@noy-db/hub 0.7.0 → 0.8.0-pre.0

package/dist/with-shape/introspection/types.d.ts

@@ -46,6 +46,16 @@ export interface FieldDescriptor {
     readonly optional?: boolean;
     /** Foreign-key target as `<collection>.<field>` when declared. */
     readonly references?: string;
+    /**
+     * Read-shape sensitivity, declared as `FieldMeta.bulk` (#1363). Present only
+     * when the collection is live in this process (the declaration lives in the
+     * `fieldMeta` channel, which is not persisted with the schema).
+     *
+     * ⚠️ Telemetry, never a control: it tells a coverage sensor which
+     * collections have a corpus worth accounting for. Against an insider holding
+     * the device and local keys it prevents nothing — key custody does.
+     */
+    readonly bulk?: 'sensitive';
 }
 export interface CollectionStats {
     readonly records: number;
@@ -113,6 +123,23 @@ export interface CollectionDescriptor {
     readonly stats?: CollectionStats;
     readonly meta?: CollectionMeta;
     readonly config?: CollectionConfig;
+    /**
+     * #1447 — fields the datastore itself computes or resolves, as
+     * `field → the via brands covering it` (`money`, `computed`, `i18n`,
+     * `lookup`, `geo`, `classified`, `blob`). Absent when the collection
+     * declares no via pipeline.
+     *
+     * Exists so a consumer can gate documentation against what the vault
+     * actually enforces. The reported case: a rulebook described three
+     * vault-computed fields as app-owned — the UNDERSTATING direction, which is
+     * silent, because it produces app-side reimplementation of a guarantee that
+     * already exists rather than a missing behaviour someone trips over.
+     *
+     * ⛔ Brand and field only. A binding's CONFIGURATION is deliberately absent:
+     * a dump saying "this field is classified, sensitivity pii" is a map of the
+     * columns worth attacking, in an artefact that by design leaves the vault.
+     */
+    readonly via?: Record<string, readonly string[]>;
 }
 export interface MaterializedViewDescriptor {
     readonly sources: ReadonlyArray<string>;
@@ -134,8 +161,37 @@ export interface InternalCollectionStats {
     readonly records: number;
     readonly bytes: number;
 }
+/**
+ * A report section `dumpSchema()` is capable of emitting (#1447).
+ *
+ * ⛔ CAPABILITY OF THE EMITTER, NEVER CONTENT OF THIS DUMP. `reports` lists
+ * what this hub *would* have reported, not what it found — a vault that
+ * genuinely declares no via fields still lists `'via'`.
+ *
+ * That distinction is the entire point. A content-based list reintroduces the
+ * ambiguity it exists to remove: a consumer could not tell "no via fields
+ * here" from "this hub cannot report them", which is exactly how a
+ * documentation gate switching to the live report passes VACUOUSLY on a hub
+ * too old to answer. Measured by a consumer attempting that adoption.
+ */
+export type SnapshotReport = 'via' | 'stats';
 export interface VaultSchemaSnapshot {
-    readonly _noydb_snapshot: 1;
+    readonly _noydb_snapshot: 2;
+    /**
+     * Which report sections this snapshot's emitter can produce (#1447).
+     *
+     * Check this before concluding anything from an ABSENT section:
+     *
+     * ```ts
+     * if (!snap.reports.includes('via')) throw new Error('hub cannot report via')
+     * // only now is a missing `via` key evidence that a collection declares none
+     * ```
+     *
+     * Required, and required deliberately: an optional field would leave
+     * `undefined` meaning "old emitter", which is the same ambiguity one level up.
+     * Every snapshot states what it can say.
+     */
+    readonly reports: readonly SnapshotReport[];
     readonly vault: string;
     readonly emittedAt: string;
     readonly subsystems: Record<string, boolean>;

package/dist/with-shape/links/vault-facade.d.ts

@@ -16,7 +16,7 @@
  */
 import { type RefDescriptor, type RefViolation, type RefRegistry } from '../../kernel/refs.js';
 import { type LinkSpec, type LinkSetHandle } from './names.js';
-import type { JoinableSource } from '../../kernel/query/index.js';
+import type { JoinableSource } from '../../kernel/query/relate/join.js';
 import type { Collection } from '../../kernel/collection.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { TxContext } from '../../with-commit/tx/transaction.js';

package/dist/with-store/partitioned/index.d.ts

@@ -0,0 +1,337 @@
+/**
+ * Partitioned collections — the union read path and the declaration surface
+ * (#1342, ADR 0007 "partitioning is collection-shaped").
