@noy-db/hub 0.4.0 → 0.6.0-pre.0

package/dist/{chunk-ZBYFMI6D.js → chunk-3CLZY46Y.js}

@@ -1,29 +1,33 @@
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-SHEEBRZ4.js";
+} from "./chunk-HVQGCKY4.js";
 import {
   resolveStaleOnRead
-} from "./chunk-NJ4DYYO5.js";
+} from "./chunk-4HDYQL3J.js";
+import {
+  isManifestReservedCollection
+} from "./chunk-EPFF7LOX.js";
 import {
   LinkIntegrityError,
+  declareLink,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-4JQK3L4V.js";
+} from "./chunk-HNHCQ556.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
 import {
   loadFence
-} from "./chunk-WK7ULBTP.js";
+} from "./chunk-MVOWXQHN.js";
 import {
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-PWPYO73B.js";
+} from "./chunk-ZGGVOADG.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -31,38 +35,41 @@ import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-DAFBJS4Y.js";
+} from "./chunk-GS5RT2KK.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-RQ4ZI4ZI.js";
+} from "./chunk-PGAPBZEK.js";
 import {
   NO_PORTABILITY
-} from "./chunk-BLBAQRBM.js";
+} from "./chunk-FUHKW252.js";
 import {
   NO_CARGO,
   runDrainBarrier
-} from "./chunk-TG634KCO.js";
+} from "./chunk-DG27IUVI.js";
 import {
-  resolveManagedSecret,
   saveSealedSecret
-} from "./chunk-CLE3TMIS.js";
+} from "./chunk-MC2LFTQM.js";
 import {
+  fallbackDerivationName,
   jsonSchemaToFields
-} from "./chunk-VYYM3MEN.js";
+} from "./chunk-KHKKD62N.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-6ZNSB3H6.js";
+} from "./chunk-2LGDCNFJ.js";
+import {
+  loadPersistedSchema
+} from "./chunk-V5C5NNBR.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-TS5XLBZR.js";
+} from "./chunk-TLNNHG3A.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-4ZKNC6A6.js";
+} from "./chunk-T4GPR2IR.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -86,30 +93,31 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-LRRX57UA.js";
+} from "./chunk-ZXJXDHNK.js";
 import {
   OverlayedCollection
-} from "./chunk-ZTLOXFPB.js";
+} from "./chunk-OF3L2SD6.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
 } from "./chunk-55LKVALY.js";
 import {
   NO_ATTESTATION
-} from "./chunk-5GQEU4DN.js";
+} from "./chunk-VJFMXYKP.js";
 import {
   NO_CONSENT
 } from "./chunk-PEOZ34EM.js";
 import {
-  NO_PERIODS
-} from "./chunk-ZFG5EBI3.js";
+  NO_PERIODS,
+  purgeMarkersOn
+} from "./chunk-LTU4FLHG.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-NM5UYF6Q.js";
+} from "./chunk-JXIDGFKS.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -118,9 +126,8 @@ import {
 } from "./chunk-DZFQVICS.js";
 import {
   TxContext,
-  bestEffortRevert,
-  revertExecuted
-} from "./chunk-GTYFIVIZ.js";
+  bestEffortRevert
+} from "./chunk-35EBKWQU.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -128,29 +135,32 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-KYRDJI5O.js";
+} from "./chunk-XBLKM73C.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-NBXFCQX4.js";
+} from "./chunk-NQCNSVGI.js";
 import {
   Query,
   ScanBuilder
-} from "./chunk-WBKZUO5V.js";
+} from "./chunk-3737A6EA.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-WUHEP3HH.js";
+} from "./chunk-P7NGLLUF.js";
 import {
   LazyQuery,
   NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-L3YYLT4E.js";
+} from "./chunk-JIUVJ4M7.js";
+import {
+  normalizeIndexDefs
+} from "./chunk-GQ3BX5EA.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -170,7 +180,7 @@ import {
 } from "./chunk-PVEWA2DU.js";
 import {
   dictCollectionName
-} from "./chunk-OWHP3H5C.js";
+} from "./chunk-XB7LUDKM.js";
 import {
   NO_I18N,
   getAtPath,
@@ -178,11 +188,11 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-UADPR6F4.js";
+} from "./chunk-7G6VDWXB.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-6UBZ6I5Z.js";
+} from "./chunk-UHXCLPGC.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -205,7 +215,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-ZNWSG7XC.js";
+} from "./chunk-DPJTDNUF.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -220,15 +230,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-Q5YJCVJY.js";
+} from "./chunk-RLWY6Z44.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-2BET5QTS.js";
+} from "./chunk-27TCYH6G.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-IXNCZTWA.js";
+} from "./chunk-W3TVWF6N.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -242,10 +252,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-JYJFGD2H.js";
+} from "./chunk-3FSX6LDG.js";
 import {
   sha256Hex
-} from "./chunk-DQZXPGGZ.js";
+} from "./chunk-24UICKTB.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -254,10 +264,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-ZHDSUZQU.js";
+} from "./chunk-RPXL6KSX.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-QD46HPZG.js";
+} from "./chunk-FAXZQ5UF.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -268,20 +278,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-FY343IZR.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-EFJAAFBW.js";
+} from "./chunk-NQRJ5AJO.js";
 import {
   encrypt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -291,6 +301,7 @@ import {
   ConflictError,
   DebugPlaintextError,
   DictKeyInUseError,
+  EchoCeremonyRequiredError,
   ElevationExpiredError,
   ExportCapabilityError,
   FieldNotQueryableError,
@@ -321,8 +332,9 @@ import {
   UniqueConstraintError,
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
-  ValidationError
-} from "./chunk-QZWTRENR.js";
+  ValidationError,
+  isConflictError
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
@@ -386,9 +398,91 @@ function resolveStrategies(options) {
   return resolved;
 }
 
+// src/kernel/secret-mode.ts
+function validateSecretModeOptions(options) {
+  const encrypted = options.encrypt !== false;
+  const managed = options.secretMode === "managed";
+  const echo = options.secretMode === "echo";
+  if (options.secret && options.getKeyring) {
+    throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
+  }
+  if (managed) {
+    if (options.secret) {
+      throw new ValidationError(
+        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
+      );
+    }
+    if (options.getKeyring) {
+      throw new ValidationError(
+        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
+      );
+    }
+    if (!options.sealingKey) {
+      throw new ValidationError(
+        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+      );
+    }
+  }
+  if (echo && typeof options.secret === "string") {
+    throw new ValidationError(
+      "secretMode 'echo' requires a structured { prompt, echo, key } secret \u2014 a single string can never unlock an echo vault (AG-1)."
+    );
+  }
+  if (echo && typeof options.secret === "object" && options.secret !== null) {
+    const parts = options.secret;
+    if (typeof parts.prompt !== "string" || typeof parts.echo !== "string" || typeof parts.key !== "string") {
+      throw new ValidationError(
+        "secretMode 'echo' requires a structured secret with all three fields present as strings: prompt, echo, key."
