@noy-db/hub 0.4.0-pre.6 → 0.4.0-pre.7

package/dist/with-formula/derivations/registry.d.ts

@@ -1,7 +1,7 @@
 import { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js';
-import type { DerivationStrategy } from './types.js';
+import type { DerivationSpec } from './types.js';
 interface RegisteredStrategy {
-    spec: DerivationStrategy<any, any>;
+    spec: DerivationSpec<any, any>;
     strategyHash: string;
 }
 /**
@@ -13,7 +13,7 @@ interface RegisteredStrategy {
 export declare class DerivationRegistry {
     private readonly _bySource;
     private readonly _byOutput;
-    register(spec: DerivationStrategy<any, any>): Promise<void>;
+    register(spec: DerivationSpec<any, any>): Promise<void>;
     strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy>;
     strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy>;
     /**

package/dist/with-formula/derivations/stale.d.ts

@@ -2,7 +2,7 @@ import type { Collection } from '../../kernel/collection.js';
 import type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js';
 import type { TxContext } from '../../with-commit/tx/transaction.js';
 import type { DerivationRegistry } from './registry.js';
-import type { DerivationStrategy } from './types.js';
+import type { DerivationSpec } from './types.js';
 /**
  * Accessor shape passed through from the owning Vault. Provides the
  * registry (used to look up strategies and as the WeakMap key) and a
@@ -29,7 +29,7 @@ export interface DerivationStaleAccessor {
     getActiveTxContext(): TxContext | null;
 }
 /** Mark every output of (strategy, sourceId) as stale. */
-export declare function markStale(registry: DerivationRegistry, strategy: DerivationStrategy<any, any>, sourceId: string): Promise<void>;
+export declare function markStale(registry: DerivationRegistry, strategy: DerivationSpec<any, any>, sourceId: string): Promise<void>;
 /**
  * Called from `Collection.get` on lazy-mode output collections. If the
  * id has a pending stale flag for any strategy producing this output

package/dist/with-formula/derivations/types.d.ts

@@ -119,7 +119,7 @@ export type OutputSpec = RecordOutputSpec | ArrayOutputSpec;
  *   value may be a single record, or — for `shape: 'array'` outputs — an
  *   array of records (the fanout sidecar upserts/deletes each row).
  */
-export interface DerivationStrategy<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>> {
+export interface DerivationSpec<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>> {
     /** Source collection name. */
     source: string;
     /**
@@ -242,7 +242,7 @@ export interface DerivationStrategy<TSource extends Record<string, unknown>, TOu
     strict?: boolean;
 }
 /** Returned by `withDerivation()` and consumed by `createNoydb`. */
-export interface DerivationStrategyHandle {
+export interface DerivationStrategy {
     readonly __noydb_strategy: 'derivation';
-    readonly spec: DerivationStrategy<any, any>;
+    readonly spec: DerivationSpec<any, any>;
 }

package/dist/with-formula/derivations/with-derivation.d.ts

@@ -1,4 +1,4 @@
-import type { DerivationStrategy, DerivationStrategyHandle } from './types.js';
+import type { DerivationSpec, DerivationStrategy } from './types.js';
 /**
  * Register a deterministic derivation: one source collection → one or
  * more typed outputs, computed by the user's `derive` function on
@@ -7,4 +7,4 @@ import type { DerivationStrategy, DerivationStrategyHandle } from './types.js';
  *
  * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.
  */
-export declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(spec: DerivationStrategy<TSource, TOutputs>): DerivationStrategyHandle;
+export declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(spec: DerivationSpec<TSource, TOutputs>): DerivationStrategy;

