@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.7

package/dist/with-lookup/{aggregate/aggregation.d.ts → reduce/reduction.d.ts}

@@ -1,13 +1,13 @@
 /**
  * Aggregate execution — the runtime behind `Query.aggregate()`.
  *
- * takes an `AggregateSpec` (a record of named reducers
+ * takes an `ReduceSpec` (a record of named reducers
  * built from `reducers.ts`) and runs every reducer over the records
  * produced by the underlying query. Two terminal surfaces:
  *
  *   - `.run(): R` — synchronous one-shot reduction. Matches the
  *     existing `Query.toArray()` / `.first()` / `.count()` style.
- *   - `.live(): LiveAggregation<R>` — reactive primitive that
+ *   - `.live(): LiveReduction<R>` — reactive primitive that
  *     re-runs the reduction whenever the query's source notifies of
  *     a change. uses naive full re-run; incremental delta
  *     maintenance is admitted by the reducer protocol (`remove()`)
@@ -15,7 +15,7 @@
  *     can switch from full re-run to delta-based without breaking
  *     the public API. Consumers get correct, reactive values today.
  *
- * The `Aggregation<R>` wrapper is deliberately tiny — it exists so
+ * The `Reduction<R>` wrapper is deliberately tiny — it exists so
  * `.aggregate(spec)` can be chained with either `.run()` or `.live()`
  * without the builder needing two separate terminal methods. It
  * holds the closure over the query execution (produces the current
@@ -39,9 +39,9 @@ import type { Reducer } from './reducers.js';
  * }
  * ```
  */
-export type AggregateSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
+export type ReduceSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
 /**
- * Map an `AggregateSpec` to its reduced result shape — each key
+ * Map an `ReduceSpec` to its reduced result shape — each key
  * carries the finalized result type from its reducer. A spec built
  * from `{ total: sum('amount'), n: count() }` yields a result of
  * `{ total: number, n: number }`.
@@ -50,26 +50,26 @@ export type AggregateSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
  * each `Reducer<R, _>`. The `infer` captures the user-visible result
  * type, discarding the internal state type `S`.
  */
-export type AggregateResult<Spec extends AggregateSpec> = {
+export type ReduceResult<Spec extends ReduceSpec> = {
     [K in keyof Spec]: Spec[K] extends Reducer<infer R, unknown> ? R : never;
 };
 /**
  * Pure reduction over a record array. Runs every reducer's
  * `init → step* → finalize` pipeline exactly once over the records.
  *
- * Called by `Aggregation.run()` and by the live-mode refresh path.
+ * Called by `Reduction.run()` and by the live-mode refresh path.
  * Exported for tests and for future `scan().aggregate()` reuse
  * — the streaming path will call the same reducer protocol with a
  * per-page loop instead of a single array.
  */
-export declare function reduceRecords<Spec extends AggregateSpec>(records: readonly unknown[], spec: Spec): AggregateResult<Spec>;
+export declare function reduceRecords<Spec extends ReduceSpec>(records: readonly unknown[], spec: Spec): ReduceResult<Spec>;
 /**
- * A minimal reactive primitive for aggregation results.
+ * A minimal reactive primitive for reduction results.
  *
  * Same spirit as the `LiveQuery` in : frame-agnostic, a plain
  * object with `value` / `error` fields and a `subscribe(cb)`
  * notification channel that Vue / React / Solid adapters wrap in
- * their own primitive. Intentionally NOT a Promise — aggregations
+ * their own primitive. Intentionally NOT a Promise — reductions
  * have a well-defined "current value" at every instant, and the
  * reactive consumer wants to read that value synchronously.
  *
@@ -86,7 +86,7 @@ export declare function reduceRecords<Spec extends AggregateSpec>(records: reado
  * Always call `stop()` when done; Vue's `onUnmounted` is the
  * canonical place. Raw consumers must do it themselves.
  */
-export interface LiveAggregation<R> {
+export interface LiveReduction<R> {
     /** Current reduced value. Undefined only if the first compute threw. */
     readonly value: R | undefined;
     /** Last execution error, if any. Cleared on the next successful run. */
@@ -97,14 +97,14 @@ export interface LiveAggregation<R> {
     stop(): void;
 }
 /**
- * Upstream change-notification hook for live aggregation.
+ * Upstream change-notification hook for live reduction.