+      );
+    }
+  }
+  if (!echo && options.secret !== void 0 && typeof options.secret !== "string") {
+    throw new ValidationError("A { prompt, echo, key } secret requires secretMode: 'echo'.");
+  }
+  if (!echo && options.deviceSeal !== void 0) {
+    throw new ValidationError("deviceSeal is only meaningful with secretMode: 'echo'.");
+  }
+  if (!echo && options.echoSecretPolicy !== void 0) {
+    throw new ValidationError("echoSecretPolicy is only meaningful with secretMode: 'echo'.");
+  }
+  if (!echo && options.echoMaskHint !== void 0) {
+    throw new ValidationError("echoMaskHint is only meaningful with secretMode: 'echo'.");
+  }
+  if (echo && options.sealingKey !== void 0) {
+    throw new ValidationError(
+      "secretMode 'echo' is mutually exclusive with `sealingKey` \u2014 that provider belongs to managed mode."
+    );
+  }
+  if (echo && options.secret === void 0 && options.getKeyring === void 0) {
+    throw new ValidationError(
+      "secretMode 'echo' requires either a structured secret or a getKeyring ceremony hook."
+    );
+  }
+  if (encrypted && !managed && !options.secret && !options.getKeyring) {
+    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
+  }
+}
+async function resolveEffectiveSecret(options, store, vault) {
+  if (options.secretMode === "managed") {
+    const { resolveManagedSecret } = await import("./managed-secret-EAOYWRYF.js");
+    return resolveManagedSecret(store, vault, options.sealingKey);
+  }
+  return options.secret;
+}
+function ownerKeyringOptions(options, secret) {
+  return {
+    userId: options.user,
+    secret,
+    validate: options.secretMode === "managed" ? false : options.validateSecret === true,
+    ...options.deviceSeal !== void 0 && { deviceSeal: options.deviceSeal },
+    ...options.echoSecretPolicy !== void 0 && { echoSecretPolicy: options.echoSecretPolicy },
+    ...options.echoMaskHint !== void 0 && { echoMaskHint: options.echoMaskHint }
+  };
+}
+
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-AHGFEMFA.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-4SKLSFUG.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -835,6 +929,40 @@ async function countLiveEnvelopes(adapter, vault, name, storeCiphertext) {
   return n;
 }
 
+// src/kernel/cutover-transform.ts
+async function applyCutoverTransform(ctx) {
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  await assertCutoverTierSafe(ctx.adapter, ctx.vault, ctx.name, ctx.tiers !== null);
+  let count = 0;
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env || isTombstone(env, ctx.storeCiphertext) || isDeleteMarker(env)) continue;
+    const decoded = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
+    if (decoded === null) continue;
+    const record = decoded;
+    const next = ctx.transform(record);
+    const nextVersion = (env._v ?? 0) + 1;
+    const cek = ctx.perRecordCek ? await ctx.resolveRecordCek(id) : void 0;
+    const migEnvelope = await ctx.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, ctx.vdigFields !== null ? { id, prev: env } : void 0, id);
+    await ctx.adapter.put(ctx.vault, ctx.name, id, migEnvelope);
+    await ctx.onRecordMutated(id, "put", "cutover");
+    if (ctx.ledger) {
+      await ctx.ledger.append({
+        op: "migration",
+        collection: ctx.name,
+        id,
+        version: nextVersion,
+        actor: ctx.keyring.userId,
+        payloadHash: await ctx.envelopePayloadHash(migEnvelope),
+        reason: "schema:coordinated-cutover"
+      }).catch(() => {
+      });
+    }
+    count++;
+  }
+  return count;
+}
+
 // src/with-lookup/indexing/collection-facade.ts
 function readPersistedValue(record, field) {
   if (!field.includes(".")) return record[field];
@@ -1474,6 +1602,16 @@ async function deriveZodFields(schema) {
   }
   return result;
 }
+async function resolveDescribeFieldIds(store, vaultName, collectionName, getDEK) {
+  let dek;
+  try {
+    dek = await getDEK(collectionName);
+  } catch {
+    return {};
+  }
+  const persisted = await loadPersistedSchema(store, vaultName, collectionName, dek);
+  return persisted?.fieldIds !== void 0 ? { fieldIds: persisted.fieldIds } : {};
+}
 function deriveWidget(opts) {
   if (opts.resolvedWidget !== void 0) return opts.resolvedWidget;
   switch (opts.semanticType) {
@@ -1498,7 +1636,7 @@ function deriveWidget(opts) {
   return "text";
 }
 function buildDescription(input) {
-  const { collection, fieldMeta, moneyFields, dictKeyFields, lookupFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified, taint } = input;
+  const { collection, fieldMeta, moneyFields, dictKeyFields, lookupFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified, taint, fieldIds } = input;
   const lookupFragments = input.viaFragments?.["lookup"]?.lookupFields;
   const blobFragments = input.viaFragments?.["blob"]?.blobFields;
   if (zodFields !== void 0 && Object.keys(zodFields).length > 0 && fieldMeta !== void 0) {
@@ -1665,6 +1803,7 @@ function buildDescription(input) {
     const editable = !isComputed && key !== "id" && blobBlock === void 0;
     const field = {
       key,
+      ...fieldIds?.[key] !== void 0 ? { id: fieldIds[key] } : {},
       type,
       optional: zod?.optional ?? false,
       ...zod?.constraints !== void 0 ? { constraints: zod.constraints } : {},
@@ -1710,6 +1849,109 @@ function buildDescription(input) {
   };
 }
 
+// src/kernel/put-many-atomic.ts
+var toRevertLeg = ({ op, priorEnvelope }) => ({
+  vaultName: op.vaultName,
+  collectionName: op.collectionName,
+  id: op.id,
+  prior: priorEnvelope
+});
+async function runPutManyAtomic(ctx, entries) {
+  const { store, vault, name } = ctx;
+  const priors = /* @__PURE__ */ new Map();
+  let duplicateId = false;
+  for (const [id, , opts] of entries) {
+    if (priors.has(id)) duplicateId = true;
+    else priors.set(id, await store.get(vault, name, id));
+    if (opts?.expectedVersion !== void 0) {
+      const actual = priors.get(id)?._v ?? 0;
+      if (actual !== opts.expectedVersion) {
+        throw new ConflictError(
+          actual,
+          `putMany atomic: ${vault}/${name}/${id} expected v${opts.expectedVersion}, found v${actual}`
+        );
+      }
+    }
+  }
+  if (!duplicateId && store.capabilities?.txAtomic === true && typeof store.tx === "function" && ctx.host._txAtomicSafe("put")) {
+    return commitViaStoreTx(ctx, entries, priors);
+  }
+  return commitSequentially(ctx, entries, priors);
+}
+async function commitViaStoreTx(ctx, entries, priors) {
+  const { host, store, vault, name } = ctx;
+  await host._assertWriteGates();
+  const executed = [];
+  const legs = [];
+  for (const [id, record] of entries) {
+    const prior = priors.get(id) ?? null;
+    executed.push({ op: { type: "put", vaultName: vault, collectionName: name, id }, priorEnvelope: prior });
+    const prepared = await host._preparePut(id, record);
+    legs.push({
+      prepared,
+      // Every leg carries CAS against the Phase-1 snapshot, so a writer
+      // landing between prepare and the batch reaching the store loses.
