@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/{verify-6MDTIUEV.js → verify-UKALW7C2.js}

@@ -1,26 +1,28 @@
 import {
   blindedEqual,
-  evaluateKofN,
+  dualReadSealedSlot,
   openVdigPayload
-} from "./chunk-BRLKZUBT.js";
-import {
-  dualReadSealedSlot
-} from "./chunk-BTDR2PXY.js";
+} from "./chunk-5KC7QYEC.js";
 import {
   VDIG_ITERATIONS,
-  normalizeForVerify,
   pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
+} from "./chunk-EZOAKKTB.js";
+import {
+  evaluateKofN
+} from "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
 import {
   base64ToBuffer,
-  generateSalt
-} from "./chunk-HPVZCW43.js";
+  generateSalt,
+  normalizeForVerify
+} from "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
-// src/kernel/enclave/classify/verify.ts
+// src/capsule/enclave-aes/classify/verify.ts
 async function padOnce(iter = VDIG_ITERATIONS) {
   const dummy = await pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
   await blindedEqual(dummy, dummy);
@@ -136,4 +138,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-6MDTIUEV.js.map
+//# sourceMappingURL=verify-UKALW7C2.js.map

package/dist/verify-UKALW7C2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/enclave-aes/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Elevated records (_tier > 0, with-audit tier moves) are non-comparable\n * through every door and pad-false exactly like missing records (#691) —\n * the tier-aware read surface is getAtTier, never verify.\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { type EnclaveKey } from '../crypto.js'\nimport { generateSalt, base64ToBuffer } from '../../plumbing/digest.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from '../../plumbing/normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from '../../plumbing/kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../bound.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../../kernel/errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../../kernel/types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  // #691: an elevated envelope (_tier > 0) is non-comparable through every\n  // tier-0 door — its key material is tier-DEK-wrapped and must never be\n  // resolved here (the elevating session's warm cekCache would otherwise\n  // leak past the tier audit). Exactly the missing-record pad path, checked\n  // BEFORE the R6 residue probe so tier-0 callers learn nothing.\n  if (env === null || (env._tier ?? 0) > 0) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && (env._tier ?? 0) === 0 && blob !== undefined) { // #691: elevated ≡ missing\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const fetched = await ctx.getEnvelope(id)\n  // #691: elevated ≡ missing — nulling the view here also skips the R6\n  // residue probe (a tier-0 caller must not learn an elevated record's\n  // storage form) and forces the cek-undefined pad path for every member.\n  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AAMpC,MAAI,QAAQ,SAAS,IAAI,SAAS,KAAK,EAAG,QAAO,SAAS;AAC1D,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,SAAS,IAAI,SAAS,OAAO,KAAK,SAAS,QAAW;AAChE,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,UAAU,MAAM,IAAI,YAAY,EAAE;AAIxC,QAAM,MAAM,YAAY,SAAS,QAAQ,SAAS,KAAK,IAAI,OAAO;AAClE,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/via/blob/index.d.ts

@@ -35,6 +35,7 @@ export { detectMimeType, detectMagic, isPreCompressed } from '../../with-shape/b
 export { runCompaction, BLOB_EVICTION_AUDIT_COLLECTION } from '../../with-shape/blobs/blob-compaction.js';
 export { reportOrphanBlobChunks } from '../../with-shape/blobs/orphan-report.js';
 export type { OrphanChunkReport } from '../../with-shape/blobs/orphan-report.js';
+export type { UnreferencedLegacyBlobReport } from '../../with-shape/blobs/legacy-sweep.js';
 export type { NoydbStore } from '../../kernel/types.js';
 export type { BlobFieldsConfig, BlobFieldPolicy, BlobEvictionEntry, CompactRunOptions, CompactionResult, CompactionContext, } from '../../with-shape/blobs/blob-compaction.js';
 export { createExportBlobsHandle, ExportBlobsAbortedError, EXPORT_AUDIT_COLLECTION, } from '../../with-shape/blobs/export-blobs.js';

