@noy-db/hub 0.4.0 → 0.6.0-pre.0

package/dist/kernel/errors.d.ts

@@ -288,6 +288,23 @@ export declare class KeyringExpiredError extends NoydbError {
         expiresAt: string;
     });
 }
+/**
+ * Thrown when a plain single-string secret is offered against an
+ * echo-mode keyring. Echo keyrings unlock ONLY via the stepwise
+ * ceremony (`beginEchoUnlock`) or a structured `EchoSecretParts`
+ * value — never a single field (spec AG-1, #940).
+ */
+export declare class EchoCeremonyRequiredError extends NoydbError {
+    constructor();
+}
+/** Echo ceremony: the typed prompt failed its verifier. */
+export declare class WrongPromptError extends NoydbError {
+    constructor();
+}
+/** Echo ceremony (degraded path): the TYPED echo failed its verifier. */
+export declare class WrongEchoError extends NoydbError {
+    constructor();
+}
 /**
  * Thrown when an `@noy-db/as-*` import is attempted but the invoking
  * keyring lacks the required import-capability bit.
@@ -361,6 +378,35 @@ export declare class StoreCapabilityError extends NoydbError {
     readonly capability: string;
     constructor(capability: string, callerApi: string, storeName?: string);
 }
+/**
+ * Thrown by `StoreLocator.resolve()` (the `@noy-db/hub/to` Locator seam,
+ * #945) when a `StoreDescriptor.kind` has no registered factory. Names both
+ * the offending kind and every kind currently registered on the locator, so
+ * the fix — register the missing factory, or correct a typo'd kind string —
+ * is visible without a debugger.
+ */
+export declare class UnknownStoreKindError extends NoydbError {
+    /** The unregistered descriptor kind that was looked up. */
+    readonly kind: string;
+    /** Every kind currently registered on the locator, for comparison. */
+    readonly registeredKinds: readonly string[];
+    constructor(kind: string, registeredKinds: readonly string[]);
+}
+/**
+ * Thrown by `StoreLocator.register()` (the `@noy-db/hub/to` Locator seam,
+ * #945) when `kind` is already registered on the locator. A locator
+ * registers each kind exactly once — a duplicate registration is almost
+ * always a mistake (a copy-pasted setup block, two satellite packages
+ * fighting over the same kind string) — so it fails loudly at the mistake's
+ * source rather than silently overwriting (last-wins) and surfacing
+ * confusion at some unrelated `resolve()` call later. Mirrors
+ * `DuplicateBehaviorNameError`.
+ */
+export declare class DuplicateStoreKindError extends NoydbError {
+    /** The kind string that was already registered. */
+    readonly kind: string;
+    constructor(kind: string);
+}
 export declare class PrivilegeEscalationError extends NoydbError {
     readonly offendingCollection: string;
     constructor(offendingCollection: string, message?: string);
@@ -617,6 +663,39 @@ export declare class ConflictError extends NoydbError {
     readonly version: number;
     constructor(version: number, message?: string);
 }
+/**
+ * #935 — identity-safe ConflictError detection for store-boundary catches.
+ *
+ * A store may bind a DIFFERENT copy of `@noy-db/hub/to` than the caller
+ * (npm failing to dedupe hub within the peer range in production;
+ * src-vs-dist inside the workspace), so its ConflictError is a foreign
+ * class identity and a bare `instanceof` silently misses it — CAS retry
+ * loops rethrow instead of retrying, and the sync engine misfiles the
+ * conflict under `errors` with no resolution run. Every site that catches
+ * an error a STORE may have thrown must use this predicate; `instanceof`
+ * stays correct only for errors that never cross the store seam.
+ * The name check is the contract: every copy sets `name = 'ConflictError'`
+ * in its constructor, and the structural `version` field rides along.
+ */
+export declare function isConflictError(err: unknown): err is ConflictError;
+/**
+ * Thrown by the schema-manifest writer (`with-shape/manifest/writer.ts`,
+ * #941 AC #1) when a strict-CAS write to the `_manifest/schema` record
+ * loses the race — the stored `_v` no longer matches `expectedVersion`.