+      txOp: { type: "put", vault, collection: name, id, expectedVersion: prior?._v ?? 0, envelope: prepared.envelope }
+    });
+  }
+  await store.tx(legs.map((l) => l.txOp));
+  try {
+    for (const leg of legs) {
+      await host._finalizePut(leg.prepared);
+      await host._fireAtomicAfterWrite("put", leg.prepared);
+    }
+  } catch (err) {
+    await bestEffortRevert(executed.map(toRevertLeg), store);
+    for (const { op } of [...executed].reverse()) {
+      try {
+        await host._invalidateCacheEntry(op.id);
+      } catch {
+      }
+    }
+    throw err;
+  }
+  return { ok: true, success: entries.map(([id]) => id), failures: [] };
+}
+async function commitSequentially(ctx, entries, priors) {
+  const { host, store, vault, name, derivationSource } = ctx;
+  const txCtx = derivationSource?.createTxContext() ?? null;
+  if (txCtx !== null && derivationSource) {
+    derivationSource.setActiveTxContext(txCtx);
+  }
+  const localExecuted = [];
+  try {
+    for (const [id, record] of entries) {
+      const entry = {
+        op: { type: "put", vaultName: vault, collectionName: name, id },
+        priorEnvelope: priors.get(id) ?? null
+      };
+      if (txCtx !== null) txCtx._executed.push(entry);
+      else localExecuted.push(entry);
+      await host.put(id, record);
+    }
+    return { ok: true, success: entries.map(([id]) => id), failures: [] };
+  } catch (err) {
+    const executedForRevert = txCtx !== null ? txCtx._executed : localExecuted;
+    await bestEffortRevert(executedForRevert.map(toRevertLeg), store);
+    for (const { op } of [...executedForRevert].reverse()) {
+      if (op.vaultName !== vault) continue;
+      try {
+        if (op.collectionName === name) {
+          await host._invalidateCacheEntry(op.id);
+        } else if (derivationSource) {
+          await derivationSource.getCollection(op.collectionName)._invalidateCacheEntry(op.id);
+        }
+      } catch {
+      }
+    }
+    throw err;
+  } finally {
+    if (txCtx !== null && derivationSource) {
+      derivationSource.clearActiveTxContext(txCtx);
+    }
+  }
+}
+
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -2174,7 +2416,7 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-AB45PS4V.js"));
+var loadComputed = lazy(() => import("./computed-6G5M3UPH.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2275,6 +2517,8 @@ var Collection = class {
    * `null` when no `unique:true` indexes are declared on this collection, or when the collection is in lazy mode (which throws at registration).
    */
   uniqueConstraints;
+  declaredIndexes;
+  // declared index defs, normalized (introspection only)
   /**
    * True once `_idx/*` side-cars have been bulk-loaded into
    * `persistedIndexes`. Flipped by `ensurePersistedIndexesLoaded()` on
@@ -2596,12 +2840,7 @@ var Collection = class {
       );
     }
     if (this.sensitiveFields.size > 0 && opts.indexes) {
-      const indexedFields = /* @__PURE__ */ new Set();
-      for (const def of opts.indexes) {
-        if (typeof def === "string") indexedFields.add(def);
-        else if (Array.isArray(def)) for (const f of def) indexedFields.add(f);
-        else for (const f of def.fields) indexedFields.add(f);
-      }
+      const indexedFields = new Set(normalizeIndexDefs(opts.indexes).flatMap((d) => d.fields));
       const leaked = [...this.sensitiveFields].filter((f) => indexedFields.has(f));
       if (leaked.length > 0) {
         console.warn(
@@ -2705,6 +2944,7 @@ var Collection = class {
       defs: opts.indexes ?? [],
       lazy: this.lazy
     });
+    this.declaredIndexes = normalizeIndexDefs(opts.indexes ?? []);
     this.indexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.persistedIndexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.uniqueConstraints = buildUniqueConstraintSet(this.name, opts.indexes, {
@@ -2735,6 +2975,10 @@ var Collection = class {
   getMeta() {
     return this.meta;
   }
+  getDeclaredIndexes() {
+    return this.declaredIndexes;
+  }
+  // declared index defs, normalized; consumed by walk.ts
   /**
    * Aggregate all collection-level configuration options that are actively set
    * into a {@link CollectionConfig} snapshot. Returns `undefined` when no options
@@ -2830,8 +3074,10 @@ var Collection = class {
       ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
       ...this.classified !== void 0 ? { classified: this.classified.byField } : {},
       ...this.via?.taint !== void 0 ? { taint: this.via.taint } : {},
-      ...this.via ? { viaFragments: this.via.describeFragments() } : {}
+      ...this.via ? { viaFragments: this.via.describeFragments() } : {},
       // #650 Task 7
+      ...await resolveDescribeFieldIds(this.adapter, this.vault, this.name, this.getDEK)
+      // #946
     });
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
@@ -2952,7 +3198,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-7XWHJWUN.js");
+    const { verifyDigestField } = await import("./verify-RO5RTZOJ.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3158,7 +3404,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-T3V7XEOB.js");
+      const { resolveStaleMVOnRead } = await import("./stale-K734VACF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3688,7 +3934,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-6TV3DGO6.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-4XIJSFTT.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3861,7 +4107,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-W7NWQ637.js");
+    const { dispatchDerivations } = await import("./dispatch-N5HGVUGU.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -3905,38 +4151,28 @@ var Collection = class {
     }
   }
   /**
-   * @internal — bulk-rewrite every record through a cutover transform. Raw adapter path (bypasses the write gate + guards — the transform is trusted and runs only during the `migrating` phase). Bumps each record's `_v` and appends a ledger `op:'migration'` entry. #708: refuses BEFORE any rewrite if a live record is elevated (assertCutoverTierSafe) — demote it first.
+   * @internal — bulk-rewrite every record through a cutover transform. Body
+   * lives in `./cutover-transform.js` (kernel-surface line ceiling); this is
+   * a thin context-passing delegator. See {@link applyCutoverTransform} for
+   * the full behavior doc.