  *
  * Matches the shape that `QuerySource.subscribe` already uses — a
  * single method that accepts a callback and returns an unsubscribe
- * function. The `Aggregation` wrapper collects upstreams from the
+ * function. The `Reduction` wrapper collects upstreams from the
  * query's source and wires them into a single re-run trigger.
  */
-export interface AggregationUpstream {
+export interface ReductionUpstream {
     subscribe(cb: () => void): () => void;
 }
 /**
@@ -120,14 +120,14 @@ export interface AggregationUpstream {
  * `.aggregate(spec).live()`. Wrapping lets the spec be named once
  * and reused for either terminal, and keeps the `Query` class
  * from growing a pair of near-duplicate method overloads
- * (`aggregateRun` / `aggregateLive`) that would be harder to
+ * (`reduceRun` / `reduceLive`) that would be harder to
  * discover.
  */
-export declare class Aggregation<R> {
+export declare class Reduction<R> {
     private readonly executeRecords;
     private readonly spec;
     private readonly upstreams;
-    constructor(executeRecords: () => readonly unknown[], spec: AggregateSpec, upstreams: readonly AggregationUpstream[]);
+    constructor(executeRecords: () => readonly unknown[], spec: ReduceSpec, upstreams: readonly ReductionUpstream[]);
     /**
      * Execute the query and reduce the results synchronously.
      * Returns the reduced shape matching the spec — e.g. a spec of
@@ -136,7 +136,7 @@ export declare class Aggregation<R> {
      */
     run(): R;
     /**
-     * Build a reactive `LiveAggregation<R>` that re-runs the reduction
+     * Build a reactive `LiveReduction<R>` that re-runs the reduction
      * whenever any upstream source notifies of a change. The initial
      * value is computed eagerly in the constructor, so consumers can
      * read `live.value` immediately after calling `.live()`.
@@ -153,14 +153,14 @@ export declare class Aggregation<R> {
      * correct, reactive values today; future PRs can switch to
      * delta-based maintenance without changing this API.
      */
-    live(): LiveAggregation<R>;
+    live(): LiveReduction<R>;
 }
 /**
- * Build a `LiveAggregation<V>` from a recompute closure and a list
+ * Build a `LiveReduction<V>` from a recompute closure and a list
  * of upstreams. Exposed so sibling files in the query DSL
  * (currently `groupby.ts`) can reuse the reactive primitive
  * without reaching into `LiveAggregationImpl` directly. This keeps
  * the implementation class private while still allowing planned
  * composition with `.groupBy().aggregate().live()`.
  */
-export declare function buildLiveAggregation<V>(recompute: () => V, upstreams: readonly AggregationUpstream[]): LiveAggregation<V>;
+export declare function buildLiveReduction<V>(recompute: () => V, upstreams: readonly ReductionUpstream[]): LiveReduction<V>;

package/dist/with-lookup/{aggregate → reduce}/strategy.d.ts

@@ -1,18 +1,18 @@
 /**
  * Strategy seam between the core Query / ScanBuilder chain and the
  * optional aggregate / groupBy service. Core imports
- * `AggregateStrategy` as a TYPE-ONLY symbol and `NO_AGGREGATE` as a
+ * `ReduceStrategy` as a TYPE-ONLY symbol and `NO_REDUCE` as a
  * tiny runtime stub.
  *
- * The heavy machinery — `Aggregation`, `GroupedQuery`, the
- * reducer-step logic — is only reachable from `withAggregate()` in
+ * The heavy machinery — `Reduction`, `GroupedQuery`, the
+ * reducer-step logic — is only reachable from `withReduce()` in
  * `./active.ts`, which is only exported through the
- * `@noy-db/hub/aggregate` subpath. Consumers that don't import the
+ * `@noy-db/hub/reduce` subpath. Consumers that don't import the
  * subpath ship none of the ~886 LOC.
  *
  * @internal
  */
-import type { Aggregation, AggregateSpec, AggregateResult, AggregationUpstream } from './aggregation.js';
+import type { Reduction, ReduceSpec, ReduceResult, ReductionUpstream } from './reduction.js';
 import type { GroupedQuery, GroupedQueryN } from './groupby.js';
 import type { ViaPipeline } from '../../kernel/via/pipeline.js';
 /**
@@ -21,39 +21,39 @@ import type { ViaPipeline } from '../../kernel/via/pipeline.js';
  *
  * @internal
  */
-export interface AggregateStrategy {
+export interface ReduceStrategy {
     /**
-     * Build an `Aggregation<R>` for `Query.aggregate(spec)`. `executeRecords`
+     * Build an `Reduction<R>` for `Query.aggregate(spec)`. `executeRecords`
      * is a closure that produces the matching record set when the
-     * aggregation runs. NO_AGGREGATE throws; the active strategy
-     * constructs a real `Aggregation`.
