@noy-db/hub 0.4.0-pre.6 → 0.4.0-pre.7

package/dist/{chunk-EWPS35AR.js → chunk-XOBHRD2M.js}

@@ -1,95 +1,59 @@
-import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-YGMREQAK.js";
-import {
-  loadVaultPolicy
-} from "./chunk-M7W2KYTL.js";
-import {
-  jsonSchemaToFields
-} from "./chunk-VYYM3MEN.js";
 import {
   resolveStaleOnRead
-} from "./chunk-5ABOFAHN.js";
+} from "./chunk-NJ4DYYO5.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-MUPZ6IZX.js";
+} from "./chunk-4JQK3L4V.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-522MBPE5.js";
+} from "./chunk-SHEEBRZ4.js";
 import {
   loadFence
-} from "./chunk-44Y3P5U6.js";
+} from "./chunk-6M2I3DKF.js";
 import {
-  InvertedIndex,
-  MemoryIndexStore,
-  NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-3TZUC4WS.js";
-import {
-  derivePersistedSchema,
-  isZod4Schema
-} from "./chunk-SEU6QHH4.js";
-import {
-  CustodyApi,
-  NO_CARGO,
-  NO_CUSTODY,
-  runDrainBarrier
-} from "./chunk-3S2YNMUS.js";
+} from "./chunk-CCDP6EPB.js";
 import {
-  resolveManagedSecret,
-  saveSealedSecret
-} from "./chunk-6SSWOUUS.js";
+  SchemaUpdateGate
+} from "./chunk-6LJY7X5A.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
-import {
-  NO_SYNC
-} from "./chunk-EP5L47XV.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-GTNRMJYH.js";
-import {
-  NO_CLASSIFIED,
-  guardClassifiedCompat,
-  resolveClassifiedFields
-} from "./chunk-ZM72UO3Y.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-HDF5R2K6.js";
+} from "./chunk-6R6Q3MRN.js";
 import {
   NO_PORTABILITY
-} from "./chunk-OWLZONGX.js";
+} from "./chunk-BLBAQRBM.js";
 import {
-  NO_PERIODS
-} from "./chunk-IUATR5UE.js";
+  NO_CARGO,
+  runDrainBarrier
+} from "./chunk-TG634KCO.js";
 import {
-  NO_SHADOW
-} from "./chunk-SMY5X46Z.js";
+  resolveManagedSecret,
+  saveSealedSecret
+} from "./chunk-OLIWCCFM.js";
 import {
-  NO_SNAPSHOTS
-} from "./chunk-NIKO2BBZ.js";
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
 import {
-  TxContext,
-  bestEffortRevert,
-  revertExecuted
-} from "./chunk-QVGEVZ5F.js";
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-6ZNSB3H6.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-Z4D3YGAB.js";
+} from "./chunk-4ZKNC6A6.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -113,29 +77,69 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-JTIPVW4J.js";
+} from "./chunk-GP3UWP22.js";
+import {
+  OverlayedCollection
+} from "./chunk-ZTLOXFPB.js";
+import {
+  NO_SYNC
+} from "./chunk-EP5L47XV.js";
+import {
+  NO_ATTESTATION
+} from "./chunk-5GQEU4DN.js";
+import {
+  NO_CLASSIFIED,
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-ZFUFAHZ3.js";
+import {
+  NO_PERIODS
+} from "./chunk-N5PLUFH2.js";
+import {
+  NO_SHADOW
+} from "./chunk-SMY5X46Z.js";
+import {
+  NO_SNAPSHOTS
+} from "./chunk-DZFQVICS.js";
+import {
+  TxContext,
+  bestEffortRevert,
+  revertExecuted
+} from "./chunk-BQ6DHN4I.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
 import {
-  OverlayedCollection
-} from "./chunk-PWWWMRT7.js";
+  InvertedIndex,
+  MemoryIndexStore,
+  NO_SEARCH
+} from "./chunk-QADFHRQM.js";
+import {
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-EBKCYQ2D.js";
+import {
+  CustodyApi,
+  NO_CUSTODY
+} from "./chunk-SKM35Y4Q.js";
 import {
   Query,
   ScanBuilder
-} from "./chunk-MPPWL64H.js";
+} from "./chunk-WBKZUO5V.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-LN3MQFUE.js";
+} from "./chunk-IF6WNGAK.js";
 import {
   LazyQuery,
   NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-GQT6J4FJ.js";
+} from "./chunk-L3YYLT4E.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -158,7 +162,7 @@ import {
 } from "./chunk-PEOZ34EM.js";
 import {
   dictCollectionName
-} from "./chunk-C2V7AJO2.js";
+} from "./chunk-NEX7JCMO.js";
 import {
   NO_I18N,
   getAtPath,
@@ -166,13 +170,17 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-JOCMXSR2.js";
+} from "./chunk-UADPR6F4.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-ZUDAK436.js";
+} from "./chunk-6UBZ6I5Z.js";
 import {
   NO_TEAM,
+  describeAllUsersAuth,
+  describeAuthConfig,
+  describeUserAuth,
+  diagramAuthConfig,
   enrollAuthenticator,
   findAuthenticator,
   hasRecoveryEnrolled,
