@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/with-audit/coverage/accounting.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Coverage accounting (#1363) — per `(principal, vault, collection)`.
+ *
+ * ⛔⛔ **TELEMETRY, NOT A CONTROL.** Against an insider holding the device and
+ * local keys this prevents nothing; it makes bulk extraction visible early,
+ * attributable and loud. Key custody (tiers, per-collection DEKs) is the
+ * remediation. Nothing in this module refuses a read, and nothing in it may
+ * ever grow the ability to (#1251 §3: a refusal is a threshold the reader can
+ * binary-search; a signal is not).
+ *
+ * What is accounted, and why each one:
+ *
+ *  - **distinct ids ever decrypted** (HyperLogLog) — coverage is the protected
+ *    quantity, not rate: patience lowers an extractor's rate and never their
+ *    coverage. Monotonic, and the horizon is the life of the state, never a
+ *    30-day window that resets faster than the attack completes.
+ *  - **novelty per window** (Bloom, cleared per window) — the discriminator
+ *    that is orthogonal to speed. A legitimate operator re-reads a working
+ *    subset (high volume, low novelty); an extractor reads new records.
+ *  - **served** — decrypts, all time and per window.
+ *  - **burstiness** — this window's served count over the running mean of the
+ *    previous windows'. 1 while there is no history to compare against.
+ *
+ * @module
+ */
+import type { CoverageEmitter, CoverageFieldMeta, CoverageObserver, CoverageStrategy } from '../../port/with/coverage-strategy.js';
+/** Per-collection policy. Absent `corpusSize` ⇒ no coverage estimate, so no alert. */
+export interface CoverageCollectionPolicy {
+    /**
+     * How many records the corpus holds. Coverage is `distinct / corpusSize`.
+     * Deliberately DECLARED rather than counted: counting means a store read on
+     * a sensor that must not touch the store, and a corpus size that moves with
+     * every write makes an alert threshold un-reproducible.
+     */
+    readonly corpusSize?: number;
+    /** Coverage fractions to alert at. Default `[0.6, 0.9]`. Each fires at most once. */
+    readonly alertAt?: readonly number[];
+}
+export interface WithCoverageOptions {
+    /**
+     * HyperLogLog precision — the register file is `2^precision` bytes per
+     * `(principal, vault, collection)`. Default 14 (16 KiB), chosen by
+     * measurement; the table is in `sketch.ts`.
+     */
+    readonly precision?: number;
+    /** Bloom width in bits, per key, per window. Default 16 384 (2 KiB). */
+    readonly bloomBits?: number;
+    /** Bloom hash count. Default 7. */
+    readonly bloomHashes?: number;
+    /** Novelty window length. Default one hour. NOT the coverage horizon — that never resets. */
+    readonly windowMs?: number;
+    /** Per-collection corpus size and alert thresholds. */
+    readonly collections?: Readonly<Record<string, CoverageCollectionPolicy>>;
+    /** Clock seam, for tests. */
+    readonly now?: () => number;
+}
+export interface CoverageStats {
+    readonly principal: string;
+    readonly vault: string;
+    readonly collection: string;
+    /** HLL estimate of distinct ids ever decrypted. */
+    readonly distinct: number;
+    readonly served: number;
+    readonly novelInWindow: number;
+    readonly servedInWindow: number;
+    readonly burstiness: number;
+    /** Absent when the collection declares no `corpusSize`. */
+    readonly coverage?: number;
+    readonly window: string;
+}
+/**
+ * Serializable coverage state.
+ *
+ * ⛔ SKETCHES ONLY — the invariant this module exists to hold. A structure
+ * that could name the records a principal has read would be a second copy of
+ * the sensitive set: the sensor built to notice bulk extraction would become
+ * the single best artefact to extract. Pinned by
+ * `__tests__/coverage/no-record-ids.test.ts`.
+ */
+export interface CoverageSnapshot {
+    readonly _noydb_coverage: 1;
+    readonly entries: ReadonlyArray<{
+        readonly principal: string;
+        readonly vault: string;
+        readonly collection: string;
+        readonly hll: {
+            readonly p: number;
+            readonly r: string;
+        };
+        readonly served: number;
+        readonly windowStart: number;
+    }>;
+}
+export declare class CoverageRegistry implements CoverageStrategy {
+    #private;
+    constructor(opts?: WithCoverageOptions);
+    observer(vault: string, collection: string, principal: string, fieldMeta: () => CoverageFieldMeta | undefined, emitter: CoverageEmitter, eager: boolean): CoverageObserver | undefined;
+    /** Current accounting, for an operator surface. Estimates, never exact. */
+    stats(): readonly CoverageStats[];
+    /**
+     * Serializable state, for a deployment that wants coverage to survive a
+     * restart — the horizon must exceed tenure, and a process does not.
+     * ⛔ Sketches only. Never a record id: see {@link CoverageSnapshot}.
+     */
+    snapshot(): CoverageSnapshot;
+    /**
+     * Restore a snapshot. The novelty filter is deliberately NOT restored:
+     * novelty is a within-window notion and the window did not survive.
+     * Distinct-ever did, which is the quantity that must not reset.
+     */
+    restore(snapshot: CoverageSnapshot): void;
+}

