@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/kernel/types.d.ts

@@ -30,6 +30,7 @@ import type { ArchiveStrategy } from '../with-fork/archive/index.js';
 import type { IndexingStrategy } from '../with-lookup/indexing/strategy.js';
 import type { ReduceStrategy } from '../with-lookup/reduce/strategy.js';
 import type { ConsentStrategy } from '../with-audit/consent/strategy.js';
+import type { CoverageEvent, CoverageStrategy } from '../port/with/coverage-strategy.js';
 import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { TransactionsStrategy } from '../with-commit/tx/strategy.js';
@@ -67,7 +68,7 @@ import type { FormatsStrategy } from '../port/with/formats-strategy.js';
 import type { NoydbMesh } from '../port/by/types.js';
 import type { ScriptWarning } from '../port/with/i18n-strategy.js';
 import type { ViaDescriptor } from './via/index.js';
-import type { EnclaveKey, EchoSecretParts } from './enclave/index.js';
+import type { EnclaveKey, EchoSecretParts } from '../capsule/index.js';
 import type { NoydbDeviceSeal } from '../port/with/device-seal-strategy.js';
 export type { EchoSecretParts };
 /** Format version for encrypted record envelopes. */
@@ -162,13 +163,34 @@ export type Permission = 'rw' | 'ro';
  * `'*'` is the wildcard collection matching all collections in the vault.
  */
 export type Permissions = Record<string, Permission>;
-/** The encrypted wrapper stored by stores. Stores only ever see this. */
-export interface EncryptedEnvelope {
+/**
+ * The wrapper stored by stores. Stores only ever see this.
+ *
+ * ⚠️ **`_iv`/`_data` are OPTIONAL, and that is a capsule contract, not a
+ * convenience** (#15). An *enclave* capsule (the default, `enclave-aes`)
+ * always writes both; an *exclave* capsule stores a plaintext row and has no
+ * ciphertext body at all, so it writes neither.
+ *
+ * **Absence and `''` mean the same thing: no sealed body.** That equivalence
+ * is not new — a tombstone, a delete marker (`_del`) and a plaintext
+ * collection have carried `_iv: ''` since the format's first version, and
+ * {@link hasSealedBody} has always been the question callers ask. Widening
+ * only lets a capsule omit the keys instead of emptying them; every existing
+ * envelope on disk keeps its exact bytes and reads back identically.
+ *
+ * Consequently NOTHING here is a wire-format change, and `NOYDB_FORMAT_VERSION`
+ * does not move. What changed is that every READER must now cope with absence
+ * — which is the whole point, since the store contract at `@noy-db/hub/to` is
+ * what an exclave's rows travel through.
+ */
+export interface Envelope {
     readonly _noydb: typeof NOYDB_FORMAT_VERSION;
     readonly _v: number;
     readonly _ts: string;
-    readonly _iv: string;
-    readonly _data: string;
+    /** Body IV. Absent (≡ `''`) when there is no sealed body — see the interface doc. */
+    readonly _iv?: string;
+    /** Body ciphertext, or plaintext JSON on an unencrypted collection. Absent ≡ `''`. */
+    readonly _data?: string;
     /** User who created this version (unencrypted metadata). */
     readonly _by?: string;
     /**
@@ -277,6 +299,22 @@ export interface EncryptedEnvelope {
      */
     readonly _del?: true;
 }
+/**
+ * The former name of {@link Envelope}, kept as an exact alias.
+ *
+ * ⚠️ **It is an ALIAS, not a narrower type** — `EncryptedEnvelope._data` is
+ * `string | undefined` here too. Declaring it as a body-required subtype was
+ * considered and rejected: it would have let every existing hub reader keep
+ * compiling untouched, which is precisely the bug — a store handing back an
+ * exclave row would then fail at runtime in 43 files that the compiler had
+ * declared safe.
+ *
+ * Retiring the name is a 0.9 seam decision, not a 0.8 one: it is published
+ * from the root barrel and from `@noy-db/hub/to`, so removing it is breaking
+ * for every satellite that binds the store contract. It stays for the whole
+ * 0.8 line.
+ */
+export type EncryptedEnvelope = Envelope;
 /** Spine policy for one digest-only classified field — the enclave-consumable
  *  projection of a ClassifiedFieldSpec (the enclave never imports with-*). */
 export interface VdigFieldPolicy {
@@ -404,6 +442,7 @@ export type IndexFieldName<T, S extends keyof T = never, Q extends keyof T & str
 export type IndexDefFor<F extends string> = F | {
     readonly fields: readonly F[];
     readonly unique?: boolean;
+    readonly kind?: 'hash' | 'sorted';
 } | readonly F[];
 /**
  * The type of the `sensitive` collection option, conditional on whether the
@@ -849,7 +888,7 @@ export type RecoveryEnrollment = {
  * (LUKS pattern). Adding or removing a slot is a constant-time keyring
  * write — no DEK re-keying required.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Tier 2 — Authenticate (multi-slot)
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Tier 2 — Authenticate (multi-slot)
  */
 /**
  * Shared fields across all authenticator slot variants. The variant
@@ -1528,6 +1567,14 @@ export interface ChangeEvent {
     readonly collection: string;
     readonly id: string;
     readonly action: 'put' | 'delete';
+    /**
