@noy-db/hub 0.5.0 → 0.6.0-pre.0

package/dist/{chunk-5UKUOMO6.js → chunk-3CLZY46Y.js}

@@ -1,29 +1,33 @@
+import {
+  hashFields,
+  validateSatelliteDeclaration
+} from "./chunk-HVQGCKY4.js";
 import {
   resolveStaleOnRead
-} from "./chunk-F5UWVF6Z.js";
+} from "./chunk-4HDYQL3J.js";
+import {
+  isManifestReservedCollection
+} from "./chunk-EPFF7LOX.js";
 import {
   LinkIntegrityError,
+  declareLink,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-EBETHILL.js";
-import {
-  hashFields,
-  validateSatelliteDeclaration
-} from "./chunk-FT5Y4VSP.js";
+} from "./chunk-HNHCQ556.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
 import {
   loadFence
-} from "./chunk-WK7ULBTP.js";
+} from "./chunk-MVOWXQHN.js";
 import {
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-6RDTG6E5.js";
+} from "./chunk-ZGGVOADG.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -31,38 +35,41 @@ import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-7P4LL3JH.js";
+} from "./chunk-GS5RT2KK.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-QITP2JGX.js";
+} from "./chunk-PGAPBZEK.js";
 import {
   NO_PORTABILITY
-} from "./chunk-NIKQQXI2.js";
+} from "./chunk-FUHKW252.js";
 import {
   NO_CARGO,
   runDrainBarrier
-} from "./chunk-QTMZDMJ6.js";
+} from "./chunk-DG27IUVI.js";
 import {
-  resolveManagedSecret,
   saveSealedSecret
-} from "./chunk-CLE3TMIS.js";
+} from "./chunk-MC2LFTQM.js";
 import {
+  fallbackDerivationName,
   jsonSchemaToFields
-} from "./chunk-VYYM3MEN.js";
+} from "./chunk-KHKKD62N.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-3LYMOSY7.js";
+} from "./chunk-2LGDCNFJ.js";
+import {
+  loadPersistedSchema
+} from "./chunk-V5C5NNBR.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-NMYH55MW.js";
+} from "./chunk-TLNNHG3A.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-QQL6XPPG.js";
+} from "./chunk-T4GPR2IR.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -86,30 +93,31 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-4MSNAB64.js";
+} from "./chunk-ZXJXDHNK.js";
 import {
   OverlayedCollection
-} from "./chunk-Y2PTKKIN.js";
+} from "./chunk-OF3L2SD6.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
 } from "./chunk-55LKVALY.js";
 import {
   NO_ATTESTATION
-} from "./chunk-IJV56FWY.js";
+} from "./chunk-VJFMXYKP.js";
 import {
   NO_CONSENT
 } from "./chunk-PEOZ34EM.js";
 import {
-  NO_PERIODS
-} from "./chunk-F2WWHKO7.js";
+  NO_PERIODS,
+  purgeMarkersOn
+} from "./chunk-LTU4FLHG.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-SBGXQK5I.js";
+} from "./chunk-JXIDGFKS.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -119,7 +127,7 @@ import {
 import {
   TxContext,
   bestEffortRevert
-} from "./chunk-NWK6SVBM.js";
+} from "./chunk-35EBKWQU.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -127,29 +135,32 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-YA7Y3EZP.js";
+} from "./chunk-XBLKM73C.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-RQILGK3N.js";
+} from "./chunk-NQCNSVGI.js";
 import {
   Query,
   ScanBuilder
-} from "./chunk-QMCWYN6O.js";
+} from "./chunk-3737A6EA.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-XX7YB5BI.js";
+} from "./chunk-P7NGLLUF.js";
 import {
   LazyQuery,
   NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-ALUVACKT.js";
+} from "./chunk-JIUVJ4M7.js";
+import {
+  normalizeIndexDefs
+} from "./chunk-GQ3BX5EA.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -169,7 +180,7 @@ import {
 } from "./chunk-PVEWA2DU.js";
 import {
   dictCollectionName
-} from "./chunk-MPW6AHTC.js";
+} from "./chunk-XB7LUDKM.js";
 import {
   NO_I18N,
   getAtPath,
@@ -177,11 +188,11 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-5EKL6BXI.js";
+} from "./chunk-7G6VDWXB.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-DDB626I7.js";
+} from "./chunk-UHXCLPGC.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -204,7 +215,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-IHYSIPEK.js";
+} from "./chunk-DPJTDNUF.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -219,15 +230,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-FZAP4JNC.js";
+} from "./chunk-RLWY6Z44.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-6PFST3FC.js";
+} from "./chunk-27TCYH6G.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-PWEMRXPO.js";
+} from "./chunk-W3TVWF6N.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -241,10 +252,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-GYJRDALN.js";
+} from "./chunk-3FSX6LDG.js";
 import {
   sha256Hex
-} from "./chunk-V3EGXDFN.js";
+} from "./chunk-24UICKTB.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -253,10 +264,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-V4O6YZSP.js";
+} from "./chunk-RPXL6KSX.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-U2ID5A2I.js";
+} from "./chunk-FAXZQ5UF.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -267,20 +278,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-623QEHDB.js";
+} from "./chunk-FY343IZR.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-EFJAAFBW.js";
+} from "./chunk-NQRJ5AJO.js";
 import {
   encrypt
-} from "./chunk-RPWMDIGK.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -290,6 +301,7 @@ import {
   ConflictError,
   DebugPlaintextError,
   DictKeyInUseError,
+  EchoCeremonyRequiredError,
   ElevationExpiredError,
   ExportCapabilityError,
   FieldNotQueryableError,
@@ -322,7 +334,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
@@ -386,9 +398,91 @@ function resolveStrategies(options) {
   return resolved;
 }
 
+// src/kernel/secret-mode.ts
+function validateSecretModeOptions(options) {
+  const encrypted = options.encrypt !== false;
+  const managed = options.secretMode === "managed";
+  const echo = options.secretMode === "echo";
+  if (options.secret && options.getKeyring) {
+    throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
+  }
+  if (managed) {
+    if (options.secret) {
+      throw new ValidationError(
+        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
+      );
+    }
+    if (options.getKeyring) {
+      throw new ValidationError(
+        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
+      );
+    }
+    if (!options.sealingKey) {
+      throw new ValidationError(
+        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+      );
+    }
+  }
+  if (echo && typeof options.secret === "string") {
+    throw new ValidationError(
+      "secretMode 'echo' requires a structured { prompt, echo, key } secret \u2014 a single string can never unlock an echo vault (AG-1)."