@@ -189,7 +197,17 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-M4GO4ZJK.js";
+} from "./chunk-C25JXSOR.js";
+import {
+  INDEXED_STORE_POLICY
+} from "./chunk-VQNJ7UZL.js";
+import {
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-EZNTORXE.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -204,25 +222,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-ZDFU34XY.js";
+} from "./chunk-KPXM4WO6.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-7IQWHYL2.js";
-import {
-  INDEXED_STORE_POLICY
-} from "./chunk-VQNJ7UZL.js";
-import {
-  PERIODS_COLLECTION,
-  PERIOD_ARCHIVES_COLLECTION,
-  PERIOD_FREEZES_COLLECTION,
-  PERIOD_TARGET_PURGES_COLLECTION,
-  periodExclusiveUpperBound
-} from "./chunk-TMR64XPL.js";
+} from "./chunk-WZ3NCMK6.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-P4NUJVWL.js";
+} from "./chunk-IXNCZTWA.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -236,10 +244,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-PTT2NB46.js";
+} from "./chunk-JYJFGD2H.js";
 import {
   sha256Hex
-} from "./chunk-2BVW754E.js";
+} from "./chunk-ISRKW4YN.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -248,10 +256,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-AZXEOEQK.js";
+} from "./chunk-KFRPNHWR.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-7LP7FFJ2.js";
+} from "./chunk-QD46HPZG.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -262,20 +270,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-MMVQ3SUO.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-KCZAFDP5.js";
+} from "./chunk-VH6SOCXH.js";
 import {
   encrypt
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-DOZFU7OZ.js";
+} from "./chunk-GZACYEOB.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -316,13 +324,13 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
-  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
+  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/transactions" and pass it to `createNoydb({ transactionsStrategy: withTransactions() })`.'
 );
-var NO_TX = {
+var NO_TRANSACTIONS = {
   async runTransaction(_db, _fn, _options, _txInvariants) {
     throw NOT_ENABLED;
   },
@@ -344,7 +352,7 @@ var STRATEGY_DEFAULTS = {
   reduce: NO_REDUCE,
   archive: NO_ARCHIVE,
   attestation: NO_ATTESTATION,
-  blob: NO_BLOBS,
+  blobs: NO_BLOBS,
   broker: NO_BROKER,
   cargo: NO_CARGO,
   classified: NO_CLASSIFIED,
@@ -354,7 +362,7 @@ var STRATEGY_DEFAULTS = {
   forget: NO_FORGET,
   history: NO_HISTORY,
   i18n: NO_I18N,
-  index: NO_INDEXING,
+  indexing: NO_INDEXING,
   lazy: IMPLICIT_LAZY,
   periods: NO_PERIODS,
   portability: NO_PORTABILITY,
@@ -363,11 +371,11 @@ var STRATEGY_DEFAULTS = {
   sequence: NO_SEQUENCE,
   session: NO_SESSION,
   shadow: NO_SHADOW,
-  snapshot: NO_SNAPSHOTS,
+  snapshots: NO_SNAPSHOTS,
   sync: NO_SYNC,
   team: NO_TEAM,
   tiers: NO_TIERS,
-  tx: NO_TX
+  transactions: NO_TRANSACTIONS
 };
 var STRATEGY_KEYS = Object.keys(STRATEGY_DEFAULTS);
 function resolveStrategies(options) {
@@ -382,7 +390,7 @@ function resolveStrategies(options) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-DX5HECK3.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-5LX2UFU2.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -930,7 +938,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
   const persisted = ctx.persistedIndexes;
   if (!persisted) {
     throw new Error(
-      `Collection "${ctx.name}": indexing is disabled on this Noydb instance. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexStrategy })\`.`
+      `Collection "${ctx.name}": indexing is disabled on this Noydb instance. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy })\`.`
     );
   }
   if (!persisted.has(field)) {
@@ -2168,7 +2176,7 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-33DRJDOC.js"));
+var loadComputed = lazy(() => import("./computed-AB45PS4V.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2212,7 +2220,7 @@ var Collection = class {
    * `NO_*` stub — a tiny module that throws with an actionable message —
    * so, for example, none of the BlobSet / chunk / MIME-magic machinery
    * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
-   * passes `blobStrategy: blobs()` to `createNoydb`.