+     * True when this change was produced by APPLYING another tab's or process's
+     * signal rather than by a write here (#1362). Two consumers read it:
+     * `ChangeBroadcast` never re-posts one (echo suppression), and the query
+     * source hands the live query NO delta for one — a remote address is not a
+     * trustworthy delta, so the live query re-runs instead of patching.
+     */
+    readonly remote?: boolean;
 }
 export interface NoydbEventMap {
     'change': ChangeEvent;
@@ -1585,6 +1632,16 @@ export interface NoydbEventMap {
      * index mirror may have drifted. Operators reconcile via
      * `collection.reconcileIndex(field)`.
      */
+    /**
+     * A principal's estimated COVERAGE of a `bulk: 'sensitive'` collection
+     * crossed a declared threshold (`withCoverage()`, #1363). Fires at most once
+     * per threshold per `(principal, vault, collection)`.
+     *
+     * ⛔ A SIGNAL, never a refusal — the read it reports has already been
+     * served, and no refusal path exists by design (#1251 §3: a refusal at a
+     * boundary is a threshold the reader can binary-search).
+     */
+    'coverage:threshold': CoverageEvent;
     'index:write-partial': {
         vault: string;
         collection: string;
@@ -1592,6 +1649,37 @@ export interface NoydbEventMap {
         action: 'put' | 'delete';
         error: Error;
     };
+    /**
+     * #1358 — a `unique` index collision that was DETECTED rather than
+     * prevented. Emitted only by a CRDT collection, which is the one mode where
+     * prevention is not available: two replicas that are offline from each
+     * other can both accept the same value, and no local check can see the
+     * other's write. So the write is never refused, BOTH records are kept (as
+     * CRDT convergence requires), and the collision is reported here — when it
+     * is created, and again when a later session first sees the two records
+     * together (the merge point).
+     *
+     * The guarantee a consumer may rely on is therefore: uniqueness within what
+     * this writer could see at write time, plus detection when the replicas
+     * meet. Nothing stronger.
+     *
+     * `error` is a `UniqueConstraintError` (`kernel/errors.ts`) carrying the
+     * same `collection` / `recordId` / `fields` / `conflictingId` as the
+     * duplicate `put()` would have thrown on a non-CRDT collection — so a
+     * handler can treat it with the code it already has for that error.
+     * Eager, lazy and tiered collections PREVENT instead and never emit this.
+     */
+    'unique:violation': {
+        vault: string;
+        collection: string;
+        /** The record that arrived second (locally — replicas need not agree on order). */
+        id: string;
+        /** The constrained field tuple; more than one field means a compound unique. */
+        fields: readonly string[];
+        /** The record already holding the value. Both are still readable. */
+        conflictingId: string;
+        error: Error;
+    };
     /**
      * emitted by `Collection.ensurePersistedIndexesLoaded()`
      * once per field on first lazy-mode query when
@@ -2493,6 +2581,23 @@ export interface NoydbOptions {
      * @internal
      */
     readonly consentStrategy?: ConsentStrategy;
+    /**
+     * tree-shake seam — optional read-coverage SENSOR. Pass `withCoverage()`
+     * from `@noy-db/hub/coverage` to account how much of a `bulk: 'sensitive'`
+     * collection each principal has ever decrypted, and to emit
+     * `'coverage:threshold'` when a declared coverage threshold is crossed.
+     *
+     * ⛔⛔ TELEMETRY, NOT A CONTROL. Against an insider holding the device and
+     * local keys it prevents nothing — they hold the DEK. It makes bulk
+     * extraction visible early, attributable and loud. The remediation is key
+     * custody (tiers, per-collection DEKs). It never refuses a read.
+     *
+     * When omitted, `NO_COVERAGE` resolves no observer at all: the decrypt path
+     * holds `undefined` and the sensor's code never reaches the bundle.
+     *
+     * @internal
+     */
+    readonly coverageStrategy?: CoverageStrategy;
     /**
      * tree-shake seam — optional periods strategy. Pass
      * `withPeriods()` from `@noy-db/hub/periods` to enable
@@ -2839,7 +2944,7 @@ export interface NoydbOptions {
      *     takes an {@link EchoSecretParts} struct instead of a plain
      *     string (spec design-history/2026-08-02-echo-secret-design.md, #940).
      *
-     * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
+     * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
      */
     readonly secretMode?: 'standard' | 'echo' | 'managed';
     /**
@@ -2984,7 +3089,7 @@ export interface NoydbOptions {
      */
     readonly onInvalidKey?: 'error' | 'reset';
     /**
-     * Enable the cover service (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`).
+     * Enable the cover service (`https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md`).
      * Pass `true` for the default schema (every standard field, 256 KB
      * icon cap, 200-char text cap), or a `CoverSchema` to narrow what
      * the owner can set. Off by default — vaults written by hubs