+    );
+  }
+  if (echo && typeof options.secret === "object" && options.secret !== null) {
+    const parts = options.secret;
+    if (typeof parts.prompt !== "string" || typeof parts.echo !== "string" || typeof parts.key !== "string") {
+      throw new ValidationError(
+        "secretMode 'echo' requires a structured secret with all three fields present as strings: prompt, echo, key."
+      );
+    }
+  }
+  if (!echo && options.secret !== void 0 && typeof options.secret !== "string") {
+    throw new ValidationError("A { prompt, echo, key } secret requires secretMode: 'echo'.");
+  }
+  if (!echo && options.deviceSeal !== void 0) {
+    throw new ValidationError("deviceSeal is only meaningful with secretMode: 'echo'.");
+  }
+  if (!echo && options.echoSecretPolicy !== void 0) {
+    throw new ValidationError("echoSecretPolicy is only meaningful with secretMode: 'echo'.");
+  }
+  if (!echo && options.echoMaskHint !== void 0) {
+    throw new ValidationError("echoMaskHint is only meaningful with secretMode: 'echo'.");
+  }
+  if (echo && options.sealingKey !== void 0) {
+    throw new ValidationError(
+      "secretMode 'echo' is mutually exclusive with `sealingKey` \u2014 that provider belongs to managed mode."
+    );
+  }
+  if (echo && options.secret === void 0 && options.getKeyring === void 0) {
+    throw new ValidationError(
+      "secretMode 'echo' requires either a structured secret or a getKeyring ceremony hook."
+    );
+  }
+  if (encrypted && !managed && !options.secret && !options.getKeyring) {
+    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
+  }
+}
+async function resolveEffectiveSecret(options, store, vault) {
+  if (options.secretMode === "managed") {
+    const { resolveManagedSecret } = await import("./managed-secret-EAOYWRYF.js");
+    return resolveManagedSecret(store, vault, options.sealingKey);
+  }
+  return options.secret;
+}
+function ownerKeyringOptions(options, secret) {
+  return {
+    userId: options.user,
+    secret,
+    validate: options.secretMode === "managed" ? false : options.validateSecret === true,
+    ...options.deviceSeal !== void 0 && { deviceSeal: options.deviceSeal },
+    ...options.echoSecretPolicy !== void 0 && { echoSecretPolicy: options.echoSecretPolicy },
+    ...options.echoMaskHint !== void 0 && { echoMaskHint: options.echoMaskHint }
+  };
+}
+
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-AHGFEMFA.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-4SKLSFUG.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -835,6 +929,40 @@ async function countLiveEnvelopes(adapter, vault, name, storeCiphertext) {
   return n;
 }
 
+// src/kernel/cutover-transform.ts
+async function applyCutoverTransform(ctx) {
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  await assertCutoverTierSafe(ctx.adapter, ctx.vault, ctx.name, ctx.tiers !== null);
+  let count = 0;
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env || isTombstone(env, ctx.storeCiphertext) || isDeleteMarker(env)) continue;
+    const decoded = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
+    if (decoded === null) continue;
+    const record = decoded;
+    const next = ctx.transform(record);
+    const nextVersion = (env._v ?? 0) + 1;
+    const cek = ctx.perRecordCek ? await ctx.resolveRecordCek(id) : void 0;
+    const migEnvelope = await ctx.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, ctx.vdigFields !== null ? { id, prev: env } : void 0, id);
+    await ctx.adapter.put(ctx.vault, ctx.name, id, migEnvelope);
+    await ctx.onRecordMutated(id, "put", "cutover");
+    if (ctx.ledger) {
+      await ctx.ledger.append({
+        op: "migration",
+        collection: ctx.name,
+        id,
+        version: nextVersion,
+        actor: ctx.keyring.userId,
+        payloadHash: await ctx.envelopePayloadHash(migEnvelope),
+        reason: "schema:coordinated-cutover"
+      }).catch(() => {
+      });
+    }
+    count++;
+  }
+  return count;
+}
+
 // src/with-lookup/indexing/collection-facade.ts
 function readPersistedValue(record, field) {
   if (!field.includes(".")) return record[field];
@@ -1474,6 +1602,16 @@ async function deriveZodFields(schema) {
   }
   return result;
 }
+async function resolveDescribeFieldIds(store, vaultName, collectionName, getDEK) {
+  let dek;
+  try {
+    dek = await getDEK(collectionName);
+  } catch {
+    return {};
+  }
+  const persisted = await loadPersistedSchema(store, vaultName, collectionName, dek);
+  return persisted?.fieldIds !== void 0 ? { fieldIds: persisted.fieldIds } : {};
+}
 function deriveWidget(opts) {
   if (opts.resolvedWidget !== void 0) return opts.resolvedWidget;
   switch (opts.semanticType) {
@@ -1498,7 +1636,7 @@ function deriveWidget(opts) {
   return "text";
 }
 function buildDescription(input) {
