@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.7

package/dist/{chunk-EEZCB74X.js → chunk-XOBHRD2M.js}

@@ -1,93 +1,59 @@
 import {
-  loadVaultPolicy
-} from "./chunk-QMZ5A6FQ.js";
-import {
-  jsonSchemaToFields
-} from "./chunk-VYYM3MEN.js";
-import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-X3MWEFPT.js";
+  resolveStaleOnRead
+} from "./chunk-NJ4DYYO5.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-MUPZ6IZX.js";
+} from "./chunk-4JQK3L4V.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-522MBPE5.js";
-import {
-  resolveStaleOnRead
-} from "./chunk-XUFAFHQM.js";
+} from "./chunk-SHEEBRZ4.js";
 import {
   loadFence
-} from "./chunk-M6QA2KK2.js";
+} from "./chunk-6M2I3DKF.js";
 import {
-  InvertedIndex,
-  MemoryIndexStore,
-  NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-HAPY7WFP.js";
+} from "./chunk-CCDP6EPB.js";
 import {
-  derivePersistedSchema,
-  isZod4Schema
-} from "./chunk-SEU6QHH4.js";
+  SchemaUpdateGate
+} from "./chunk-6LJY7X5A.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
-import {
-  CustodyApi,
-  NO_CARGO,
-  NO_CUSTODY
-} from "./chunk-L2CAWCQL.js";
-import {
-  resolveManagedSecret,
-  saveSealedSecret
-} from "./chunk-OHV6T5JB.js";
-import {
-  ServiceBus,
-  WriteHookRegistry,
-  assertCanExport,
-  assertCanImport,
-  canExport,
-  canImport
-} from "./chunk-IGLU4ME7.js";
-import {
-  runDrainBarrier
-} from "./chunk-AFAPBZAA.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-GTNRMJYH.js";
-import {
-  NO_CLASSIFIED,
-  guardClassifiedCompat,
-  resolveClassifiedFields
-} from "./chunk-YZNKFYDC.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-FTCGEUOY.js";
+} from "./chunk-6R6Q3MRN.js";
 import {
   NO_PORTABILITY
-} from "./chunk-OWLZONGX.js";
+} from "./chunk-BLBAQRBM.js";
 import {
-  TxContext,
-  bestEffortRevert,
-  revertExecuted
-} from "./chunk-QVGEVZ5F.js";
+  NO_CARGO,
+  runDrainBarrier
+} from "./chunk-TG634KCO.js";
+import {
+  resolveManagedSecret,
+  saveSealedSecret
+} from "./chunk-OLIWCCFM.js";
+import {
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-6ZNSB3H6.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-Z4D3YGAB.js";
+} from "./chunk-4ZKNC6A6.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -111,25 +77,69 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-7BIJS6II.js";
+} from "./chunk-GP3UWP22.js";
 import {
   OverlayedCollection
-} from "./chunk-PWWWMRT7.js";
+} from "./chunk-ZTLOXFPB.js";
+import {
+  NO_SYNC
+} from "./chunk-EP5L47XV.js";
+import {
+  NO_ATTESTATION
+} from "./chunk-5GQEU4DN.js";
+import {
+  NO_CLASSIFIED,
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-ZFUFAHZ3.js";
+import {
+  NO_PERIODS
+} from "./chunk-N5PLUFH2.js";
+import {
+  NO_SHADOW
+} from "./chunk-SMY5X46Z.js";
+import {
+  NO_SNAPSHOTS
+} from "./chunk-DZFQVICS.js";
+import {
+  TxContext,
+  bestEffortRevert,
+  revertExecuted
+} from "./chunk-BQ6DHN4I.js";
+import {
+  lazy
+} from "./chunk-5D2ALSM5.js";
+import {
+  InvertedIndex,
+  MemoryIndexStore,
+  NO_SEARCH
+} from "./chunk-QADFHRQM.js";
+import {
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-EBKCYQ2D.js";
+import {
+  CustodyApi,
+  NO_CUSTODY
+} from "./chunk-SKM35Y4Q.js";
 import {
-  NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-HQKRZIX6.js";
+} from "./chunk-WBKZUO5V.js";
 import {
   EXPORT_AUDIT_COLLECTION,
+  NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-J5TEU77Q.js";
+} from "./chunk-IF6WNGAK.js";
 import {
   LazyQuery,
+  NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-BY5YBSXA.js";
+} from "./chunk-L3YYLT4E.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -137,13 +147,22 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-QMMOMBH6.js";
+} from "./chunk-XZHEOSQ2.js";
+import {
+  NO_REDUCE
+} from "./chunk-YMUFFJCO.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
+import {
+  NO_CRDT
+} from "./chunk-PVEWA2DU.js";
+import {
+  NO_CONSENT
+} from "./chunk-PEOZ34EM.js";
 import {
   dictCollectionName
-} from "./chunk-K7BADAOS.js";
+} from "./chunk-NEX7JCMO.js";
 import {
   NO_I18N,
   getAtPath,
@@ -151,23 +170,44 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-JN3SGXJE.js";
+} from "./chunk-UADPR6F4.js";
 import {
-  installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-ZUDAK436.js";
+} from "./chunk-6UBZ6I5Z.js";
 import {
   NO_TEAM,
+  describeAllUsersAuth,
+  describeAuthConfig,
+  describeUserAuth,
+  diagramAuthConfig,
   enrollAuthenticator,
   findAuthenticator,
+  hasRecoveryEnrolled,
+  hasStrongRecoveryEnrolled,
+  loadPaperRecoveryEntries,
+  loadShamirRecoveryEntries,
+  mintPaperRecoveryEntry,
+  mintShamirRecoveryEntry,
   recoverSecret,
   recoverUser,
   removeAuthenticator,
   rotateSecret,
+  savePaperRecoveryEntries,
+  saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-FIP7KI2P.js";
+} from "./chunk-C25JXSOR.js";
+import {
+  INDEXED_STORE_POLICY
+} from "./chunk-VQNJ7UZL.js";
+import {
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-EZNTORXE.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -175,51 +215,39 @@ import {
   createOwnerKeyring,