package/dist/kernel/validation.d.ts

@@ -68,6 +68,12 @@ export interface SecretPolicy {
      * {@link assertStrongSecret} dispatches on — `ok: true` accepts;
      * `ok: false` throws `WeakSecretError` with the supplied reason.
      *
+     * ⚠️ Also supply `suggestion` on a rejection (#1430). Because this
+     * knob replaces every default rule, the hub's built-in remediation
+     * copy no longer describes anything true about your vault — so it is
+     * deliberately NOT used here. Omitting `suggestion` yields a bare
+     * `Weak secret (<reason>).`, which is less helpful but never wrong.
+     *
      */
     readonly customValidator?: (phrase: string) => SecretValidationResult;
 }
@@ -80,6 +86,19 @@ export type SecretValidationResult = {
     readonly reason: WeakSecretReason;
     readonly minimum?: number;
     readonly got?: number;
+    /**
+     * Remediation copy for THIS failure, overriding the hub's built-in
+     * `SUGGESTIONS` map (#1430).
+     *
+     * Only a {@link SecretPolicy.customValidator} has any business
+     * setting it: the built-in copy describes the hub's default rules
+     * ("lowercase letters and single spaces", "at least 6 words"), and
+     * a vault that replaced those rules gets advice contradicting the
+     * format it actually accepts. Supply the copy your rules justify —
+     * and note that a validator returning no `suggestion` produces a
+     * bare `Weak secret (<reason>).` rather than false advice.
+     */
+    readonly suggestion?: string;
 };
 /**
  * Thrown by `assertStrongSecret()` and by every hub ingress
@@ -88,8 +107,15 @@ export type SecretValidationResult = {
  */
 export declare class WeakSecretError extends NoydbError {
     readonly reason: WeakSecretReason;
+    /**
+     * Remediation copy. Empty string when no truthful advice was
+     * available — a `customValidator` rejected the phrase and supplied
+     * none, so the hub has no rules to describe (#1430). Never populated
+     * with the built-in copy in that case: wrong advice is worse than
+     * none, especially for a vault whose own credentials violate it.
+     */
     readonly suggestion: string;
-    constructor(reason: WeakSecretReason, suggestion: string);
+    constructor(reason: WeakSecretReason, suggestion?: string);
 }
 /**
  * Inspect a phrase against the format rules and return a structured
@@ -97,15 +123,6 @@ export declare class WeakSecretError extends NoydbError {
  * result to {@link assertStrongSecret} for the throwing flavour.
  */
 export declare function validateSecret(s: string, opts?: SecretPolicy): SecretValidationResult;
-/**
- * Throw {@link WeakSecretError} when the phrase fails. Used by
- * `createOwnerKeyring`, `grant`, and `rotateSecret` at ingress.
- *
- * Pass `{ allowWeakSecret: true }` to bypass — intended for test
- * fixtures, CLI scripts, and dev environments. The override never
- * loosens the cryptographic key derivation; it only relaxes the
- * structural-strength gate.
- */
 export declare function assertStrongSecret(s: string, opts?: SecretPolicy & {
     allowWeakSecret?: boolean;
 }): void;