    */
   async _applyCutoverTransform(transform) {
-    const ids = await this.adapter.list(this.vault, this.name);
-    await assertCutoverTierSafe(this.adapter, this.vault, this.name, this.tiers !== null);
-    let count = 0;
-    for (const id of ids) {
-      const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) continue;
-      const decoded = await this.codec.decryptRecord(env, { skipValidation: true, id });
-      if (decoded === null) continue;
-      const record = decoded;
-      const next = transform(record);
-      const nextVersion = (env._v ?? 0) + 1;
-      const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      await this.adapter.put(this.vault, this.name, id, await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0, id));
-      await this._onRecordMutated(id, "put", "cutover");
-      if (this.ledger) {
-        await this.ledger.append({
-          op: "migration",
-          collection: this.name,
-          id,
-          version: nextVersion,
-          actor: this.keyring.userId,
-          payloadHash: "",
-          reason: "schema:coordinated-cutover"
-        }).catch(() => {
-        });
-      }
-      count++;
-    }
-    return count;
+    return applyCutoverTransform({
+      adapter: this.adapter,
+      vault: this.vault,
+      name: this.name,
+      tiers: this.tiers,
+      storeCiphertext: this.storeCiphertext,
+      codec: this.codec,
+      perRecordCek: this.perRecordCek,
+      vdigFields: this.vdigFields,
+      ledger: this.ledger,
+      keyring: this.keyring,
+      resolveRecordCek: this.resolveRecordCek.bind(this),
+      onRecordMutated: this._onRecordMutated.bind(this),
+      envelopePayloadHash: (envelope) => this.strategies.history.envelopePayloadHash(envelope),
+      transform
+    });
   }
   /** @internal Untracked delete body — call {@link delete}, not this. */
   async _deleteInternal(id) {
@@ -4186,7 +4422,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-W7NWQ637.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-N5HGVUGU.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4200,7 +4436,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-6TV3DGO6.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-4XIJSFTT.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4220,7 +4456,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-T3V7XEOB.js");
+      const { resolveStaleMVOnRead } = await import("./stale-K734VACF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4308,8 +4544,11 @@ var Collection = class {
    * **True tx-atomic putMany** — pass `{ atomic: true }` to switch
    * to the  transaction executor: pre-flight CAS against every
    * item's `expectedVersion`, then commit all ops with best-effort
-   * revert on mid-batch failure. Atomic mode throws on failure rather
-   * than returning a mixed-results object.
+   * revert on mid-batch failure. On a store that declares `txAtomic`
+   * the whole batch is instead submitted as ONE `store.tx()` call with
+   * per-leg CAS (#921) — genuinely all-or-nothing, with history/ledger/
+   * change events firing after the batch is durable. Atomic mode throws
+   * on failure rather than returning a mixed-results object.
    *
    * ## Change events
    *
@@ -4334,66 +4573,20 @@ var Collection = class {
     return { ok: failures.length === 0, success, failures };
   }
   /**
-   * Atomic-mode implementation of {@link putMany}. Pre-flights every
-   * `expectedVersion`, executes all puts in declaration order, and
-   * reverts executed ops via the raw adapter on mid-batch failure.
-   * See `runTransaction` for the shared semantics + crash-window caveat.
+   * Atomic-mode implementation of {@link putMany} — both branches live in
+   * `kernel/put-many-atomic.ts`: #921 delegates the batch through ONE
+   * `store.tx()` on a `txAtomic` store when the single-collection
+   * reduction of the #906 gate admits it (store bits + no duplicate ids +
+   * `_txAtomicSafe('put')`); anything else keeps the sequential pre-flight
+   * → execute → best-effort-revert loop.
    *
    * @internal
    */
-  async putManyAtomic(entries) {
-    const priors = /* @__PURE__ */ new Map();
-    for (const [id, , opts] of entries) {
-      if (!priors.has(id)) {
-        priors.set(id, await this.adapter.get(this.vault, this.name, id));
-      }
-      if (opts?.expectedVersion !== void 0) {
-        const env = priors.get(id) ?? null;
-        const actual = env?._v ?? 0;
-        if (actual !== opts.expectedVersion) {
-          throw new ConflictError(
-            actual,
-            `putMany atomic: ${this.vault}/${this.name}/${id} expected v${opts.expectedVersion}, found v${actual}`
-          );
-        }
-      }
-    }
-    const txCtx = this.derivationSource?.createTxContext() ?? null;
-    if (txCtx !== null && this.derivationSource) {
-      this.derivationSource.setActiveTxContext(txCtx);
-    }
-    const localExecuted = [];
-    try {
-      for (const [id, record] of entries) {
-        const entry = {
-          op: { type: "put", vaultName: this.vault, collectionName: this.name, id },
-          priorEnvelope: priors.get(id) ?? null
-        };
-        if (txCtx !== null) txCtx._executed.push(entry);
-        else localExecuted.push(entry);
-        await this.put(id, record);
-      }
-      return { ok: true, success: entries.map(([id]) => id), failures: [] };
-    } catch (err) {
-      const executedForRevert = txCtx !== null ? txCtx._executed : localExecuted;
-      await revertExecuted(executedForRevert, this.adapter);
-      for (const { op } of [...executedForRevert].reverse()) {
-        if (op.vaultName !== this.vault) continue;
-        try {
-          if (op.collectionName === this.name) {
-            await this._invalidateCacheEntry(op.id);
-          } else if (this.derivationSource) {
-            await this.derivationSource.getCollection(op.collectionName)._invalidateCacheEntry(op.id);
-          }
-        } catch {
-        }
-      }
-      throw err;
-    } finally {
-      if (txCtx !== null && this.derivationSource) {
-        this.derivationSource.clearActiveTxContext(txCtx);
-      }
-    }
+  putManyAtomic(entries) {
+    return runPutManyAtomic(
+      { host: this, store: this.adapter, vault: this.vault, name: this.name, derivationSource: this.derivationSource },
+      entries
+    );
   }
   /**
    * Get many records in one call. Returns a `Map<id, T | null>` —
@@ -5373,14 +5566,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-LE54HWSX.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-MH3ON5OL.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-LE54HWSX.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-MH3ON5OL.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5479,11 +5672,33 @@ var Collection = class {
     await this.schemaFence?.assertWritable(this.name);
   }
   // @internal #906 — the two refusals `put()`/`delete()` assert BEFORE anything else: the schema-update gate (an opt-in but persistent `reject` decision) and the schema fence (stale generation → MigrationRequiredError; draining/migrating vault or pending per-collection cutover → SchemaFenceError). Neither lives in the prepare halves, and the atomic commit path calls those directly — so it asserts here, per op, mirroring put()/delete() exactly (the fence does a fresh store read per call, so per-op matches today's cost model). Deliberately NOT moved into the prepare halves: that would double-assert on the OCC path.
+  /**
+   * @internal #931 — the after-write OBSERVERS `put()`/`delete()` fire in
+   * their wrappers (user `onAfterWrite` hooks, then the `afterPut`/
+   * `afterDelete` observe bus), replayed for one atomic-path leg after its
+   * finalize. Neither can refuse a completed write, so since #931 they no
+   * longer gate `_txAtomicSafe`; skipping them silently would still be a
+   * policy hole (forget's subject index and the cross-tab write relay are
+   * both wired this way), so the atomic path calls this per leg. The
+   * WriteEvent is built from the prepared carrier — same prior basis the
+   * wrappers use — and the same re-entrancy guards apply (`runAfter`
+   * suppresses nested hook firing; the bus gate checks `dispatching`).