   ensureCollectionDEK,
   hasAccess,
+  hasExportCapability,
+  hasImportCapability,
   hasWritePermission,
   isSecretBearingReservedCollection,
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-3LJYHE7S.js";
+} from "./chunk-KPXM4WO6.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-6RPWILRH.js";
-import {
-  hasRecoveryEnrolled,
-  hasStrongRecoveryEnrolled,
-  loadPaperRecoveryEntries,
-  loadShamirRecoveryEntries,
-  mintPaperRecoveryEntry,
-  mintShamirRecoveryEntry,
-  savePaperRecoveryEntries,
-  saveShamirRecoveryEntries
-} from "./chunk-CJVEAVYH.js";
-import {
-  INDEXED_STORE_POLICY
-} from "./chunk-VQNJ7UZL.js";
-import {
-  PERIODS_COLLECTION,
-  PERIOD_ARCHIVES_COLLECTION,
-  PERIOD_FREEZES_COLLECTION,
-  PERIOD_TARGET_PURGES_COLLECTION,
-  periodExclusiveUpperBound
-} from "./chunk-TMR64XPL.js";
+} from "./chunk-WZ3NCMK6.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-P4NUJVWL.js";
+} from "./chunk-IXNCZTWA.js";
+import {
+  NO_SESSION
+} from "./chunk-VKQCVU2Z.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
+import {
+  NO_HISTORY
+} from "./chunk-AFHQATY4.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-PTT2NB46.js";
+} from "./chunk-JYJFGD2H.js";
 import {
   sha256Hex
-} from "./chunk-RWW3I3PO.js";
+} from "./chunk-ISRKW4YN.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -228,10 +256,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-I2XEBEEF.js";
+} from "./chunk-KFRPNHWR.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-7LP7FFJ2.js";
+} from "./chunk-QD46HPZG.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -242,20 +270,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-SC4JLMZI.js";
+} from "./chunk-VH6SOCXH.js";
 import {
   encrypt
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-GZACYEOB.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -266,8 +294,10 @@ import {
   DebugPlaintextError,
   DictKeyInUseError,
   ElevationExpiredError,
+  ExportCapabilityError,
   FieldNotQueryableError,
   ForgetStrategyNotConfiguredError,
+  ImportCapabilityError,
   IndexWriteFailureError,
   InvalidKeyError,
   KeyringCorruptError,
@@ -294,234 +324,18 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-6SYOHUHM.js";
-
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
-// src/with-audit/consent/strategy.ts
-var NO_CONSENT = {
-  async write() {
-  },
-  async read() {
-    return [];
-  }
-};
-
-// src/with-commit/crdt/strategy.ts
-var NOT_ENABLED = new Error(
-  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
-);
-var NO_CRDT = {
-  buildLwwMapState() {
-    throw NOT_ENABLED;
-  },
-  buildRgaState() {
-    throw NOT_ENABLED;
-  },
-  mergeCrdtStates() {
-    throw NOT_ENABLED;
-  },
-  resolveCrdtSnapshot() {
-    throw NOT_ENABLED;
-  }
-};
-
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-// src/with-lookup/indexing/strategy.ts
-var NO_INDEXING = {
-  createState() {
-    return DISABLED_STATE;
-  }
-};
-var DISABLED_STATE = {
-  isEnabled: false,
-  getEagerIndexes: () => null,
-  getPersistedIndexes: () => null
-};
-
-// src/with-audit/periods/strategy.ts
-var NOT_ENABLED2 = new Error(
-  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-);
-var NO_PERIODS = {
-  async loadPeriods() {
-    return [];
-  },
-  async chainAnchor() {
-    return { priorPeriodHash: "" };
-  },
-  assertTsWritable() {
-  },
-  validatePeriodName() {
-    throw NOT_ENABLED2;
-  },
-  async appendPeriodLedgerEntry() {
-    throw NOT_ENABLED2;
-  }
-};
-
-// src/with-party/session/strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
-  );
-}
-var NO_SESSION = {
-  validateSessionPolicy() {
-    throw notEnabled2("sessionPolicy");
-  },
-  createEnforcer() {
-    throw notEnabled2("session policy enforcement");
-  },
-  revokeAllSessions() {
-  }
-};
-
-// src/with-fork/shadow/strategy.ts
-var NOT_ENABLED3 = new Error(
-  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-);
-var NO_SHADOW = {
-  buildFrame() {
-    throw NOT_ENABLED3;
-  }
-};
-
-// src/with-fork/snapshots/strategy.ts
-var NOT_ENABLED4 = new Error(
-  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
-);
-var NO_SNAPSHOTS = {
-  async snapshot() {
-    throw NOT_ENABLED4;
-  },
-  async listSnapshots() {
-    throw NOT_ENABLED4;
-  },
-  async restoreSnapshot() {
-    throw NOT_ENABLED4;
-  },
-  async autoSnapshot() {
-    throw NOT_ENABLED4;
-  }
-};
-
-// src/with-party/team/sync-strategy.ts
-function notEnabled3(op) {
-  return new Error(
-    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
-  );
-}
-var NO_SYNC = {
-  buildSyncEngine() {
-    throw notEnabled3("SyncEngine");
-  },
-  buildSyncTransaction() {
-    throw notEnabled3("SyncTransaction");
-  },
-  buildPresence() {
-    throw notEnabled3("collection.presence()");
-  }
-};
+} from "./chunk-QZWTRENR.js";
 
 // src/with-commit/tx/strategy.ts
-var NOT_ENABLED5 = new Error(
-  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
+var NOT_ENABLED = new Error(
+  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/transactions" and pass it to `createNoydb({ transactionsStrategy: withTransactions() })`.'