+   * passes `blobsStrategy: blobs()` to `createNoydb`.
    */
   strategies;
   objectStore;
@@ -2254,7 +2262,7 @@ var Collection = class {
   lru;
   /**
    * tree-shake seam — per-Collection indexing state. Owned by the
-   * `IndexStrategy` passed through from `createNoydb({ indexStrategy })`.
+   * `IndexingStrategy` passed through from `createNoydb({ indexingStrategy })`.
    * Defaults to a disabled state (both accessors return null) so the
    * `CollectionIndexes` / `PersistedCollectionIndex` / `LazyQuery`
    * classes never reach the bundle when indexing is unused.
@@ -2694,7 +2702,7 @@ var Collection = class {
     } else {
       this.lru = null;
     }
-    const strategy = opts.strategies.index;
+    const strategy = opts.strategies.indexing;
     this.indexState = strategy.createState({
       defs: opts.indexes ?? [],
       lazy: this.lazy
@@ -2946,7 +2954,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-5X37OXRY.js");
+    const { verifyDigestField } = await import("./verify-7XWHJWUN.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3152,7 +3160,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-BJO2WIN7.js");
+      const { resolveStaleMVOnRead } = await import("./stale-JOE7GBAE.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3638,7 +3646,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-V5MSMQYX.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-RPTLK7LJ.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3811,7 +3819,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-SPMYNXNW.js");
+    const { dispatchDerivations } = await import("./dispatch-7T45NN7C.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4088,7 +4096,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-SPMYNXNW.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-7T45NN7C.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4102,7 +4110,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-V5MSMQYX.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-RPTLK7LJ.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4122,7 +4130,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-BJO2WIN7.js");
+      const { resolveStaleMVOnRead } = await import("./stale-JOE7GBAE.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5003,7 +5011,7 @@ var Collection = class {
    * vault-shared `_blob` DEK (enabling cross-collection deduplication).