package/dist/kernel/vault.d.ts

@@ -5,7 +5,7 @@ import type { NoydbStore, EncryptedEnvelope, HistoryConfig, ExportStreamOptions,
 import type { Noydb } from './noydb.js';
 import type { IssueDelegationOptions, DelegationToken } from '../with-party/team/delegation.js';
 import { Collection } from './collection.js';
-import type { JoinableSource } from './query/index.js';
+import type { JoinableSource } from './query/relate/join.js';
 import type { OnDirtyCallback } from './collection.js';
 import type { UnlockedKeyring, PodRecipient } from '../with-party/team/keyring.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
@@ -44,7 +44,7 @@ import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import { type BehaviorSummary } from '../with-shape/introspection/behaviors.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
 import { type PeriodRecord, type PeriodReopenEvent, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
-import { type EnclaveKey } from './enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import type { RecipientSealer } from '../with-party/team/managed-secret.js';
 import { type ExportBlobsOptions, type ExportBlobsHandle } from '../with-shape/blobs/export-blobs.js';
 import { type CompactRunOptions, type CompactionResult } from '../with-shape/blobs/blob-compaction.js';
@@ -52,7 +52,7 @@ import { type IssueMagicLinkGrantOptions, type MagicLinkGrantRecord } from '../w
 import { CustodyApi } from '../with-party/custody/index.js';
 import { SchemaFenceController } from '../with-shape/schema-update/fence-controller.js';
 import { type FenceDoc } from '../with-shape/schema-update/fence.js';
-import type { RevocationList } from '@noy-db/attestation';
+import type { RevocationList } from './attestation-types.js';
 import type { DumpSchemaOptions, VaultSchemaSnapshot, SchemaIntrospection } from '../with-shape/introspection/types.js';
 import type { VaultIntrospectState } from '../with-shape/introspection/walk.js';
 import type { VaultMeta } from '../with-shape/introspection/meta.js';
@@ -366,6 +366,8 @@ export declare class Vault {
      * (it will read fresh on next open). Mirrors `#runCutoverTransform`'s guard.
      */
     _applyRemoteWrite(collectionName: string, docId: string, action: 'put' | 'delete'): Promise<void>;
+    /** @internal #1362 — verb-less variant; no-op for a collection this instance never opened. */
+    _applyRemoteSignal(collectionName: string, docId: string): Promise<void>;
     /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session.
      *  #650 Task 4 (#647): a reserved-lookup collection has no `Collection` instance — instead, refresh
      *  its already-warmed `LookupHandle._syncCache` (membership/altIndex/snapshot reads never see a
@@ -1000,11 +1002,12 @@ export declare class Vault {
     /**
      * Manual re-materialize for a single registered MV (`refresh: 'manual'` consumers,
      * stale-bit recovery on vault reopen, bulk-recompute escape hatch after a strategy
-     * change). Returns `{ written, deleted, failed, residueUndecodable, residueDeclined }` (`deleted`
-     * always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
+     * change). Returns `{ written, skipped, deleted, failed, residueUndecodable, residueDeclined }` (`skipped` counts rows whose
+     * content was unchanged since the last refresh, #1418; `deleted` always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
      */
     refreshView(name: string): Promise<{
         written: number;
+        skipped: number;
         deleted: number;
         failed: number;
         residueUndecodable: string[];
@@ -1276,6 +1279,8 @@ export declare class Vault {
     listPeriodReopens(name: string, options?: PeriodScope): Promise<readonly PeriodReopenEvent[]>;
     /** @internal — called by the gate bus before put/delete. */
     _assertTsWritable(existing: PeriodGuardPrior | null, incoming: Record<string, unknown> | null, collection?: string): Promise<void>;
+    /** #1439 — sync superset test: could a closed period govern this row? See `periods/vault-facade.ts#couldGovern`. @internal */
+    _periodCouldGovern(record?: Record<string, unknown>): boolean;
     /** List all collection names in this vault. */
     collections(): Promise<string[]>;
     /**
@@ -1361,7 +1366,7 @@ export declare class Vault {
      * single, already-opened `Vault` instance so the
      * bundle writer can snapshot it without holding a `Noydb` reference.
      *
-     * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
+     * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md
      */
     getCover(opts?: {
         readonly locale?: string;