 );
-var NO_TX = {
+var NO_TRANSACTIONS = {
   async runTransaction(_db, _fn, _options, _txInvariants) {
-    throw NOT_ENABLED5;
+    throw NOT_ENABLED;
   },
   async runDryRun() {
-    throw NOT_ENABLED5;
+    throw NOT_ENABLED;
   }
 };
 
@@ -535,10 +349,10 @@ var NO_ARCHIVE = {
 
 // src/port/with/strategies.ts
 var STRATEGY_DEFAULTS = {
-  aggregate: NO_AGGREGATE,
+  reduce: NO_REDUCE,
   archive: NO_ARCHIVE,
   attestation: NO_ATTESTATION,
-  blob: NO_BLOBS,
+  blobs: NO_BLOBS,
   broker: NO_BROKER,
   cargo: NO_CARGO,
   classified: NO_CLASSIFIED,
@@ -548,7 +362,7 @@ var STRATEGY_DEFAULTS = {
   forget: NO_FORGET,
   history: NO_HISTORY,
   i18n: NO_I18N,
-  index: NO_INDEXING,
+  indexing: NO_INDEXING,
   lazy: IMPLICIT_LAZY,
   periods: NO_PERIODS,
   portability: NO_PORTABILITY,
@@ -557,11 +371,11 @@ var STRATEGY_DEFAULTS = {
   sequence: NO_SEQUENCE,
   session: NO_SESSION,
   shadow: NO_SHADOW,
-  snapshot: NO_SNAPSHOTS,
+  snapshots: NO_SNAPSHOTS,
   sync: NO_SYNC,
   team: NO_TEAM,
   tiers: NO_TIERS,
-  tx: NO_TX
+  transactions: NO_TRANSACTIONS
 };
 var STRATEGY_KEYS = Object.keys(STRATEGY_DEFAULTS);
 function resolveStrategies(options) {
@@ -576,10 +390,61 @@ function resolveStrategies(options) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-P3IU5JHD.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-5LX2UFU2.js");
   return new StoreCoordinationProvider(store);
 }
 
+// src/port/with/collection-registries.ts
+function populateCollectionRegistries(r, collectionName, options, effectiveViaFields) {
+  if (options?.refs) {
+    r.refRegistry.register(collectionName, options.refs);
+  }
+  if (effectiveViaFields.i18nFields) {
+    r.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
+  }
+  if (options?.blobFields) {
+    r.blobFieldsRegistry.set(collectionName, options.blobFields);
+  }
+  if (options?.archive) {
+    r.archiveRegistry.set(collectionName, options.archive);
+  }
+  if (options?.attestation !== void 0) {
+    r.attestation.register(collectionName, options.attestation);
+  }
+  if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
+    const dictFieldMap = {};
+    const staticFieldMap = {};
+    for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
+      if (isStaticDictDescriptor(desc)) {
+        staticFieldMap[field] = desc;
+        r.staticDictNames.add(desc.name);
+        r.staticByName.set(desc.name, desc);
+      } else {
+        dictFieldMap[field] = desc.name;
+      }
+    }
+    const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
+    Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
+    for (const [field, desc] of lookupCompat.staticEntries) {
+      staticFieldMap[field] = desc;
+      r.staticDictNames.add(desc.name);
+      r.staticByName.set(desc.name, desc);
+    }
+    if (Object.keys(dictFieldMap).length > 0) {
+      r.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
+      for (const dictName of new Set(Object.values(dictFieldMap))) {
+        r.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
+      }
+    }
+    if (Object.keys(staticFieldMap).length > 0) {
+      r.staticDescriptorByField.set(collectionName, staticFieldMap);
+    }
+  }
+  if ((options?.schemaUpdate?.length ?? 0) > 0) {
+    r.schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
+  }
+}
+
 // src/kernel/via/pipeline.ts
 var ViaPipeline = class _ViaPipeline {
   constructor(bindings, taint) {
@@ -1073,7 +938,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
   const persisted = ctx.persistedIndexes;
   if (!persisted) {
     throw new Error(
-      `Collection "${ctx.name}": indexing is disabled on this Noydb instance. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexStrategy })\`.`
+      `Collection "${ctx.name}": indexing is disabled on this Noydb instance. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy })\`.`
     );
   }
   if (!persisted.has(field)) {
@@ -2311,10 +2176,9 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var fn = null;
+var loadComputed = lazy(() => import("./computed-AB45PS4V.js"));
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-33DRJDOC.js")).evalComputedFields;
-  return fn;
+  return (await loadComputed()).evalComputedFields;
 }
 
 // src/kernel/collection.ts
@@ -2356,7 +2220,7 @@ var Collection = class {
    * `NO_*` stub — a tiny module that throws with an actionable message —
    * so, for example, none of the BlobSet / chunk / MIME-magic machinery
    * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
-   * passes `blobStrategy: blobs()` to `createNoydb`.
+   * passes `blobsStrategy: blobs()` to `createNoydb`.
    */
   strategies;
   objectStore;
@@ -2398,7 +2262,7 @@ var Collection = class {
   lru;
   /**
    * tree-shake seam — per-Collection indexing state. Owned by the
-   * `IndexStrategy` passed through from `createNoydb({ indexStrategy })`.
+   * `IndexingStrategy` passed through from `createNoydb({ indexingStrategy })`.
    * Defaults to a disabled state (both accessors return null) so the
    * `CollectionIndexes` / `PersistedCollectionIndex` / `LazyQuery`
    * classes never reach the bundle when indexing is unused.
@@ -2838,7 +2702,7 @@ var Collection = class {
     } else {
       this.lru = null;
     }
-    const strategy = opts.strategies.index;
+    const strategy = opts.strategies.indexing;
     this.indexState = strategy.createState({
       defs: opts.indexes ?? [],
       lazy: this.lazy
@@ -3090,7 +2954,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-5X37OXRY.js");
+    const { verifyDigestField } = await import("./verify-7XWHJWUN.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3296,7 +3160,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
+      const { resolveStaleMVOnRead } = await import("./stale-JOE7GBAE.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3782,7 +3646,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-SMXUO7W5.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-RPTLK7LJ.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3955,7 +3819,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-PKQQFDBT.js");
+    const { dispatchDerivations } = await import("./dispatch-7T45NN7C.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4232,7 +4096,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-PKQQFDBT.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-7T45NN7C.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4246,7 +4110,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-SMXUO7W5.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-RPTLK7LJ.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4266,7 +4130,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
+      const { resolveStaleMVOnRead } = await import("./stale-JOE7GBAE.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4518,7 +4382,7 @@ var Collection = class {
       ...this.defaultLocale !== void 0 ? { defaultLocale: this.defaultLocale } : {},
       ...resolver.resolveDictSource ? { resolveDictSource: (field) => resolver.resolveDictSource(leftCollection, field) } : {}
     } : void 0;
-    return new Query(source, void 0, joinContext, this.strategies.aggregate);
+    return new Query(source, void 0, joinContext, this.strategies.reduce);
   }
   /**
    * Subscribe to every put/delete on this collection. Returns an
@@ -5147,7 +5011,7 @@ var Collection = class {
    * vault-shared `_blob` DEK (enabling cross-collection deduplication).