+ *
+ * ## What was ruled, and what that left to build
+ *
+ * ADR 0007 ruled **NO** on lifting a partition value into a storage key or
+ * into cleartext envelope metadata: it is a permanent per-record
+ * classification handed to the backend, and it widens `@noy-db/hub/to` across
+ * every `to-*` adapter and the conformance kit to buy a win on one read path.
+ * `NoydbStore.listPage` is untouched by this file, and must stay untouched.
+ *
+ * It ruled instead that **a partition IS a collection**. The store already
+ * sees collection names in cleartext — `listPage(vault, collection, cursor,
+ * limit)` takes the name as a parameter — so `invoices@FY2026-Q1` prunes for
+ * free: `listPage` never fetches an excluded partition because it is never
+ * asked to. No seam change, no new leak class, and partition = collection =
+ * DEK makes it a REAL boundary rather than an advisory one (per-collection
+ * wrapping, #1004): a principal granted only Q1 cannot decrypt Q2, and a
+ * closed period's DEK can be archived or dropped outright — something a
+ * scoped predicate can never do.
+ *
+ * The honest cost of that ruling was three missing pieces. This module is
+ * them:
+ *
+ *   1. **a cross-collection union read path** — there was none, so a query
+ *      spanning four quarters meant running four and merging by hand;
+ *   2. **cheap partition enumeration** — `vault.collections()` is
+ *      `adapter.loadAll(vault)`, the WHOLE vault snapshot, so even LISTING
+ *      partitions cost a full load;
+ *   3. **a declaration** binding a set of collections into one logical
+ *      collection with a partition key, so a `where` on that key can prune.
+ *
+ * ## Where the win actually is
+ *
+ * `collection.query()` runs over an already-decrypted in-memory cache with
+ * hash / sorted / compound dispatch in front of it (#1344, #1345), so pruning
+ * there is strictly weaker than an index that already ships. `scan()` is the
+ * prize: every page is DECRYPTED, so a partition never fetched is a page
+ * never decrypted. {@link PartitionedScan} is where the measured win lives;
+ * {@link PartitionedQuery} exists because a union that only streams is not a
+ * union read path.
+ *
+ * ## Why this is a free function and not `vault.partitioned()`
+ *
+ * `check-architecture`'s kernel-surface ratchet leaves `vault.ts` one line of
+ * headroom, and a service that re-couples itself into the kernel is exactly
+ * what that ratchet exists to catch. It is also not a `with*()` factory: once
+ * ADR 0007 removed the storage-layout policy (there is no key prefixing to
+ * configure — the partition is a collection), nothing is left to opt into.
+ * What remains is a query-shaped helper over collections the caller already
+ * owns, so it is a plain function, tree-shaken when unused.
+ *
+ * ## The immutability precondition, stated once
+ *
+ * ⛔ **A record's partition key must be immutable.** If a record can be edited
+ * from one partition to another, a scope derived at plan time and a scope
+ * derived at read time can disagree, and the difference is silently missing
+ * rows. {@link PartitionedCollection.put} routes on `record[key]` and will
+ * happily write the same id into two partitions if the key changes; it does
+ * not police this, because it cannot see the prior value without reading
+ * every partition — which is the cost the whole design exists to avoid.