package/dist/with-audit/coverage/active.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `withCoverage()` — the opt-in read-coverage sensor (#1363).
+ *
+ * ⛔⛔ **Against an insider holding the device and local keys, this prevents
+ * nothing. It makes bulk extraction visible early, attributable and loud. It
+ * is telemetry.** The real remediation is key custody — tiers and
+ * per-collection DEKs — and this factory is not a substitute for one. Read the
+ * sentence again before wiring it into anything that describes itself as a
+ * control.
+ *
+ * @module
+ */
+import { CoverageRegistry } from './accounting.js';
+import type { WithCoverageOptions } from './accounting.js';
+/**
+ * Enable coverage accounting for every collection that declares a
+ * `bulk: 'sensitive'` field (or that is named in `opts.collections`).
+ *
+ * ```ts
+ * const coverage = withCoverage({ collections: { clients: { corpusSize: 1200, alertAt: [0.6, 0.9] } } })
+ * const db = await createNoydb({ user: 'alice', secret, coverageStrategy: coverage })
+ * db.on('coverage:threshold', (e) => notifyOwner(e))   // a SIGNAL, never a refusal
+ * ```
+ *
+ * The returned registry is the strategy AND the read surface: `stats()` for a
+ * live view, `snapshot()`/`restore()` to carry the coverage horizon across a
+ * restart. Nothing it returns can name a record that was read.
+ */
+export declare function withCoverage(opts?: WithCoverageOptions): CoverageRegistry;

package/dist/with-audit/coverage/index.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `@noy-db/hub/coverage` — read-coverage sensor (#1363, from the #1251 design).
+ *
+ * ⛔⛔ **Against an insider holding the device and local keys, this prevents
+ * nothing. It makes bulk extraction visible early, attributable and loud. It
+ * is telemetry.** The real remediation is key custody (tiers, per-collection
+ * DEKs); a coverage alert is a complement to a key boundary and a poor
+ * substitute for one.
+ *
+ * The reframe it implements: the protected quantity for "safe individually,
+ * sensitive in bulk" data is **coverage** — the fraction of a corpus a
+ * principal has *ever* decrypted — not rate. Rate limiting fails structurally
+ * against low-and-slow; patience lowers an extractor's rate and never their
+ * coverage. So this service accounts distinct-ever (HyperLogLog), novelty per
+ * window (Bloom), served count and burstiness per
+ * `(principal, vault, collection)`, and emits `'coverage:threshold'` when
+ * declared coverage thresholds are crossed.
+ *
+ * ⛔ It never refuses a read, and no option to do so may be added: a refusal
+ * at a boundary is a threshold the reader can binary-search.
+ * ⛔ It never persists a record id. Sketches are the only state.
+ * ⚠️ It accounts only LAZY collections (`prefetch: false`). An eager
+ * collection decrypts its whole corpus at hydration, which a decrypt-point
+ * sensor cannot tell from a read — see `accounting.ts#resolveAccounted`.
+ *
+ * ## Honeytoken recipe (prose — the cheapest high-signal sensor in the design)
+ *
+ * Coverage alerting tells you how much of a corpus a principal has seen.
+ * A honeytoken tells you, on the FIRST read, that someone is enumerating —
+ * and it is immune to rate shaping, because there is no legitimate rate at
+ * which a record nobody should open gets opened.
+ *
+ * 1. Seed a handful of records in the bulk-declared collection that no
+ *    business process ever addresses: plausible-looking rows with ids no
+ *    workflow can reach, never referenced by a ref, never in a report.
+ * 2. Keep the list of their ids OUTSIDE the vault — in the code or the
+ *    operator's config. It must never become a queryable "honeytokens"
+ *    collection: that is a lookup table telling an insider which rows to
+ *    avoid, i.e. the same second-copy mistake the sketches exist to avoid.
+ * 3. Wrap the read path the app already owns and compare the id it is about
+ *    to serve against that list. Any hit is a high-confidence signal — page
+ *    the owner, and (with `withHistory()`) append a ledger entry so the
+ *    detection itself is tamper-evident.
+ * 4. Do not refuse the read. Serving it keeps the reader unaware they tripped
+ *    a sensor, which is the entire value; refusing turns the honeytoken into
+ *    an oracle for finding the other honeytokens.
+ * 5. Rotate them when staff change. A honeytoken whose location has leaked is
+ *    a honeytoken that reports nothing.
+ *
+ * ⚠️ Honeytokens detect ENUMERATION, not exfiltration of a known subset. They
+ * complement coverage alerting; neither prevents anything.
+ *
+ * @category capability
+ * @module
+ */
+export { withCoverage } from './active.js';
+export { CoverageRegistry } from './accounting.js';
+export type { CoverageCollectionPolicy, CoverageSnapshot, CoverageStats, WithCoverageOptions, } from './accounting.js';
+export { BloomFilter, HyperLogLog } from './sketch.js';
+export type { CoverageEmitter, CoverageEvent, CoverageFieldMeta, CoverageObserver, CoverageStrategy, } from '../../port/with/coverage-strategy.js';
+export { NO_COVERAGE } from '../../port/with/coverage-strategy.js';