-  const { collection, fieldMeta, moneyFields, dictKeyFields, lookupFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified, taint } = input;
+  const { collection, fieldMeta, moneyFields, dictKeyFields, lookupFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified, taint, fieldIds } = input;
   const lookupFragments = input.viaFragments?.["lookup"]?.lookupFields;
   const blobFragments = input.viaFragments?.["blob"]?.blobFields;
   if (zodFields !== void 0 && Object.keys(zodFields).length > 0 && fieldMeta !== void 0) {
@@ -1665,6 +1803,7 @@ function buildDescription(input) {
     const editable = !isComputed && key !== "id" && blobBlock === void 0;
     const field = {
       key,
+      ...fieldIds?.[key] !== void 0 ? { id: fieldIds[key] } : {},
       type,
       optional: zod?.optional ?? false,
       ...zod?.constraints !== void 0 ? { constraints: zod.constraints } : {},
@@ -2277,7 +2416,7 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-YOQCGUCS.js"));
+var loadComputed = lazy(() => import("./computed-6G5M3UPH.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2378,6 +2517,8 @@ var Collection = class {
    * `null` when no `unique:true` indexes are declared on this collection, or when the collection is in lazy mode (which throws at registration).
    */
   uniqueConstraints;
+  declaredIndexes;
+  // declared index defs, normalized (introspection only)
   /**
    * True once `_idx/*` side-cars have been bulk-loaded into
    * `persistedIndexes`. Flipped by `ensurePersistedIndexesLoaded()` on
@@ -2699,12 +2840,7 @@ var Collection = class {
       );
     }
     if (this.sensitiveFields.size > 0 && opts.indexes) {
-      const indexedFields = /* @__PURE__ */ new Set();
-      for (const def of opts.indexes) {
-        if (typeof def === "string") indexedFields.add(def);
-        else if (Array.isArray(def)) for (const f of def) indexedFields.add(f);
-        else for (const f of def.fields) indexedFields.add(f);
-      }
+      const indexedFields = new Set(normalizeIndexDefs(opts.indexes).flatMap((d) => d.fields));
       const leaked = [...this.sensitiveFields].filter((f) => indexedFields.has(f));
       if (leaked.length > 0) {
         console.warn(
@@ -2808,6 +2944,7 @@ var Collection = class {
       defs: opts.indexes ?? [],
       lazy: this.lazy
     });
+    this.declaredIndexes = normalizeIndexDefs(opts.indexes ?? []);
     this.indexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.persistedIndexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.uniqueConstraints = buildUniqueConstraintSet(this.name, opts.indexes, {
@@ -2838,6 +2975,10 @@ var Collection = class {
   getMeta() {
     return this.meta;
   }
+  getDeclaredIndexes() {
+    return this.declaredIndexes;
+  }
+  // declared index defs, normalized; consumed by walk.ts
   /**
    * Aggregate all collection-level configuration options that are actively set
    * into a {@link CollectionConfig} snapshot. Returns `undefined` when no options
@@ -2933,8 +3074,10 @@ var Collection = class {
       ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
       ...this.classified !== void 0 ? { classified: this.classified.byField } : {},
       ...this.via?.taint !== void 0 ? { taint: this.via.taint } : {},
-      ...this.via ? { viaFragments: this.via.describeFragments() } : {}
+      ...this.via ? { viaFragments: this.via.describeFragments() } : {},
       // #650 Task 7
+      ...await resolveDescribeFieldIds(this.adapter, this.vault, this.name, this.getDEK)
+      // #946
     });
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
@@ -3055,7 +3198,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-JEIXSK5U.js");
+    const { verifyDigestField } = await import("./verify-RO5RTZOJ.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3261,7 +3404,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-U3WO5MYN.js");
+      const { resolveStaleMVOnRead } = await import("./stale-K734VACF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3791,7 +3934,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-VNR3TLBX.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-4XIJSFTT.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3964,7 +4107,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-TKV4UCKB.js");
+    const { dispatchDerivations } = await import("./dispatch-N5HGVUGU.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4008,38 +4151,28 @@ var Collection = class {
     }
   }
   /**
-   * @internal — bulk-rewrite every record through a cutover transform. Raw adapter path (bypasses the write gate + guards — the transform is trusted and runs only during the `migrating` phase). Bumps each record's `_v` and appends a ledger `op:'migration'` entry. #708: refuses BEFORE any rewrite if a live record is elevated (assertCutoverTierSafe) — demote it first.
