
     const out = [self, ...[...this.#peers.values()].filter((p) => p.lastSeen >= cutoff)];
     return out.sort((a, b) => a.tabId.localeCompare(b.tabId));
   }
-  onTabRoleChange(fn2) {
-    this.#roleHandlers.add(fn2);
-    return () => this.#roleHandlers.delete(fn2);
+  onTabRoleChange(fn) {
+    this.#roleHandlers.add(fn);
+    return () => this.#roleHandlers.delete(fn);
   }
-  onActiveTabsChange(fn2) {
-    this.#tabsHandlers.add(fn2);
-    return () => this.#tabsHandlers.delete(fn2);
+  onActiveTabsChange(fn) {
+    this.#tabsHandlers.add(fn);
+    return () => this.#tabsHandlers.delete(fn);
   }
   dispose() {
     if (this.#disposed) return;
@@ -11630,8 +11691,9 @@ var TeamFacade = class {
   async runRotate(engine, vault, collections) {
     this.deps.checkPolicyOperation(vault, "rotate");
     const keyring = await this.deps.getKeyringInternal(vault);
-    await engine(this.deps.options.store, vault, keyring, collections);
+    const result = await engine(this.deps.options.store, vault, keyring, collections);
     this.deps.keyringCache.set(vault, keyring);
+    return result;
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
@@ -12974,16 +13036,26 @@ var Noydb = class {
   /**
    * Rotate the DEKs for the given collections in a vault.
    *
-   * Generates fresh DEKs, re-encrypts every record in each collection,
-   * and re-wraps the new DEKs into every remaining user's keyring. The
-   * old DEKs become unreachable — useful as a defense-in-depth measure
-   * after a suspected key leak, or as the scheduled half of a
-   * key-rotation policy.
+   * Generates fresh DEKs and re-encrypts every record in each collection.
+   * The old DEKs become unreachable — useful as a defense-in-depth measure
+   * after a suspected key leak, or as the scheduled half of a key-rotation
+   * policy.
+   *
+   * ## Other members LOSE access to the rotated collections (#854)
+   *
+   * A member's DEKs are wrapped under that member's KEK, and a KEK derives
+   * only from that member's secret. The caller cannot derive anyone else's
+   * KEK, so re-wrapping a fresh DEK for them is impossible — that is the
+   * zero-knowledge property working as designed. Rotation therefore DROPS
+   * the rotated collections from every other member's keyring.
+   *
+   * The returned {@link RotateResult.needsRegrant} names each (member,
+   * collection) pair that was dropped. Re-run `grant()` for those pairs, or
+   * they stay locked out.
    *
-   * Unlike `revoke({ rotateKeys: true })`, this call does NOT remove
-   * any users — every current member keeps access, but with fresh
-   * keys. This is the "just rotate" path; the "revoke and rotate"
-   * path still lives in `revoke()`.
+   * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
+   * user from the vault — they keep membership and their other collections.
+   * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
    *
    * Exposed on Noydb (rather than only on the lower-level keyring
    * module) so CLI and admin tooling can trigger rotation without
@@ -13151,7 +13223,7 @@ var Noydb = class {
    * })
    * ```
    */
-  async queryAcross(vaultIds, fn2, options = {}) {
+  async queryAcross(vaultIds, fn, options = {}) {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.resetSessionTimer();
     const concurrency = Math.max(1, options.concurrency ?? 1);
@@ -13165,7 +13237,7 @@ var Noydb = class {
       const task = (async () => {
         try {
           const comp = await this.openVault(vaultId, { create: options.create !== false });
-          const result = await fn2(comp);
+          const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
           results[idx] = {
@@ -13387,8 +13459,8 @@ var Noydb = class {
     }
     return engine;
   }
-  _forEachSyncEngine(vault, fn2) {
-    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn2(engine);
+  _forEachSyncEngine(vault, fn) {
+    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn(engine);
   }
   // ─── Events ────────────────────────────────────────────────────
   on(event, handler) {
@@ -13432,9 +13504,9 @@ var Noydb = class {
     return this.writeHooks.onAfterWrite(handler);
   }
   /** Subscribe to cross-tab write conflicts. Returns an unsubscribe. */
-  onWriteConflict(fn2) {
-    this.on("write:conflict", fn2);
-    return () => this.off("write:conflict", fn2);
+  onWriteConflict(fn) {
+    this.on("write:conflict", fn);
+    return () => this.off("write:conflict", fn);
   }
   /**
    * Enable same-device multi-tab coordination: primary/secondary
@@ -13508,12 +13580,12 @@ var Noydb = class {
   activeTabs() {
     return this.tabCoordinator?.activeTabs() ?? [];
   }
-  onTabRoleChange(fn2) {
-    return this.tabCoordinator?.onTabRoleChange(fn2) ?? (() => {
+  onTabRoleChange(fn) {
+    return this.tabCoordinator?.onTabRoleChange(fn) ?? (() => {
     });
   }
-  onActiveTabsChange(fn2) {
-    return this.tabCoordinator?.onActiveTabsChange(fn2) ?? (() => {
+  onActiveTabsChange(fn) {
+    return this.tabCoordinator?.onActiveTabsChange(fn) ?? (() => {
     });
   }
   /** @internal The write-hook registry, threaded into each Collection. */
@@ -13799,7 +13871,7 @@ var Noydb = class {
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-5BSNJREH.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-ADBCTIKN.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -13831,7 +13903,7 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-5BSNJREH.js");
+    const { readCover } = await import("./cover-ADBCTIKN.js");
     return readCover(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -13958,9 +14030,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-22ES33N3.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-5QVQX4HG.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-IY2YEA3A.js");
+    const policyModule = await import("./policy-QWGJB7P7.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -13997,4 +14069,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-EEZCB74X.js.map
+//# sourceMappingURL=chunk-EWPS35AR.js.map