package/dist/with-formula/derivations/with-rollup.d.ts

@@ -1,4 +1,17 @@
-import type { DerivationStrategyHandle } from './types.js';
+import type { DerivationStrategy } from './types.js';
+/** Options for {@link withRollup} (#844b — was an inline literal, so unnameable). */
+export interface WithRollupOptions<TChild extends Record<string, unknown> = Record<string, unknown>, TParent extends Record<string, unknown> = Record<string, unknown>> {
+    /** Child collection — the trigger. */
+    readonly from: string;
+    /** FK field on the child pointing at the parent id. */
+    readonly key: keyof TChild & string;
+    /** Parent collection carrying the maintained summary. */
+    readonly into: string;
+    /** Field on the parent to maintain. */
+    readonly field: keyof TParent & string;
+    /** Reduces the matching children to the value written at `field`. */
+    readonly compute: (children: TChild[]) => unknown;
+}
 /**
  * `withRollup` — aggregate many child records onto a single field of their
  * parent. The reverse of a join: instead of reading children
@@ -25,10 +38,4 @@ import type { DerivationStrategyHandle } from './types.js';
  * Desugars to a `withDerivation` strategy carrying a `rollup` marker; dispatch
  * handles it without invoking the executor. Eager-only in this slice.
  */
-export declare function withRollup<TChild extends Record<string, unknown> = Record<string, unknown>, TParent extends Record<string, unknown> = Record<string, unknown>>(config: {
-    from: string;
-    key: keyof TChild & string;
-    into: string;
-    field: keyof TParent & string;
-    compute: (children: TChild[]) => unknown;
-}): DerivationStrategyHandle;
+export declare function withRollup<TChild extends Record<string, unknown> = Record<string, unknown>, TParent extends Record<string, unknown> = Record<string, unknown>>(opts: WithRollupOptions<TChild, TParent>): DerivationStrategy;

package/dist/with-formula/materialized-views/dependency-analyzer.d.ts

@@ -1,5 +1,5 @@
 import type { Query } from '../../kernel/query/builder.js';
-import type { MaterializedViewStrategy } from './types.js';
+import type { MaterializedViewSpec } from './types.js';
 /**
  * Walks a `Query<T>` plan and returns the set of source collection
  * names that any source-write should trigger a refresh on.
@@ -55,7 +55,7 @@ export declare function summarizeQueryPlan(query: Query<any>): string;
  * the MV's `name` (or rely on application-level cache busting) when
  * `map` semantics change non-equivalently.
  */
-export declare function summarizeUnionPlan<T extends Record<string, unknown>>(spec: MaterializedViewStrategy<T>): string;
+export declare function summarizeUnionPlan<T extends Record<string, unknown>>(spec: MaterializedViewSpec<T>): string;
 /**
  * Canonical string description of a projection MV's plan (#810), used
  * as input to `computeQueryHash`.
@@ -70,4 +70,4 @@ export declare function summarizeUnionPlan<T extends Record<string, unknown>>(sp
  * the UNION arm `map`); consumers must bump the MV's `name` when
  * `map` semantics change non-equivalently.
  */
-export declare function summarizeProjectionPlan<T extends Record<string, unknown>>(spec: MaterializedViewStrategy<T>): string;
+export declare function summarizeProjectionPlan<T extends Record<string, unknown>>(spec: MaterializedViewSpec<T>): string;

package/dist/with-formula/materialized-views/index.d.ts

@@ -5,7 +5,7 @@ export { analyzeDependencies, summarizeQueryPlan } from './dependency-analyzer.j
 export { computeQueryHash, canonicalizeQueryPlan } from './query-hash.js';
 export { markMVStale, resolveStaleMVOnRead, isMVStale, clearMVStale } from './stale.js';
 export type { MVStaleAccessor } from './stale.js';
-export type { MaterializedViewStrategy, MaterializedViewStrategyHandle, MaterializedViewOutput, MaterializedFromMeta, UnionSource, UnionArmJoin, ProjectionSpec, ProjectionJoinLeg, } from './types.js';
+export type { MaterializedViewSpec, MaterializedViewStrategy, MaterializedViewOutput, MaterializedFromMeta, UnionSource, UnionArmJoin, ProjectionSpec, ProjectionJoinLeg, } from './types.js';
 export type { RegisteredMV } from './registry.js';
 export type { MVExecutorAccessor, RefreshResult } from './executor.js';
 export { MaterializedViewCycleError, MaterializedViewConfigError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, } from '../../kernel/errors.js';