package/dist/via/classified/binding.d.ts

@@ -29,9 +29,9 @@ import { type ClassifiedEntry } from './resolve.js';
 import { type ClassifiedGuardCtx } from './guards.js';
 /**
  * One classified per-slot shred/residue verdict — mirrors
- * `RecordCodec.SealedShredSlot` (`kernel/enclave/record-keys/record-codec.ts`)
+ * `RecordCodec.SealedShredSlot` (`capsule/plumbing/record-codec.ts`)
  * byte-for-byte. Duplicated here (not imported) so this binding never
- * reaches into `kernel/enclave/` (`via-enclave-isolation`, #629) — the
+ * reaches into `capsule/enclave-aes/` (`via-enclave-isolation`, #629) — the
  * closure that PRODUCES real values of this shape is codec-owned and
  * injected via {@link ClassifiedViaConfig.classifySealedShred}.
  */

package/dist/via/classified/config-drift.d.ts

@@ -12,9 +12,9 @@
  * R10 guard.
  *
  * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`
- * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives
+ * (`capsule/enclave-aes/crypto.ts`'s alias for the same type) — this file lives
  * under `via/classified/`, which the `via-enclave-isolation`
- * architecture guard (#629) forbids from importing `kernel/enclave/` at
+ * architecture guard (#629) forbids from importing `capsule/enclave-aes/` at
  * all, even type-only.
  *
  * @module

package/dist/via/classified/errors.d.ts

@@ -2,7 +2,7 @@
  * Configuration/write errors for classified fields. @module
  *
  * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
- * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
+ * (stage 2) so `capsule/enclave-aes/classify/*` can throw them without importing
  * with-*. Re-exported here under the same names so existing import paths
  * keep working.
  */

package/dist/via/geo/binding.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The geo `NoydbVia` (#1355) — wires the geohash engine into the kernel's
+ * generic Via port. `geo()` (descriptor.ts) calls {@link linkGeoVia} at
+ * declaration time, the same #553 static-link pattern money/lookup/computed
+ * use.
+ *
+ * ⭐ WHERE THE GEOHASH ACTUALLY LIVES, and why in two places:
+ *
+ *  - `ingest` writes it BESIDE `{ lat, lng }` in the record, so the stored
+ *    document is self-describing: an export, a `crdt` merge or a consumer
+ *    reading the raw shape sees the cell without re-deriving it.
+ *  - `canonicalizeIndexKey` DERIVES it from `lat`/`lng` rather than reading
+ *    that stored field. Deriving is what makes MIXED-ERA data land in the
+ *    right bucket (money's #672 story, same shape): a record written before
+ *    the field was declared `geo()` carries no `geohash` at all, and one
+ *    written at a different `precision` carries the wrong-length one. Both
+ *    index correctly because the coordinate — not the cached cell — is the
+ *    source of truth for the key.
+ *
+ * The index key is therefore always a geohash STRING, so the field's
+ * entries live in one key space and `startsWith` over it is a spatial
+ * slice.
+ */
+import type { NoydbVia } from '../../kernel/via/index.js';
+import type { GeoDescriptor } from './descriptor.js';
+/** The geo binder's config bag: field name → its descriptor. */
+export interface GeoBindingConfig {
+    readonly geoFields: Record<string, GeoDescriptor>;
+}
+export declare function geoVia(geoFields: Record<string, GeoDescriptor>): NoydbVia;
+export declare function linkGeoVia(): void;