+     * reduction runs. NO_REDUCE throws; the active strategy
+     * constructs a real `Reduction`.
      */
-    aggregate<Spec extends AggregateSpec>(executeRecords: () => readonly unknown[], spec: Spec, upstreams: readonly AggregationUpstream[]): Aggregation<AggregateResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(executeRecords: () => readonly unknown[], spec: Spec, upstreams: readonly ReductionUpstream[]): Reduction<ReduceResult<Spec>>;
     /**
      * Build a `GroupedQuery<T, F, S>` for `Query.groupBy(field)`. Same
      * closure / upstream inputs as `aggregate` plus the group key field.
      */
-    groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], field: F, upstreams: readonly AggregationUpstream[], dictLabelResolver?: (key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>, via?: ViaPipeline): GroupedQuery<T, F, S, M>;
+    groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], field: F, upstreams: readonly ReductionUpstream[], dictLabelResolver?: (key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>, via?: ViaPipeline): GroupedQuery<T, F, S, M>;
     /**
      * Variadic-keyed sibling — builds a `GroupedQueryN<T, F, S>` for
      * `Query.groupBy(...fields)`. No dictLabelResolver — `<field>Label`
      * projection only applies to single-field groupings, which dispatch
      * through `groupBy` above.
      */
-    groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], fields: F, upstreams: readonly AggregationUpstream[], via?: ViaPipeline): GroupedQueryN<T, F, S, M>;
+    groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], fields: F, upstreams: readonly ReductionUpstream[], via?: ViaPipeline): GroupedQueryN<T, F, S, M>;
     /**
      * Terminal streaming aggregator for `ScanBuilder.aggregate(spec)`.
      * Takes an async iterable of decrypted records + the spec and
      * returns the reduced result.
      */
-    scanAggregate<Spec extends AggregateSpec>(iter: AsyncIterable<unknown>, spec: Spec): Promise<AggregateResult<Spec>>;
+    scanAggregate<Spec extends ReduceSpec>(iter: AsyncIterable<unknown>, spec: Spec): Promise<ReduceResult<Spec>>;
 }
 /**
  * No-aggregate stub. Every `.aggregate()` / `.groupBy()` / streaming
  * `scan().aggregate()` call throws with a pointer at the subpath. The
- * real `Aggregation` / `GroupedQuery` classes are never referenced at
+ * real `Reduction` / `GroupedQuery` classes are never referenced at
  * runtime, so the bundler drops the ~886 LOC.
  *
  * @internal
  */
-export declare const NO_AGGREGATE: AggregateStrategy;
+export declare const NO_REDUCE: ReduceStrategy;

package/dist/with-lookup/search/build-docs.d.ts

@@ -1,7 +1,13 @@
 import type { I18nTextDescriptor } from '../../via/i18n/core.js';
 import type { DictKeyDescriptor, StaticDictDescriptor } from '../../via/i18n/dictionary.js';
 import type { IndexDoc } from './inverted-index.js';
-type FieldEntry = IndexDoc['fields'][number];
+/**
+ * One entry in an {@link IndexDoc}'s `fields` array — the return shape of the
+ * `build*FieldEntries` helpers. Exported so `@noy-db/hub/search` can name the
+ * return type of its own public functions (#843 C1: the subpath's first
+ * type-reachability gap).
+ */
+export type FieldEntry = IndexDoc['fields'][number];
 export declare function buildStringFieldEntries(record: Record<string, unknown>, textIndexes: readonly string[], only?: readonly string[]): FieldEntry[];
 export declare function buildI18nFieldEntries(record: Record<string, unknown>, i18nFields: Record<string, I18nTextDescriptor>, textIndexes: readonly string[], only?: readonly string[]): FieldEntry[];
 /** label map: field -> (key -> { locale -> label }). Precomputed in the collection (async for dynamic dicts). */
@@ -12,4 +18,3 @@ export declare function buildDictKeyFieldEntries(record: Record<string, unknown>
  * caller). Bytes are never tokenized; only the slot `filename` is indexed.