package/dist/with-formula/materialized-views/registry.d.ts

@@ -1,12 +1,12 @@
 import type { ViaGraph, FieldRef, EdgeKind, Grain } from '../../kernel/via/graph.js';
 import type { FieldClause } from '../../kernel/query/predicate.js';
-import type { MaterializedViewStrategy, MVQueryContext } from './types.js';
+import type { MaterializedViewSpec, MVQueryContext } from './types.js';
 /**
  * One registered MV strategy alongside its derived metadata. Stored
  * type-erased on `TRow` so the registry can hold heterogeneous MVs.
  */
 export interface RegisteredMV {
-    readonly spec: MaterializedViewStrategy<any>;
+    readonly spec: MaterializedViewSpec<any>;
     /** Output collection name (`spec.output?.collection ?? spec.name`). */
     readonly outputCollection: string;
     /** Set of source collections; populated at registration via the analyzer. */
@@ -65,7 +65,7 @@ export declare class MaterializedViewRegistry {
      * surfaces a dependency the vault doesn't know about (when a
      * `knownCollections` checker is supplied).
      */
-    register(spec: MaterializedViewStrategy<any>, db: MVQueryContext, options?: {
+    register(spec: MaterializedViewSpec<any>, db: MVQueryContext, options?: {
         knownCollections?: (name: string) => boolean;
     }): Promise<void>;
     /** All MVs that depend on `source`, in registration order. */
@@ -125,4 +125,4 @@ export declare class MaterializedViewRegistry {
  *
  * @internal
  */
-export declare function wrapDbWithPredicates(db: MVQueryContext, predicates: NonNullable<MaterializedViewStrategy<Record<string, unknown>>['predicates']>): MVQueryContext;
+export declare function wrapDbWithPredicates(db: MVQueryContext, predicates: NonNullable<MaterializedViewSpec<Record<string, unknown>>['predicates']>): MVQueryContext;

package/dist/with-formula/materialized-views/types.d.ts

@@ -97,7 +97,7 @@ export interface UnionSource<TRow extends Record<string, unknown>> {
      * `as` — the same machinery as the query-form `Query.join()`.
      *
      * The right-side collections must be listed in the strategy's
-     * {@link MaterializedViewStrategy.sources} so writes to them trigger
+     * {@link MaterializedViewSpec.sources} so writes to them trigger
      * MV refresh — registration throws `MaterializedViewConfigError`
      * otherwise (the union dependency set comes from arm `collection`s
      * alone, which would not include join targets).
@@ -185,7 +185,7 @@ export type ProjectionJoinLeg = {
  *
  * @typeParam TRow - the materialized row type (the query's result row)
  */
-export interface MaterializedViewStrategy<TRow extends Record<string, unknown>> {
+export interface MaterializedViewSpec<TRow extends Record<string, unknown>> {
     /**
      * Stable identity for this view. Used as the output collection name
      * unless `output.collection` overrides. Must be unique within the vault.
@@ -393,7 +393,7 @@ export interface MaterializedViewStrategy<TRow extends Record<string, unknown>>
     maxRows?: number;
 }
 /** Returned by `withMaterializedView()` and consumed by `createNoydb`. */
-export interface MaterializedViewStrategyHandle {
+export interface MaterializedViewStrategy {
     readonly __noydb_strategy: 'materialized-view';
-    readonly spec: MaterializedViewStrategy<any>;
+    readonly spec: MaterializedViewSpec<any>;
 }

package/dist/with-formula/materialized-views/with-materialized-view.d.ts

@@ -1,4 +1,4 @@
-import type { MaterializedViewStrategy, MaterializedViewStrategyHandle } from './types.js';
+import type { MaterializedViewSpec, MaterializedViewStrategy } from './types.js';
 /**
  * Register a materialized view: a declared query whose result is
  * persisted as a queryable collection and kept fresh as sources
@@ -25,4 +25,4 @@ import type { MaterializedViewStrategy, MaterializedViewStrategyHandle } from '.
  * docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION),
  * and docs/superpowers/specs/2026-07-25-join-projection-mv-design.md (projection).
  */
-export declare function withMaterializedView<TRow extends Record<string, unknown>>(spec: MaterializedViewStrategy<TRow>): MaterializedViewStrategyHandle;
+export declare function withMaterializedView<TRow extends Record<string, unknown>>(spec: MaterializedViewSpec<TRow>): MaterializedViewStrategy;