    */
   blob(id) {
-    return this.strategies.blob.openSlot({
+    return this.strategies.blobs.openSlot({
       store: this.adapter,
       vault: this.vault,
       collection: this.name,
@@ -5380,7 +5244,7 @@ var Collection = class {
     const persisted = this.persistedIndexes;
     if (!persisted) {
       throw new Error(
-        `Collection "${this.name}": lazyQuery() requires indexing to be enabled. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexStrategy: withIndexing() })\`.`
+        `Collection "${this.name}": lazyQuery() requires indexing to be enabled. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy: withIndexing() })\`.`
       );
     }
     if (persisted.fields().length === 0) {
@@ -5419,14 +5283,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-52P3D72W.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-EOOSMWFC.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-52P3D72W.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-EOOSMWFC.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5554,7 +5418,7 @@ var Collection = class {
       },
       historyEnabled: this.historyConfig.enabled !== false && this.strategies.history !== NO_HISTORY,
       // #728/#737: lets putAtTier skip decrypting `existing` when no real history strategy is wired
-      syncBlobs: (id, fromTier, toTier) => this.strategies.blob !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
+      syncBlobs: (id, fromTier, toTier) => this.strategies.blobs !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
       // #724 I1: gate on blob storage enabled (not on declared blobFields) so undeclared-field blobs still rehome; #746: syncTierMove mints/resumes the rehome journal marker; self-no-ops on an empty slot map
       syncLedger: async (id) => {
         await this.ledger?.purgeRecordDeltas(this.name, id);
@@ -5597,6 +5461,64 @@ var Collection = class {
   }
 };
 
+// src/port/with/capabilities.ts
+function assertCanExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanExport: plaintext tier requires a format");
+    }
+    if (!hasExportCapability(keyring, "plaintext", format)) {
+      throw new ExportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasExportCapability(keyring, "bundle")) {
+    throw new ExportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function assertCanImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanImport: plaintext tier requires a format");
+    }
+    if (!hasImportCapability(keyring, "plaintext", format)) {
+      throw new ImportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasImportCapability(keyring, "bundle")) {
+    throw new ImportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function canExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasExportCapability(keyring, "plaintext", format);
+  }
+  return hasExportCapability(keyring, "bundle");
+}
+function canImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasImportCapability(keyring, "plaintext", format);
+  }
+  return hasImportCapability(keyring, "bundle");
+}
+
 // src/with-commit/tx/elevated-handle.ts
 var ELEVATION_AUDIT_COLLECTION = "_elevation_audit";
 var ElevatedHandle = class {
@@ -6811,7 +6733,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-ZU4E5J5S.js").then(
+  const load = () => engine ??= import("./link-set-POQB7BU5.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7294,7 +7216,7 @@ var SatelliteRegistry = class {
     if (reason !== void 0) throw new SatelliteConfigError(reason);
   }
   /** Per-base async mutex: chains sections on a stored promise tail. */
-  async withPairLock(base, fn2) {
+  async withPairLock(base, fn) {
     const tail = this.locks.get(base) ?? Promise.resolve();
     let release;
     const gate = new Promise((res) => {
@@ -7303,7 +7225,7 @@ var SatelliteRegistry = class {
     this.locks.set(base, tail.then(() => gate));
     await tail;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       release();
     }
@@ -7349,7 +7271,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-XIAHB6KF.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-URQANI3B.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7680,20 +7602,6 @@ async function migrateSatelliteCek(name, coll) {
   return { migrated };
 }
 
-// src/with-shape/schema-update/gate.ts
-var SchemaUpdateGate = class {
-  #decision;
-  constructor(decision) {
-    this.#decision = decision.catch(() => null);
-  }
-  async assertWritable() {
-    const decision = await this.#decision;
-    if (decision && decision.action === "reject") {
-      throw decision.error;
-    }
-  }
-};
-
 // src/with-shape/schema-update/fence-controller.ts
 var SchemaFenceController = class {
   #coordination;
@@ -8245,6 +8153,22 @@ var Vault = class {
       enforceStaticDictOnPut: (collectionName, record) => this.enforceStaticDictOnPut(collectionName, record)
     };
   }
+  /** The registries `populateCollectionRegistries` writes into (#841). */
+  #registries() {
+    return {
+      refRegistry: this.refRegistry,
+      i18nFieldRegistry: this.i18nFieldRegistry,
+      blobFieldsRegistry: this.blobFieldsRegistry,
+      archiveRegistry: this.archiveRegistry,
+      attestation: this.attestation,
+      dictKeyFieldRegistry: this.dictKeyFieldRegistry,
+      staticDictNames: this.staticDictNames,
+      staticByName: this.staticByName,
+      staticDescriptorByField: this.staticDescriptorByField,
+      reservedLookupCollections: this.reservedLookupCollections,
+      schemaUpdateNames: this.#schemaUpdateNames
+    };
+  }
   collection(collectionName, options) {
     const overlayRegistry = this.overlayedViewRegistry;
     if (overlayRegistry !== null && overlayRegistry.isOverlay(collectionName)) {
@@ -8278,8 +8202,8 @@ var Vault = class {
         registerPoisonHook: (hook) => {
           this.noydb._writeHooks.onBeforeWrite(hook);
         },
-        forEachSyncEngine: (fn2) => {
-          this.noydb._forEachSyncEngine(this.name, fn2);
+        forEachSyncEngine: (fn) => {
+          this.noydb._forEachSyncEngine(this.name, fn);
         }
       }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
     }
@@ -8296,60 +8220,14 @@ var Vault = class {
       });
     }
     if (!coll) {
-      if (options?.refs) {
-        this.refRegistry.register(collectionName, options.refs);
-      }
-      if (effectiveViaFields.i18nFields) {
-        this.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
-      }
-      if (options?.blobFields) {
-        this.blobFieldsRegistry.set(collectionName, options.blobFields);
-      }
-      if (options?.archive) {
-        this.archiveRegistry.set(collectionName, options.archive);
-      }
-      if (options?.attestation !== void 0) {
-        this.attestation.register(collectionName, options.attestation);
-      }
-      if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
-        const dictFieldMap = {};
-        const staticFieldMap = {};
-        for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
-          if (isStaticDictDescriptor(desc)) {
-            staticFieldMap[field] = desc;
-            this.staticDictNames.add(desc.name);
-            this.staticByName.set(desc.name, desc);
-          } else {
-            dictFieldMap[field] = desc.name;
-          }
-        }
-        const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
-        Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
-        for (const [field, desc] of lookupCompat.staticEntries) {
-          staticFieldMap[field] = desc;
-          this.staticDictNames.add(desc.name);
-          this.staticByName.set(desc.name, desc);
-        }
-        if (Object.keys(dictFieldMap).length > 0) {
-          this.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
-          for (const dictName of new Set(Object.values(dictFieldMap))) {
-            this.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
-          }
-        }
-        if (Object.keys(staticFieldMap).length > 0) {
-          this.staticDescriptorByField.set(collectionName, staticFieldMap);
-        }
-      }
-      if ((options?.schemaUpdate?.length ?? 0) > 0) {
-        this.#schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
-      }
+      populateCollectionRegistries(this.#registries(), collectionName, options, effectiveViaFields);
       let schemaUpdateGate;
       if (options?.persistJsonSchema === true && options.schema !== void 0 && (options.schemaUpdate?.length ?? 0) > 0) {
         const validator = options.schema;
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-HB4TQZSV.js");
+          const { persistSchemaIfNeeded } = await import("./register-5W6CG4RM.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8435,7 +8313,7 @@ var Vault = class {
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
-            `[noy-db] Collection "${collectionName}" is declared in withForgetCascade but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
+            `[noy-db] Collection "${collectionName}" is declared in withForget but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
           );
         }
         collOpts.perRecordKeys = true;
@@ -8498,7 +8376,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-HB4TQZSV.js")).persistSchemaIfNeeded({
+            await (await import("./register-5W6CG4RM.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9368,7 +9246,7 @@ var Vault = class {
    * stay decryptable; migrate, then re-forget) and `blobResidueCollections` (blob attachments, keyed
    * off a separate `_blob` DEK, out of scope here).