  */
 export declare function buildBlobFieldEntries(filenamesByField: Map<string, string[]>): FieldEntry[];
-export {};

package/dist/with-lookup/search/index.d.ts

@@ -11,7 +11,7 @@ export { segmentTokens, segmentTokenizer, type Token } from './segment.js';
 export { InvertedIndex, type IndexDoc, type IndexHit, type QueryOptions } from './inverted-index.js';
 export { extractSnippet } from './snippet.js';
 export { MemoryIndexStore, type IndexStore } from './index-store.js';
-export { buildStringFieldEntries } from './build-docs.js';
+export { buildStringFieldEntries, type FieldEntry } from './build-docs.js';
 export type { RetrieveOptions, RetrieveHit } from './retrieve-types.js';
 export { fuseRetrieval, type FuseOptions } from './fuse.js';
 export { withSearch } from './active.js';

package/dist/with-party/directory/cover/index.d.ts

@@ -8,6 +8,7 @@
  */
 export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, } from './types.js';
 export { COVER_FIELDS, DEFAULT_COVER_SCHEMA, resolveSchema, } from './types.js';
+export { resolveSchema as resolveCoverSchema } from './types.js';
 export type { SetCoverInput } from './schema.js';
 export { validateCoverInput, isCover } from './schema.js';
 export { mergeCustom, validateCoverSize } from './custom.js';

package/dist/with-party/directory/index.d.ts

@@ -7,5 +7,7 @@
  * @module
  */
 export type { DirectoryConfig, UserVisibility } from './types.js';
+export { loadUserEnvelope, saveUserEnvelope, deleteUserEnvelope, listUserEnvelopeIds, } from './user-envelope/storage.js';
+export { UserApi } from './user-envelope/api.js';
 export { readDirectoryConfig, persistDirectoryConfig, META_COLLECTION, DIRECTORY_RECORD_ID, } from './storage.js';
 export { readUserVisibility, persistUserVisibility, deleteUserVisibility, visibilityRecordId, VISIBILITY_RECORD_PREFIX, } from './visibility.js';

package/dist/with-party/session/index.d.ts

@@ -21,3 +21,5 @@ export type { DevUnlockOptions } from './dev-unlock.js';
 export { withSession } from './active.js';
 export type { SessionStrategy } from './strategy.js';
 export { SessionExpiredError, SessionNotFoundError, SessionPolicyError, } from '../../kernel/errors.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_SESSION } from './strategy.js';

package/dist/with-party/sync/index.d.ts

@@ -29,3 +29,5 @@
  */
 export { withSync } from '../team/sync-active.js';
 export type { SyncStrategy } from '../team/sync-strategy.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_SYNC } from '../team/sync-strategy.js';

package/dist/with-party/team/index.d.ts

@@ -18,6 +18,7 @@ export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { BundleRecipient, ListUsersOptions } from './keyring.js';
+export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
 export { rotateSecret, recoverSecret, } from './rotate-recover.js';
@@ -36,3 +37,4 @@ export { SyncTransaction } from './sync-transaction.js';
 export { PresenceHandle } from './presence.js';
 export { putCredential, getCredential, deleteCredential, listCredentials, credentialStatus, SYNC_CREDENTIALS_COLLECTION, } from './sync-credentials.js';
 export type { SyncCredential } from './sync-credentials.js';
+export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -71,8 +71,15 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
+/** Options for {@link loadKeyring} (#846b). */
+export interface LoadKeyringOptions {
+    /** The user whose keyring to unlock. */
+    readonly userId: string;
+    /** That user's secret. */
+    readonly secret: string;
+}
 /** Load and unlock a user's keyring for a vault. */
-export declare function loadKeyring(adapter: NoydbStore, vault: string, userId: string, secret: string): Promise<UnlockedKeyring>;
+export declare function loadKeyring(store: NoydbStore, vault: string, opts: LoadKeyringOptions): Promise<UnlockedKeyring>;
 /**
  * Open-policy pre-gate: decide create-vs-fail-closed **before** any
  * vault write. `openVault` must not self-provision an owner keyring into a
@@ -85,22 +92,34 @@ export declare function loadKeyring(adapter: NoydbStore, vault: string, userId:
  * on first open), so a fail-closed open writes nothing.
  */
 export declare function assertKeyringOpenAllowed(store: NoydbStore, vault: string, userId: string, create: boolean): Promise<void>;
+/**
+ * Options for {@link createOwnerKeyring} (#846b). The `SecretPolicy` knobs are
+ * flattened into the same bag rather than nested, so `assertStrongSecret` can
+ * take `opts` directly.