package/dist/with-formula/overlay-views/index.d.ts

@@ -1,5 +1,5 @@
 export { withOverlayedView } from './with-overlayed-view.js';
 export { OverlayedViewRegistry } from './registry.js';
 export { OverlayedCollection } from './virtual-collection.js';
-export type { OverlayedViewStrategy, OverlayedViewStrategyHandle, OverlayFieldMergeRule, OverlayFieldMergeMode, } from './types.js';
+export type { OverlayedViewSpec, OverlayedViewStrategy, OverlayFieldMergeRule, OverlayFieldMergeMode, } from './types.js';
 export { OverlayBaseIsVirtualError, OverlayCollectionUnavailableError, OverlayNameCollisionError, OverlayIdMismatchError, } from '../../kernel/errors.js';

package/dist/with-formula/overlay-views/registry.d.ts

@@ -1,5 +1,5 @@
 import type { MaterializedViewRegistry } from '../materialized-views/registry.js';
-import type { OverlayedViewStrategy } from './types.js';
+import type { OverlayedViewSpec } from './types.js';
 /**
  * Vault-internal registry of overlay strategies. Resolves the base
  * MV's `rowKey` lazily so virtual-collection writes can derive ids
@@ -15,12 +15,12 @@ export declare class OverlayedViewRegistry {
      * declared without the MV registry context skip cross-registry
      * checks but still validate self-consistency.
      */
-    register(spec: OverlayedViewStrategy, options: {
+    register(spec: OverlayedViewSpec, options: {
         isOverlayName?: (name: string) => boolean;
         isMVOutput?: (name: string) => boolean;
         isKnownCollection?: (name: string) => boolean;
     }): void;
-    byName(name: string): OverlayedViewStrategy | undefined;
+    byName(name: string): OverlayedViewSpec | undefined;
     /** All overlay virtual names. */
     names(): ReadonlySet<string>;
     isOverlay(name: string): boolean;
@@ -31,7 +31,7 @@ export declare class OverlayedViewRegistry {
      *
      * Used by `dumpSchema()` to populate the `overlayViews` map.
      */
-    all(): ReadonlyArray<OverlayedViewStrategy>;
+    all(): ReadonlyArray<OverlayedViewSpec>;
     /**
      * Resolve the `rowKey` function for an overlay's base MV. Returns
      * `undefined` if the base isn't an MV (raw source collection) or

package/dist/with-formula/overlay-views/types.d.ts

@@ -6,7 +6,7 @@
  * v2 ships the read-shadow variant only — arbitrary `mergePolicy`
  * callbacks are deferred to v3.
  */
-export interface OverlayedViewStrategy {
+export interface OverlayedViewSpec {
     /**
      * Virtual collection name. `vault.collection(name)` returns a
      * proxy that merges `base` and `overlay` per the shadow rule.
@@ -91,7 +91,7 @@ export interface OverlayFieldMergeMode {
     readonly rules: readonly OverlayFieldMergeRule[];
 }
 /** Returned by `withOverlayedView()` and consumed by `createNoydb`. */
-export interface OverlayedViewStrategyHandle {
+export interface OverlayedViewStrategy {
     readonly __noydb_strategy: 'overlayed-view';
-    readonly spec: OverlayedViewStrategy;
+    readonly spec: OverlayedViewSpec;
 }

package/dist/with-formula/overlay-views/virtual-collection.d.ts

@@ -1,5 +1,5 @@
 import type { Collection } from '../../kernel/collection.js';
-import type { OverlayedViewStrategy } from './types.js';
+import type { OverlayedViewSpec } from './types.js';
 /**
  * Virtual-collection proxy returned by `vault.collection(overlayName)`
  * when `overlayName` is a registered `withOverlayedView`.
@@ -23,7 +23,7 @@ export declare class OverlayedCollection<T extends Record<string, unknown> = any
     private readonly baseCollection;
     private readonly overlayCollection;
     private readonly baseRowKey;
-    constructor(spec: OverlayedViewStrategy, baseCollection: Collection<T>, overlayCollection: Collection<T>, baseRowKey: ((row: Record<string, unknown>) => string) | undefined);
+    constructor(spec: OverlayedViewSpec, baseCollection: Collection<T>, overlayCollection: Collection<T>, baseRowKey: ((row: Record<string, unknown>) => string) | undefined);
     /**
      * Convenience accessors for advanced callers that need to bypass the
      * virtual layer (bulk imports, direct overlay queries). Mirrors the