package/dist/kernel/via/compose.d.ts

@@ -43,6 +43,9 @@ export interface MergedViaFields {
      *  entries (#650 Task 2) — a SEPARATE binding from i18n; `dictKey()`/`staticDict()` stay
      *  routed onto `dictKeyFields`/the i18n binding (the alias, unchanged). */
     readonly lookupFields: Record<string, LookupDescriptor> | undefined;
+    /** `via(geo())` entries (#1355). Like `computedFields`, there is no `geoFields` sugar
+     *  KEY to merge against — geo is declared through the `via()` composer only. */
+    readonly geoFields: Record<string, ViaDescriptor> | undefined;
 }
 /**
  * Merge `viaFields` (the {@link via} composer) with the money/i18n sugar

package/dist/kernel/via/index.d.ts

@@ -145,6 +145,38 @@ export interface NoydbVia {
      * the already-dressed value.
      */
     presentLate?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>;
+    /**
+     * #1416 — declare that BOTH `present` and `presentLate` return synchronously,
+     * so `ViaPipeline.presentSync` may fold this binding.
+     *
+     * ⛔ DECLARED, NOT SNIFFED, and that is the whole point. A plain function
+     * returning a promise is indistinguishable at runtime from one that does not
+     * (`constructor.name === 'AsyncFunction'` catches `async () =>` and nothing
+     * else), so detecting it would silently mis-classify the one binding that
+     * matters. Calling an async hook and discarding its promise is worse still:
+     * side effects run and a rejection surfaces unhandled.
+     *
+     * Defaults to `false` — a binding that has not thought about it is skipped by
+     * the sync path and dressed only on the async one, which is today's
+     * behaviour. `money` and `computed` set it; `i18n` and `lookup` cannot.
+     */
+    readonly presentIsSync?: boolean;
+    /**
+     * #1447 — the fields this binding covers, ENUMERATED.
+     *
+     * ⛔ `covers()` is a PREDICATE and cannot answer this. Iterating a
+     * collection's declared fields and asking "do you cover this?" misses every
+     * field that exists only in the binding's own config — a
+     * `computed({ mode: 'virtual' })` field is exactly that, and it is the case
+     * that motivated the report: a consumer's rulebook described three vault
+     * -computed fields as app-owned, and a predicate-based check would not have
+     * caught it because it never thinks to ask about them.
+     *
+     * Optional, and absence is honest rather than empty: a binding that has not
+     * declared its set is omitted from the report rather than reported as
+     * covering nothing.
+     */
+    readonly coveredFields?: readonly string[];
     /** Returns an opaque clause payload when this binding covers `field`, else undefined. */
     buildClause?(field: string, op: string, value: unknown): unknown | undefined;
     /** Evaluate a payload produced by buildClause against a raw stored value. */
@@ -198,6 +230,30 @@ export interface NoydbVia {
     erase?(ctx: ViaEraseCtx): Promise<ViaEraseReport>;
     describeFragment?(): Record<string, unknown>;
 }
+/**
+ * An `indexProbe` result asking for a UNION of sorted-index PREFIX slices
+ * (#1355), rather than the single equality operand `indexProbe` yielded
+ * before it existed.
+ *
+ * ⛔ IT IS A SUPERSET, AND THAT IS THE CONTRACT. `candidateRecords()`
+ * (`kernel/query/builder.ts`) narrows to the union of these prefixes and
+ * then keeps the clause in `remainingClauses`, so the binding's own
+ * `evaluateClause` still runs over every candidate. A binding returning
+ * this promises only that no MATCHING record lies outside the union —
+ * never that every record inside it matches. Return `undefined` instead
+ * of a cover you cannot prove complete: an over-wide cover costs
+ * predicate calls, a short one silently drops rows.