+   */
+  async _fireAtomicAfterWrite(opType, prepared) {
+    const hooksActive = this.#hooksActive();
+    const busPoint = opType === "put" ? "afterPut" : "afterDelete";
+    const busActive = (this.subsystemBus?.hasHandlers(busPoint) ?? false) && !(this.subsystemBus?.dispatching ?? false);
+    if (!hooksActive && !busActive) return;
+    const base = { vault: this.vault, collection: this.name, userId: this.keyring.userId, timestamp: Date.now(), txId: this.#txIdForHook() };
+    const event = opType === "put" ? { ...base, op: prepared.prior ? "update" : "create", docId: prepared.id, before: prepared.prior?.record ?? null, after: prepared.event, baseVersion: prepared.prior?.version ?? 0, version: prepared.version } : { ...base, op: "delete", docId: prepared.id, before: prepared.existing?.record ?? null, after: null, baseVersion: prepared.existing?.version ?? 0, version: (prepared.existing?.version ?? 0) + 1 };
+    if (hooksActive) await this.writeHooks.runAfter(event);
+    if (busActive) await this.subsystemBus.dispatch(busPoint, event);
+  }
   _txAtomicSafe(opType) {
-    if (this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.#hooksActive() || (this.subsystemBus?.hasHandlers(opType === "put" ? "afterPut" : "afterDelete") ?? false)) return false;
-    return opType === "put" ? Object.keys(this._refs).length === 0 : this.refEnforcer === void 0;
+    if (this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.writeHooks !== void 0 && this.writeHooks.hasBeforeHandlers && !this.writeHooks.suppressed) return false;
+    return opType === "put" ? Object.keys(this._refs).length === 0 : this.refEnforcer === void 0 || !this.refEnforcer._deleteCascadesPossible(this.name);
   }
-  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete deliberately uses blanket `refEnforcer` presence, NOT `refRegistry.getInbound()` — `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) cascades from THREE sources (lookup-ref edges, classic inbound refs, managed links), and only the blanket check is >= as strict as all three. #906: also false while user write-hooks or an `afterPut`/`afterDelete` bus handler are live — note both signals are db-GLOBAL (one `onAfterWrite` anywhere, including the auto-registered cross-tab write relay, keeps every collection on the OCC path) — both fire in `put()`/`delete()`, which the atomic path bypasses (a `beforeWrite` hook can REFUSE a write, so silently skipping them would be a policy hole). See atomic-eligibility.ts.
+  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete (#922) consults the enforcer's `_deleteCascadesPossible(name)` — Vault unions ALL THREE cascade sources `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) fires from (lookup-ref edges, classic inbound refs, managed links); anything narrower (e.g. `getInbound` alone) would admit unsafe atomic deletes, because `_prepareDelete` runs those cascades DURING prepare. #931 narrows #906's hooks blanket: only BEFORE-hooks gate (they can REFUSE a write, which only `put()`/`delete()` honors); after-hooks and the `afterPut`/`afterDelete` observe bus cannot refuse, so the atomic path fires them itself post-finalize via `_fireAtomicAfterWrite` instead of forfeiting the batch (the pre-#931 db-global blanket cost multi-tab write-relay and forget-subject apps the atomic path entirely). See atomic-eligibility.ts.
   _reconcileReadState(patch) {
     if (patch.dictKeyFields) this.dictKeyFields = { ...patch.dictKeyFields, ...this.dictKeyFields };
     if (patch.i18nFields) this.i18nFields = { ...patch.i18nFields, ...this.i18nFields };
@@ -5889,7 +6104,7 @@ var DeferredNumberingStore = class {
     try {
       await this.writeJson(NUMBERING_HEAD_COLLECTION, series, { series, lastSerial: serial, watermark: now.earliest }, headEnv?._v ?? 0);
     } catch (err) {
-      if (err instanceof ConflictError) return [];
+      if (isConflictError(err)) return [];
       throw err;
     }
     for (const { id, entry } of settled) {
@@ -6833,7 +7048,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-CGYC3OH5.js").then(
+  const load = () => engine ??= import("./link-set-2TTP4VLO.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7261,6 +7476,115 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
   reconcileCollectionReadState(coll, vaultCtx, plan, hadI18n, hadLookup);
 }
 
+// src/with-shape/introspection/behaviors.ts
+function buildBehaviorSummary(registries) {
+  return {
+    guards: buildGuardEntries(registries.guards),
+    derivations: buildDerivationEntries(registries.derivations),
+    materializedViews: buildMaterializedViewEntries(registries.materializedViews),
+    overlays: buildOverlayEntries(registries.overlays),
+    satellites: buildSatelliteEntries(registries.satellites)
+  };
+}
+function buildGuardEntries(registry) {
+  if (!registry) return [];
+  const all = registry.all();
+  const used = /* @__PURE__ */ new Set();
+  for (const spec of all) {
+    if (spec.name !== void 0) used.add(spec.name);
+  }
+  const unnamedOccurrence = /* @__PURE__ */ new Map();
+  return all.map((spec) => {
+    let name = spec.name;
+    if (name === void 0) {
+      let occurrence = (unnamedOccurrence.get(spec.collection) ?? 0) + 1;
+      let candidate = `${spec.collection}#${occurrence}`;
+      while (used.has(candidate)) {
+        occurrence++;
+        candidate = `${spec.collection}#${occurrence}`;
+      }
+      unnamedOccurrence.set(spec.collection, occurrence);
+      name = candidate;
+      used.add(name);
+    }
+    return {
+      name,
+      collection: spec.collection,
+      ...spec.frozenFields ? { frozenFields: { fields: spec.frozenFields.fields } } : {},
+      ...spec.amendment ? { amendment: { roles: spec.amendment.roles } } : {}
+    };
+  });
+}
+function buildDerivationEntries(registry) {
+  if (!registry) return [];
+  const all = registry.all();
+  const usedNames = /* @__PURE__ */ new Set();
+  for (const { spec } of all) {
+    if (spec.name !== void 0) usedNames.add(spec.name);
+  }
+  const entries = all.map(({ spec }) => {
+    const outputCollections = Object.values(spec.outputs).map((o) => o.collection);
+    const name = spec.name ?? fallbackDerivationName(outputCollections, spec.source, usedNames);
+    if (spec.name === void 0) usedNames.add(name);
+    const outputs = {};
+    for (const [key, output] of Object.entries(spec.outputs)) {
+      outputs[key] = output.shape === "record" ? { shape: "record", collection: output.collection, ...output.optional !== void 0 ? { optional: output.optional } : {}, ...output.denorm ? { denorm: output.denorm } : {} } : { shape: "array", collection: output.collection, ...output.maxFanout !== void 0 ? { maxFanout: output.maxFanout } : {} };
+    }
+    return {
+      name,
+      source: spec.source,
+      ...spec.sources ? { sources: spec.sources } : {},
+      ...spec.triggerBy ? { triggerBy: spec.triggerBy } : {},