package/dist/with-audit/coverage/sketch.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Bounded-size sketches for the coverage sensor (#1363).
+ *
+ * ⚠️ THE WHOLE POINT OF A SKETCH HERE IS WHAT IT CANNOT DO. Coverage state
+ * answers *"how much of this corpus has this principal seen"*, and the exact
+ * answer — the id set — is a SECOND COPY OF THE SENSITIVE SET. A sensor built
+ * to notice bulk extraction would then be the best single artefact to extract.
+ * So no structure in this module retains a record id, and none can be
+ * enumerated back into one: HyperLogLog keeps per-register leading-zero ranks,
+ * Bloom keeps bits. Both are lossy on purpose, and the accuracy that costs is
+ * the price of the property (`no-record-ids.test.ts` pins it).
+ *
+ * @module
+ */
+/**
+ * HyperLogLog over `2^precision` one-byte registers.
+ *
+ * ⭐ SIZING IS THE OPEN QUESTION THIS FEATURE SHIPS WITH, not a settled
+ * default. At the scale the design anticipates (~1k records, ~30 principals)
+ * the estimator runs entirely in its LINEAR-COUNTING range, where accuracy is
+ * a function of load factor rather than of HLL's asymptotic 1.04/√m. So the
+ * default is chosen by MEASUREMENT, not theory — `__tests__/coverage/sketch.test.ts`
+ * pins the error band this implementation actually produces:
+ *
+ * | distinct ids | p=10 (1 KiB) | p=12 (4 KiB) | **p=14 (16 KiB, default)** |
+ * |---:|---:|---:|---:|
+ * | 100    | 3.00% | 1.00% | **0.00%** |
+ * | 1 000  | 2.90% | 0.50% | **0.40%** |
+ * | 10 000 | 2.34% | 5.62% | **0.96%** |
+ * | 50 000 | 2.31% | 1.70% | **1.52%** |
+ *
+ * (p=12's 5.62% at 10 000 is the linear-counting/raw-estimator crossover, and
+ * is exactly why the default is not chosen from the memory column.)
+ * 16 KiB is per `(principal, vault, collection)` — a ~30-principal deployment
+ * with a handful of bulk-declared collections stays in the low megabytes.
+ * `precision` is configurable for a deployment whose corpus is a different
+ * order of magnitude.
+ *
+ * ⛔ An exact per-collection bitmap would be smaller AND exact at that scale.
+ * It is not shipped because it leaks ids: bit *i* set means "record *i* was
+ * read", which is the second copy this module exists to avoid. Revisit only
+ * against a real dataset, and only with that trade stated.
+ */
+export declare class HyperLogLog {
+    readonly precision: number;
+    private readonly registers;
+    constructor(precision?: number);
+    add(id: string): void;
+    /** Estimated distinct count. */
+    count(): number;
+    /** Serializable state — registers only. No id, no id-derived key. */
+    toJSON(): {
+        readonly p: number;
+        readonly r: string;
+    };
+    static fromJSON(state: {
+        readonly p: number;
+        readonly r: string;
+    }): HyperLogLog;
+}
+/**
+ * Bloom filter for *novelty per window* — "have I seen this id in this
+ * window?". False positives under-report novelty (a novel read is scored as a
+ * repeat), which is the safe direction for a sensor that must not cry wolf;
+ * false negatives are impossible.
+ */
+export declare class BloomFilter {
+    readonly bits: number;
+    readonly hashes: number;
+    private readonly words;
+    constructor(bits?: number, hashes?: number);
+    /** Set the id's bits; returns true when the id was NOT already present. */
+    addIfAbsent(id: string): boolean;
+    clear(): void;
+}