+ *
+ * Generic on purpose. Geo is today's only producer, but nothing here is
+ * spatial — any binding whose stored key is an ordered string with a
+ * meaningful prefix (a path, a bucketed timestamp) can use it.
+ */
+export interface ViaPrefixProbe {
+    readonly kind: 'via-prefixes';
+    readonly prefixes: readonly string[];
+}
+/** Runtime predicate for a {@link ViaPrefixProbe} handed back by `indexProbe`. */
+export declare function isViaPrefixProbe(x: unknown): x is ViaPrefixProbe;
 /** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */
 export type ViaBinder = (config: unknown) => NoydbVia;
 /** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */

package/dist/kernel/via/pipeline.d.ts

@@ -110,6 +110,54 @@ export declare class ViaPipeline {
         asHandles: boolean;
     }): Promise<Record<string, unknown>>;
     present(record: Record<string, unknown>, ctx: ViaReadCtx): Promise<Record<string, unknown>>;
+    /**
+     * #1416 — the synchronous half of {@link present}, for the query path.
+     *
+     * `query().toArray()` is SYNCHRONOUS (#1413) and so cannot await `present`,
+     * which is why it ran `decodeResults` instead — money's stored→canonical
+     * decode and nothing else. The visible cost was that a
+     * `computed({ mode:'virtual' })` field read `undefined` on a query row while
+     * `get()` and `list()` returned it, so the same record had two shapes
+     * depending on which read verb produced it, and a caller summing that field
+     * over a query result got `NaN` with no error.
+     *
+     * This folds the SAME order as `present`, skipping any binding that has not
+     * declared {@link ViaBinding.presentIsSync}. `money` and `computed` do, which
+     * is the pair that carries values; `i18n` and `lookup` are genuinely async
+     * and are reported in `skipped` rather than silently dropped — the caller can
+     * then say so instead of leaving a hole.
+     *
+     * ⚠️ Ordering is preserved exactly, including the `presentLate` boundary,
+     * because money's `presentLate` exists to react to computed's virtual output
+     * (#669). Reordering here would corrupt a field that is both money and
+     * virtual.
+     */
+    presentSync(record: Record<string, unknown>, ctx: ViaReadCtx): {
+        record: Record<string, unknown>;
+        skipped: readonly string[];
+    };
+    /** True iff some binding's presentation can only run on the async path (#1416). */
+    get hasAsyncPresent(): boolean;
+    /**
+     * #1447 — which bindings cover which fields, for `dumpSchema()`.
+     *
+     * Field name → the brands covering it, sorted. A field can appear under more
+     * than one brand: a money field that is also `computed({ mode:'virtual' })`
+     * is covered by both, and collapsing that to one would misreport what the
+     * datastore does to it.
+     *
+     * ⛔ BRAND AND FIELD ONLY — never a binding's configuration, and the reason
+     * is not payload size. A schema dump travels further than a vault does, and
+     * a report saying "this field is classified, sensitivity pii" is a map of
+     * which columns are worth attacking, in an artefact that by design leaves
+     * the vault. The consumer who asked for this said brand-plus-field is the
+     * whole of their need, so there is no trade being made.
+     *
+     * A binding that declares no {@link NoydbVia.coveredFields} is omitted
+     * rather than reported as covering nothing — absence of a declaration is not
+     * evidence of absence of coverage.
+     */
+    fieldCoverage(): Record<string, readonly string[]>;
     buildClause(field: string, op: string, value: unknown): ViaClause | undefined;
     evaluateClause(clause: ViaClause, actual: unknown, op: string): boolean;
     /**