package/dist/via/geo/descriptor.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `geo()` — the field descriptor for a `{ lat, lng }` point (#1355).
+ *
+ * A branded schema-layer descriptor, a sibling of `money()` / `lookup()`.
+ * It owns one decision: at what geohash PRECISION this field is indexed
+ * and stored. The math lives in {@link ./geohash}; the query participation
+ * in {@link ./where}.
+ *
+ * Declared through the `via()` composer:
+ *
+ * ```ts
+ * vault.collection('places', {
+ *   viaFields: { at: via(geo()) },
+ *   indexes: [{ fields: ['at'], kind: 'sorted' }],
+ * })
+ * ```
+ *
+ * The sorted index is what makes `near()` cheaper than a scan; without it
+ * the query still returns the RIGHT answer, just by walking every record.
+ */
+import { NoydbError } from '../../kernel/errors.js';
+import type { ViaDescriptor } from '../../kernel/via/index.js';
+export interface GeoOptions {
+    /**
+     * Geohash characters stored and indexed per record. Default 9
+     * (≈ 4.8m × 4.8m) — finer than any consumer GPS fix and still short
+     * enough that a prefix cover of a city-scale radius is a handful of
+     * cells.
+     */
+    readonly precision?: number;
+    /**
+     * Ceiling on how many geohash prefixes one `near()` query may probe.
+     * Default 32. Raising it buys a tighter candidate set at the cost of
+     * more index slices per query; lowering it does the reverse. It never
+     * affects CORRECTNESS — the cover is a superset at every precision and
+     * the haversine post-filter is the exact answer either way.
+     */
+    readonly maxPrefixes?: number;
+}
+export interface GeoDescriptor extends ViaDescriptor {
+    readonly _viaBrand: 'geo';
+    readonly precision: number;
+    readonly maxPrefixes: number;
+}
+/** Raised when a written value is not a usable `{ lat, lng }` point. */
+export declare class GeoPointError extends NoydbError {
+    readonly field: string;
+    readonly value: unknown;
+    constructor(field: string, value: unknown);
+}
+/** Create a {@link GeoDescriptor}. */
+export declare function geo(options?: GeoOptions): GeoDescriptor;
+/** Runtime predicate for detecting a {@link GeoDescriptor}. */
+export declare function isGeoDescriptor(x: unknown): x is GeoDescriptor;