    *
-   * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
+   * @throws ForgetStrategyNotConfiguredError when no `withForget` was set.
    */
   async forget(subjectId) {
     if (Object.keys(this.strategies.forget.subjects).length === 0) {
@@ -9393,7 +9271,7 @@ var Vault = class {
     const sealedResidue = [];
     const indexResidue = [];
     const ledgerDeltaResidue = [];
-    const blobsEnabled = this.strategies.blob !== NO_BLOBS;
+    const blobsEnabled = this.strategies.blobs !== NO_BLOBS;
     const actor = this.keyring.userId;
     const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [], derivedResidueUndecodable: [], derivedResidueDeclined: [] };
     const { partitionSealedCekKeys, shouldSkipBlobScan, bumpResidueCount, residueNoticesFromMap } = await import("./purge-scope-FGNNLWHD.js");
@@ -9657,7 +9535,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-VW6P6A3J.js"),
+      import("./registry-BWD2ED52.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new GuardRegistry();
@@ -9685,7 +9563,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-JOFO7RAH.js"),
+      import("./registry-MCSGBZXI.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9717,7 +9595,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-6BMBFEXT.js");
+    const { MaterializedViewRegistry } = await import("./registry-UJFP3NWF.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9742,7 +9620,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-7CZWF3EQ.js");
+    const { OverlayedViewRegistry } = await import("./registry-7Y5WF7GS.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9789,14 +9667,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-SHYLIBOM.js");
+    const { MaterializedViewExecutor } = await import("./executor-XZYM4KHT.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-NBROTA66.js");
+    const { clearMVStaleFully } = await import("./stale-JOE7GBAE.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9809,7 +9687,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-FCJEH3FU.js");
+    const { DerivationExecutor } = await import("./executor-IEBLTBCW.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9836,7 +9714,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WWXVHHUH.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-TV7CXAJ6.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -9991,11 +9869,11 @@ var Vault = class {
    *
    *.
    */
-  async withConsent(ctx, fn2) {
+  async withConsent(ctx, fn) {
     const prior = this.consentContext;
     this.consentContext = ctx;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       this.consentContext = prior;
     }
@@ -10063,7 +9941,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONOZVPIP.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10085,7 +9963,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONOZVPIP.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10333,7 +10211,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-E3OVLBFR.js");
+    const { dumpVaultSchema } = await import("./walk-6OHAWGBS.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10468,7 +10346,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-5BSNJREH.js");
+    const { readCover } = await import("./cover/index.js");
     return readCover(this.adapter, this.name, opts);
   }
   /**
@@ -10483,7 +10361,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-YCHAC575.js");
+    const { dumpVault } = await import("./backup-PTSVXDDW.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10535,7 +10413,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-YCHAC575.js");
+    const { loadVault } = await import("./backup-PTSVXDDW.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10567,7 +10445,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-YCHAC575.js");
+    const { verifyBackupIntegrity } = await import("./backup-PTSVXDDW.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10785,7 +10663,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-YCHAC575.js");
+    const { exportVaultJSON } = await import("./backup-PTSVXDDW.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10862,10 +10740,10 @@ var WriteQueueTracker = class {
    * (success or failure). The fn's resolved value is returned; a thrown
    * error is re-thrown after the queue is decremented.
    */
-  async track(fn2) {
+  async track(fn) {
     this.begin();
     try {
-      const value = await fn2();
+      const value = await fn();
       this.settle();
       return value;
     } catch (error) {
@@ -10888,6 +10766,183 @@ var WriteQueueTracker = class {
   }
 };
 
+// src/port/with/write-hooks.ts
+var WriteHookRegistry = class {
+  #before = [];
+  #after = [];
+  #suppressed = false;
+  /** True while handlers are running — used by the write path to skip nested firing. */
+  get suppressed() {
+    return this.#suppressed;
+  }
+  /** True when any hook is registered (cheap gate for the write path). */
+  get hasHandlers() {
+    return this.#before.length > 0 || this.#after.length > 0;
+  }
+  onBeforeWrite(handler) {
+    this.#before.push(handler);
+    return () => {
+      const i = this.#before.indexOf(handler);
+      if (i >= 0) this.#before.splice(i, 1);
+    };
+  }
+  onAfterWrite(handler) {
+    this.#after.push(handler);
+    return () => {
+      const i = this.#after.indexOf(handler);
+      if (i >= 0) this.#after.splice(i, 1);
+    };
+  }
+  /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
+  async runBefore(event) {
+    if (this.#before.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#before.slice()) await h(event);
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+  /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
+  async runAfter(event) {
+    if (this.#after.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#after.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] onAfterWrite handler failed for ${event.collection}/${event.docId}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+};
+
+// src/port/with/service-bus.ts
+var ServiceBus = class {
+  #handlers = /* @__PURE__ */ new Map();
+  #gateHandlers = /* @__PURE__ */ new Map();
+  #depth = 0;
+  /** Register a handler for an observe point. Returns an unsubscribe fn. */
+  register(point, handler) {
+    let arr = this.#handlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#handlers.set(point, arr);
+    }
+    arr.push(handler);
+    return () => {
+      const a = this.#handlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(handler);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any handler is registered for the point. */
+  hasHandlers(point) {
+    const a = this.#handlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True while one or more dispatches are in flight. Backed by a depth counter
+   * so that two concurrent async dispatches (`Promise.all([put('a'), put('b')])`
+   * each captured `busAfterPut=true` at their respective put() tops while depth
+   * was 0) both proceed independently — the counter stays > 0 until BOTH finish,
+   * so any nested write attempted by a handler still sees `dispatching === true`
+   * and is suppressed by the write-path gate in `collection.ts`
+   * (`busAfterPut = hasHandlers('afterPut') && !dispatching`). Re-entrancy
+   * suppression lives exclusively on that write-path gate; concurrent independent
+   * dispatches must not drop each other's events.