package/dist/with-audit/forget/subject-index.d.ts

@@ -32,7 +32,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 /** Reserved collection holding the encrypted subject → records index. */
 export declare const SUBJECT_INDEX_COLLECTION = "_subject_index";

package/dist/with-audit/periods/periods.d.ts

@@ -146,6 +146,7 @@
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/index.js';
+import { ValidationError } from '../../kernel/errors.js';
 export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, } from './window.js';
 /**
  * Companion record recording that a closed period was frozen (its delete
@@ -398,9 +399,25 @@ export interface ClosePeriodOptions {
     /** Human-readable name. Must not collide with an existing period. */
     readonly name: string;
     /**
-     * Inclusive upper cutoff. A record is sealed when its
-     * `record[dateField]` (or, if absent, the envelope `_ts`) is at or
-     * before this ISO timestamp.
+     * Inclusive upper cutoff. With a `dateField`, a record is sealed when its
+     * `record[dateField]` is at or before this ISO timestamp; a record with
+     * NO value there (absent / `null`) carries no business date and belongs
+     * to no period, and a value that is neither an ISO string nor a `Date`
+     * is refused (#1455). Without a `dateField`, the envelope `_ts` of the
+     * stored record is compared instead.
+     *
+     * ⚠️ String comparison is lexicographic: keep `endDate` and the field in
+     * one ISO-8601 shape (`YYYY-MM-DD` against `YYYY-MM-DD`, or full
+     * timestamps against full timestamps).
+     *
+     * ⛔ **Zero-padding is now ENFORCED on both sides (#1459), because that
+     * warning was not enough.** `'2026-6-30'` names a real day and is refused
+     * anyway: as text it sorts BELOW every June date, so the close would seal
+     * nothing and report success — and symmetrically a record dated
+     * `'2026-6-15'` sorted ABOVE `'2026-06-30'` and was written into a sealed
+     * June. Both are `ValidationError` now, at the close and at the write,
+     * rather than a silent pass or a `PeriodClosedError` that fired for a reason
+     * unrelated to dates.
      */
     readonly endDate: string;
     /**
@@ -502,6 +519,17 @@ export interface ReadOnlyCollection<T> {
  * cache. Not part of the public API surface.
  */
 export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+/** sha256(canonicalJson(record)) over the STORED shape of a period record. @internal */
+export declare function hashStoredPeriod(period: PeriodRecord): Promise<string>;
+/**
+ * #1454 — every record's `priorPeriodName` / `priorPeriodHash` must resolve to
+ * a stored predecessor in ITS timeline whose hash matches. Followed by name,
+ * not by sort position: two closes within one millisecond sort arbitrarily,
+ * and a deleted predecessor must read as a break, not as a new root.
+ *
+ * @internal
+ */
+export declare function verifyPeriodChain(records: readonly PeriodRecord[]): Promise<void>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor
@@ -513,22 +541,42 @@ export declare function chainAnchor(records: readonly PeriodRecord[], partition?
     priorPeriodName?: string;
     priorPeriodHash: string;
 }>;
+/**
+ * @internal #1459 — is `value` a business date that can be compared against an
+ * `endDate` and give the calendar's answer?
+ */
+export declare function isOrderableBusinessDate(value: string): boolean;
+/**
+ * @internal #1459 — the refusal, phrased once so the guard and `closePeriod()`
+ * cannot drift on what "malformed" means or on how they say it.
+ */
+export declare function malformedBusinessDate(where: string, value: string): ValidationError;
 /**
  * Throw `PeriodClosedError` if the record being touched falls within
  * any closed period.
  *
- * Three signals, evaluated per period:
+ * Per period, per side (existing record / incoming record):
  *
  *  1. If the period declares a `dateField`, the guard reads
  *     `record[dateField]` on BOTH the existing (prior) record AND the
- *     incoming (new) record. Either comparing `<= endDate` triggers
- *     the error — callers cannot slide a record into a closed period
- *     by editing its date field.
+ *     incoming (new) record, each under its OWN partition. Either comparing
+ *     `<= endDate` triggers the error — callers cannot slide a record into a
+ *     closed period by editing its date field.
+ *     #1455 — value shapes: a string is compared as-is (ISO-8601 assumed —
+ *     the comparison is lexicographic); a `Date` is compared as the ISO string
+ *     it will be stored as; `undefined` / `null` means the record carries no
+ *     business date and belongs to NO period; anything else is REFUSED with
+ *     `ValidationError` — a date the gate cannot evaluate is not a permission.
  *  2. If the period has no `dateField`, the guard falls back to the
  *     envelope `_ts` of the existing record. Fresh inserts (no
  *     existing envelope) pass.
  *  3. For a delete, only the existing side is checked.
  *
+ * #1456 — a value is OWNED by the closed period in its timeline with the
+ * smallest `endDate` at or after it. When that owner is effectively reopened,
+ * no later close vetoes the value: reopening January frees January-dated
+ * rows even with February and March closed, and February's rows stay sealed.
+ *
  * @internal
  */
 export declare function assertTsWritable(existing: {