+ *
+ * Unlike {@link ConflictError} (which every other reserved-collection
+ * writer catches and retries), the manifest writer REFUSES: it does not
+ * re-read, re-apply, and retry. Two concurrent direct edits to the
+ * manifest must be refused and surfaced to the caller, never silently
+ * merged.
+ */
+export declare class ManifestConflictError extends NoydbError {
+    /** The actual stored `_v` at the time of conflict. */
+    readonly foundVersion: number;
+    /** The `expectedVersion` the caller supplied. */
+    readonly expectedVersion: number;
+    constructor(foundVersion: number, expectedVersion: number, message?: string);
+}
 /**
  * Thrown by `LedgerStore.append()` after exhausting its CAS retry
  * budget under multi-writer contention. Two browser tabs, a
@@ -946,6 +1025,18 @@ export declare class FieldNotQueryableError extends NoydbError {
 export declare class BundleIntegrityError extends NoydbError {
     constructor(message: string);
 }
+/**
+ * Thrown by `open()` (`with-pod/open.ts`, #941) when the caller supplied
+ * `trustedKeys` and `verifyPodHeader` reports `'untrusted'` or `'tampered'`.
+ * Both are treated the same, fail-closed — same posture as
+ * `RedirectBadSignatureError`: once a caller opts into signature
+ * verification, an unverifiable header is a hard stop, not a soft signal.
+ * `'unsigned'` is deliberately NOT included — a legacy/unsigned pod is
+ * benign and open() proceeds, surfacing the status via `OpenPodResult.verification`.
+ */
+export declare class PodHeaderVerificationError extends NoydbError {
+    constructor(status: 'untrusted' | 'tampered', keyId?: string);
+}
 /**
  * Thrown by `readPod` when the bundle carries
  * sealed per-user secrets but no supplied `SealingKeyProvider`
@@ -973,6 +1064,40 @@ export declare class BundleSealMismatchError extends NoydbError {
     readonly pid: string;
     constructor(userId: string, pid: string);
 }
+/**
+ * Thrown by `followRedirects` when the number of hops followed exceeds
+ * `maxDepth` (default 8) without reaching a terminal (non-redirect) pod.
+ */
+export declare class RedirectDepthExceededError extends NoydbError {
+    constructor(maxDepth: number);
+}
+/**
+ * Thrown by `followRedirects` when a redirect chain revisits a target it has
+ * already followed — an infinite loop rather than progress toward a terminal
+ * pod.
+ */
+export declare class RedirectLoopError extends NoydbError {
+    constructor(target: string);
+}
+/**
+ * Thrown by `followRedirects` when a hop's Redirect record fails
+ * verification — either its `issuedBy` is not in the caller's `trustedKeys`
+ * or its signature does not match the record contents. Both cases are
+ * treated the same, fail-closed: a Redirect is required to be signed by a
+ * trusted key, so an untrusted or forged hop is invalid for following, not
+ * merely "unverified".
+ */
+export declare class RedirectBadSignatureError extends NoydbError {
+    constructor(target: string);
+}
+/**
+ * Thrown by `followRedirects` when the caller's `fetcher` cannot produce the
+ * pod bytes for a hop's target — it returned `null` or threw. `cause` carries
+ * the underlying fetcher error, when there was one.
+ */
+export declare class RedirectUnreachableError extends NoydbError {
+    constructor(target: string, cause?: unknown);
+}
 /**
  * Thrown when `vault.collection()` is called with a name that is
  * reserved for NOYDB internal use (any name starting with `_dict_`).