package/dist/with-formula/overlay-views/with-overlayed-view.d.ts

@@ -1,4 +1,4 @@
-import type { OverlayedViewStrategy, OverlayedViewStrategyHandle } from './types.js';
+import type { OverlayedViewSpec, OverlayedViewStrategy } from './types.js';
 /**
  * Register a read-shadow overlay: bind an MV-owned base collection to
  * a user-writable overlay so consumers can express operator-editable
@@ -6,4 +6,4 @@ import type { OverlayedViewStrategy, OverlayedViewStrategyHandle } from './types
  *
  * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md.
  */
-export declare function withOverlayedView(spec: OverlayedViewStrategy): OverlayedViewStrategyHandle;
+export declare function withOverlayedView(spec: OverlayedViewSpec): OverlayedViewStrategy;

package/dist/with-lookup/indexing/active.d.ts

@@ -1,6 +1,6 @@
 /**
  * Active indexing strategy factory. Calling `withIndexing()` returns
- * an `IndexStrategy` whose `createState` constructs a real
+ * an `IndexingStrategy` whose `createState` constructs a real
  * `CollectionIndexes` (eager) or `PersistedCollectionIndex` (lazy)
  * per Collection, depending on the collection's `prefetch` mode and
  * its declared `IndexDef[]`.
@@ -9,10 +9,10 @@
  * subpath — a consumer that never imports the subpath ships none of
  * this (ESM tree-shaking + hub's `"sideEffects": false`).
  */
-import type { IndexStrategy } from './strategy.js';
+import type { IndexingStrategy } from './strategy.js';
 /**
  * Build the default indexing strategy. Pass into
- * `createNoydb({ indexStrategy: withIndexing() })` to light up the
+ * `createNoydb({ indexingStrategy: withIndexing() })` to light up the
  * eager-mode `==/in` fast-path on `.query()` and the full lazy-mode
  * `.lazyQuery()` + rebuild / reconcile / auto-reconcile surface.
  *
@@ -23,8 +23,8 @@ import type { IndexStrategy } from './strategy.js';
  *
  * const db = await createNoydb({
  *   store, user, secret,
- *   indexStrategy: withIndexing(),
+ *   indexingStrategy: withIndexing(),
  * })
  * ```
  */
-export declare function withIndexing(): IndexStrategy;
+export declare function withIndexing(): IndexingStrategy;

package/dist/with-lookup/indexing/index.d.ts

@@ -18,7 +18,7 @@
  * capability boundary is explicit in import statements.
  */
 export { withIndexing } from './active.js';
-export type { IndexStrategy, IndexState } from './strategy.js';
+export type { IndexingStrategy, IndexState } from './strategy.js';
 export { CollectionIndexes } from './eager-indexes.js';
 export type { IndexDef, HashIndex } from './eager-indexes.js';
 export { PersistedCollectionIndex, IDX_PREFIX, COMPOSITE_DELIMITER, encodeIdxId, decodeIdxId, isIdxId, compositeKey, } from './persisted-indexes.js';

package/dist/with-lookup/indexing/strategy.d.ts

@@ -1,6 +1,6 @@
 /**
  * Strategy seam between core Collection and the optional indexing
- * service. Core imports `IndexStrategy` and `IndexState` as
+ * service. Core imports `IndexingStrategy` and `IndexState` as
  * TYPE-ONLY symbols and `NO_INDEXING` as a tiny runtime stub.
  *
  * The heavy classes — `CollectionIndexes`, `PersistedCollectionIndex`,
@@ -39,7 +39,7 @@ export interface IndexState {
  *
  * @internal
  */
-export interface IndexStrategy {
+export interface IndexingStrategy {
     createState(args: {
         readonly defs: readonly IndexDef[];
         readonly lazy: boolean;
@@ -53,4 +53,4 @@ export interface IndexStrategy {
  *
  * @internal
  */
-export declare const NO_INDEXING: IndexStrategy;
+export declare const NO_INDEXING: IndexingStrategy;

package/dist/with-lookup/search/build-docs.d.ts

@@ -1,7 +1,13 @@
 import type { I18nTextDescriptor } from '../../via/i18n/core.js';
 import type { DictKeyDescriptor, StaticDictDescriptor } from '../../via/i18n/dictionary.js';
 import type { IndexDoc } from './inverted-index.js';
-type FieldEntry = IndexDoc['fields'][number];
+/**
+ * One entry in an {@link IndexDoc}'s `fields` array — the return shape of the
+ * `build*FieldEntries` helpers. Exported so `@noy-db/hub/search` can name the
+ * return type of its own public functions (#843 C1: the subpath's first
+ * type-reachability gap).
+ */