package/dist/via/geo/geohash.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The geospatial primitives (#1355) — geohash encoding, great-circle
+ * distance, and the bounding-box → prefix-set cover that lets a `near()`
+ * query take the existing sorted index.
+ *
+ * ⭐ WHY A GEOHASH PREFIX AND NOT A COORDINATE. The store holds ciphertext
+ * and never runs a query, but a secondary index key is a value the hub
+ * itself keeps in a structure a persisted sidecar can carry (#1359). A raw
+ * `lat`/`lng` in that key space is a coordinate at full precision; a
+ * geohash PREFIX is a cell — deliberately lossy, and the coarser the query
+ * the less it says. That is the whole reason this module exists rather
+ * than a pair of numeric range indexes on `lat` and `lng`.
+ *
+ * ⛔ THE SUPERSET LAW. {@link coverPrefixes} must return a cover whose
+ * union CONTAINS every point of the box, and {@link boundingBox} a box
+ * that contains every point within the radius. A candidate set that is
+ * too big costs a haversine call per extra row; one that is too small is
+ * a WRONG ANSWER, and no post-filter can put a dropped record back.
+ * `__tests__/geo-superset.test.ts` is the property that pins it.
+ *
+ * Pure, portable, dependency-free — no Node built-ins, no npm math lib.
+ */
+/** A WGS-84 point. Latitude in [-90, 90], longitude in [-180, 180]. */
+export interface GeoPoint {
+    readonly lat: number;
+    readonly lng: number;
+}
+/** A latitude/longitude rectangle. Never wraps: {@link boundingBox} splits at the antimeridian instead. */
+export interface GeoBox {
+    readonly minLat: number;
+    readonly maxLat: number;
+    readonly minLng: number;
+    readonly maxLng: number;
+}
+/** Mean Earth radius (IUGG), km — the same constant every reference haversine uses. */
+export declare const EARTH_RADIUS_KM = 6371.0088;
+/** Widest geohash precision this module encodes. 12 chars ≈ 3.7cm — past any GPS fix. */
+export declare const MAX_PRECISION = 12;
+/** True when `p` is a usable point. Rejects NaN, infinities and out-of-range values. */
+export declare function isGeoPoint(p: unknown): p is GeoPoint;
+/**
+ * Great-circle distance in kilometres.
+ *
+ * Haversine rather than the law of cosines: the two agree to metres at
+ * continental scale, but `acos` loses all its significant digits for
+ * nearby points (`cos d → 1`), which is exactly the regime a `near()`
+ * query lives in.
+ */
+export declare function haversineKm(a: GeoPoint, b: GeoPoint): number;
+/**
+ * Encode a point as a geohash of `precision` characters.
+ *
+ * Bits interleave longitude-first, which is what makes a shared prefix
+ * mean "the same cell" and therefore what makes the sorted index's
+ * `startsWith` slice a spatial answer.
+ */
+export declare function encodeGeohash(point: GeoPoint, precision: number): string;
+/** The cell a geohash names. Throws on a character outside the alphabet. */
+export declare function decodeGeohashBox(hash: string): GeoBox;
+/** How many latitude / longitude bits a `precision`-character hash spends. */
+export declare function gridBits(precision: number): {
+    latBits: number;
+    lngBits: number;
+};
+/**
+ * The boxes enclosing every point within `radiusKm` of `center`.
+ *
+ * Returns TWO boxes when the circle crosses the antimeridian, and one
+ * spanning the full longitude range when it reaches a pole — a rectangle
+ * in lat/lng cannot express either case, and quietly clipping would
+ * violate the superset law at exactly the coordinates nobody tests by
+ * hand.
+ */
+export declare function boundingBox(center: GeoPoint, radiusKm: number): GeoBox[];
+/** Number of `precision`-cells the boxes touch — computed from grid indices, never by enumerating. */
+export declare function coverSize(boxes: readonly GeoBox[], precision: number): number;
+/**
+ * The geohash prefixes whose cells cover `boxes` at `precision`.
+ *
+ * Every returned prefix is exactly `precision` characters, so the set can
+ * be handed to the sorted index one `startsWith` at a time and unioned.
+ */
+export declare function coverPrefixes(boxes: readonly GeoBox[], precision: number): string[];
+/**
+ * The finest cover of `center`/`radiusKm` that stays within `maxCells`
+ * prefixes, capped at `maxPrecision`.
+ *
+ * Finer is better: the prefixes ARE the candidate set, so a coarser cover
+ * hands more rows to the haversine post-filter. The search always
+ * terminates — precision 1 is a 4×8 grid, so 32 cells cover the planet.
+ */
+export declare function prefixesForRadius(center: GeoPoint, radiusKm: number, maxPrecision: number, maxCells: number): {
+    prefixes: string[];
+    precision: number;
+};

package/dist/via/geo/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@noy-db/hub` geospatial field descriptor (#1355) — `geo()` plus the
+ * pure primitives a consumer may want directly (`haversineKm` for a
+ * distance column, `encodeGeohash` for a cell label).
+ *
+ * @see ./descriptor for the public `geo()` factory.
+ * @see ./geohash for the superset law the prefix cover obeys.
+ */
+export { geo, isGeoDescriptor, GeoPointError } from './descriptor.js';
+export type { GeoDescriptor, GeoOptions } from './descriptor.js';
+export { haversineKm, encodeGeohash, decodeGeohashBox, boundingBox, coverPrefixes, coverSize, prefixesForRadius, isGeoPoint, gridBits, EARTH_RADIUS_KM, MAX_PRECISION, } from './geohash.js';
+export type { GeoPoint, GeoBox } from './geohash.js';
+export type { NearOperand, GeoWhereOperand, GeoNearOperand, GeoPassthroughOperand } from './where.js';