package/dist/kernel/write-queue.d.ts

@@ -43,4 +43,21 @@ export declare class WriteQueueTracker implements WriteQueue {
      * error is re-thrown after the queue is decremented.
      */
     track<R>(fn: () => Promise<R>): Promise<R>;
+    /**
+     * Run a write whose PRE-COMMIT phase may legitimately REFUSE — the schema
+     * gates, and a user `beforeWrite` hook that throws to abort. `fn` calls
+     * `committed()` at the point the store write itself begins.
+     *
+     * Before that point a rejection releases the depth it took but records NO
+     * queue error; after it, a rejection settles as a failure like `track`.
+     *
+     * #11 — why the phase is inside `depth` at all: `pending` is the documented
+     * shutdown guard (see the `writeQueue` getter's `beforeunload` example) and
+     * the schema fence does a fresh store read per write, so leaving the gates
+     * outside made `pending` read `false` during a real round-trip on every
+     * write. The refusal carve-out is what the old outside-the-queue placement
+     * was protecting ("a rejected write never counts toward depth") — it is kept
+     * deliberately, so a refused write cannot reject a concurrent `onFlush()`.
+     */
+    trackGated<R>(fn: (committed: () => void) => Promise<R>): Promise<R>;
 }

package/dist/{ledger-EDXFFZQL.js → ledger-5ZMGE44K.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-V7ZRRCRJ.js";
+} from "./chunk-N7EVQD5S.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,15 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-QPQUVOZ2.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
+} from "./chunk-6QVKPHBF.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -38,4 +37,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-EDXFFZQL.js.map
+//# sourceMappingURL=ledger-5ZMGE44K.js.map

package/dist/liberate-WZSZM2W6.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-UIYESRD6.js";
+import "./chunk-IMQKWR46.js";
+import "./chunk-EJLV62NI.js";
+import "./chunk-3XJQBBZD.js";
+import "./chunk-KZXDLBY6.js";
+import "./chunk-5A4345TG.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-XSPFDUDG.js";
+import "./chunk-LIOVX5TJ.js";
+import "./chunk-FLPCETP6.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-WZSZM2W6.js.map

package/dist/link-set-MFXC24VK.js

@@ -0,0 +1,29 @@
+import {
+  LinkEndpointError,
+  LinkSet
+} from "./chunk-WXE4W2U6.js";
+import {
+  LINK_COLLECTION_PREFIX,
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-Q4UHJ5SN.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  LINK_COLLECTION_PREFIX,
+  LinkEndpointError,
+  LinkIntegrityError,
+  LinkSet,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+};
+//# sourceMappingURL=link-set-MFXC24VK.js.map

package/dist/{managed-secret-NCWEMPUQ.js → managed-secret-MFTFT22X.js}

@@ -9,16 +9,15 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-4GVM6QZA.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
+} from "./chunk-3XJQBBZD.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 export {
   MemoryRecipientSealer,
   MemorySealer,
@@ -31,4 +30,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-NCWEMPUQ.js.map
+//# sourceMappingURL=managed-secret-MFTFT22X.js.map