+export type FieldEntry = IndexDoc['fields'][number];
 export declare function buildStringFieldEntries(record: Record<string, unknown>, textIndexes: readonly string[], only?: readonly string[]): FieldEntry[];
 export declare function buildI18nFieldEntries(record: Record<string, unknown>, i18nFields: Record<string, I18nTextDescriptor>, textIndexes: readonly string[], only?: readonly string[]): FieldEntry[];
 /** label map: field -> (key -> { locale -> label }). Precomputed in the collection (async for dynamic dicts). */
@@ -12,4 +18,3 @@ export declare function buildDictKeyFieldEntries(record: Record<string, unknown>
  * caller). Bytes are never tokenized; only the slot `filename` is indexed.
  */
 export declare function buildBlobFieldEntries(filenamesByField: Map<string, string[]>): FieldEntry[];
-export {};

package/dist/with-lookup/search/index.d.ts

@@ -11,7 +11,7 @@ export { segmentTokens, segmentTokenizer, type Token } from './segment.js';
 export { InvertedIndex, type IndexDoc, type IndexHit, type QueryOptions } from './inverted-index.js';
 export { extractSnippet } from './snippet.js';
 export { MemoryIndexStore, type IndexStore } from './index-store.js';
-export { buildStringFieldEntries } from './build-docs.js';
+export { buildStringFieldEntries, type FieldEntry } from './build-docs.js';
 export type { RetrieveOptions, RetrieveHit } from './retrieve-types.js';
 export { fuseRetrieval, type FuseOptions } from './fuse.js';
 export { withSearch } from './active.js';

package/dist/with-party/directory/cover/index.d.ts

@@ -8,6 +8,7 @@
  */
 export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, } from './types.js';
 export { COVER_FIELDS, DEFAULT_COVER_SCHEMA, resolveSchema, } from './types.js';
+export { resolveSchema as resolveCoverSchema } from './types.js';
 export type { SetCoverInput } from './schema.js';
 export { validateCoverInput, isCover } from './schema.js';
 export { mergeCustom, validateCoverSize } from './custom.js';

package/dist/with-party/directory/index.d.ts

@@ -7,5 +7,7 @@
  * @module
  */
 export type { DirectoryConfig, UserVisibility } from './types.js';
+export { loadUserEnvelope, saveUserEnvelope, deleteUserEnvelope, listUserEnvelopeIds, } from './user-envelope/storage.js';
+export { UserApi } from './user-envelope/api.js';
 export { readDirectoryConfig, persistDirectoryConfig, META_COLLECTION, DIRECTORY_RECORD_ID, } from './storage.js';
 export { readUserVisibility, persistUserVisibility, deleteUserVisibility, visibilityRecordId, VISIBILITY_RECORD_PREFIX, } from './visibility.js';

package/dist/with-party/team/index.d.ts

@@ -18,6 +18,7 @@ export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { BundleRecipient, ListUsersOptions } from './keyring.js';
+export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
 export { rotateSecret, recoverSecret, } from './rotate-recover.js';
@@ -36,3 +37,4 @@ export { SyncTransaction } from './sync-transaction.js';
 export { PresenceHandle } from './presence.js';
 export { putCredential, getCredential, deleteCredential, listCredentials, credentialStatus, SYNC_CREDENTIALS_COLLECTION, } from './sync-credentials.js';
 export type { SyncCredential } from './sync-credentials.js';
+export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -71,8 +71,15 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
+/** Options for {@link loadKeyring} (#846b). */
+export interface LoadKeyringOptions {
+    /** The user whose keyring to unlock. */
+    readonly userId: string;
+    /** That user's secret. */
+    readonly secret: string;
+}
 /** Load and unlock a user's keyring for a vault. */
-export declare function loadKeyring(adapter: NoydbStore, vault: string, userId: string, secret: string): Promise<UnlockedKeyring>;
+export declare function loadKeyring(store: NoydbStore, vault: string, opts: LoadKeyringOptions): Promise<UnlockedKeyring>;
 /**
  * Open-policy pre-gate: decide create-vs-fail-closed **before** any
  * vault write. `openVault` must not self-provision an owner keyring into a
@@ -85,22 +92,34 @@ export declare function loadKeyring(adapter: NoydbStore, vault: string, userId:
  * on first open), so a fail-closed open writes nothing.