+      ...spec.rollup ? { rollup: { from: spec.rollup.from, key: spec.rollup.key, field: spec.rollup.field } } : {},
+      deterministic: true,
+      outputs,
+      lifecycle: spec.lifecycle,
+      ...spec.strict !== void 0 ? { strict: spec.strict } : {}
+    };
+  });
+  return entries;
+}
+function buildMaterializedViewEntries(registry) {
+  if (!registry) return [];
+  return registry.all().map(({ spec }) => ({
+    name: spec.name,
+    spec: stripFunctions(spec)
+  }));
+}
+function buildOverlayEntries(registry) {
+  if (!registry) return [];
+  return registry.all().map((spec) => ({
+    name: spec.name,
+    base: spec.base,
+    overlay: spec.overlay,
+    shadowField: spec.shadowField,
+    shadowValue: spec.shadowValue,
+    ...spec.mergeMode ? { mergeMode: spec.mergeMode } : {}
+  }));
+}
+function buildSatelliteEntries(registry) {
+  if (!registry) return [];
+  return registry.allSpecs().map((spec) => ({
+    name: spec.satellite,
+    base: spec.base,
+    fields: spec.fields,
+    ...spec.joined !== void 0 ? { joined: spec.joined } : {}
+  }));
+}
+function stripFunctions(value) {
+  if (typeof value === "function") return void 0;
+  if (Array.isArray(value)) return value.map(stripFunctions).filter((v) => v !== void 0);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const stripped = stripFunctions(v);
+      if (stripped !== void 0) out[k] = stripped;
+    }
+    return out;
+  }
+  return value;
+}
+
 // src/with-shape/satellites/registry.ts
 var SatelliteRegistry = class {
   byBase = /* @__PURE__ */ new Map();
@@ -7371,7 +7695,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-LY35EDTJ.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-ORQOQJCS.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7703,6 +8027,21 @@ async function migrateSatelliteCek(name, coll) {
 }
 
 // src/with-shape/schema-update/fence-controller.ts
+function schemaBumpAuditHook(getLedger, actor) {
+  return async (generation) => {
+    const ledger = getLedger();
+    if (!ledger) return;
+    await ledger.append({
+      op: "lifecycle",
+      collection: "",
+      id: "",
+      version: 0,
+      actor,
+      payloadHash: "",
+      reason: `schema:generation-bump=${generation}`
+    });
+  };
+}
 var SchemaFenceController = class {
   #coordination;
   #vault;
@@ -7712,6 +8051,7 @@ var SchemaFenceController = class {
   #staleMs;
   #quiesceTimeoutMs;
   #emit;
+  #auditBump;
   #snapshot = 0;
   #pending = /* @__PURE__ */ new Map();
   constructor(opts) {
@@ -7724,6 +8064,7 @@ var SchemaFenceController = class {
     this.#quiesceTimeoutMs = opts.quiesceTimeoutMs ?? 6e4;
     this.#emit = opts.emit ?? (() => {
     });
+    this.#auditBump = opts.auditBump;
   }
   /** Capture the generation snapshot at vault-open. */
   async init() {
@@ -7786,6 +8127,8 @@ var SchemaFenceController = class {
         this.#pending.clear();
         await this.#setState(nextVersion, "normal");
         this.#snapshot = nextVersion;
+        if (this.#auditBump) await this.#auditBump(nextVersion).catch(() => {
+        });
       }
     );
     return { migrated };
@@ -7873,6 +8216,13 @@ var VaultAttestation = class {
   }
 };
 
+// src/with-shape/introspection/subsystem-matrix.ts
+function buildSubsystemMatrix(strategies, registries) {
+  const matrix = {};
+  for (const key of STRATEGY_KEYS) matrix[key] = strategies[key] !== STRATEGY_DEFAULTS[key];
+  return { ...matrix, ...registries };
+}
+
 // src/kernel/vault.ts
 var COLLECTION_PASSTHROUGH_KEYS = [
   "indexes",
@@ -8118,7 +8468,8 @@ var Vault = class {
       onFlush: () => this.noydb._writeQueueTracker.onFlush(),
       clientId: this.noydb._clientId,
       sessionId: this.noydb._sessionId,
-      emit: (e) => this.emitter.emit("schema:fence-changed", { vault: this.name, ...e })
+      emit: (e) => this.emitter.emit("schema:fence-changed", { vault: this.name, ...e }),
+      auditBump: schemaBumpAuditHook(() => this.getLedgerOrNull(), this.keyring.userId)
     });
     this.emitter = opts.emitter;
     this.onDirty = opts.onDirty;
@@ -8283,7 +8634,7 @@ var Vault = class {
     if (isDictCollectionName(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (collectionName === SEQUENCE_COLLECTION) throw new ReservedCollectionNameError(collectionName);
     if (isLinkCollectionName(collectionName)) throw new ReservedCollectionNameError(collectionName);
-    if (isSecretBearingReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
+    if (isSecretBearingReservedCollection(collectionName) || isManifestReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (this.satelliteRegistry?.byJoined(collectionName)) {
       throw new SatelliteConfigError(`"${collectionName}" is a joined handle \u2014 use vault.joined('${collectionName}'), not vault.collection().`);
     }
@@ -8327,14 +8678,15 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-6RIBIT3I.js");
+          const { persistSchemaIfNeeded } = await import("./register-LHETZRJM.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
             collectionName,
             validator,
             dek,
-            strategies
+            strategies,
+            manifestSync: { getDEK: this.getDEK, lookupDEK: async (name) => this.keyring.deks.get(name), getLedgerOrNull: () => this._getLedgerOrNull() }
           });
           const decision = result.decision ?? { action: "allow" };
           if (decision.action === "cutover") {
@@ -8476,12 +8828,13 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-6RIBIT3I.js")).persistSchemaIfNeeded({
+            await (await import("./register-LHETZRJM.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
               validator,
-              dek
+              dek,
+              manifestSync: { getDEK: this.getDEK, lookupDEK: async (name) => this.keyring.deks.get(name), getLedgerOrNull: () => this._getLedgerOrNull() }
             });
           } catch (err) {
             console.warn(
@@ -8631,7 +8984,7 @@ var Vault = class {
    *
    * Emits no ledger/event itself — its callers (#604's `freezePeriod`, #615's
    * `purgePeriodTargets`) own the audit record. The sweep body is shared via
-   * {@link _purgeMarkersOn}, which #615 also aims at push-only sync targets.
+   * `purgeMarkersOn`, which #615 also aims at push-only sync targets.
    *
    * Purges the local adapter only. Markers already pushed to the vault's
    * push-only (`backup`/`archive`) sync targets are reclaimed by #615's
@@ -8639,25 +8992,7 @@ var Vault = class {
    * them would re-open the resurrection window — the deferred half of #611).
    */
   async _purgeDeleteMarkers(before, collections) {
-    return this._purgeMarkersOn(this.adapter, before, collections);
-  }
-  /**
-   * @internal #615. Sweep delete markers with `_ts < before` off ANY store
-   * (local adapter or a push-only sync target). Returns the count removed.