@@ -1653,6 +1778,19 @@ export declare class OverlayIdMismatchError extends NoydbError {
     readonly expected: string;
     constructor(actual: string, expected: string);
 }
+/**
+ * Thrown at registration if a guard or derivation declares a `name` that
+ * is already registered by another behavior of the same kind in this
+ * vault. `name` is optional on both `GuardSpec` and `DerivationSpec` —
+ * unnamed behaviors never trigger this check — but once given, a name is
+ * the stable per-vault identifier a behavior manifest references, so it
+ * must be unique among behaviors of the same `kind`.
+ */
+export declare class DuplicateBehaviorNameError extends NoydbError {
+    readonly behaviorName: string;
+    readonly kind: 'guard' | 'derivation';
+    constructor(name: string, kind: 'guard' | 'derivation');
+}
 /**
  * Thrown when a requested snapshot version does not exist in the
  * snapshot store — either it was never created, was pruned by the

package/dist/kernel/noydb.d.ts

@@ -1,5 +1,5 @@
 import type { RotateResult } from '../with-party/team/keyring.js';
-import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
+import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
 import type { SecretPolicy } from './validation.js';
 import { type CoordinationProvider } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
@@ -502,6 +502,8 @@ export declare class Noydb {
      * @internal
      */
     get _store(): NoydbStore;
+    /** The default store this instance was opened with (#948). */
+    get store(): NoydbStore;
     /**
      * Currently-running multi-record transaction, or `null` outside
      * Phase 2. `Collection.dispatchDerivations` consults this so a
@@ -547,6 +549,13 @@ export declare class Noydb {
     _clearActiveTxContext(ctx: TxContext): void;
     /** Get sync status for a vault. */
     syncStatus(vault: string): SyncStatus;
+    /**
+     * Enumerate the sync targets wired for `vault` (#948) — the primary engine
+     * (keyed by vault name) plus any additional targets (keyed `vault::label`
+     * or `vault::role`). No preset name: a resolved `SyncPolicy` doesn't retain
+     * which preset (if any) produced it.
+     */
+    listSyncTargets(vault: string): SyncTargetInfo[];
     private getSyncEngine;
     _forEachSyncEngine(vault: string, fn: (engine: SyncEngine) => void): void;
     on<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;

package/dist/kernel/put-many-atomic.d.ts

@@ -0,0 +1,45 @@
+import type { PreparedPut } from './prepared-write.js';
+import type { EncryptedEnvelope, NoydbStore, PutManyItemOptions, PutManyResult } from './types.js';
+/** @internal Structural view of one executed op on a transaction context. */
+interface BulkExecutedOp {
+    readonly op: {
+        readonly type: 'put' | 'delete';
+        readonly vaultName: string;
+        readonly collectionName: string;
+        readonly id: string;
+    };
+    readonly priorEnvelope: EncryptedEnvelope | null;
+}
+/** @internal Structural slice of `with-commit`'s `TxContext` this module drives. */
+interface BulkTxContext {
+    readonly _executed: BulkExecutedOp[];
+}
+/** @internal The slice of `Collection` both branches drive. */
+export interface PutManyAtomicHost<T> {
+    put(id: string, record: T): Promise<void>;
+    _preparePut(id: string, record: T): Promise<PreparedPut<T>>;
+    _finalizePut(prepared: PreparedPut<T>): Promise<void>;
+    _fireAtomicAfterWrite(opType: 'put', prepared: PreparedPut<T>): Promise<void>;
+    _assertWriteGates(): Promise<void>;
+    _txAtomicSafe(opType: 'put' | 'delete'): boolean;
+    _invalidateCacheEntry(id: string): Promise<void>;
+}
+/** @internal The owning collection's private coordinates + wiring. */
+export interface PutManyAtomicContext<T> {
+    readonly host: PutManyAtomicHost<T>;
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly name: string;
+    readonly derivationSource?: {
+        createTxContext(): BulkTxContext;
+        setActiveTxContext(ctx: BulkTxContext): void;
+        clearActiveTxContext(ctx: BulkTxContext): void;
+        getCollection(name: string): {
+            _invalidateCacheEntry(id: string): Promise<void>;
+        };
+    } | undefined;
+}
+type PutManyEntries<T> = ReadonlyArray<readonly [id: string, record: T, opts?: PutManyItemOptions]>;
+/** @internal Atomic-mode implementation of `Collection.putMany`. */
+export declare function runPutManyAtomic<T>(ctx: PutManyAtomicContext<T>, entries: PutManyEntries<T>): Promise<PutManyResult>;
+export {};

package/dist/kernel/secret-mode.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Secret-mode rules for `createNoydb` / keyring unlock — the option
+ * cross-checks and the per-mode secret resolution for the three
+ * {@link NoydbOptions.secretMode} values (`standard` / `managed` / `echo`).