+ */
+import type { Collection } from '../../kernel/collection.js';
+import type { Vault } from '../../kernel/vault.js';
+import type { Operator } from '../../kernel/query/predicate.js';
+import type { OrderBy } from '../../kernel/query/builder.js';
+import type { QueryExplanation } from '../../kernel/query/relate/explain.js';
+import { ScanBuilder } from '../../kernel/query/scan-builder.js';
+import type { ScanPageProvider } from '../../kernel/query/scan-builder.js';
+import type { ReduceResult, ReduceSpec } from '../../with-lookup/reduce/reduction.js';
+import type { PartitionScope } from '../../kernel/query/relate/partition.js';
+/**
+ * The collection holding one registry record per partitioned logical
+ * collection. A normal, ENCRYPTED collection — the partition list is record
+ * content, not a record id, so declaring a partition set adds no cleartext
+ * channel of its own. (The partition VALUES do become collection names, and
+ * that exposure is ADR 0007's deliberate, developer-visible trade; this
+ * registry does not widen it.)
+ */
+export declare const PARTITION_REGISTRY_COLLECTION = "_partition_sets";
+/** How a partition value becomes a collection name. */
+export type PartitionNamer = (logicalName: string, partition: string) => string;
+/** The default: `invoices` + `FY2026-Q1` → `invoices@FY2026-Q1`. */
+export declare const defaultPartitionNamer: PartitionNamer;
+export interface PartitionSpec<T> {
+    /** The logical collection name. Never itself a stored collection. */
+    readonly name: string;
+    /**
+     * The field whose value names the partition. ⛔ Must be immutable per
+     * record — see this module's header.
+     */
+    readonly key: keyof T & string;
+    /**
+     * Partition values known to the caller. Merged with whatever the registry
+     * already holds, so a caller may declare none and rely on the registry, or
+     * declare the full set and never write one.
+     */
+    readonly partitions?: readonly string[];
+    /** Override the partition → collection-name mapping. */
+    readonly namer?: PartitionNamer;
+    /**
+     * Options passed to every member `vault.collection()` — indexes, refs,
+     * schema. Identical across partitions by construction: they are one logical
+     * collection, and a per-partition shape would make the union unsound.
+     */
+    readonly collectionOptions?: unknown;
+}
+/**
+ * Bind a set of collections into one partitioned logical collection.
+ *
+ * ```ts
+ * const invoices = partitioned<Invoice>(vault, {
+ *   name: 'invoices',
+ *   key: 'period',
+ *   partitions: ['FY2026-Q1', 'FY2026-Q2', 'FY2026-Q3', 'FY2026-Q4'],
+ * })
+ *
+ * await invoices.put('inv-1', { id: 'inv-1', period: 'FY2026-Q1', amount: 100 })
+ *
+ * // reads ONE collection — the other three are never asked for
+ * const q1 = await invoices.query().where('period', '==', 'FY2026-Q1').all()
+ *
+ * // reads all four, merged, sorted and paged AFTER the union
+ * const top = await invoices.query().orderBy('amount', 'desc').limit(10).all()
+ * ```
+ */
+export declare function partitioned<T>(vault: Vault, spec: PartitionSpec<T>): PartitionedCollection<T>;
+export declare class PartitionedCollection<T> {
+    readonly name: string;
+    readonly key: string;
+    private readonly vault;
+    private readonly namer;
+    private readonly collectionOptions;
+    private readonly declared;
+    /**
+     * Session cache of the REGISTRY's partition list — deliberately not of the
+     * merged set. The two are different questions and conflating them cost a
+     * red test: `ensurePartition` must persist a partition the caller DECLARED
+     * but never wrote, and a cache of the merged set makes every declared value
+     * look already-known, so the registry stays empty and a later session that
+     * declares nothing enumerates nothing.
+     */
+    private stored;
+    constructor(vault: Vault, spec: PartitionSpec<T>);
+    /** The member collection name for a partition value. */
+    collectionNameOf(partition: string): string;
+    /** The member `Collection` for one partition. */
+    partition(value: string): Collection<T>;
+    /**
+     * The declared partition set, in declaration order.
+     *
+     * ⭐ **This is the "cheap enumeration" half of #1342, and cheap means a
+     * measured thing.** `vault.collections()` is `adapter.loadAll(vault)` — the
+     * whole vault snapshot, every collection, every envelope — so enumerating
+     * twelve quarters cost a full load before this existed. Here it is ONE
+     * record read out of {@link PARTITION_REGISTRY_COLLECTION}, and zero reads
+     * once the session has resolved it.