-   */
-  async _purgeMarkersOn(store, before, collections) {
-    const snapshot = await store.loadAll(this.name);
-    let removed = 0;
-    for (const [coll, records] of Object.entries(snapshot)) {
-      if (collections && !collections.includes(coll)) continue;
-      for (const [id, env] of Object.entries(records)) {
-        if (isDeleteMarker(env) && env._ts < before) {
-          await store.delete(this.name, coll, id);
-          removed++;
-        }
-      }
-    }
-    return removed;
+    return purgeMarkersOn(this.adapter, this.name, before, collections);
   }
   /**
    * @internal #613. Relocate this closed period's in-window records (those
@@ -8683,7 +9018,7 @@ var Vault = class {
   async _purgePeriodTargets(before) {
     const out = [];
     for (const t of this.getPurgeableTargets()) {
-      const purgedCount = await this._purgeMarkersOn(t.store, before);
+      const purgedCount = await purgeMarkersOn(t.store, this.name, before);
       out.push({ ...t.label !== void 0 ? { label: t.label } : {}, role: t.role, purgedCount });
     }
     return out;
@@ -8869,24 +9204,7 @@ var Vault = class {
    * (`'cascade'` default, `'strict'`, `'warn'`).
    */
   link(name, spec) {
-    const a = typeof spec.a === "string" ? spec.a : spec.a.target;
-    const b = typeof spec.b === "string" ? spec.b : spec.b.target;
-    for (const [slot, target] of [["a", a], ["b", b]]) {
-      if (!target || target.startsWith("_") || target.includes("/")) {
-        throw new ValidationError(
-          `vault.link("${name}"): endpoint "${slot}" must be a simple collection name, got "${target}".`
-        );
-      }
-    }
-    const resolved = { a, b, ...spec.onDelete ? { onDelete: spec.onDelete } : {} };
-    const existing = this.linkRegistry.get(name);
-    if (existing) {
-      if (existing.a !== resolved.a || existing.b !== resolved.b || (existing.onDelete ?? "cascade") !== (resolved.onDelete ?? "cascade")) {
-        throw new ValidationError(`vault.link("${name}"): conflicting re-declaration.`);
-      }
-      return;
-    }
-    this.linkRegistry.set(name, resolved);
+    declareLink(this.linkRegistry, name, spec);
   }
   /**
    * Access a declared link set. Throws if `name` was not first
@@ -9176,6 +9494,19 @@ var Vault = class {
   publishRevocationList() {
     return this.attestation.publishRevocationList();
   }
+  /**
+   * @internal #943 — read-only access to this vault's persisted document
+   * signer, for pod export signing. Never mints and does NOT require the
+   * `withAttestation()` opt-in (role-agnostic, pure read): if no signer has
+   * ever been minted, resolves to `null` (unsigned pod) rather than throwing
+   * or minting one. Dynamic-imports `signer.js` (the S4 gate escape hatch —
+   * see `_ensureFenceCoordination` above) since it is a with-* service path.
+   */
+  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+  async _loadPodSigner() {
+    const { loadSigner } = await import("./signer-7KHD4OL2.js");
+    return loadSigner(this.adapter, this.name, this.getDEK);
+  }
   async writeExportAudit(entry) {
     const json = JSON.stringify(entry);
     const envelope = this.encrypted ? await (async () => {
@@ -9230,6 +9561,27 @@ var Vault = class {
   async enforceRefsOnDelete(collectionName, id) {
     return this.linksEnforcer.enforceRefsOnDelete(this.graph, collectionName, id);
   }
+  /**
+   * #922 — can a delete on `collectionName` trigger ANY cross-record work in
+   * `enforceRefsOnDelete` above? Unions ALL THREE of its cascade sources —
+   * lookup-ref edges (`graph.referencingEdgesOf`), classic inbound refs
+   * (`refRegistry.getInbound`), and managed link sets whose either endpoint
+   * is this collection. `Collection._txAtomicSafe('delete')` consults this
+   * instead of the pre-#922 blanket enforcer-presence check: `_prepareDelete`
+   * runs those cascades DURING prepare (not abortable), so a delete may take
+   * the atomic tx path only when all three sources are provably absent.
+   * Registry state only — no store reads, safe to call at commit time.
+   *
+   * @internal
+   */
+  _deleteCascadesPossible(collectionName) {
+    if (this.graph.referencingEdgesOf(collectionName).length > 0) return true;
+    if (this.refRegistry.getInbound(collectionName).length > 0) return true;
+    for (const spec of this.linkRegistry.values()) {
+      if (spec.a === collectionName || spec.b === collectionName) return true;
+    }
+    return false;
+  }
   // ─── Join resolver) ────────────────────
   /**
    * Look up the `RefDescriptor` the left collection declared for a
@@ -9635,7 +9987,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-BWD2ED52.js"),
+      import("./registry-IKUR2MXD.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new GuardRegistry();
@@ -9663,7 +10015,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-RON4WHAP.js"),
+      import("./registry-JRIN447B.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9695,7 +10047,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-MUSL4AW6.js");
+    const { MaterializedViewRegistry } = await import("./registry-AMAZ6QRZ.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9720,7 +10072,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-7Y5WF7GS.js");
+    const { OverlayedViewRegistry } = await import("./registry-CZVINVQH.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9748,6 +10100,21 @@ var Vault = class {
   _getOverlayedViewRegistry() {
     return this.overlayedViewRegistry;
   }
+  /**
+   * Read-only enumeration of the five behavior registries — guards,
+   * derivations, materialized views, overlays, satellites — each entry
+   * carrying its name and the serializable half of its spec (never a
+   * function body). @see with-shape/introspection/behaviors.ts
+   */
+  listBehaviors() {
+    return buildBehaviorSummary({
+      guards: this.guardRegistry,
+      derivations: this.derivationRegistry,
+      materializedViews: this.materializedViewRegistry,
+      overlays: this.overlayedViewRegistry,
+      satellites: this.satelliteRegistry
+    });
+  }
   /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
   _dispatchCtx(source) {
     return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.getLedgerOrNull() ?? void 0, this.keyring.userId) };
@@ -9767,14 +10134,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-FPHKWDWT.js");
+    const { MaterializedViewExecutor } = await import("./executor-3JZ4POTW.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-T3V7XEOB.js");
+    const { clearMVStaleFully } = await import("./stale-K734VACF.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9787,7 +10154,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-IEBLTBCW.js");
+    const { DerivationExecutor } = await import("./executor-S4QIKEHW.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9814,7 +10181,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-273RDMYS.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-T2ZGLQFE.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10041,7 +10408,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-JDUMAF6L.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-PDYL6RWT.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10063,7 +10430,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-JDUMAF6L.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-PDYL6RWT.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10311,7 +10678,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-G3NFEP5L.js");
+    const { dumpVaultSchema } = await import("./walk-MQHYNDLZ.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10351,12 +10718,12 @@ var Vault = class {
       refRegistry: this.refRegistry,
       getDEK: this.getDEK,
       keyring: this.keyring,
-      subsystems: {
+      subsystems: buildSubsystemMatrix(this.strategies, {
         guards: this.guardRegistry !== null,
         derivations: this.derivationRegistry !== null,
         materializedViews: this.materializedViewRegistry !== null,
         overlayViews: this.overlayedViewRegistry !== null
-      },
+      }),
       ...this.vaultMeta !== void 0 ? { vaultMeta: this.vaultMeta } : {},
       mvRegistry: this.materializedViewRegistry,
       overlayRegistry: this.overlayedViewRegistry,
@@ -10407,30 +10774,8 @@ var Vault = class {
    * separate vault instances now.