  */
 export declare function assertKeyringOpenAllowed(store: NoydbStore, vault: string, userId: string, create: boolean): Promise<void>;
+/**
+ * Options for {@link createOwnerKeyring} (#846b). The `SecretPolicy` knobs are
+ * flattened into the same bag rather than nested, so `assertStrongSecret` can
+ * take `opts` directly.
+ */
+export interface CreateOwnerKeyringOptions extends SecretPolicy {
+    /** The owner to create. */
+    readonly userId: string;
+    /** The owner's secret. */
+    readonly secret: string;
+    /** Gate creation on the phrase-format strength rules. Default false. */
+    readonly validate?: boolean;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
 /**
  * Create the initial owner keyring for a new vault.
  *
- * Pass `{ validate: true }` (or a `SecretPolicy`) to gate creation
+ * Pass `{ validate: true }` (or any `SecretPolicy` knob) to gate creation
  * on the phrase-format strength rules — `Noydb` threads this from
  * `NoydbOptions.validateSecret`. Direct callers (CLI, scripts,
  * test fixtures) opt in explicitly.
  */
-export declare function createOwnerKeyring(adapter: NoydbStore, vault: string, userId: string, secret: string, secretOpts?: SecretPolicy & {
-    validate?: boolean;
-    allowWeakSecret?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
-export declare function grant(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
+export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
-export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
 /**
  * Mutate `role`, `displayName`, and/or `permissions` on an existing
  * keyring. Pure plaintext-header rewrite — no DEK rewrap, no KEK
@@ -125,7 +144,7 @@ export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring
  * @throws `ValidationError` when the diff is empty (nothing to update).
  *
  */
-export declare function updateKeyringIdentity(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
+export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
 /**
  * Rotate DEKs for specified collections:
  * 1. Generate new DEKs
@@ -151,7 +170,19 @@ export interface RotateResult {
         readonly collection: string;
     }>;
 }
-export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]): Promise<RotateResult>;
+/** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
+export interface RotateKeysOptions {
+    /** Collections whose DEKs are re-minted. */
+    readonly collections: readonly string[];
+}
+export declare function rotateKeys(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions): Promise<RotateResult>;
+/** Options for {@link changeSecret} (#846b). */
+export interface ChangeSecretOptions extends SecretPolicy {
+    /** The replacement secret. */
+    readonly newSecret: string;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
 /**
  * Change the user's secret. Re-wraps every DEK under the new KEK.
  *
@@ -164,13 +195,11 @@ export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKey
  * for re-derivation; `changeSecret` reuses the cached unlocked KEK so
  * the OLD secret is not retyped.
  */
-export declare function changeSecret(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, newSecret: string, secretOpts?: SecretPolicy & {
-    allowWeakSecret?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function changeSecret(store: NoydbStore, vault: string, keyring: UnlockedKeyring, opts: ChangeSecretOptions): Promise<UnlockedKeyring>;
 /**
  * Recipient slot in a re-keyed `.noydb` bundle. Each slot becomes its
  * own keyring file inside the bundle, sealed with its own secret.
- * Same role/permission semantics as `db.grant()` but no adapter side
+ * Same role/permission semantics as `db.grant()` but no store side
  * effect — the slot only exists inside the bundle bytes.
  *
  * @public
@@ -212,7 +241,7 @@ export interface BundleRecipient {
 }
 /**
  * Build a `KeyringFile` for one bundle recipient, given the source
- * vault's unwrapped DEKs. Mirrors `grant()` minus the adapter write —
+ * vault's unwrapped DEKs. Mirrors `grant()` minus the store write —
  * the produced file is meant to be embedded in the bundle's