+ *
+ * Extracted out of `kernel/noydb.ts` (which is under a line ceiling — see
+ * `check-architecture`'s `kernel-surface` rule) when echo mode was wired in
+ * (spec docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940). The
+ * managed-mode rules and their exact messages moved verbatim; the echo rules
+ * are the addition.
+ *
+ * Nothing here is re-exported from a package barrel — it is kernel-internal.
+ *
+ * @module
+ */
+import type { NoydbOptions, NoydbStore } from './types.js';
+import type { EchoSecretParts } from './enclave/index.js';
+/**
+ * Cross-check the secret-mode-related options at `createNoydb` time, before
+ * any store touch. Throws `ValidationError` on the first violation.
+ */
+export declare function validateSecretModeOptions(options: NoydbOptions): void;
+/**
+ * Resolve the secret that actually unlocks (or creates) `vault`'s keyring.
+ *
+ * Managed-secret mode resolves before falling into the normal load/create
+ * path: the first call mints + seals + persists, subsequent calls unseal
+ * what's there. The returned string takes the place of `options.secret` for
+ * the rest of the unlock (and is NOT persisted on the options).
+ *
+ * Standard and echo mode both hand back `options.secret` unchanged — a
+ * string for standard, an {@link EchoSecretParts} struct for echo; the KDF
+ * dispatch on that shape happens in `deriveKekForKeyring`.
+ */
+export declare function resolveEffectiveSecret(options: NoydbOptions, store: NoydbStore, vault: string): Promise<string | EchoSecretParts | undefined>;
+/**
+ * Build the `createOwnerKeyring` bag for a first-boot (or `onInvalidKey:
+ * 'reset'`) enrollment under the current secret mode.
+ *
+ * Managed mode generates 256-bit base64 strings that don't satisfy the
+ * human-secret strength rules (no spaces, no "words"), so it skips
+ * validation — the entropy floor is already 256 bits by construction. Echo
+ * mode does NOT skip it: the parts are human-chosen, so `validateSecret`
+ * applies exactly as it does in standard mode.
+ *
+ * The return type is inferred rather than annotated as
+ * `CreateOwnerKeyringOptions` — naming that type here would be a static
+ * spine→service import, which `port-layering` forbids even type-only. The
+ * shape is still checked: `noydb.ts` passes the result straight into
+ * `createOwnerKeyring`, so any drift fails typecheck at the call site.