+   * @internal — bulk-rewrite every record through a cutover transform. Body
+   * lives in `./cutover-transform.js` (kernel-surface line ceiling); this is
+   * a thin context-passing delegator. See {@link applyCutoverTransform} for
+   * the full behavior doc.
    */
   async _applyCutoverTransform(transform) {
-    const ids = await this.adapter.list(this.vault, this.name);
-    await assertCutoverTierSafe(this.adapter, this.vault, this.name, this.tiers !== null);
-    let count = 0;
-    for (const id of ids) {
-      const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) continue;
-      const decoded = await this.codec.decryptRecord(env, { skipValidation: true, id });
-      if (decoded === null) continue;
-      const record = decoded;
-      const next = transform(record);
-      const nextVersion = (env._v ?? 0) + 1;
-      const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      await this.adapter.put(this.vault, this.name, id, await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0, id));
-      await this._onRecordMutated(id, "put", "cutover");
-      if (this.ledger) {
-        await this.ledger.append({
-          op: "migration",
-          collection: this.name,
-          id,
-          version: nextVersion,
-          actor: this.keyring.userId,
-          payloadHash: "",
-          reason: "schema:coordinated-cutover"
-        }).catch(() => {
-        });
-      }
-      count++;
-    }
-    return count;
+    return applyCutoverTransform({
+      adapter: this.adapter,
+      vault: this.vault,
+      name: this.name,
+      tiers: this.tiers,
+      storeCiphertext: this.storeCiphertext,
+      codec: this.codec,
+      perRecordCek: this.perRecordCek,
+      vdigFields: this.vdigFields,
+      ledger: this.ledger,
+      keyring: this.keyring,
+      resolveRecordCek: this.resolveRecordCek.bind(this),
+      onRecordMutated: this._onRecordMutated.bind(this),
+      envelopePayloadHash: (envelope) => this.strategies.history.envelopePayloadHash(envelope),
+      transform
+    });
   }
   /** @internal Untracked delete body — call {@link delete}, not this. */
   async _deleteInternal(id) {
@@ -4289,7 +4422,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-TKV4UCKB.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-N5HGVUGU.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4303,7 +4436,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-VNR3TLBX.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-4XIJSFTT.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4323,7 +4456,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-U3WO5MYN.js");
+      const { resolveStaleMVOnRead } = await import("./stale-K734VACF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5433,14 +5566,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-ZALWKOBC.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-MH3ON5OL.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-ZALWKOBC.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-MH3ON5OL.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -6915,7 +7048,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-7F5ZPDEB.js").then(
+  const load = () => engine ??= import("./link-set-2TTP4VLO.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7343,6 +7476,115 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
   reconcileCollectionReadState(coll, vaultCtx, plan, hadI18n, hadLookup);
 }
 
+// src/with-shape/introspection/behaviors.ts
+function buildBehaviorSummary(registries) {
+  return {
+    guards: buildGuardEntries(registries.guards),
+    derivations: buildDerivationEntries(registries.derivations),
+    materializedViews: buildMaterializedViewEntries(registries.materializedViews),
+    overlays: buildOverlayEntries(registries.overlays),
+    satellites: buildSatelliteEntries(registries.satellites)
+  };
+}
+function buildGuardEntries(registry) {
+  if (!registry) return [];
+  const all = registry.all();
+  const used = /* @__PURE__ */ new Set();
+  for (const spec of all) {
+    if (spec.name !== void 0) used.add(spec.name);
+  }
+  const unnamedOccurrence = /* @__PURE__ */ new Map();
+  return all.map((spec) => {
+    let name = spec.name;
+    if (name === void 0) {
+      let occurrence = (unnamedOccurrence.get(spec.collection) ?? 0) + 1;
+      let candidate = `${spec.collection}#${occurrence}`;
+      while (used.has(candidate)) {
+        occurrence++;
+        candidate = `${spec.collection}#${occurrence}`;
+      }
+      unnamedOccurrence.set(spec.collection, occurrence);
+      name = candidate;
+      used.add(name);
+    }
+    return {
+      name,
+      collection: spec.collection,
+      ...spec.frozenFields ? { frozenFields: { fields: spec.frozenFields.fields } } : {},
+      ...spec.amendment ? { amendment: { roles: spec.amendment.roles } } : {}
+    };
+  });
+}
+function buildDerivationEntries(registry) {
+  if (!registry) return [];
+  const all = registry.all();
+  const usedNames = /* @__PURE__ */ new Set();
+  for (const { spec } of all) {
+    if (spec.name !== void 0) usedNames.add(spec.name);
+  }
+  const entries = all.map(({ spec }) => {
+    const outputCollections = Object.values(spec.outputs).map((o) => o.collection);