+   */
+  get dispatching() {
+    return this.#depth > 0;
+  }
+  /**
+   * Dispatch in registration order, awaited. Per-handler errors are warned, not
+   * thrown — an observe handler must never abort a completed write. A
+   * re-entrancy guard suppresses nested firing so a handler that itself writes
+   * cannot loop (same rationale as WriteHookRegistry.#suppressed).
+   */
+  async dispatch(point, event) {
+    const a = this.#handlers.get(point);
+    if (!a || a.length === 0) return;
+    this.#depth++;
+    try {
+      for (const h of a.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] service observe handler failed at ${point}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#depth--;
+    }
+  }
+  /**
+   * Register a write-gating handler. A throw from the handler ABORTS the
+   * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+   * the `needsPrior` prior-read declaration (#267).
+   */
+  registerGate(point, handler, opts) {
+    let arr = this.#gateHandlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#gateHandlers.set(point, arr);
+    }
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    arr.push(entry);
+    return () => {
+      const a = this.#gateHandlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(entry);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any gate handler is registered for the point. */
+  hasGateHandlers(point) {
+    const a = this.#gateHandlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True when at least one gate handler at `point` needs the prior record
+   * (the default). False when the point has no handlers or every handler
+   * registered with `needsPrior: false` — the write path then skips the
+   * prior-read before dispatching (#267 prior-read elision).
+   */
+  gateNeedsPrior(point) {
+    const a = this.#gateHandlers.get(point);
+    if (!a) return false;
+    return a.some((e) => e.needsPrior);
+  }
+  /**
+   * Run gate handlers in registration order, awaited. Unlike `dispatch`
+   * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
+   * write before it reaches the store. The first throw stops the remaining
+   * handlers (fail-fast). This is the seam guards/periods migrate onto.
+   *
+   * Note: gate handlers are validators that read, not write. A gate handler
+   * that writes back into the same collection would re-enter the write path
+   * and re-dispatch this point; loop-suppression for that case is deferred to
+   * the migration slice (contract: gate handlers must not perform writes that
+   * re-trigger their own point).
+   */
+  async dispatchGate(point, event) {
+    const a = this.#gateHandlers.get(point);
+    if (!a || a.length === 0) return;
+    for (const e of a.slice()) {
+      await e.fn(event);
+    }
+  }
+};
+
 // src/with-party/tab-coordination.ts
 var TabCoordinator = class {
   tabId;
@@ -10950,13 +11005,13 @@ var TabCoordinator = class {
     const out = [self, ...[...this.#peers.values()].filter((p) => p.lastSeen >= cutoff)];
     return out.sort((a, b) => a.tabId.localeCompare(b.tabId));
   }
-  onTabRoleChange(fn2) {
-    this.#roleHandlers.add(fn2);
-    return () => this.#roleHandlers.delete(fn2);
+  onTabRoleChange(fn) {
+    this.#roleHandlers.add(fn);
+    return () => this.#roleHandlers.delete(fn);
   }
-  onActiveTabsChange(fn2) {
-    this.#tabsHandlers.add(fn2);
-    return () => this.#tabsHandlers.delete(fn2);
+  onActiveTabsChange(fn) {
+    this.#tabsHandlers.add(fn);
+    return () => this.#tabsHandlers.delete(fn);
   }
   dispose() {
     if (this.#disposed) return;
@@ -11304,7 +11359,7 @@ var NoydbSnapshots = class {
   dirtyVaults = /* @__PURE__ */ new Set();
   /**
    * Take an on-demand checkpoint of the given vault.
-   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
    * @throws ValidationError when the vault is not open
    */
   async snapshot(vault, opts) {
@@ -11466,129 +11521,6 @@ function memoryStore() {
   };
 }
 
-// src/with-party/auth-introspection/index.ts
-async function describeAuthConfig(store, vault) {
-  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
-  const recoveryProfiles = await listRecoveryProfilesEnrolled(store, vault);
-  const lines = [];
-  lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
-  lines.push("");
-  lines.push("Tier 1 \u2014 Secret (master)");
-  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
-  lines.push("  Strength validator: enforced (override available for tests only)");
-  lines.push("");
-  lines.push("Tier 2 \u2014 Authenticate (routine login)");
-  lines.push("  Allowed methods: WebAuthn (passkey), OIDC, Password");
-  lines.push("  Slots per user: unlimited");
-  lines.push("");
-  lines.push("Tier 3 \u2014 Unlock (quick resume)");
-  lines.push("  Method: PIN (per-app configurable)");
-  lines.push("");
-  lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
-  lines.push("Managed-secret mode: off (post-1.0)");
-  lines.push("");
-  lines.push("Sensitive-action gates:");
-  for (const [gate, gp] of Object.entries(policy.gates)) {
-    lines.push(`  ${gate} \u2014 ${describeGatePolicy(gp)}`);
-  }
-  return lines.join("\n");
-}
-async function diagramAuthConfig(store, vault) {
-  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
-  const lines = [];
-  lines.push("flowchart TB");
-  lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
-  lines.push('  tier1["Tier 1<br/>Secret"]');
-  lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
-  lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
-  lines.push("  vault --> tier1");
-  lines.push("  tier1 --> tier2");
-  lines.push("  tier2 --> tier3");
-  for (const [gateName, gp] of Object.entries(policy.gates)) {
-    if (gp.enabled === false) continue;
-    const id = sanitizeId(gateName);
-    const label = `${gateName}<br/>tier \u2265 ${gp.minTier}`;
-    lines.push(`  ${id}["${escapeMermaid(label)}"]`);
-    const tierNode = gp.minTier === 1 ? "tier1" : gp.minTier === 2 ? "tier2" : "tier3";
-    lines.push(`  ${tierNode} --> ${id}`);
-  }
-  return lines.join("\n");
-}
-async function describeUserAuth(store, vault, userId) {
-  const env = await store.get(vault, "_keyring", userId);
-  if (!env) return "";