package/dist/with-audit/periods/reserved-collections.d.ts

@@ -0,0 +1,3 @@
+export declare const PERIODS_RESERVED_COLLECTIONS: ReadonlySet<string>;
+/** True when `name` belongs to the periods family (#1454). */
+export declare function isPeriodsReservedCollection(name: string): boolean;

package/dist/with-audit/periods/vault-facade.d.ts

@@ -1,4 +1,4 @@
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/store.js';
 import type { Collection } from '../../kernel/collection.js';
@@ -166,6 +166,23 @@ export declare class VaultPeriods {
     private mergeReopenState;
     /** Resolve one period within the timeline named by `options` (vault-wide when absent). */
     private findPeriod;
+    /**
+     * #1439 — could a closed period govern this record? Synchronous, and
+     * deliberately a SUPERSET of what {@link assertTsWritable} would refuse.
+     *
+     * Exists so a caller can tell "the period gate is registered" from "the
+     * period gate can fire for this row". Those were conflated, and the cost was
+     * that installing `withPeriods()` disabled an unrelated optimisation for
+     * every collection in the vault — with no period closed and no collection
+     * registered as a subject (#1439, measured: 0 → 250 redundant MV writes per
+     * source write).
+     *
+     * ⛔ Answers `true` whenever it cannot rule the gate out: the cache is not
+     * loaded yet, a closed period has no `dateField` to test against, or no row
+     * was supplied. A predicate that exists to permit an optimisation must fail
+     * towards "the gate applies", never away from it.
+     */
+    couldGovern(record?: Record<string, unknown>): boolean;
     /** Called by the gate bus before put/delete. `collection` selects the subject mapping (#1005). */
     assertTsWritable(existing: {
         ts: string | null;

package/dist/with-audit/sealed-record/index.d.ts

@@ -57,8 +57,8 @@ export { SealedRecordNotEnabledError } from '../../kernel/errors.js';
  * opens, even with a valid sealed CEK.
  */
 export declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
-    readonly _iv: string;
-    readonly _data: string;
+    readonly _iv?: string;
+    readonly _data?: string;
     /** Bound into the AAD since #1093 — a rewound body no longer opens. */
     readonly _v: number;
     readonly _tier?: number | undefined;

package/dist/with-audit/sealed-record/strategy.d.ts

@@ -12,7 +12,7 @@
  * stays ungated). Only the vault-side grantor operations are the capability.
  * @internal
  */
-import type { SealingContext } from '../../kernel/enclave/index.js';
+import type { SealingContext } from '../../capsule/index.js';
 import type { RecipientSealer } from '../../with-party/team/managed-secret.js';
 export interface SealedRecordStrategy {
     sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {

package/dist/with-audit/tiers/index.d.ts

@@ -23,7 +23,7 @@
 export { withTiers } from './active.js';
 export { NO_TIERS, type TiersStrategy } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
-import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
+import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../capsule/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
@@ -36,6 +36,25 @@ export interface TiersContext<T> {
     readonly vault: string;
     /** The ciphertext store. */
     readonly adapter: NoydbStore;
+    /**
+     * #1358 — the unique-constraint keys a record occupies, or `[]` when the
+     * record is exempt (null-distinct) . `undefined` when the collection
+     * declares no `unique` index, which is what makes the tier scan free for
+     * every other collection. Deliberately a plain callback rather than the
+     * `UniqueConstraintSet` itself: the tier domain must not import the
+     * indexing domain, and this is the whole of what it needs.
+     */
+    readonly uniqueKeys?: ((record: unknown) => ReadonlyArray<{
+        readonly fields: readonly string[];
+        readonly key: string;
+    }>) | undefined;
+    /**
+     * #1358 — the collection's own tier-0 unique pre-flight (the eager map or
+     * the lazy `_idx/` probe). `putAtTier` runs it before its write because it
+     * bypasses `Collection.put()` entirely; the tier-0 `put()` path calls it
+     * directly and does not need this. `undefined` ⇒ no unique index declared.
+     */
+    readonly checkUniqueLocal?: ((id: string, record: unknown) => Promise<void>) | undefined;
     /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */
     readonly keyring: UnlockedKeyring;
     /** The record codec — decrypts a tier-0 envelope to T. */
@@ -367,6 +386,38 @@ export declare function putAtTier<T>(ctx: TiersContext<T>, id: string, record: T
  * when `_tier > 0`.
  */
 export declare function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>;
+/**
+ * Unique-constraint enforcement across TIERS (#1358).
+ *
+ * The in-memory / persisted mirrors that back ordinary unique enforcement
+ * hold TIER-0 records only — #709 purges an elevated record's index entries
+ * precisely so elevation actually hides its field values. That is correct,
+ * and it is also exactly why a tier-0 `put()` would otherwise be free to
+ * re-take a value an elevated record still holds. This closes that by
+ * scanning the above-tier records the writer can decrypt.
+ *
+ * ## The guarantee, stated exactly
+ *
+ * Uniqueness is enforced across **every tier whose DEK this writer holds**.
+ * A tier the writer cannot read is **outside the guarantee**: those records
+ * are not merely skipped-with-a-warning, they are unreadable, so no local
+ * check of any design can see them. A duplicate against such a record is
+ * accepted, and stays accepted. Do not describe this as "enforced across all
+ * tiers" anywhere.
+ *
+ * ## Cost
+ *
+ * Zero for a collection with no unique index (`ctx.uniqueKeys` is undefined
+ * and this returns immediately) and for one with no elevated records (the
+ * scan reads envelope headers only until it meets a `_tier > 0` row it can
+ * read). On a tiered collection that DOES hold both, it is a list + get per
+ * write — the price of the guarantee, paid only where it was asked for.
+ *
+ * No cross-tier ACCESS event is emitted per scanned record: this is a
+ * constraint pre-flight over material the writer is already cleared for, not
+ * a read the caller asked for. The write it gates emits its own event.
+ */
+export declare function checkUniqueAcrossTiers<T>(ctx: TiersContext<T>, id: string, record: T): Promise<void>;
 /**
  * list ids grouped by the caller's readability. Returns only ids whose tier the
  * caller can read. Above-tier ids are omitted in `'invisibility'` mode and
@@ -407,4 +458,4 @@ export declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: numb
 export declare function classifySealedShred<T>(ctx: TiersContext<T>, live: EncryptedEnvelope): Promise<{
     readonly slots: readonly SealedShredSlot[];
 }>;
-export type { SealedShredSlot } from '../../kernel/enclave/index.js';
+export type { SealedShredSlot } from '../../capsule/index.js';