+    const name = spec.name ?? fallbackDerivationName(outputCollections, spec.source, usedNames);
+    if (spec.name === void 0) usedNames.add(name);
+    const outputs = {};
+    for (const [key, output] of Object.entries(spec.outputs)) {
+      outputs[key] = output.shape === "record" ? { shape: "record", collection: output.collection, ...output.optional !== void 0 ? { optional: output.optional } : {}, ...output.denorm ? { denorm: output.denorm } : {} } : { shape: "array", collection: output.collection, ...output.maxFanout !== void 0 ? { maxFanout: output.maxFanout } : {} };
+    }
+    return {
+      name,
+      source: spec.source,
+      ...spec.sources ? { sources: spec.sources } : {},
+      ...spec.triggerBy ? { triggerBy: spec.triggerBy } : {},
+      ...spec.rollup ? { rollup: { from: spec.rollup.from, key: spec.rollup.key, field: spec.rollup.field } } : {},
+      deterministic: true,
+      outputs,
+      lifecycle: spec.lifecycle,
+      ...spec.strict !== void 0 ? { strict: spec.strict } : {}
+    };
+  });
+  return entries;
+}
+function buildMaterializedViewEntries(registry) {
+  if (!registry) return [];
+  return registry.all().map(({ spec }) => ({
+    name: spec.name,
+    spec: stripFunctions(spec)
+  }));
+}
+function buildOverlayEntries(registry) {
+  if (!registry) return [];
+  return registry.all().map((spec) => ({
+    name: spec.name,
+    base: spec.base,
+    overlay: spec.overlay,
+    shadowField: spec.shadowField,
+    shadowValue: spec.shadowValue,
+    ...spec.mergeMode ? { mergeMode: spec.mergeMode } : {}
+  }));
+}
+function buildSatelliteEntries(registry) {
+  if (!registry) return [];
+  return registry.allSpecs().map((spec) => ({
+    name: spec.satellite,
+    base: spec.base,
+    fields: spec.fields,
+    ...spec.joined !== void 0 ? { joined: spec.joined } : {}
+  }));
+}
+function stripFunctions(value) {
+  if (typeof value === "function") return void 0;
+  if (Array.isArray(value)) return value.map(stripFunctions).filter((v) => v !== void 0);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const stripped = stripFunctions(v);
+      if (stripped !== void 0) out[k] = stripped;
+    }
+    return out;
+  }
+  return value;
+}
+
 // src/with-shape/satellites/registry.ts
 var SatelliteRegistry = class {
   byBase = /* @__PURE__ */ new Map();
@@ -7453,7 +7695,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-PQSY544J.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-ORQOQJCS.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7785,6 +8027,21 @@ async function migrateSatelliteCek(name, coll) {
 }
 
 // src/with-shape/schema-update/fence-controller.ts
+function schemaBumpAuditHook(getLedger, actor) {
+  return async (generation) => {
+    const ledger = getLedger();
+    if (!ledger) return;
+    await ledger.append({
+      op: "lifecycle",
+      collection: "",
+      id: "",
+      version: 0,
+      actor,
+      payloadHash: "",
+      reason: `schema:generation-bump=${generation}`
+    });
+  };
+}
 var SchemaFenceController = class {
   #coordination;
   #vault;
@@ -7794,6 +8051,7 @@ var SchemaFenceController = class {
   #staleMs;
   #quiesceTimeoutMs;
   #emit;
+  #auditBump;
   #snapshot = 0;
   #pending = /* @__PURE__ */ new Map();
   constructor(opts) {
@@ -7806,6 +8064,7 @@ var SchemaFenceController = class {
     this.#quiesceTimeoutMs = opts.quiesceTimeoutMs ?? 6e4;
     this.#emit = opts.emit ?? (() => {
     });
+    this.#auditBump = opts.auditBump;
   }
   /** Capture the generation snapshot at vault-open. */
   async init() {
@@ -7868,6 +8127,8 @@ var SchemaFenceController = class {
         this.#pending.clear();
         await this.#setState(nextVersion, "normal");
         this.#snapshot = nextVersion;
+        if (this.#auditBump) await this.#auditBump(nextVersion).catch(() => {
+        });
       }
     );
     return { migrated };
@@ -7955,6 +8216,13 @@ var VaultAttestation = class {
   }
 };
 
+// src/with-shape/introspection/subsystem-matrix.ts
+function buildSubsystemMatrix(strategies, registries) {
+  const matrix = {};
+  for (const key of STRATEGY_KEYS) matrix[key] = strategies[key] !== STRATEGY_DEFAULTS[key];
+  return { ...matrix, ...registries };
+}
+
 // src/kernel/vault.ts
 var COLLECTION_PASSTHROUGH_KEYS = [
   "indexes",
@@ -8200,7 +8468,8 @@ var Vault = class {
       onFlush: () => this.noydb._writeQueueTracker.onFlush(),
       clientId: this.noydb._clientId,
       sessionId: this.noydb._sessionId,
-      emit: (e) => this.emitter.emit("schema:fence-changed", { vault: this.name, ...e })
+      emit: (e) => this.emitter.emit("schema:fence-changed", { vault: this.name, ...e }),
+      auditBump: schemaBumpAuditHook(() => this.getLedgerOrNull(), this.keyring.userId)
     });
     this.emitter = opts.emitter;
     this.onDirty = opts.onDirty;
@@ -8365,7 +8634,7 @@ var Vault = class {
     if (isDictCollectionName(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (collectionName === SEQUENCE_COLLECTION) throw new ReservedCollectionNameError(collectionName);
     if (isLinkCollectionName(collectionName)) throw new ReservedCollectionNameError(collectionName);
-    if (isSecretBearingReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