+     * `__tests__/partitioned-collection.test.ts` asserts the `loadAll` count is
+     * zero rather than trusting the sentence.
+     */
+    partitions(): Promise<readonly string[]>;
+    /**
+     * Declare a partition, persisting it so a later session enumerates it
+     * without the caller re-declaring. Idempotent, and keyed on what the
+     * REGISTRY holds rather than on what this handle declared.
+     */
+    ensurePartition(value: string): Promise<void>;
+    private loadStored;
+    /**
+     * Write a record into the partition its key names, declaring that partition
+     * if it is new.
+     *
+     * Throws when `record[key]` is not a string — a partition value names a
+     * collection, and routing a record to a partition derived by coercion is
+     * how a record ends up somewhere no query will look for it.
+     */
+    put(id: string, record: T): Promise<void>;
+    /** A union query across the member collections, pruned by the predicate. */
+    query(): PartitionedQuery<T>;
+    /**
+     * A union scan across the member collections, pruned by the predicate.
+     * Pages are decrypted, so an excluded partition is decryption never paid.
+     */
+    scan(opts?: {
+        pageSize?: number;
+    }): PartitionedScan<T>;
+    /** @internal — the normalizer for clause shapes, and the union's legs. */
+    _registryName(): string;
+    private registry;
+}
+/** `record[partitionKey]` was absent, empty, or not a string. */
+export declare class PartitionKeyError extends Error {
+    constructor(collection: string, key: string, value: unknown);
+}
+/**
+ * One recorded builder call, replayed onto each in-scope member's own
+ * builder.
+ *
+ * ⭐ **Replay, not re-implementation.** The alternative was to build `Clause`
+ * objects here, which would have meant a second copy of `Query.where()`'s
+ * normalization — the `matches` lowering (#1357), the subquery resolution
+ * (#1351), the Via posture gate and the operand rewrite. A second copy is a
+ * second thing to drift. Instead every leg is a real `Query` / `ScanBuilder`
+ * that normalized the call itself, and the PRUNING reads the normalized
+ * `Clause[]` back off one of them — so the clause the pruner classifies is
+ * byte-identical to the clause the executor evaluates.
+ */
+type Step<T> = {
+    readonly kind: 'where';
+    readonly field: string;
+    readonly op: Operator;
+    readonly value: unknown;
+} | {
+    readonly kind: 'filter';
+    readonly fn: (record: T) => boolean;
+};
+/**
+ * A union query across a partitioned collection's members.
+ *
+ * **Filtering runs per leg; ordering and paging run AFTER the union** — the
+ * same shape `orderBy('client.name')` needed when the sort moved after the
+ * join legs (#1337). A `limit` is deliberately NOT pushed down: the top ten
+ * of the union is not the top ten of any one leg, and a leg-local limit would
+ * be correct only for an unordered query, which is the case nobody writes.
+ */
+export declare class PartitionedQuery<T> {
+    private readonly col;
+    private readonly steps;
+    private readonly orderBys;
+    private readonly limitN;
+    private readonly offsetN;
+    constructor(col: PartitionedCollection<T>, steps: readonly Step<T>[], orderBys: readonly OrderBy[], limitN: number | undefined, offsetN: number);
+    private with;
+    where(field: keyof T & string, op: Operator, value: unknown): PartitionedQuery<T>;
+    filter(fn: (record: T) => boolean): PartitionedQuery<T>;
+    orderBy(field: keyof T & string, direction?: 'asc' | 'desc'): PartitionedQuery<T>;
+    limit(n: number): PartitionedQuery<T>;
+    offset(n: number): PartitionedQuery<T>;
+    /** The pruning decision for this query, and the set it was taken against. */
+    scope(): Promise<{
+        declared: readonly string[];
+        scope: PartitionScope;
+    }>;
+    /**
+     * The matched rows, unordered and unpaged — the set every reduce-shaped
+     * terminal reports over, matching `Query.count()`'s rule that orderBy /
+     * limit / offset describe a page and a reduction is not paginated.