-  const file = JSON.parse(env._data);
-  const lines = [];
-  lines.push(
-    `User: ${file.user_id} (joined ${file.created_at.slice(0, 10)}, role: ${file.role})`
-  );
-  lines.push("");
-  lines.push("Tier 2 enrollments:");
-  if (!file.authenticators || file.authenticators.length === 0) {
-    lines.push("  (none enrolled)");
-  } else {
-    for (const slot of file.authenticators) {
-      lines.push(`  - ${describeSlot(slot)}`);
-    }
-  }
-  return lines.join("\n");
-}
-async function describeAllUsersAuth(store, vault) {
-  const ids = await store.list(vault, "_keyring");
-  const results = [];
-  for (const userId of ids) {
-    const description = await describeUserAuth(store, vault, userId);
-    if (description !== "") results.push({ userId, description });
-  }
-  return results;
-}
-var SLOT_FIELD_ALLOWLIST = [
-  "id",
-  "method",
-  "enrolled_at",
-  "enrolled_via_tier"
-];
-function describeSlot(slot) {
-  const sanitized = {};
-  for (const key of SLOT_FIELD_ALLOWLIST) {
-    if (key in slot) {
-      sanitized[key] = slot[key];
-    }
-  }
-  const date = (sanitized.enrolled_at ?? "").slice(0, 10);
-  return `${sanitized.method ?? "?"} (id=${sanitized.id ?? "?"}, enrolled ${date}, via tier ${sanitized.enrolled_via_tier ?? "?"})`;
-}
-function describeGatePolicy(gp) {
-  if (gp.enabled === false) return "disabled";
-  const parts = [];
-  parts.push(`tier ${gp.minTier}`);
-  if (gp.factors && gp.factors.length > 0) {
-    for (const f of gp.factors) {
-      parts.push(`+ ${f.count ?? 1}\xD7 ${f.anyOf.join("|")}`);
-    }
-  }
-  if (gp.warn?.sharedDevice === "block") parts.push("block-on-shared-device");
-  return parts.join(" ");
-}
-function defaultPolicySnapshot() {
-  return {
-    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
-    gates: {}
-  };
-}
-async function listRecoveryProfilesEnrolled(store, vault) {
-  const enrolled = [];
-  const paper = await loadPaperRecoveryEntries(store, vault);
-  if (paper.length > 0) enrolled.push(`paper (${paper.length} codes)`);
-  return enrolled;
-}
-function escapeMermaid(s) {
-  return s.replace(/"/g, '\\"').replace(/\n/g, " ");
-}
-function sanitizeId(s) {
-  return s.replace(/[^a-zA-Z0-9]/g, "_");
-}
-
 // src/with-party/team/noydb-facade.ts
 var TeamFacade = class {
   constructor(deps) {
@@ -11630,8 +11562,9 @@ var TeamFacade = class {
   async runRotate(engine, vault, collections) {
     this.deps.checkPolicyOperation(vault, "rotate");
     const keyring = await this.deps.getKeyringInternal(vault);
-    await engine(this.deps.options.store, vault, keyring, collections);
+    const result = await engine(this.deps.options.store, vault, keyring, { collections });
     this.deps.keyringCache.set(vault, keyring);
+    return result;
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
@@ -12496,7 +12429,7 @@ var Noydb = class {
     this.policyCheckGate = options.policyCheckGateFn;
     this.strategies = resolveStrategies(options);
     this.snapshots = new NoydbSnapshots({
-      strategy: this.strategies.snapshot,
+      strategy: this.strategies.snapshots,
       user: options.user,
       isClosed: () => this.closed,
       getVault: (name) => this.vaultCache.get(name),
@@ -12544,7 +12477,7 @@ var Noydb = class {
   get _forgetStrategy() {
     return this.strategies.forget;
   }
-  // GDPR subject-index maintenance. When `withForgetCascade` declares
+  // GDPR subject-index maintenance. When `withForget` declares
   // any subject fields, keep the encrypted `_subject_index` in lock-step with
   // writes so `vault.forget(subjectId)` can find every record for a subject.
   //
@@ -12619,7 +12552,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-OHET7TF7.js");
+      const { GuardExecutor } = await import("./executor-RM7XWQDU.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -12810,12 +12743,10 @@ var Noydb = class {
       // compartments leave it null and load() skips the refresh.
       reloadKeyring: this.options.encrypt !== false && this.options.secret ? async () => {
         this.keyringCache.delete(name);
-        const refreshed = await loadKeyring(
-          this.options.store,
-          name,
-          this.options.user,
-          this.options.secret
-        );
+        const refreshed = await loadKeyring(this.options.store, name, {
+          userId: this.options.user,
+          secret: this.options.secret
+        });
         this.keyringCache.set(name, refreshed);
         return refreshed;
       } : void 0
@@ -12974,16 +12905,26 @@ var Noydb = class {
   /**
    * Rotate the DEKs for the given collections in a vault.
    *
-   * Generates fresh DEKs, re-encrypts every record in each collection,
-   * and re-wraps the new DEKs into every remaining user's keyring. The
-   * old DEKs become unreachable — useful as a defense-in-depth measure
-   * after a suspected key leak, or as the scheduled half of a
-   * key-rotation policy.
+   * Generates fresh DEKs and re-encrypts every record in each collection.
+   * The old DEKs become unreachable — useful as a defense-in-depth measure
+   * after a suspected key leak, or as the scheduled half of a key-rotation
+   * policy.
+   *
+   * ## Other members LOSE access to the rotated collections (#854)
+   *
+   * A member's DEKs are wrapped under that member's KEK, and a KEK derives
+   * only from that member's secret. The caller cannot derive anyone else's
+   * KEK, so re-wrapping a fresh DEK for them is impossible — that is the
+   * zero-knowledge property working as designed. Rotation therefore DROPS
+   * the rotated collections from every other member's keyring.
    *
-   * Unlike `revoke({ rotateKeys: true })`, this call does NOT remove
-   * any users — every current member keeps access, but with fresh
-   * keys. This is the "just rotate" path; the "revoke and rotate"
-   * path still lives in `revoke()`.
+   * The returned {@link RotateResult.needsRegrant} names each (member,
+   * collection) pair that was dropped. Re-run `grant()` for those pairs, or
+   * they stay locked out.
+   *
+   * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
+   * user from the vault — they keep membership and their other collections.