+ */
+export declare function ownerKeyringOptions(options: NoydbOptions, secret: string | EchoSecretParts): {
+    echoMaskHint?: string;
+    echoSecretPolicy?: import("./validation.js").EchoSecretPolicy;
+    deviceSeal?: import("../index.js").DeviceSealProvider;
+    userId: string;
+    secret: string | EchoSecretParts;
+    validate: boolean;
+};

package/dist/kernel/types.d.ts

@@ -24,7 +24,7 @@
  */
 import type { StandardSchemaV1 } from './schema.js';
 import type { DeferredNumberingConfig } from '../with-commit/numbering/descriptor.js';
-import type { SyncPolicy, ReadinessState } from './sync-policy.js';
+import type { SyncPolicy, ReadinessState, PushMode, PullMode } from './sync-policy.js';
 import type { BlobsStrategy } from '../port/with/blob-strategy.js';
 import type { ArchiveStrategy } from '../with-fork/archive/index.js';
 import type { IndexingStrategy } from '../with-lookup/indexing/strategy.js';
@@ -55,7 +55,7 @@ import type { SyncStrategy } from '../with-sync/strategy.js';
 import type { GuardStrategyAny } from '../with-audit/guards/types.js';
 import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
-import type { SecretPolicy } from './validation.js';
+import type { SecretPolicy, EchoSecretPolicy } from './validation.js';
 import type { CoverSchema } from '../with-party/directory/cover/types.js';
 import type { MaterializedViewStrategy } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewStrategy } from '../with-formula/overlay-views/types.js';
@@ -65,7 +65,9 @@ import type { ObjectProjection } from '../with-shape/blobs/object-projection.js'
 import type { CoordinationProvider } from '../port/by/types.js';
 import type { ScriptWarning } from '../port/with/i18n-strategy.js';
 import type { ViaDescriptor } from './via/index.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey, EchoSecretParts } from './enclave/index.js';
+import type { DeviceSealProvider } from '../port/with/device-seal-strategy.js';
+export type { EchoSecretParts };
 /** Format version for encrypted record envelopes. */
 export declare const NOYDB_FORMAT_VERSION: 1;
 /** Format version for keyring files. */
@@ -869,6 +871,36 @@ export interface KeyringAuthenticatorWrappingDEKs extends KeyringAuthenticatorBa
  * dispatch is safe.
  */
 export type KeyringAuthenticator = KeyringAuthenticatorWrappingKEK | KeyringAuthenticatorWrappingDEKs;
+/**
+ * Echo-secret (3-part ceremony) declaration on a keyring — spec
+ * docs/superpowers/specs/2026-08-02-echo-secret-design.md (#940).
+ * Optional / append-only: keyrings written before the extension (or
+ * using standard/managed modes) simply lack it.
+ */
+export interface KeyringEchoBlock {
+    readonly v: 1;
+    /** Salt + AES-KW verifier gating the reveal on the typed prompt (600K PBKDF2). */
+    readonly prompt_salt: string;
+    readonly prompt_verifier: string;
+    /** Salt + AES-KW verifier for a TYPED echo (degraded path). */
+    readonly echo_salt: string;
+    readonly echo_verifier: string;
+    /** Hybrid reveal policy (spec decision 4). */
+    readonly reveal: {
+        readonly kind: 'portable';
+        readonly blob: string;
+        readonly iv: string;
+        readonly salt: string;
+    } | {
+        readonly kind: 'sealed';
+        readonly blob: string;
+        readonly provider_hint: string;
+    } | {
+        readonly kind: 'none';
+    };
+    /** Optional display-masking hint — pure player-UI concern. */
+    readonly mask_hint?: string;
+}
 export interface KeyringFile {
     readonly _noydb_keyring: typeof NOYDB_KEYRING_VERSION;
     readonly user_id: string;
@@ -942,6 +974,11 @@ export interface KeyringFile {
      * highest tier they have DEKs for at grant time.
      */
     readonly clearance?: number;
+    /**
+     * Echo-secret (3-part ceremony) declaration. Absent for keyrings
+     * using standard/managed mode, or written before this extension.
+     */
+    readonly echo?: KeyringEchoBlock;
 }
 export interface VaultBackup {
     readonly _noydb_backup: typeof NOYDB_BACKUP_VERSION;
@@ -1287,6 +1324,23 @@ export interface SyncTarget {
     /** Human-readable label for DevTools and audit logs. */
     readonly label?: string;
 }
+/**
+ * Introspection view of a wired sync target, returned by `Noydb.listSyncTargets()`
+ * (#948). Deliberately omits any preset *name* — a resolved `SyncPolicy` doesn't
+ * retain which preset (if any) it came from, so only its push/pull mode is surfaced.