    */
   blob(id) {
-    return this.strategies.blob.openSlot({
+    return this.strategies.blobs.openSlot({
       store: this.adapter,
       vault: this.vault,
       collection: this.name,
@@ -5236,7 +5244,7 @@ var Collection = class {
     const persisted = this.persistedIndexes;
     if (!persisted) {
       throw new Error(
-        `Collection "${this.name}": lazyQuery() requires indexing to be enabled. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexStrategy: withIndexing() })\`.`
+        `Collection "${this.name}": lazyQuery() requires indexing to be enabled. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy: withIndexing() })\`.`
       );
     }
     if (persisted.fields().length === 0) {
@@ -5275,14 +5283,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-SVDRXLD3.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-EOOSMWFC.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-SVDRXLD3.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-EOOSMWFC.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5410,7 +5418,7 @@ var Collection = class {
       },
       historyEnabled: this.historyConfig.enabled !== false && this.strategies.history !== NO_HISTORY,
       // #728/#737: lets putAtTier skip decrypting `existing` when no real history strategy is wired
-      syncBlobs: (id, fromTier, toTier) => this.strategies.blob !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
+      syncBlobs: (id, fromTier, toTier) => this.strategies.blobs !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
       // #724 I1: gate on blob storage enabled (not on declared blobFields) so undeclared-field blobs still rehome; #746: syncTierMove mints/resumes the rehome journal marker; self-no-ops on an empty slot map
       syncLedger: async (id) => {
         await this.ledger?.purgeRecordDeltas(this.name, id);
@@ -6725,7 +6733,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-XVZY2ODC.js").then(
+  const load = () => engine ??= import("./link-set-POQB7BU5.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7263,7 +7271,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-5VHHVFJY.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-URQANI3B.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7594,20 +7602,6 @@ async function migrateSatelliteCek(name, coll) {
   return { migrated };
 }
 
-// src/with-shape/schema-update/gate.ts
-var SchemaUpdateGate = class {
-  #decision;
-  constructor(decision) {
-    this.#decision = decision.catch(() => null);
-  }
-  async assertWritable() {
-    const decision = await this.#decision;
-    if (decision && decision.action === "reject") {
-      throw decision.error;
-    }
-  }
-};
-
 // src/with-shape/schema-update/fence-controller.ts
 var SchemaFenceController = class {
   #coordination;
@@ -8233,7 +8227,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-CEX7R7NE.js");
+          const { persistSchemaIfNeeded } = await import("./register-5W6CG4RM.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8319,7 +8313,7 @@ var Vault = class {
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
-            `[noy-db] Collection "${collectionName}" is declared in withForgetCascade but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
+            `[noy-db] Collection "${collectionName}" is declared in withForget but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
           );
         }
         collOpts.perRecordKeys = true;
@@ -8382,7 +8376,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-CEX7R7NE.js")).persistSchemaIfNeeded({
+            await (await import("./register-5W6CG4RM.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9252,7 +9246,7 @@ var Vault = class {
    * stay decryptable; migrate, then re-forget) and `blobResidueCollections` (blob attachments, keyed
    * off a separate `_blob` DEK, out of scope here).
    *
-   * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
+   * @throws ForgetStrategyNotConfiguredError when no `withForget` was set.
    */
   async forget(subjectId) {
     if (Object.keys(this.strategies.forget.subjects).length === 0) {
@@ -9277,7 +9271,7 @@ var Vault = class {
     const sealedResidue = [];
     const indexResidue = [];
     const ledgerDeltaResidue = [];
-    const blobsEnabled = this.strategies.blob !== NO_BLOBS;
+    const blobsEnabled = this.strategies.blobs !== NO_BLOBS;
     const actor = this.keyring.userId;
     const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [], derivedResidueUndecodable: [], derivedResidueDeclined: [] };
     const { partitionSealedCekKeys, shouldSkipBlobScan, bumpResidueCount, residueNoticesFromMap } = await import("./purge-scope-FGNNLWHD.js");
@@ -9541,7 +9535,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-VW6P6A3J.js"),
+      import("./registry-BWD2ED52.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new GuardRegistry();
@@ -9569,7 +9563,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-EWIB5NTI.js"),
+      import("./registry-MCSGBZXI.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9601,7 +9595,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-DIKMRXUC.js");
+    const { MaterializedViewRegistry } = await import("./registry-UJFP3NWF.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9626,7 +9620,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-7CZWF3EQ.js");
+    const { OverlayedViewRegistry } = await import("./registry-7Y5WF7GS.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9673,14 +9667,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-SVHAJZ4A.js");
+    const { MaterializedViewExecutor } = await import("./executor-XZYM4KHT.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-BJO2WIN7.js");
+    const { clearMVStaleFully } = await import("./stale-JOE7GBAE.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9693,7 +9687,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-FCJEH3FU.js");
+    const { DerivationExecutor } = await import("./executor-IEBLTBCW.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9720,7 +9714,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HRMHC34B.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-TV7CXAJ6.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -9947,7 +9941,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-EV7LKJPH.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONOZVPIP.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -9969,7 +9963,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-EV7LKJPH.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONOZVPIP.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10217,7 +10211,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-JXMWKKQW.js");
+    const { dumpVaultSchema } = await import("./walk-6OHAWGBS.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10352,7 +10346,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-ADBCTIKN.js");
+    const { readCover } = await import("./cover/index.js");
     return readCover(this.adapter, this.name, opts);
   }
   /**
@@ -10367,7 +10361,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-USYSNCYM.js");
+    const { dumpVault } = await import("./backup-PTSVXDDW.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10419,7 +10413,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-USYSNCYM.js");
+    const { loadVault } = await import("./backup-PTSVXDDW.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10451,7 +10445,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-USYSNCYM.js");
+    const { verifyBackupIntegrity } = await import("./backup-PTSVXDDW.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10669,7 +10663,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-USYSNCYM.js");
+    const { exportVaultJSON } = await import("./backup-PTSVXDDW.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11365,7 +11359,7 @@ var NoydbSnapshots = class {
   dirtyVaults = /* @__PURE__ */ new Set();
   /**
    * Take an on-demand checkpoint of the given vault.