package/dist/via/geo/where.d.ts

@@ -0,0 +1,50 @@
+import { type Operator } from '../../kernel/query/predicate.js';
+import type { ViaPrefixProbe } from '../../kernel/via/index.js';
+import type { GeoDescriptor } from './descriptor.js';
+import { type GeoPoint } from './geohash.js';
+/** The `near` operand: a centre and a radius in kilometres. */
+export interface NearOperand extends GeoPoint {
+    readonly radiusKm: number;
+}
+/** A `near` clause: the centre, the radius, and the cover the index probes. */
+export interface GeoNearOperand {
+    readonly kind: 'near';
+    readonly center: GeoPoint;
+    readonly radiusKm: number;
+    readonly prefixes: readonly string[];
+    /** Cover precision actually chosen — reported by `describeFragment()`, not used to match. */
+    readonly precision: number;
+}
+/** Any other operator over a geo field: claimed, un-probed, generically compared. */
+export interface GeoPassthroughOperand {
+    readonly kind: 'passthrough';
+    readonly value: unknown;
+}
+/** The opaque payload `buildClause` produces and `evaluateClause` consumes. */
+export type GeoWhereOperand = GeoNearOperand | GeoPassthroughOperand;
+/**
+ * Build the payload for a clause over a geo field. A `near` operand is
+ * validated and covered here; every other operator is captured verbatim.
+ *
+ * A malformed `near` operand throws at the `where()` CALL SITE (money's
+ * precedent) — a silently-empty result set is the worst possible answer to
+ * a typo'd coordinate.
+ */
+export declare function geoFieldClause(field: string, op: Operator, value: unknown, desc: GeoDescriptor): GeoWhereOperand;
+/**
+ * Exact membership: the stored point is within `radiusKm` of the centre.
+ *
+ * A value that is not a point — absent, nullish, or written before the
+ * field was declared `geo()` — matches nothing. That is the same posture
+ * every other operator takes on a type mismatch, and it is what keeps the
+ * index sound: such a record has no geohash key either, so it is absent
+ * from the candidate set AND from the answer.
+ */
+export declare function evaluateGeoClause(actual: unknown, op: string, payload: GeoWhereOperand): boolean;
+/**
+ * The index operand: a prefix cover the sorted index can slice.
+ *
+ * `undefined` for any other operator, which sends the clause to the scan
+ * — the geo binding claims no fast path it cannot make sound.
+ */
+export declare function geoIndexProbe(op: string, payload: GeoWhereOperand): ViaPrefixProbe | undefined;

package/dist/via/i18n/core.d.ts

@@ -246,7 +246,7 @@ export { getAtPath } from '../../kernel/paths.js';
 export declare function applyI18nLocale(record: Record<string, unknown>, i18nFields: Record<string, I18nTextDescriptor>, locale: string, fallback?: string | readonly string[], layer?: Layer): Record<string, unknown>;
 /**
  * Sync i18n-text-only present-for-join dressing — the exact `join`-layer
- * partial application `kernel/query/join.ts` used to import and call
+ * partial application `kernel/query/relate/join.ts` used to import and call
  * directly before #626's retirement (#650 Task 6): fixes `fallback`
  * `undefined` and `layer` `'join'`. `via/lookup/snapshot.ts`'s
  * `buildPresentForJoin` composes this with the lookup-label half to build

package/dist/via/lookup/handle.d.ts

@@ -81,9 +81,9 @@ export declare class LookupHandle<Keys extends string = string> {
      * #647 fix wave 1 — mints a version-ordered delete-marker envelope (the reserved-tier
      * mirror of #589's ordinary-collection delete marker). Injected rather than imported:
      * `buildDeleteMarker` constructs the envelope's protected-body fields (`_iv`/`_data`), and
-     * `via/lookup/**` may not reach `kernel/enclave/` directly (Check 11
+     * `via/lookup/**` may not reach `capsule/enclave-aes/` directly (Check 11
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
-     * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
+     * `capsule/enclave-aes` function at construction time, same pattern as `reservedEnvelopes` above.
      */
     private readonly buildDeleteMarker;
     /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */
@@ -128,9 +128,9 @@ export declare class LookupHandle<Keys extends string = string> {
      * #647 fix wave 1 — mints a version-ordered delete-marker envelope (the reserved-tier
      * mirror of #589's ordinary-collection delete marker). Injected rather than imported:
      * `buildDeleteMarker` constructs the envelope's protected-body fields (`_iv`/`_data`), and
-     * `via/lookup/**` may not reach `kernel/enclave/` directly (Check 11
+     * `via/lookup/**` may not reach `capsule/enclave-aes/` directly (Check 11
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
-     * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
+     * `capsule/enclave-aes` function at construction time, same pattern as `reservedEnvelopes` above.
      */
     buildDeleteMarker: (identity: {
         collection: string;