    */
   async getBundleHandle() {
-    const existing = await this.adapter.get(this.name, "_meta", "handle");
-    if (existing) {
-      try {
-        const parsed = JSON.parse(existing._data);
-        if (parsed !== null && typeof parsed === "object" && "handle" in parsed) {
-          const handle2 = parsed.handle;
-          if (typeof handle2 === "string" && /^[0-9A-HJKMNP-TV-Z]{26}$/.test(handle2)) {
-            return handle2;
-          }
-        }
-      } catch {
-      }
-    }
-    const { generateULID: generateULID2 } = await import("./ulid-PTAIMDG4.js");
-    const handle = generateULID2();
-    const envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: JSON.stringify({ handle })
-    };
-    await this.adapter.put(this.name, "_meta", "handle", envelope);
-    return handle;
+    const { buildBundleHandle } = await import("./bundle-handle-5OUAI7CV.js");
+    return buildBundleHandle(this.adapter, this.name);
   }
   /**
    * Read the owner-curated cover for this vault (or `undefined` if
@@ -10461,7 +10806,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-X7F3TCFV.js");
+    const { dumpVault } = await import("./backup-GAYWQAFN.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10513,7 +10858,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-X7F3TCFV.js");
+    const { loadVault } = await import("./backup-GAYWQAFN.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10545,7 +10890,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-X7F3TCFV.js");
+    const { verifyBackupIntegrity } = await import("./backup-GAYWQAFN.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10763,7 +11108,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-X7F3TCFV.js");
+    const { exportVaultJSON } = await import("./backup-GAYWQAFN.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10879,6 +11224,14 @@ var WriteHookRegistry = class {
   get hasHandlers() {
     return this.#before.length > 0 || this.#after.length > 0;
   }
+  /**
+   * True when any BEFORE hook is registered — the refusal-capable kind. #931:
+   * the atomic-commit eligibility gate keys on this alone; after-hooks are
+   * observers and fire post-finalize on the atomic path instead of gating it.
+   */
+  get hasBeforeHandlers() {
+    return this.#before.length > 0;
+  }
   onBeforeWrite(handler) {
     this.#before.push(handler);
     return () => {
@@ -12652,7 +13005,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-RM7XWQDU.js");
+      const { GuardExecutor } = await import("./executor-CYJQLKKI.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13123,6 +13476,7 @@ var Noydb = class {
         "Noydb.listAccessibleVaults(): a secret (secret) is required when encryption is enabled."
       );
     }
+    const probeSecret = this.options.secret;
     const minRank = ROLE_RANK[options.minRole ?? "client"];
     const universe = await adapter.listVaults();
     const accessible = [];
@@ -13131,10 +13485,16 @@ var Noydb = class {
       try {
         keyring = await loadKeyring(adapter, vault, {
           userId: this.options.user,
-          secret: this.options.secret
+          secret: probeSecret
         });
       } catch (err) {
-        if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError) {
+        if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError || // Mixed universe (#940): a string secret probing an echo keyring
+        // throws EchoCeremonyRequiredError, echo parts probing a standard
+        // keyring throw ValidationError — both from `deriveKekForKeyring`,
+        // both meaning "no accessible key material here", exactly like a
+        // wrong secret. `createNoydb` already rejects a secret/mode shape
+        // mismatch, so neither can be a caller misconfiguration.
+        err instanceof EchoCeremonyRequiredError || err instanceof ValidationError) {
           continue;
         }
         throw err;
@@ -13358,6 +13718,10 @@ var Noydb = class {
   get _store() {
     return this.options.store;
   }
+  /** The default store this instance was opened with (#948). */
+  get store() {
+    return this.options.store;
+  }
   /**
    * Currently-running multi-record transaction, or `null` outside
    * Phase 2. `Collection.dispatchDerivations` consults this so a
@@ -13419,6 +13783,25 @@ var Noydb = class {
     }
     return engine.status();
   }
+  /**
+   * Enumerate the sync targets wired for `vault` (#948) — the primary engine
+   * (keyed by vault name) plus any additional targets (keyed `vault::label`
+   * or `vault::role`). No preset name: a resolved `SyncPolicy` doesn't retain
+   * which preset (if any) produced it.
+   */
+  listSyncTargets(vault) {
+    const targets = [];
+    for (const [key, engine] of this.syncEngines) {
+      if (key === vault || key.startsWith(`${vault}::`)) {
+        targets.push({
+          label: engine.label,
+          role: engine.role,
+          policy: engine.policy ? { push: { mode: engine.policy.push.mode }, pull: { mode: engine.policy.pull.mode } } : void 0
+        });
+      }
+    }
+    return targets;
+  }
   getSyncEngine(vault) {
     const engine = this.syncEngines.get(vault);
     if (!engine) {
@@ -13896,16 +14279,7 @@ var Noydb = class {
       return keyring2;
     }
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
-    let effectiveSecret;
-    if (this.options.secretMode === "managed") {
-      effectiveSecret = await resolveManagedSecret(
-        this.options.store,
-        vault,
-        this.options.sealingKey
-      );
-    } else {
-      effectiveSecret = this.options.secret;
-    }
+    const effectiveSecret = await resolveEffectiveSecret(this.options, this.options.store, vault);
     if (!effectiveSecret) {
       throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
     }
@@ -13914,22 +14288,10 @@ var Noydb = class {
       keyring = await loadKeyring(this.options.store, vault, { userId: this.options.user, secret: effectiveSecret });
     } catch (err) {
       if (err instanceof NoAccessError) {
-        keyring = await createOwnerKeyring(this.options.store, vault, {
-          userId: this.options.user,
-          secret: effectiveSecret,
-          // Managed mode generates 256-bit base64 strings that don't satisfy
-          // the human-secret strength rules (no spaces, no "words").
-          // Skip validation in managed mode — the entropy floor is already
-          // 256 bits by construction.
-          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-        });
+        keyring = await createOwnerKeyring(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
         await this.options.store.delete(vault, "_keyring", this.options.user);
-        keyring = await createOwnerKeyring(this.options.store, vault, {
-          userId: this.options.user,
-          secret: effectiveSecret,
-          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-        });
+        keyring = await createOwnerKeyring(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
       } else {
         throw err;
       }
@@ -13964,33 +14326,9 @@ var Noydb = class {
 };
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
-  const encrypted = options.encrypt !== false;
-  const managed = options.secretMode === "managed";
-  if (options.secret && options.getKeyring) {
-    throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
-  }
-  if (managed) {
-    if (options.secret) {
-      throw new ValidationError(
-        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
-      );
-    }
-    if (options.getKeyring) {
-      throw new ValidationError(
-        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
-      );
-    }
-    if (!options.sealingKey) {
-      throw new ValidationError(
-        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
-      );
-    }
-  }
-  if (encrypted && !managed && !options.secret && !options.getKeyring) {
-    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
-  }
+  validateSecretModeOptions(options);
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-SI2IVBQO.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-67SBPMMH.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14025,4 +14363,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-ZBYFMI6D.js.map
+//# sourceMappingURL=chunk-3CLZY46Y.js.map