+    if (isSecretBearingReservedCollection(collectionName) || isManifestReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (this.satelliteRegistry?.byJoined(collectionName)) {
       throw new SatelliteConfigError(`"${collectionName}" is a joined handle \u2014 use vault.joined('${collectionName}'), not vault.collection().`);
     }
@@ -8409,14 +8678,15 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-S3ECUZPV.js");
+          const { persistSchemaIfNeeded } = await import("./register-LHETZRJM.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
             collectionName,
             validator,
             dek,
-            strategies
+            strategies,
+            manifestSync: { getDEK: this.getDEK, lookupDEK: async (name) => this.keyring.deks.get(name), getLedgerOrNull: () => this._getLedgerOrNull() }
           });
           const decision = result.decision ?? { action: "allow" };
           if (decision.action === "cutover") {
@@ -8558,12 +8828,13 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-S3ECUZPV.js")).persistSchemaIfNeeded({
+            await (await import("./register-LHETZRJM.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
               validator,
-              dek
+              dek,
+              manifestSync: { getDEK: this.getDEK, lookupDEK: async (name) => this.keyring.deks.get(name), getLedgerOrNull: () => this._getLedgerOrNull() }
             });
           } catch (err) {
             console.warn(
@@ -8713,7 +8984,7 @@ var Vault = class {
    *
    * Emits no ledger/event itself — its callers (#604's `freezePeriod`, #615's
    * `purgePeriodTargets`) own the audit record. The sweep body is shared via
-   * {@link _purgeMarkersOn}, which #615 also aims at push-only sync targets.
+   * `purgeMarkersOn`, which #615 also aims at push-only sync targets.
    *
    * Purges the local adapter only. Markers already pushed to the vault's
    * push-only (`backup`/`archive`) sync targets are reclaimed by #615's
@@ -8721,25 +8992,7 @@ var Vault = class {
    * them would re-open the resurrection window — the deferred half of #611).
    */
   async _purgeDeleteMarkers(before, collections) {
-    return this._purgeMarkersOn(this.adapter, before, collections);
-  }
-  /**
-   * @internal #615. Sweep delete markers with `_ts < before` off ANY store
-   * (local adapter or a push-only sync target). Returns the count removed.
-   */
-  async _purgeMarkersOn(store, before, collections) {
-    const snapshot = await store.loadAll(this.name);
-    let removed = 0;
-    for (const [coll, records] of Object.entries(snapshot)) {
-      if (collections && !collections.includes(coll)) continue;
-      for (const [id, env] of Object.entries(records)) {
-        if (isDeleteMarker(env) && env._ts < before) {
-          await store.delete(this.name, coll, id);
-          removed++;
-        }
-      }
-    }
-    return removed;
+    return purgeMarkersOn(this.adapter, this.name, before, collections);
   }
   /**
    * @internal #613. Relocate this closed period's in-window records (those
@@ -8765,7 +9018,7 @@ var Vault = class {
   async _purgePeriodTargets(before) {
     const out = [];
     for (const t of this.getPurgeableTargets()) {
-      const purgedCount = await this._purgeMarkersOn(t.store, before);
+      const purgedCount = await purgeMarkersOn(t.store, this.name, before);
       out.push({ ...t.label !== void 0 ? { label: t.label } : {}, role: t.role, purgedCount });
     }
     return out;
@@ -8951,24 +9204,7 @@ var Vault = class {
    * (`'cascade'` default, `'strict'`, `'warn'`).
    */
   link(name, spec) {
-    const a = typeof spec.a === "string" ? spec.a : spec.a.target;
-    const b = typeof spec.b === "string" ? spec.b : spec.b.target;
-    for (const [slot, target] of [["a", a], ["b", b]]) {
-      if (!target || target.startsWith("_") || target.includes("/")) {
-        throw new ValidationError(
-          `vault.link("${name}"): endpoint "${slot}" must be a simple collection name, got "${target}".`
-        );
-      }
-    }
-    const resolved = { a, b, ...spec.onDelete ? { onDelete: spec.onDelete } : {} };
-    const existing = this.linkRegistry.get(name);
-    if (existing) {
-      if (existing.a !== resolved.a || existing.b !== resolved.b || (existing.onDelete ?? "cascade") !== (resolved.onDelete ?? "cascade")) {
-        throw new ValidationError(`vault.link("${name}"): conflicting re-declaration.`);
-      }
-      return;
-    }
-    this.linkRegistry.set(name, resolved);
+    declareLink(this.linkRegistry, name, spec);
   }
   /**
    * Access a declared link set. Throws if `name` was not first
@@ -9258,6 +9494,19 @@ var Vault = class {
   publishRevocationList() {
     return this.attestation.publishRevocationList();
   }
+  /**
+   * @internal #943 — read-only access to this vault's persisted document
+   * signer, for pod export signing. Never mints and does NOT require the
+   * `withAttestation()` opt-in (role-agnostic, pure read): if no signer has
+   * ever been minted, resolves to `null` (unsigned pod) rather than throwing
+   * or minting one. Dynamic-imports `signer.js` (the S4 gate escape hatch —
+   * see `_ensureFenceCoordination` above) since it is a with-* service path.