+ */
+export interface SyncTargetInfo {
+    readonly label: string | undefined;
+    readonly role: SyncTargetRole;
+    readonly policy: {
+        readonly push: {
+            readonly mode: PushMode;
+        };
+        readonly pull: {
+            readonly mode: PullMode;
+        };
+    } | undefined;
+}
 export interface ChangeEvent {
     readonly vault: string;
     readonly collection: string;
@@ -2503,8 +2557,13 @@ export interface NoydbOptions {
     readonly sync?: NoydbStore | SyncTarget | SyncTarget[];
     /** User identifier. */
     readonly user: string;
-    /** Secret for key derivation. Required unless encrypt is false or `getKeyring` is provided. */
-    readonly secret?: string;
+    /**
+     * Secret for key derivation. Required unless encrypt is false or
+     * `getKeyring` is provided. A plain `string` for `'standard'` /
+     * `'managed'` mode; an {@link EchoSecretParts} 3-part struct for
+     * `'echo'` mode (spec docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940).
+     */
+    readonly secret?: string | EchoSecretParts;
     /**
      * Optional callback that returns an unlocked keyring for a given vault.
      * Use this to plug in WebAuthn / OIDC / Shamir / any unlock path that
@@ -2555,10 +2614,13 @@ export interface NoydbOptions {
      *     the provided `sealingKey`. The user never sees or types the
      *     secret, defeating the $5-wrench attack. Mutually
      *     exclusive with `secret` and `getKeyring`.
+     *   - `'echo'` — 3-part ceremony (prompt / echo / key). `secret`
+     *     takes an {@link EchoSecretParts} struct instead of a plain
+     *     string (spec docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940).
      *
      * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
      */
-    readonly secretMode?: 'standard' | 'managed';
+    readonly secretMode?: 'standard' | 'echo' | 'managed';
     /**
      * Provider that seals/unseals the auto-generated managed-mode
      * secret. Required when `secretMode === 'managed'`; ignored
@@ -2567,6 +2629,23 @@ export interface NoydbOptions {
      * `@noy-db/seal-libsecret`, `@noy-db/seal-aws-kms`, …).
      */
     readonly sealingKey?: SealingKeyProvider;
+    /**
+     * Device-local sealer for the echo reveal-blob. Echo mode only.
+     * Absent ⇒ live keyrings enroll `reveal: 'portable'`; present ⇒
+     * `sealed` (attacker-B resistance). Spec resolved question 4.
+     */
+    readonly deviceSeal?: DeviceSealProvider;
+    /**
+     * Echo enrollment only: optional display hint for the masked echo,
+     * threaded to the owner keyring's `KeyringEchoBlock.mask_hint` (surfaced
+     * later by `beginEchoUnlock`'s `maskHint`). Echo mode only — rejected
+     * (`ValidationError`) when `secretMode` isn't `'echo'`.
+     *
+     * Counterpart of `RotateSecretInput.echoOptions.maskHint` /
+     * `CreateOwnerKeyringOptions.echoMaskHint` for first-boot enrollment via
+     * `createNoydb` instead of a later `rotateSecret`.
+     */
+    readonly echoMaskHint?: string;
     /** Required to use `profile: 'shamir'` recovery. Pass
      *  `shamirRecoveryProvider()` from `@noy-db/on-shamir`. */
     readonly shamirRecovery?: ShamirRecoveryProvider;
@@ -2617,6 +2696,19 @@ export interface NoydbOptions {
      * back-compat; planned to flip to `true` in a future major release.
      */
     readonly validateSecret?: boolean;
+    /**
+     * Per-vault strength-policy knobs for the ECHO (3-part) secret's
+     * prompt / combined floors, applied at first-time keyring creation
+     * when `validateSecret` is on. Echo mode only — rejected
+     * (`ValidationError`) when `secretMode` isn't `'echo'`.
+     *
+     * This is the parts-path counterpart of `SecretPolicy` (there is no
+     * `secretPolicy` field on `NoydbOptions` itself — the standard/string
+     * secret path has no per-`createNoydb` override point today; see
+     * `RotateSecretInput.secretPolicy` / `RecoverSecretInput.secretPolicy`
+     * for where the string-path pairing lives).