-   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
    * @throws ValidationError when the vault is not open
    */
   async snapshot(vault, opts) {
@@ -11527,129 +11521,6 @@ function memoryStore() {
   };
 }
 
-// src/with-party/auth-introspection/index.ts
-async function describeAuthConfig(store, vault) {
-  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
-  const recoveryProfiles = await listRecoveryProfilesEnrolled(store, vault);
-  const lines = [];
-  lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
-  lines.push("");
-  lines.push("Tier 1 \u2014 Secret (master)");
-  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
-  lines.push("  Strength validator: enforced (override available for tests only)");
-  lines.push("");
-  lines.push("Tier 2 \u2014 Authenticate (routine login)");
-  lines.push("  Allowed methods: WebAuthn (passkey), OIDC, Password");
-  lines.push("  Slots per user: unlimited");
-  lines.push("");
-  lines.push("Tier 3 \u2014 Unlock (quick resume)");
-  lines.push("  Method: PIN (per-app configurable)");
-  lines.push("");
-  lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
-  lines.push("Managed-secret mode: off (post-1.0)");
-  lines.push("");
-  lines.push("Sensitive-action gates:");
-  for (const [gate, gp] of Object.entries(policy.gates)) {
-    lines.push(`  ${gate} \u2014 ${describeGatePolicy(gp)}`);
-  }
-  return lines.join("\n");
-}
-async function diagramAuthConfig(store, vault) {
-  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
-  const lines = [];
-  lines.push("flowchart TB");
-  lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
-  lines.push('  tier1["Tier 1<br/>Secret"]');
-  lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
-  lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
-  lines.push("  vault --> tier1");
-  lines.push("  tier1 --> tier2");
-  lines.push("  tier2 --> tier3");
-  for (const [gateName, gp] of Object.entries(policy.gates)) {
-    if (gp.enabled === false) continue;
-    const id = sanitizeId(gateName);
-    const label = `${gateName}<br/>tier \u2265 ${gp.minTier}`;
-    lines.push(`  ${id}["${escapeMermaid(label)}"]`);
-    const tierNode = gp.minTier === 1 ? "tier1" : gp.minTier === 2 ? "tier2" : "tier3";
-    lines.push(`  ${tierNode} --> ${id}`);
-  }
-  return lines.join("\n");
-}
-async function describeUserAuth(store, vault, userId) {
-  const env = await store.get(vault, "_keyring", userId);
-  if (!env) return "";
-  const file = JSON.parse(env._data);
-  const lines = [];
-  lines.push(
-    `User: ${file.user_id} (joined ${file.created_at.slice(0, 10)}, role: ${file.role})`
-  );
-  lines.push("");
-  lines.push("Tier 2 enrollments:");
-  if (!file.authenticators || file.authenticators.length === 0) {
-    lines.push("  (none enrolled)");
-  } else {
-    for (const slot of file.authenticators) {
-      lines.push(`  - ${describeSlot(slot)}`);
-    }
-  }
-  return lines.join("\n");
-}
-async function describeAllUsersAuth(store, vault) {
-  const ids = await store.list(vault, "_keyring");
-  const results = [];
-  for (const userId of ids) {
-    const description = await describeUserAuth(store, vault, userId);