+     */
+    private matched;
+    /** The union, sorted then paged. */
+    all(): Promise<T[]>;
+    first(): Promise<T | null>;
+    count(): Promise<number>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Promise<ReduceResult<Spec>>;
+    /**
+     * The plan, with the partition decision as its first line:
+     *
+     * ```
+     * partitions partitions: 1 of 12 scanned [partitions:pruned] -- key "period"; FY2026-Q1
+     * source snapshot (no indexes) [source] rows=500
+     * where period == "FY2026-Q1" [scan] rows=500
+     * ```
+     *
+     * ⭐ The dispatch label is decided by {@link resolvePartitionScope} — the
+     * SAME call the executor makes, not a mirror of it. `explain.ts`'s header
+     * warns that its index dispatch mirrors `candidateRecords`; #1375 deleted
+     * one such mirror, and a partition dispatch would have been a third site.
+     *
+     * The nodes after the partition line are the FIRST in-scope member's own
+     * explanation. Every member runs the same plan over the same shape, so one
+     * leg's nodes describe them all; the partition line is what says how many
+     * legs there are.
+     */
+    explain(): Promise<QueryExplanation>;
+}
+/**
+ * A union scan across a partitioned collection's members — **the path where
+ * pruning pays.**
+ *
+ * Each page is fetched through the member collection's `listPage`, which
+ * DECRYPTS it. An excluded partition is therefore not merely a store call
+ * skipped, it is every envelope in that partition never decrypted. That is
+ * the whole return on ADR 0007, and `__tests__/partitioned-scan-cost.test.ts`
+ * measures it rather than asserting it.
+ *
+ * The builder records `where`/`filter` and only materializes a
+ * {@link ScanBuilder} at the terminal, because the partition set cannot be
+ * decided before the predicate is known — a provider fixed at `scan()` time
+ * would already have committed to every partition.
+ */
+export declare class PartitionedScan<T> {
+    private readonly col;
+    private readonly steps;
+    private readonly pageSize;
+    constructor(col: PartitionedCollection<T>, steps: readonly Step<T>[], pageSize: number);
+    where(field: keyof T & string, op: Operator, value: unknown): PartitionedScan<T>;
+    filter(fn: (record: T) => boolean): PartitionedScan<T>;
+    /** The pruning decision for this scan, and the set it was taken against. */
+    scope(): Promise<{
+        declared: readonly string[];
+        scope: PartitionScope;
+    }>;
+    /**
+     * The union as a single {@link ScanBuilder} — so `.aggregate()`,
+     * `.groupBy()` and `for await` come from the streaming machinery that
+     * already exists, at its existing O(reducers) memory bound, rather than
+     * from a second implementation of it.
+     */
+    builder(): Promise<ScanBuilder<T>>;
+    [Symbol.asyncIterator](): AsyncIterator<T>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Promise<ReduceResult<Spec>>;
+    /**
+     * **ASYNC here, unlike `Query.toArray()` (#1413).** Same method name, a
+     * different contract, because the surface underneath differs: this one
+     * genuinely fetches across every partition leg, so it genuinely awaits. `Query`'s terminal reads an
+     * already-decrypted in-memory cache and returns `T[]` synchronously.
+     */
+    toArray(): Promise<T[]>;
+}
+/**
+ * Walk a list of member collections as ONE paged stream.
+ *
+ * The composite cursor is `"<memberIndex>|<memberCursor>"`. Two properties
+ * make it safe to hand back to a consumer that stores it:
+ *
+ *   - it is opaque in exactly the way a store's own cursor is — the member
+ *     cursor is passed through verbatim and never parsed;
+ *   - a member's LAST page returns a cursor pointing at the NEXT member with
+ *     an empty inner cursor, so exhaustion is detected once, not per page.
+ *
+ * ⚠️ A member that returns an empty page with a non-null cursor is walked
+ * again rather than treated as exhausted — the store contract explicitly
+ * allows a store to return fewer items than the limit while more exist.
+ */
+export declare function unionPageProvider<T>(members: readonly Collection<T>[]): ScanPageProvider<T>;
+export {};

package/dist/with-sync/change-broadcast.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Cross-tab / cross-process change signals for `.live()` — #1362.