+     */
+    readonly echoSecretPolicy?: EchoSecretPolicy;
     /**
      * Vault-level policy gate document. When present, the hub
      * persists the merged policy at `_meta/policy` on first-time vault
@@ -3346,4 +3438,3 @@ export type IndexedOf<T, O> = O extends {
 export type MoneyOf<T, O> = O extends {
     money: infer M;
 } ? (M & keyof T & string) : never;
-export {};

package/dist/kernel/validation.d.ts

@@ -128,3 +128,36 @@ export declare function estimateEntropy(secret: string): number;
  * @internal
  */
 export declare function legacyAssertSecret(s: string): void;
+/** Dedicated floors for the echo mode's three parts (spec resolved Q1/Q5). */
+export interface EchoSecretPolicy {
+    /** Floor for the typed prompt — the brute-forceable-in-isolation part. */
+    readonly prompt?: SecretPolicy;
+    /** Policy for the combined parts (defaults to the standard whole-secret rules). */
+    readonly combined?: SecretPolicy;
+}
+export declare const DEFAULT_ECHO_PROMPT_MIN_WORDS = 3;
+/**
+ * Default per-word character floor for echo-mode validation (prompt AND
+ * combined checks). Relaxed to 1 from the standard 3-char floor
+ * ({@link DEFAULT_MIN_WORD_LENGTH}) — echo secrets are natural-language
+ * sentences (spec #940's canonical example is Italian), and Romance
+ * languages are full of 2-letter function words ("mi", "da", "al") that
+ * the standard floor would otherwise reject even though the combined
+ * secret is plenty strong. Word-COUNT floors (prompt 3, combined 6) are
+ * unchanged — this only relaxes per-word length.
+ */
+export declare const DEFAULT_ECHO_MIN_WORD_LENGTH = 1;
+/** Validate a 3-part echo secret. Never throws. */
+export declare function validateEchoSecret(parts: {
+    readonly prompt: string;
+    readonly echo: string;
+    readonly key: string;
+}, opts?: EchoSecretPolicy): SecretValidationResult;
+/** Throwing form of {@link validateEchoSecret}. */
+export declare function assertStrongEchoSecret(parts: {
+    readonly prompt: string;
+    readonly echo: string;
+    readonly key: string;
+}, opts?: EchoSecretPolicy & {
+    allowWeakSecret?: boolean;
+}): void;

package/dist/kernel/vault.d.ts

@@ -39,6 +39,7 @@ import type { GuardStrategyAny } from '../with-audit/guards/types.js';
 import type { ReadOnlyVaultFacade } from '../with-audit/guards/read-only-facade.js';
 import type { DerivationRegistry } from '../with-formula/derivations/registry.js';
 import type { DerivationStrategy } from '../with-formula/derivations/types.js';
+import { type BehaviorSummary } from '../with-shape/introspection/behaviors.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
 import { type PeriodRecord, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
 import { type EnclaveKey } from './enclave/index.js';
@@ -401,7 +402,7 @@ export declare class Vault {
      *
      * Emits no ledger/event itself — its callers (#604's `freezePeriod`, #615's
      * `purgePeriodTargets`) own the audit record. The sweep body is shared via
-     * {@link _purgeMarkersOn}, which #615 also aims at push-only sync targets.
+     * `purgeMarkersOn`, which #615 also aims at push-only sync targets.
      *
      * Purges the local adapter only. Markers already pushed to the vault's
      * push-only (`backup`/`archive`) sync targets are reclaimed by #615's
@@ -409,11 +410,6 @@ export declare class Vault {
      * them would re-open the resurrection window — the deferred half of #611).
      */
     _purgeDeleteMarkers(before: string, collections?: string[]): Promise<number>;
-    /**
-     * @internal #615. Sweep delete markers with `_ts < before` off ANY store
-     * (local adapter or a push-only sync target). Returns the count removed.