package/dist/via/lookup/registry.d.ts

@@ -9,7 +9,7 @@
  * by `vault.collection()` and read by the backup path) and calls these
  * helpers through the `port/with/lookup-strategy.ts` seam.
  */
-import type { JoinableSource } from '../../kernel/query/index.js';
+import type { JoinableSource } from '../../kernel/query/relate/join.js';
 import type { ViaGraph } from '../../kernel/via/graph.js';
 import type { StaticDictDescriptor } from '../../port/with/i18n-strategy.js';
 import { type LookupHandle } from './handle.js';

package/dist/via/lookup/snapshot.d.ts

@@ -1,7 +1,7 @@
 /**
  * The sync lookup snapshot + join/locale seam (#650 Task 6, spec §5 — "the
  * snapshot+locale seam"). Retires the #626 kernel→via grandfather:
- * `kernel/query/join.ts` no longer imports `via/i18n/core.js` directly
+ * `kernel/query/relate/join.ts` no longer imports `via/i18n/core.js` directly
  * — it calls the `presentForJoin` hook this file's `buildPresentForJoin`
  * builds instead (seam map Part 2 item 4, the #626 reviewer-spec'd shape:
  * a sync `presentI18nForJoin`-class hook on `JoinableSource`).
@@ -16,7 +16,7 @@
  * Serves (reserved AND matrix tier since #650 Task 7 — `registry.ts`'s
  * `buildLookupSnapshotRows` routes both; static tier is read straight off
  * `descriptor.table` by every consumer below, never through this cache):
- *   - join dressing (`presentForJoin`, consumed by `kernel/query/join.ts`
+ *   - join dressing (`presentForJoin`, consumed by `kernel/query/relate/join.ts`
  *     via `JoinableSource.presentForJoin`)
  *   - dimension sort (`compareForOrder`, consumed by
  *     `via/lookup/binding.ts`'s `NoydbVia.compareForOrder` closure)
@@ -59,7 +59,7 @@ export declare function buildLookupSnapshot(dimension: string, rows: ReadonlyMap
  * `Collection` attaches to the `JoinableSource` it exposes
  * (`querySourceForJoin()`) — the i18n-text half (`presentI18nForJoin`, the
  * exact `applyI18nLocale(..., 'join')` partial application
- * `kernel/query/join.ts` used to call directly, #626) composed with the
+ * `kernel/query/relate/join.ts` used to call directly, #626) composed with the
  * lookup-label half above. `undefined` when the collection declares
  * neither — `JoinableSource.presentForJoin` then stays unset, matching
  * today's `i18nFields`-absent behavior exactly (#626 parity lock).

package/dist/walk-4VPK7AS4.js

@@ -0,0 +1,20 @@
+import {
+  dumpVaultSchema
+} from "./chunk-PP3K67AJ.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-747G6CT3.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-3L2NBKDR.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-4VPK7AS4.js.map

package/dist/walk-4VPK7AS4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/with-audit/attestation/index.d.ts