-    if (description !== "") results.push({ userId, description });
-  }
-  return results;
-}
-var SLOT_FIELD_ALLOWLIST = [
-  "id",
-  "method",
-  "enrolled_at",
-  "enrolled_via_tier"
-];
-function describeSlot(slot) {
-  const sanitized = {};
-  for (const key of SLOT_FIELD_ALLOWLIST) {
-    if (key in slot) {
-      sanitized[key] = slot[key];
-    }
-  }
-  const date = (sanitized.enrolled_at ?? "").slice(0, 10);
-  return `${sanitized.method ?? "?"} (id=${sanitized.id ?? "?"}, enrolled ${date}, via tier ${sanitized.enrolled_via_tier ?? "?"})`;
-}
-function describeGatePolicy(gp) {
-  if (gp.enabled === false) return "disabled";
-  const parts = [];
-  parts.push(`tier ${gp.minTier}`);
-  if (gp.factors && gp.factors.length > 0) {
-    for (const f of gp.factors) {
-      parts.push(`+ ${f.count ?? 1}\xD7 ${f.anyOf.join("|")}`);
-    }
-  }
-  if (gp.warn?.sharedDevice === "block") parts.push("block-on-shared-device");
-  return parts.join(" ");
-}
-function defaultPolicySnapshot() {
-  return {
-    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
-    gates: {}
-  };
-}
-async function listRecoveryProfilesEnrolled(store, vault) {
-  const enrolled = [];
-  const paper = await loadPaperRecoveryEntries(store, vault);
-  if (paper.length > 0) enrolled.push(`paper (${paper.length} codes)`);
-  return enrolled;
-}
-function escapeMermaid(s) {
-  return s.replace(/"/g, '\\"').replace(/\n/g, " ");
-}
-function sanitizeId(s) {
-  return s.replace(/[^a-zA-Z0-9]/g, "_");
-}
-
 // src/with-party/team/noydb-facade.ts
 var TeamFacade = class {
   constructor(deps) {
@@ -11691,7 +11562,7 @@ var TeamFacade = class {
   async runRotate(engine, vault, collections) {
     this.deps.checkPolicyOperation(vault, "rotate");
     const keyring = await this.deps.getKeyringInternal(vault);
-    const result = await engine(this.deps.options.store, vault, keyring, collections);
+    const result = await engine(this.deps.options.store, vault, keyring, { collections });
     this.deps.keyringCache.set(vault, keyring);
     return result;
   }
@@ -12558,7 +12429,7 @@ var Noydb = class {
     this.policyCheckGate = options.policyCheckGateFn;
     this.strategies = resolveStrategies(options);
     this.snapshots = new NoydbSnapshots({
-      strategy: this.strategies.snapshot,
+      strategy: this.strategies.snapshots,
       user: options.user,
       isClosed: () => this.closed,
       getVault: (name) => this.vaultCache.get(name),
@@ -12606,7 +12477,7 @@ var Noydb = class {
   get _forgetStrategy() {
     return this.strategies.forget;
   }
-  // GDPR subject-index maintenance. When `withForgetCascade` declares
+  // GDPR subject-index maintenance. When `withForget` declares
   // any subject fields, keep the encrypted `_subject_index` in lock-step with
   // writes so `vault.forget(subjectId)` can find every record for a subject.
   //
@@ -12681,7 +12552,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-OHET7TF7.js");
+      const { GuardExecutor } = await import("./executor-RM7XWQDU.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -12872,12 +12743,10 @@ var Noydb = class {
       // compartments leave it null and load() skips the refresh.