-     */
-    private _purgeMarkersOn;
     /**
      * @internal #613. Relocate this closed period's in-window records (those
      * with `_ts < before`) from the hot store to the configured cold tier,
@@ -723,6 +719,15 @@ export declare class Vault {
     unrevokeAttestation(docId: string): Promise<void>;
     getRevokedDocIds(): Promise<string[]>;
     publishRevocationList(): Promise<RevocationList>;
+    /**
+     * @internal #943 — read-only access to this vault's persisted document
+     * signer, for pod export signing. Never mints and does NOT require the
+     * `withAttestation()` opt-in (role-agnostic, pure read): if no signer has
+     * ever been minted, resolves to `null` (unsigned pod) rather than throwing
+     * or minting one. Dynamic-imports `signer.js` (the S4 gate escape hatch —
+     * see `_ensureFenceCoordination` above) since it is a with-* service path.
+     */
+    _loadPodSigner(): Promise<import('../with-audit/attestation/signer.js').DocSigner | null>;
     private writeExportAudit;
     /**
      * Read-only accessor for the invoking keyring's export capability,
@@ -766,6 +771,20 @@ export declare class Vault {
      * cascade guard. See `with-shape/links/vault-facade.ts`.
      */
     enforceRefsOnDelete(collectionName: string, id: string): Promise<void>;
+    /**
+     * #922 — can a delete on `collectionName` trigger ANY cross-record work in
+     * `enforceRefsOnDelete` above? Unions ALL THREE of its cascade sources —
+     * lookup-ref edges (`graph.referencingEdgesOf`), classic inbound refs
+     * (`refRegistry.getInbound`), and managed link sets whose either endpoint
+     * is this collection. `Collection._txAtomicSafe('delete')` consults this
+     * instead of the pre-#922 blanket enforcer-presence check: `_prepareDelete`
+     * runs those cascades DURING prepare (not abortable), so a delete may take
+     * the atomic tx path only when all three sources are provably absent.
+     * Registry state only — no store reads, safe to call at commit time.
+     *
+     * @internal
+     */
+    _deleteCascadesPossible(collectionName: string): boolean;
     /**
      * Look up the `RefDescriptor` the left collection declared for a
      * given field name. Returns `null` when the field has no ref
@@ -967,6 +986,13 @@ export declare class Vault {
      * vaults with no overlays registered.
      */
     _getOverlayedViewRegistry(): OverlayedViewRegistry | null;
+    /**
+     * Read-only enumeration of the five behavior registries — guards,
+     * derivations, materialized views, overlays, satellites — each entry
+     * carrying its name and the serializable half of its spec (never a
+     * function body). @see with-shape/introspection/behaviors.ts
+     */
+    listBehaviors(): BehaviorSummary;
     /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
     private _dispatchCtx;
     /**

package/dist/{ledger-XE7JF2I2.js → ledger-DONWFC5M.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-YGK2HMLR.js";
+} from "./chunk-ZK4CO2KZ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-DQZXPGGZ.js";
-import "./chunk-SU6SGWXM.js";
-import "./chunk-EFJAAFBW.js";
-import "./chunk-35NMVJ7I.js";
-import "./chunk-NFZGZ4AK.js";
-import "./chunk-QJNCB5SK.js";
+} from "./chunk-24UICKTB.js";
+import "./chunk-FY343IZR.js";
+import "./chunk-NQRJ5AJO.js";
+import "./chunk-HXGUIPQB.js";
+import "./chunk-AR2JDFAE.js";
+import "./chunk-747LRSOO.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-AKKRXT23.js";
-import "./chunk-77AEMXFA.js";
-import "./chunk-QZWTRENR.js";
+import "./chunk-VCETL77O.js";
+import "./chunk-24ZLWWEO.js";
+import "./chunk-HNGSV2YC.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LEDGER_COLLECTION,
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-XE7JF2I2.js.map
+//# sourceMappingURL=ledger-DONWFC5M.js.map