  * `keyrings` map, never persisted to the source vault.
  *
@@ -223,7 +252,7 @@ export interface BundleRecipient {
  */
 export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
 /** List all users with access to a vault. */
-export declare function listUsers(adapter: NoydbStore, vault: string): Promise<UserInfo[]>;
+export declare function listUsers(store: NoydbStore, vault: string): Promise<UserInfo[]>;
 /**
  * Optional filter knobs for {@link listUsersWithEnvelopes}.
  *
@@ -273,18 +302,18 @@ export interface ListUsersOptions {
  * Order matches `listUsers()` (store-defined; sort if you need a
  * stable display order).
  */
-export declare function listUsersWithEnvelopes<T = unknown>(adapter: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
+export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
     user: UserInfo;
     envelope: UserEnvelope<T> | null;
 }>>;
 /** Ensure a DEK exists for a collection. Generates one if new. */
-export declare function ensureCollectionDEK(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
+export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */
 export declare function hasAccess(keyring: UnlockedKeyring, collectionName: string): boolean;
-/** Persist a keyring file to the adapter. */
-export declare function persistKeyring(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
+/** Persist a keyring file to the store. */
+export declare function persistKeyring(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
  * export tier.

package/dist/with-party/team/noydb-facade.d.ts

@@ -19,7 +19,7 @@
  * Internal service — reached through `noydb.team.rotateSecret(...)` etc.
  */
 import type { NoydbOptions, NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
-import type { RotateResult } from './keyring.js';
+import type { RotateResult, RotateKeysOptions } from './keyring.js';
 import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
@@ -73,7 +73,7 @@ export declare class TeamFacade {
     /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
     runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
-    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
+    runRotate(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
     /**
      * Add a tier-2 authenticator slot to the calling user's keyring.
      * Each slot independently wraps the SAME KEK under a method-specific

package/dist/with-shape/blobs/blob-set.d.ts

@@ -109,7 +109,7 @@ export declare class BlobSet {
      * DECLARED; a collection with an undeclared field (or no `blobFields` at
      * all) constructs fine and reaches this write path unguarded. Refuse the
      * write itself instead of broadening the construction mandate, which
-     * would over-refuse blobless tiered collections (`blobStrategy` is
+     * would over-refuse blobless tiered collections (`blobsStrategy` is
      * vault-wide, not per-collection). Called from every content-write entry
      * (`put()`, `publish()`) — never from a read path, so a pre-existing
      * legacy blob stays readable (back-compat).

package/dist/with-shape/introspection/index.d.ts

@@ -9,4 +9,10 @@
  */
 export type { VaultSchemaSnapshot, DumpSchemaOptions, CollectionDescriptor, CollectionConfig, CollectionStats, FieldDescriptor, FieldSource, MaterializedViewDescriptor, OverlayViewDescriptor, DerivationDescriptor, InternalCollectionStats, } from './types.js';
 export { dumpVaultSchema } from './walk.js';
+export type { VaultIntrospectState } from './walk.js';
 export { jsonSchemaToFields } from './fields.js';
+export type { SchemaIntrospection } from './types.js';
+export type { FieldMeta, SemanticType } from './field-meta.js';
+export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
+export { applyListProjection } from './projection.js';
+export type { ListProjectionOptions } from './projection.js';

package/dist/with-shape/schema-update/index.d.ts

@@ -4,3 +4,4 @@ export { evaluateStrategies } from './dispatch.js';
 export { blindUpdate, additiveOnly, lockSchema } from './strategies.js';
 export { coordinatedCutover } from './cutover.js';
 export { SchemaUpdateGate } from './gate.js';
+export type { FenceDoc } from './fence.js';