@@ -13,4 +13,5 @@ export { ATTESTATIONS_COLLECTION } from './signer.js';
 export { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js';
 export type { RevokeContext } from './revoke.js';
 export { AttestationError } from '../../kernel/errors.js';
-export { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation';
+export { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList } from './verifier.js';
+export type { QrPayload, AttestationFieldSchema, VerifyResult, VerifyInput, RevocationList } from './types.js';

package/dist/with-audit/attestation/issue.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type AttestationFieldSchema, type QrPayload } from '@noy-db/attestation';
+import { type EnclaveKey } from '../../capsule/index.js';
+import type { AttestationFieldSchema, QrPayload } from './types.js';
 /** Everything issueAttestationCore needs from the Vault, injected for testability. */
 export interface IssueContext {
     readonly store: NoydbStore;

package/dist/with-audit/attestation/revoke.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type RevocationList } from '@noy-db/attestation';
+import { type EnclaveKey } from '../../capsule/index.js';
+import type { RevocationList } from './types.js';
 /** Everything the revoke core needs from the Vault, injected for testability. */
 export interface RevokeContext {
     readonly store: NoydbStore;

package/dist/with-audit/attestation/scheme.d.ts

@@ -0,0 +1,7 @@
+import type { SignatureScheme } from './types.js';
+/**
+ * Attestation signs and verifies with the ENCLAVE's sign group, not with the
+ * attestation package's bundled Ed25519 — so a different enclave (Stage B/C)
+ * changes what hub signs with, without touching attestation.
+ */
+export declare const ENCLAVE_SCHEME: SignatureScheme;

package/dist/with-audit/attestation/signer.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 export declare const ATTESTATIONS_COLLECTION = "_attestations";
 export declare const SIGNER_RECORD_ID = "_signer";
 export declare const REVOKED_RECORD_ID = "_revoked";

package/dist/with-audit/attestation/strategy.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
-import type { RevocationList } from '@noy-db/attestation';
+import type { EnclaveKey } from '../../capsule/index.js';
+import type { RevocationList } from './types.js';
 import type { IssueContext, IssueArgs, IssueResult } from './issue.js';
 import type { RevokeContext } from './revoke.js';
 /**

package/dist/with-audit/attestation/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The attestation types, re-exported at their service-layer home.
+ *
+ * The declarations live in `kernel/attestation-types.ts` because
+ * `kernel/vault.ts` names `RevocationList` on its public surface, and the
+ * kernel spine may not statically import a `with-*` service (`port-layering`,
+ * the S4 gate). This file keeps `./types.js` the natural import for everything
+ * inside `with-audit/attestation/`.
+ */
+export type { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, SignatureScheme, } from '../../kernel/attestation-types.js';

package/dist/with-audit/attestation/vault-facade.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
-import type { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
+import type { EnclaveKey } from '../../capsule/index.js';
+import type { AttestationFieldSchema, RevocationList } from './types.js';
 import type { AttestationStrategy } from './strategy.js';
 export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';
 /** Everything the moving attestation methods touched on the vault's `this.*`. */

package/dist/with-audit/attestation/verifier.d.ts

@@ -0,0 +1,6 @@
+import type { QrPayload, RevocationList, SignatureScheme, VerifyInput, VerifyResult } from './types.js';
+export declare const verifyAttestation: (input: VerifyInput, scheme?: SignatureScheme) => Promise<VerifyResult>;
+export declare const decodeQr: (s: string) => QrPayload;
+export declare const verifyRevocationList: (list: RevocationList, publicKeyB64: string, scheme?: SignatureScheme) => Promise<boolean>;
+export declare const isRevoked: (docId: string, list: RevocationList) => boolean;
+export declare const signRevocationList: (revokedDocIds: readonly string[], asOf: string, keyId: string, privateKeyPkcs8B64: string, scheme?: SignatureScheme) => Promise<RevocationList>;

package/dist/with-audit/consent/consent.d.ts

@@ -49,7 +49,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection for consent-audit entries. */
 export declare const CONSENT_AUDIT_COLLECTION = "_consent_audit";
 /**

package/dist/with-audit/consent/strategy.d.ts

@@ -11,7 +11,7 @@
  * @internal
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { ConsentAuditEntry, ConsentAuditFilter } from './consent.js';
 /**
  * @internal