+ */
+export interface CreateOwnerKeyringOptions extends SecretPolicy {
+    /** The owner to create. */
+    readonly userId: string;
+    /** The owner's secret. */
+    readonly secret: string;
+    /** Gate creation on the phrase-format strength rules. Default false. */
+    readonly validate?: boolean;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
 /**
  * Create the initial owner keyring for a new vault.
  *
- * Pass `{ validate: true }` (or a `SecretPolicy`) to gate creation
+ * Pass `{ validate: true }` (or any `SecretPolicy` knob) to gate creation
  * on the phrase-format strength rules — `Noydb` threads this from
  * `NoydbOptions.validateSecret`. Direct callers (CLI, scripts,
  * test fixtures) opt in explicitly.
  */
-export declare function createOwnerKeyring(adapter: NoydbStore, vault: string, userId: string, secret: string, secretOpts?: SecretPolicy & {
-    validate?: boolean;
-    allowWeakSecret?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
-export declare function grant(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
+export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
-export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
 /**
  * Mutate `role`, `displayName`, and/or `permissions` on an existing
  * keyring. Pure plaintext-header rewrite — no DEK rewrap, no KEK
@@ -125,14 +144,45 @@ export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring
  * @throws `ValidationError` when the diff is empty (nothing to update).
  *
  */
-export declare function updateKeyringIdentity(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
+export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
 /**
  * Rotate DEKs for specified collections:
  * 1. Generate new DEKs
  * 2. Re-encrypt all records in affected collections
  * 3. Re-wrap new DEKs for all remaining users
  */
-export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]): Promise<void>;
+/**
+ * What a DEK rotation leaves behind (#854).
+ *
+ * A member's DEKs are wrapped under that member's KEK, and a KEK derives only
+ * from that member's secret — so the caller cannot re-wrap a fresh DEK for
+ * anyone else. That is the zero-knowledge property working as designed, but it
+ * means rotation necessarily DROPS the rotated collections from every other
+ * member's keyring rather than re-keying them.
+ *
+ * `needsRegrant` names exactly who lost what, so the caller can re-run
+ * `grant()` instead of discovering the access loss later.
+ */
+export interface RotateResult {
+    /** (member, collection) pairs whose access was dropped by the rotation. */
+    readonly needsRegrant: ReadonlyArray<{
+        readonly userId: string;
+        readonly collection: string;
+    }>;
+}
+/** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
+export interface RotateKeysOptions {
+    /** Collections whose DEKs are re-minted. */
+    readonly collections: readonly string[];
+}
+export declare function rotateKeys(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions): Promise<RotateResult>;
+/** Options for {@link changeSecret} (#846b). */
+export interface ChangeSecretOptions extends SecretPolicy {
+    /** The replacement secret. */
+    readonly newSecret: string;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
 /**
  * Change the user's secret. Re-wraps every DEK under the new KEK.
  *
@@ -145,13 +195,11 @@ export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKey
  * for re-derivation; `changeSecret` reuses the cached unlocked KEK so
  * the OLD secret is not retyped.
  */
-export declare function changeSecret(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, newSecret: string, secretOpts?: SecretPolicy & {
-    allowWeakSecret?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function changeSecret(store: NoydbStore, vault: string, keyring: UnlockedKeyring, opts: ChangeSecretOptions): Promise<UnlockedKeyring>;
 /**
  * Recipient slot in a re-keyed `.noydb` bundle. Each slot becomes its
  * own keyring file inside the bundle, sealed with its own secret.
- * Same role/permission semantics as `db.grant()` but no adapter side
+ * Same role/permission semantics as `db.grant()` but no store side
  * effect — the slot only exists inside the bundle bytes.
  *
  * @public
@@ -193,7 +241,7 @@ export interface BundleRecipient {
 }
 /**
  * Build a `KeyringFile` for one bundle recipient, given the source
- * vault's unwrapped DEKs. Mirrors `grant()` minus the adapter write —
+ * vault's unwrapped DEKs. Mirrors `grant()` minus the store write —
  * the produced file is meant to be embedded in the bundle's
  * `keyrings` map, never persisted to the source vault.
  *
@@ -204,7 +252,7 @@ export interface BundleRecipient {
  */
 export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
 /** List all users with access to a vault. */
-export declare function listUsers(adapter: NoydbStore, vault: string): Promise<UserInfo[]>;
+export declare function listUsers(store: NoydbStore, vault: string): Promise<UserInfo[]>;
 /**
  * Optional filter knobs for {@link listUsersWithEnvelopes}.