+   */
+  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+  async _loadPodSigner() {
+    const { loadSigner } = await import("./signer-7KHD4OL2.js");
+    return loadSigner(this.adapter, this.name, this.getDEK);
+  }
   async writeExportAudit(entry) {
     const json = JSON.stringify(entry);
     const envelope = this.encrypted ? await (async () => {
@@ -9738,7 +9987,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-BWD2ED52.js"),
+      import("./registry-IKUR2MXD.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new GuardRegistry();
@@ -9766,7 +10015,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-FZOHKUME.js"),
+      import("./registry-JRIN447B.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9798,7 +10047,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-RISV7IDZ.js");
+    const { MaterializedViewRegistry } = await import("./registry-AMAZ6QRZ.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9823,7 +10072,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-ZE35A7WC.js");
+    const { OverlayedViewRegistry } = await import("./registry-CZVINVQH.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9851,6 +10100,21 @@ var Vault = class {
   _getOverlayedViewRegistry() {
     return this.overlayedViewRegistry;
   }
+  /**
+   * Read-only enumeration of the five behavior registries — guards,
+   * derivations, materialized views, overlays, satellites — each entry
+   * carrying its name and the serializable half of its spec (never a
+   * function body). @see with-shape/introspection/behaviors.ts
+   */
+  listBehaviors() {
+    return buildBehaviorSummary({
+      guards: this.guardRegistry,
+      derivations: this.derivationRegistry,
+      materializedViews: this.materializedViewRegistry,
+      overlays: this.overlayedViewRegistry,
+      satellites: this.satelliteRegistry
+    });
+  }
   /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
   _dispatchCtx(source) {
     return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.getLedgerOrNull() ?? void 0, this.keyring.userId) };
@@ -9870,14 +10134,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-M4ZZNX6S.js");
+    const { MaterializedViewExecutor } = await import("./executor-3JZ4POTW.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-U3WO5MYN.js");
+    const { clearMVStaleFully } = await import("./stale-K734VACF.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9890,7 +10154,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-TI64S4LE.js");
+    const { DerivationExecutor } = await import("./executor-S4QIKEHW.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9917,7 +10181,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WYXO6QQT.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-T2ZGLQFE.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10144,7 +10408,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WMO3Q3O5.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-PDYL6RWT.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10166,7 +10430,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WMO3Q3O5.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-PDYL6RWT.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10414,7 +10678,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-BF36V4SR.js");
+    const { dumpVaultSchema } = await import("./walk-MQHYNDLZ.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10454,12 +10718,12 @@ var Vault = class {
       refRegistry: this.refRegistry,
       getDEK: this.getDEK,
       keyring: this.keyring,
-      subsystems: {
+      subsystems: buildSubsystemMatrix(this.strategies, {
         guards: this.guardRegistry !== null,
         derivations: this.derivationRegistry !== null,
         materializedViews: this.materializedViewRegistry !== null,
         overlayViews: this.overlayedViewRegistry !== null
-      },
+      }),
       ...this.vaultMeta !== void 0 ? { vaultMeta: this.vaultMeta } : {},
       mvRegistry: this.materializedViewRegistry,
       overlayRegistry: this.overlayedViewRegistry,
@@ -10510,30 +10774,8 @@ var Vault = class {
    * separate vault instances now.
    */
   async getBundleHandle() {
-    const existing = await this.adapter.get(this.name, "_meta", "handle");
-    if (existing) {
-      try {
-        const parsed = JSON.parse(existing._data);
-        if (parsed !== null && typeof parsed === "object" && "handle" in parsed) {
-          const handle2 = parsed.handle;
-          if (typeof handle2 === "string" && /^[0-9A-HJKMNP-TV-Z]{26}$/.test(handle2)) {
-            return handle2;
-          }
-        }
-      } catch {
-      }
-    }
-    const { generateULID: generateULID2 } = await import("./ulid-PTAIMDG4.js");
-    const handle = generateULID2();
-    const envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: JSON.stringify({ handle })
-    };
-    await this.adapter.put(this.name, "_meta", "handle", envelope);
-    return handle;
+    const { buildBundleHandle } = await import("./bundle-handle-5OUAI7CV.js");
+    return buildBundleHandle(this.adapter, this.name);
   }
   /**
    * Read the owner-curated cover for this vault (or `undefined` if
@@ -10564,7 +10806,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-ENTZYW37.js");
+    const { dumpVault } = await import("./backup-GAYWQAFN.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10616,7 +10858,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-ENTZYW37.js");
+    const { loadVault } = await import("./backup-GAYWQAFN.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10648,7 +10890,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-ENTZYW37.js");
+    const { verifyBackupIntegrity } = await import("./backup-GAYWQAFN.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10866,7 +11108,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-ENTZYW37.js");
+    const { exportVaultJSON } = await import("./backup-GAYWQAFN.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -12763,7 +13005,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-YBK3I2OT.js");
+      const { GuardExecutor } = await import("./executor-CYJQLKKI.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13234,6 +13476,7 @@ var Noydb = class {
         "Noydb.listAccessibleVaults(): a secret (secret) is required when encryption is enabled."