+   * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
    *
    * Exposed on Noydb (rather than only on the lower-level keyring
    * module) so CLI and admin tooling can trigger rotation without
@@ -13085,12 +13026,10 @@ var Noydb = class {
     for (const vault of universe) {
       let keyring;
       try {
-        keyring = await loadKeyring(
-          adapter,
-          vault,
-          this.options.user,
-          this.options.secret
-        );
+        keyring = await loadKeyring(adapter, vault, {
+          userId: this.options.user,
+          secret: this.options.secret
+        });
       } catch (err) {
         if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError) {
           continue;
@@ -13151,7 +13090,7 @@ var Noydb = class {
    * })
    * ```
    */
-  async queryAcross(vaultIds, fn2, options = {}) {
+  async queryAcross(vaultIds, fn, options = {}) {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.resetSessionTimer();
     const concurrency = Math.max(1, options.concurrency ?? 1);
@@ -13165,7 +13104,7 @@ var Noydb = class {
       const task = (async () => {
         try {
           const comp = await this.openVault(vaultId, { create: options.create !== false });
-          const result = await fn2(comp);
+          const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
           results[idx] = {
@@ -13225,13 +13164,10 @@ var Noydb = class {
   async changeSecret(vault, newSecret, options) {
     this.checkPolicyOperation(vault, "changeSecret");
     const keyring = await this._getKeyringInternal(vault);
-    const updated = await changeSecret(
-      this.options.store,
-      vault,
-      keyring,
-      newSecret,
-      options
-    );
+    const updated = await changeSecret(this.options.store, vault, keyring, {
+      ...options,
+      newSecret
+    });
     this.keyringCache.set(vault, updated);
   }
   // ─── Sync ──────────────────────────────────────────────────────
@@ -13281,7 +13217,7 @@ var Noydb = class {
   }
   transaction(arg, maybeFn) {
     if (typeof arg === "function") {
-      return this.strategies.tx.runTransaction(this, arg);
+      return this.strategies.transactions.runTransaction(this, arg);
     }
     if (typeof arg === "object" && arg !== null && arg.dryRun === true) {
       if (typeof maybeFn !== "function") {
@@ -13289,7 +13225,7 @@ var Noydb = class {
           "db.transaction({ dryRun: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.strategies.tx.runDryRun(this, maybeFn);
+      return this.strategies.transactions.runDryRun(this, maybeFn);
     }
     if (typeof arg === "object" && arg !== null && arg.amendment === true) {
       if (typeof maybeFn !== "function") {
@@ -13297,7 +13233,7 @@ var Noydb = class {
           "db.transaction({ amendment: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.strategies.tx.runTransaction(this, maybeFn, arg);
+      return this.strategies.transactions.runTransaction(this, maybeFn, arg);
     }
     const vault = arg;
     const comp = this.vaultCache.get(vault);
@@ -13387,8 +13323,8 @@ var Noydb = class {
     }
     return engine;
   }
-  _forEachSyncEngine(vault, fn2) {
-    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn2(engine);
+  _forEachSyncEngine(vault, fn) {
+    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn(engine);
   }
   // ─── Events ────────────────────────────────────────────────────
   on(event, handler) {
@@ -13432,9 +13368,9 @@ var Noydb = class {
     return this.writeHooks.onAfterWrite(handler);
   }
   /** Subscribe to cross-tab write conflicts. Returns an unsubscribe. */
-  onWriteConflict(fn2) {
-    this.on("write:conflict", fn2);
-    return () => this.off("write:conflict", fn2);
+  onWriteConflict(fn) {
+    this.on("write:conflict", fn);
+    return () => this.off("write:conflict", fn);
   }
   /**
    * Enable same-device multi-tab coordination: primary/secondary
@@ -13508,12 +13444,12 @@ var Noydb = class {
   activeTabs() {
     return this.tabCoordinator?.activeTabs() ?? [];
   }
-  onTabRoleChange(fn2) {
-    return this.tabCoordinator?.onTabRoleChange(fn2) ?? (() => {
+  onTabRoleChange(fn) {
+    return this.tabCoordinator?.onTabRoleChange(fn) ?? (() => {
     });
   }
-  onActiveTabsChange(fn2) {
-    return this.tabCoordinator?.onActiveTabsChange(fn2) ?? (() => {
+  onActiveTabsChange(fn) {
+    return this.tabCoordinator?.onActiveTabsChange(fn) ?? (() => {
     });
   }
   /** @internal The write-hook registry, threaded into each Collection. */
@@ -13799,7 +13735,7 @@ var Noydb = class {
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-5BSNJREH.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover/index.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -13831,7 +13767,7 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-5BSNJREH.js");
+    const { readCover } = await import("./cover/index.js");
     return readCover(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -13871,33 +13807,25 @@ var Noydb = class {
     }
     let keyring;
     try {
-      keyring = await loadKeyring(this.options.store, vault, this.options.user, effectiveSecret);
+      keyring = await loadKeyring(this.options.store, vault, { userId: this.options.user, secret: effectiveSecret });
     } catch (err) {
       if (err instanceof NoAccessError) {
-        keyring = await createOwnerKeyring(
-          this.options.store,
-          vault,
-          this.options.user,
-          effectiveSecret,
-          {
-            // Managed mode generates 256-bit base64 strings that don't satisfy
-            // the human-secret strength rules (no spaces, no "words").
-            // Skip validation in managed mode — the entropy floor is already
-            // 256 bits by construction.
-            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-          }
-        );
+        keyring = await createOwnerKeyring(this.options.store, vault, {
+          userId: this.options.user,
+          secret: effectiveSecret,
+          // Managed mode generates 256-bit base64 strings that don't satisfy
+          // the human-secret strength rules (no spaces, no "words").
+          // Skip validation in managed mode — the entropy floor is already
+          // 256 bits by construction.
+          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
+        });
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
         await this.options.store.delete(vault, "_keyring", this.options.user);
-        keyring = await createOwnerKeyring(
-          this.options.store,
-          vault,
-          this.options.user,
-          effectiveSecret,
-          {
-            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-          }
-        );
+        keyring = await createOwnerKeyring(this.options.store, vault, {
+          userId: this.options.user,
+          secret: effectiveSecret,
+          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
+        });
       } else {
         throw err;
       }
@@ -13907,7 +13835,7 @@ var Noydb = class {
   }
   /**
    * Take an on-demand checkpoint of the given vault.
-   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
    * @throws ValidationError when the vault is not open
    */
   async snapshot(vault, opts) {
@@ -13958,9 +13886,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-22ES33N3.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-3NKVNZPM.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-IY2YEA3A.js");
+    const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -13990,11 +13918,7 @@ export {
   RefRegistry,
   Vault,
   QuickUnlockStore,
-  describeAuthConfig,
-  diagramAuthConfig,
-  describeUserAuth,
-  describeAllUsersAuth,
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-EEZCB74X.js.map
+//# sourceMappingURL=chunk-XOBHRD2M.js.map