  *
@@ -254,18 +302,18 @@ export interface ListUsersOptions {
  * Order matches `listUsers()` (store-defined; sort if you need a
  * stable display order).
  */
-export declare function listUsersWithEnvelopes<T = unknown>(adapter: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
+export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
     user: UserInfo;
     envelope: UserEnvelope<T> | null;
 }>>;
 /** Ensure a DEK exists for a collection. Generates one if new. */
-export declare function ensureCollectionDEK(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
+export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */
 export declare function hasAccess(keyring: UnlockedKeyring, collectionName: string): boolean;
-/** Persist a keyring file to the adapter. */
-export declare function persistKeyring(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
+/** Persist a keyring file to the store. */
+export declare function persistKeyring(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
  * export tier.

package/dist/with-party/team/noydb-facade.d.ts

@@ -19,6 +19,7 @@
  * Internal service — reached through `noydb.team.rotateSecret(...)` etc.
  */
 import type { NoydbOptions, NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
+import type { RotateResult, RotateKeysOptions } from './keyring.js';
 import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
@@ -72,7 +73,7 @@ export declare class TeamFacade {
     /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
     runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
-    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<void>, vault: string, collections: string[]): Promise<void>;
+    runRotate(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
     /**
      * Add a tier-2 authenticator slot to the calling user's keyring.
      * Each slot independently wraps the SAME KEK under a method-specific

package/dist/with-shape/blobs/blob-set.d.ts

@@ -109,7 +109,7 @@ export declare class BlobSet {
      * DECLARED; a collection with an undeclared field (or no `blobFields` at
      * all) constructs fine and reaches this write path unguarded. Refuse the
      * write itself instead of broadening the construction mandate, which
-     * would over-refuse blobless tiered collections (`blobStrategy` is
+     * would over-refuse blobless tiered collections (`blobsStrategy` is
      * vault-wide, not per-collection). Called from every content-write entry
      * (`put()`, `publish()`) — never from a read path, so a pre-existing
      * legacy blob stays readable (back-compat).

package/dist/with-shape/introspection/index.d.ts

@@ -9,4 +9,10 @@
  */
 export type { VaultSchemaSnapshot, DumpSchemaOptions, CollectionDescriptor, CollectionConfig, CollectionStats, FieldDescriptor, FieldSource, MaterializedViewDescriptor, OverlayViewDescriptor, DerivationDescriptor, InternalCollectionStats, } from './types.js';
 export { dumpVaultSchema } from './walk.js';
+export type { VaultIntrospectState } from './walk.js';
 export { jsonSchemaToFields } from './fields.js';
+export type { SchemaIntrospection } from './types.js';
+export type { FieldMeta, SemanticType } from './field-meta.js';
+export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
+export { applyListProjection } from './projection.js';
+export type { ListProjectionOptions } from './projection.js';

package/dist/with-shape/schema-update/index.d.ts

@@ -4,3 +4,4 @@ export { evaluateStrategies } from './dispatch.js';
 export { blindUpdate, additiveOnly, lockSchema } from './strategies.js';
 export { coordinatedCutover } from './cutover.js';
 export { SchemaUpdateGate } from './gate.js';
+export type { FenceDoc } from './fence.js';

package/dist/with-store/index.d.ts

@@ -3,8 +3,9 @@
  *
  * Store routing (multiplex by collection/size/age) and composable store
  * middleware (retry, logging, metrics, circuit-breaker, cache, health-check).
- * Root-barrel-only: no dedicated `@noy-db/hub/with-store` subpath export —
- * consumers reach these through the main `@noy-db/hub` entry.
+ * Published as `@noy-db/hub/store` (#843 C3a). Also re-exported from the root
+ * barrel, matching how the Via features are dual-homed — the subpath exists so
+ * the surface is navigable and tree-shakeable, not to force a migration.
  *
  * Named re-exports (not `export *`) so tsup keeps the barrel populated
  * even with `sideEffects: false`.

package/dist/withdraw-accessible-DEUCOO4F.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-TE6LH6J2.js";
+import "./chunk-WO4T4OD5.js";
+import "./chunk-SGQ4N5FS.js";
+import "./chunk-JIDLU57U.js";
+import "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-DEUCOO4F.js.map

package/dist/withdraw-accessible-DEUCOO4F.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}