+ *
+ * A live query is in-process only: a write in tab A leaves tab B's `.live()`
+ * showing the old rows until B happens to read again. This module closes that
+ * without an external coordinator: every locally-committed change posts a
+ * compact ADDRESS on a channel named per store, and every listening instance
+ * re-reads that address **through its own keyring** and re-fires the live
+ * queries that touch it.
+ *
+ * ## The zero-knowledge constraint is the feature
+ *
+ * The frame is `{ vault, collection, id, ts }` and nothing else. No record, no
+ * field, no ciphertext, no key, not even the VERB — see below. Encryption
+ * happens in hub before any store, and a broadcast channel is **not a store**:
+ * it is a side channel with no authentication and no access control, so it is
+ * treated as untrusted in BOTH directions.
+ *
+ *   - **Untrusted egress** — only the address leaves. A peer that should not
+ *     be able to read a record learns, at most, that a record at that address
+ *     changed. `change-broadcast.test.ts` asserts on the exact bytes posted and
+ *     fails if anything resembling record content ever appears in them; that
+ *     test is the thing that catches a future change which starts sending
+ *     payloads.
+ *   - **Untrusted ingress** — the frame carries no `action`. A peer's claim
+ *     "this was a delete" is not evidence, and it is free not to need it: the
+ *     receiver re-reads the address and decides the verb from what IT can
+ *     decrypt. So a hostile or buggy peer on the channel can cost a wasted
+ *     re-read, and cannot make a receiver report a state its own store does
+ *     not hold.
+ *
+ * ## Why the receiver re-reads rather than patches
+ *
+ * #1341's `LiveMaintainer` patches a result set from a delta it TRUSTS —
+ * trustworthy because it was derived from a local write the same process
+ * observed, with the record in hand. A remote signal is a different animal: it
+ * says only "id X in collection Y changed", and the receiving instance has not
+ * decrypted the new record and knows neither the before nor the after state.
+ * Feeding it to the maintainer as if it were a local delta would patch a set
+ * from an address. So a remote-origin change re-reads and re-runs: the
+ * `ChangeEvent` it produces is tagged `remote: true`, and `Collection`'s query
+ * source hands the live query NO delta for such an event — which the maintainer
+ * already understands as "rebuild from scratch", the pre-#1341 behaviour.
+ *
+ * ## Transport
+ *
+ * `BroadcastChannel` when the host has one (browsers, Node >= 18,
+ * Deno, Bun) — feature-detected at enable time, never assumed. With no channel
+ * the whole feature is an inert no-op and behaviour is exactly what it is
+ * today. Any other host transport (Electron IPC, a worker `MessagePort`, a
+ * test bus) is supported by passing a `channel` that satisfies `TabChannel`.
+ */
+import type { TabChannel } from './tab-coordination.js';
+import type { ChangeEvent } from '../kernel/types.js';
+/**
+ * The frame on the wire. `kind` discriminates it from any other traffic
+ * sharing the channel; `origin` identifies the sender so a channel that echoes
+ * to itself cannot feed an instance its own signal.
+ *
+ * ⛔ **Do not add a field carrying record state to this interface.** Not the
+ * record, not a field of it, not a hash of it, not the verb. Everything here
+ * is an ADDRESS plus routing. The test asserting on the posted bytes is what
+ * holds the line; it will fail loudly, which is the point.
+ */
+export interface ChangeSignal {
+    readonly kind: 'noydb:change';
+    /** Sending instance's id — an incoming frame with our own id is ignored. */
+    readonly origin: string;
+    readonly vault: string;
+    readonly collection: string;
+    readonly id: string;
+    /** Sender's wall clock at post time. Diagnostic only; never compared for ordering. */
+    readonly ts: number;
+}
+export interface ChangeBroadcastOptions {
+    /**
+     * Host-provided transport. Supply this for a host with no
+     * `BroadcastChannel` (Electron IPC, a worker `MessagePort`, a test bus) or to
+     * take ownership of the channel's lifetime. Default: an inline
+     * `BroadcastChannel` if the host has one, else nothing at all.