       );
     }
+    const probeSecret = this.options.secret;
     const minRank = ROLE_RANK[options.minRole ?? "client"];
     const universe = await adapter.listVaults();
     const accessible = [];
@@ -13242,10 +13485,16 @@ var Noydb = class {
       try {
         keyring = await loadKeyring(adapter, vault, {
           userId: this.options.user,
-          secret: this.options.secret
+          secret: probeSecret
         });
       } catch (err) {
-        if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError) {
+        if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError || // Mixed universe (#940): a string secret probing an echo keyring
+        // throws EchoCeremonyRequiredError, echo parts probing a standard
+        // keyring throw ValidationError — both from `deriveKekForKeyring`,
+        // both meaning "no accessible key material here", exactly like a
+        // wrong secret. `createNoydb` already rejects a secret/mode shape
+        // mismatch, so neither can be a caller misconfiguration.
+        err instanceof EchoCeremonyRequiredError || err instanceof ValidationError) {
           continue;
         }
         throw err;
@@ -13469,6 +13718,10 @@ var Noydb = class {
   get _store() {
     return this.options.store;
   }
+  /** The default store this instance was opened with (#948). */
+  get store() {
+    return this.options.store;
+  }
   /**
    * Currently-running multi-record transaction, or `null` outside
    * Phase 2. `Collection.dispatchDerivations` consults this so a
@@ -13530,6 +13783,25 @@ var Noydb = class {
     }
     return engine.status();
   }
+  /**
+   * Enumerate the sync targets wired for `vault` (#948) — the primary engine
+   * (keyed by vault name) plus any additional targets (keyed `vault::label`
+   * or `vault::role`). No preset name: a resolved `SyncPolicy` doesn't retain
+   * which preset (if any) produced it.
+   */
+  listSyncTargets(vault) {
+    const targets = [];
+    for (const [key, engine] of this.syncEngines) {
+      if (key === vault || key.startsWith(`${vault}::`)) {
+        targets.push({
+          label: engine.label,
+          role: engine.role,
+          policy: engine.policy ? { push: { mode: engine.policy.push.mode }, pull: { mode: engine.policy.pull.mode } } : void 0
+        });
+      }
+    }
+    return targets;
+  }
   getSyncEngine(vault) {
     const engine = this.syncEngines.get(vault);
     if (!engine) {
@@ -14007,16 +14279,7 @@ var Noydb = class {
       return keyring2;
     }
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
-    let effectiveSecret;
-    if (this.options.secretMode === "managed") {
-      effectiveSecret = await resolveManagedSecret(
-        this.options.store,
-        vault,
-        this.options.sealingKey
-      );
-    } else {
-      effectiveSecret = this.options.secret;
-    }
+    const effectiveSecret = await resolveEffectiveSecret(this.options, this.options.store, vault);
     if (!effectiveSecret) {
       throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
     }
@@ -14025,22 +14288,10 @@ var Noydb = class {
       keyring = await loadKeyring(this.options.store, vault, { userId: this.options.user, secret: effectiveSecret });
     } catch (err) {
       if (err instanceof NoAccessError) {
-        keyring = await createOwnerKeyring(this.options.store, vault, {
-          userId: this.options.user,
-          secret: effectiveSecret,
-          // Managed mode generates 256-bit base64 strings that don't satisfy
-          // the human-secret strength rules (no spaces, no "words").
-          // Skip validation in managed mode — the entropy floor is already
-          // 256 bits by construction.
-          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-        });
+        keyring = await createOwnerKeyring(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
         await this.options.store.delete(vault, "_keyring", this.options.user);
-        keyring = await createOwnerKeyring(this.options.store, vault, {
-          userId: this.options.user,
-          secret: effectiveSecret,
-          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
-        });
+        keyring = await createOwnerKeyring(this.options.store, vault, ownerKeyringOptions(this.options, effectiveSecret));
       } else {
         throw err;
       }
@@ -14075,33 +14326,9 @@ var Noydb = class {
 };
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
-  const encrypted = options.encrypt !== false;
-  const managed = options.secretMode === "managed";
-  if (options.secret && options.getKeyring) {
-    throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
-  }
-  if (managed) {
-    if (options.secret) {
-      throw new ValidationError(
-        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
-      );
-    }
-    if (options.getKeyring) {
-      throw new ValidationError(
-        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
-      );
-    }
-    if (!options.sealingKey) {
-      throw new ValidationError(
-        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
-      );
-    }
-  }
-  if (encrypted && !managed && !options.secret && !options.getKeyring) {
-    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
-  }
+  validateSecretModeOptions(options);
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-M7REIE7H.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-67SBPMMH.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14136,4 +14363,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-5UKUOMO6.js.map
+//# sourceMappingURL=chunk-3CLZY46Y.js.map