       reloadKeyring: this.options.encrypt !== false && this.options.secret ? async () => {
         this.keyringCache.delete(name);
-        const refreshed = await loadKeyring(
-          this.options.store,
-          name,
-          this.options.user,
-          this.options.secret
-        );
+        const refreshed = await loadKeyring(this.options.store, name, {
+          userId: this.options.user,
+          secret: this.options.secret
+        });
         this.keyringCache.set(name, refreshed);
         return refreshed;
       } : void 0
@@ -13157,12 +13026,10 @@ var Noydb = class {
     for (const vault of universe) {
       let keyring;
       try {
-        keyring = await loadKeyring(
-          adapter,
-          vault,
-          this.options.user,
-          this.options.secret
-        );
+        keyring = await loadKeyring(adapter, vault, {
+          userId: this.options.user,
+          secret: this.options.secret
+        });
       } catch (err) {
         if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError) {
           continue;
@@ -13297,13 +13164,10 @@ var Noydb = class {
   async changeSecret(vault, newSecret, options) {
     this.checkPolicyOperation(vault, "changeSecret");
     const keyring = await this._getKeyringInternal(vault);
-    const updated = await changeSecret(
-      this.options.store,
-      vault,
-      keyring,
-      newSecret,
-      options
-    );
+    const updated = await changeSecret(this.options.store, vault, keyring, {
+      ...options,
+      newSecret
+    });
     this.keyringCache.set(vault, updated);
   }
   // ─── Sync ──────────────────────────────────────────────────────
@@ -13353,7 +13217,7 @@ var Noydb = class {
   }
   transaction(arg, maybeFn) {
     if (typeof arg === "function") {
-      return this.strategies.tx.runTransaction(this, arg);
+      return this.strategies.transactions.runTransaction(this, arg);
     }
     if (typeof arg === "object" && arg !== null && arg.dryRun === true) {
       if (typeof maybeFn !== "function") {
@@ -13361,7 +13225,7 @@ var Noydb = class {
           "db.transaction({ dryRun: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.strategies.tx.runDryRun(this, maybeFn);
+      return this.strategies.transactions.runDryRun(this, maybeFn);
     }
     if (typeof arg === "object" && arg !== null && arg.amendment === true) {
       if (typeof maybeFn !== "function") {
@@ -13369,7 +13233,7 @@ var Noydb = class {
           "db.transaction({ amendment: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.strategies.tx.runTransaction(this, maybeFn, arg);
+      return this.strategies.transactions.runTransaction(this, maybeFn, arg);
     }
     const vault = arg;
     const comp = this.vaultCache.get(vault);
@@ -13871,7 +13735,7 @@ var Noydb = class {
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-ADBCTIKN.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover/index.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -13903,7 +13767,7 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-ADBCTIKN.js");
+    const { readCover } = await import("./cover/index.js");
     return readCover(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -13943,33 +13807,25 @@ var Noydb = class {
     }
     let keyring;
     try {
-      keyring = await loadKeyring(this.options.store, vault, this.options.user, effectiveSecret);
+      keyring = await loadKeyring(this.options.store, vault, { userId: this.options.user, secret: effectiveSecret });
     } catch (err) {
       if (err instanceof NoAccessError) {
-        keyring = await createOwnerKeyring(
-          this.options.store,
-          vault,
-          this.options.user,
-          effectiveSecret,
-          {
-            // Managed mode generates 256-bit base64 strings that don't satisfy
-            // the human-secret strength rules (no spaces, no "words").
-            // Skip validation in managed mode — the entropy floor is already
-            // 256 bits by construction.
-            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-          }
-        );
+        keyring = await createOwnerKeyring(this.options.store, vault, {
+          userId: this.options.user,
+          secret: effectiveSecret,
+          // Managed mode generates 256-bit base64 strings that don't satisfy
+          // the human-secret strength rules (no spaces, no "words").
+          // Skip validation in managed mode — the entropy floor is already
+          // 256 bits by construction.
+          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
+        });
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
         await this.options.store.delete(vault, "_keyring", this.options.user);
-        keyring = await createOwnerKeyring(
-          this.options.store,
-          vault,
-          this.options.user,
-          effectiveSecret,
-          {
-            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-          }
-        );
+        keyring = await createOwnerKeyring(this.options.store, vault, {
+          userId: this.options.user,
+          secret: effectiveSecret,
+          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
+        });
       } else {
         throw err;
       }
@@ -13979,7 +13835,7 @@ var Noydb = class {
   }
   /**
    * Take an on-demand checkpoint of the given vault.
-   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
    * @throws ValidationError when the vault is not open
    */
   async snapshot(vault, opts) {
@@ -14030,9 +13886,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-5QVQX4HG.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-3NKVNZPM.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-QWGJB7P7.js");
+    const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14062,11 +13918,7 @@ export {
   RefRegistry,
   Vault,
   QuickUnlockStore,
-  describeAuthConfig,
-  diagramAuthConfig,
-  describeUserAuth,
-  describeAllUsersAuth,
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-EWPS35AR.js.map
+//# sourceMappingURL=chunk-XOBHRD2M.js.map