+     */
+    readonly channel?: TabChannel;
+    /**
+     * Discriminator for the default channel name — `noydb:change:<storeId>`.
+     *
+     * ⚠️ Defaults to `store.name`, which is the backend KIND ('memory', 'file',
+     * 'idb'), not a per-dataset identity: two different IndexedDB databases both
+     * reporting `'idb'` would share one channel and re-read each other's
+     * addresses (harmless — a miss costs one read that finds nothing — but
+     * wasteful). Pass a `storeId` that names the DATASET whenever a host can
+     * open more than one.
+     */
+    readonly storeId?: string;
+    /** This instance's id. Default: a random one. */
+    readonly originId?: string;
+    /** Clock for the frame's `ts`. Default: `Date.now`. */
+    readonly now?: () => number;
+}
+/** The slice of `Noydb` this needs. Structural, so there is no import cycle. */
+export interface ChangeBroadcastHost {
+    on(event: 'change', handler: (e: ChangeEvent) => void): void;
+    off(event: 'change', handler: (e: ChangeEvent) => void): void;
+    /** @internal Store backend name, for the default channel name. */
+    readonly _storeName: string | undefined;
+    /** @internal Re-read one address through this instance's own keyring. */
+    _applyRemoteSignal(vault: string, collection: string, id: string): Promise<void>;
+}
+/**
+ * An inline `BroadcastChannel` wrapper, or `undefined` when the host has none.
+ *
+ * ⚠️ Deliberately does NOT gate on `window`, and that asymmetry with
+ * `defaultChannel()` is the cross-process half of this feature, not an
+ * oversight. That gate exists because a presence HEARTBEAT and a Web-Locks role
+ * ELECTION are browser-tab concepts that should not start running in Node; a
+ * change signal is the opposite — Node workers and Electron processes sharing a
+ * store are exactly the case #1362 names, and gating on `window` would silently
+ * exclude them.
+ */
+export declare function defaultChangeChannel(name: string): TabChannel | undefined;
+/** Channel name for a store. One namespace per store so unrelated datasets never cross-signal. */
+export declare function changeChannelName(storeId: string): string;
+/**
+ * The relay itself: local change out as an address, remote address in as a
+ * re-read. Started by {@link enableChangeBroadcast}.
+ */
+export declare class ChangeBroadcast {
+    #private;
+    constructor(host: ChangeBroadcastHost, channel: TabChannel, opts: {
+        originId: string;
+        now: () => number;
+        ownsChannel: boolean;
+    });
+    get originId(): string;
+    start(): void;
+    dispose(): void;
+}
+/**
+ * Opt in to cross-tab / cross-process live-query reactivity.
+ *
+ * ```ts
+ * const stop = enableChangeBroadcast(db, { storeId: 'invoices-2026' })
+ * // …a put in another tab now re-fires this tab's `.live()` queries…
+ * stop.dispose()
+ * ```
+ *
+ * Opt-in on purpose: it is a side channel, and a host that does not want one
+ * gets exactly today's behaviour by not calling this. **With no channel
+ * available it is also a no-op** — it returns a disposable that does nothing,
+ * never throws, and leaves in-process reactivity untouched.
+ */
+export declare function enableChangeBroadcast(host: ChangeBroadcastHost, opts?: ChangeBroadcastOptions): {
+    dispose: () => void;
+};

package/dist/withdraw-accessible-5NZUPAVA.js

@@ -0,0 +1,27 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-S57HTZ6X.js";
+import "./chunk-WNJ4AVGE.js";
+import "./chunk-HBPPGWUM.js";
+import "./chunk-IUWCVHQ7.js";
+import "./chunk-KJFW62P4.js";
+import "./chunk-SEE332EV.js";
+import "./chunk-6QSQQLSE.js";
+import "./chunk-DE4DH2RZ.js";
+import "./chunk-LQ4ZHOKP.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-UYB234ZR.js";
+import "./chunk-ODVPTDPK.js";
+import "./chunk-244VXYPG.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-5NZUPAVA.js.map

package/dist/withdraw-accessible-5NZUPAVA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}