package/dist/with-audit/tiers/strategy.d.ts

@@ -27,6 +27,14 @@ export interface TiersStrategy {
     }>>;
     elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>;
     demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>;
+    /**
+     * #1358 — unique-constraint scan across every tier whose DEK the writer
+     * holds. Called by the ORDINARY `Collection.put()` on a tiered collection
+     * (`putAtTier` calls the core directly): the tier-0 mirror cannot see an
+     * elevated record, because #709 purges its index entries on elevation.
+     * A tier the writer cannot read is outside the guarantee.
+     */
+    checkUnique<T>(ctx: TiersContext<T>, id: string, record: T): Promise<void>;
 }
 /**
  * No-op stub — the floor default. Every capability method throws

package/dist/with-cargo/adopt-partition.d.ts

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../kernel/enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import type { NoydbStore } from '../kernel/types.js';
 import type { NoydbSealer } from '../with-party/team/managed-secret.js';
 import type { NoydbShamir } from '../with-party/team/noydb-shamir.js';

package/dist/with-cargo/extract-partition.d.ts

@@ -8,7 +8,7 @@
  */
 import type { Vault } from '../kernel/vault.js';
 import type { EncryptedEnvelope } from '../kernel/types.js';
-import { type EnclaveKey } from '../kernel/enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import { type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js';
 import { type TransferSealPayload } from '../with-pod/pod.js';
 /** Re-keyed collections snapshot + the fresh DEKs used. */

package/dist/with-cargo/floor.d.ts

@@ -13,7 +13,7 @@ export { readPath } from '../kernel/query/predicate.js';
 export { reduceRecords } from '../with-lookup/reduce/reduction.js';
 export { groupAndReduce } from '../with-lookup/reduce/groupby.js';
 export { generateULID } from '../with-pod/ulid.js';
-export { sha256Hex } from '../kernel/enclave/index.js';
+export { sha256Hex } from '../capsule/index.js';
 export { isQuorum, runDrainBarrier } from '../port/by/index.js';
 export { fuseRetrieval } from '../with-lookup/search/fuse.js';
 export { CrossShardJoinError, DataResidencyError, NoAccessError, ReservedVaultNameError, ShardProvisioningError, UnknownShardError, ValidationError, VaultTemplateNotFoundError, } from '../kernel/errors.js';
@@ -24,8 +24,8 @@ export type { Collection } from '../kernel/collection.js';
 export type { Noydb } from '../kernel/noydb.js';
 export type { Operator } from '../kernel/query/predicate.js';
 export type { Query } from '../kernel/query/builder.js';
-export type { JoinStrategy } from '../kernel/query/join.js';
-export type { LiveQuery } from '../kernel/query/live.js';
+export type { JoinStrategy } from '../kernel/query/relate/join.js';
+export type { LiveQuery } from '../kernel/query/live/live.js';
 export type { ReduceResult, ReduceSpec, LiveReduction, } from '../with-lookup/reduce/reduction.js';
 export type { IndexDef } from '../with-lookup/indexing/eager-indexes.js';
 export type { FuseOptions } from '../with-lookup/search/fuse.js';

package/dist/with-commit/history/history.d.ts

@@ -1,6 +1,6 @@
-import type { RecordIdentity } from '../../kernel/enclave/index.js';
+import type { RecordIdentity } from '../../capsule/index.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /**
  * The identity a history snapshot is **sealed against** — its STORAGE location,
  * not the live record it is a copy of (#1041).

package/dist/with-commit/history/index.d.ts

@@ -30,4 +30,4 @@ export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_HISTORY } from './strategy.js';
-export type { RecordIdentity } from '../../kernel/enclave/index.js';
+export type { RecordIdentity } from '../../capsule/index.js';

package/dist/with-commit/history/ledger/store.d.ts

@@ -44,7 +44,7 @@
  * puts via `collection('_ledger')` would bypass the `append()` logic.
  */
 import type { NoydbStore } from '../../../kernel/types.js';
-import { type EnclaveKey } from '../../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../../capsule/index.js';
 import { type LedgerEntry } from './entry.js';
 import type { JsonPatch } from './patch.js';
 import { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from './constants.js';

package/dist/with-commit/history/strategy.d.ts

@@ -33,7 +33,7 @@ import type { LedgerStore } from './ledger/store.js';
 import type { JsonPatch } from './ledger/patch.js';
 import type { DiffEntry } from './diff.js';
 import type { VaultInstant, VaultEngine } from './time-machine.js';
-import type { EnclaveKey, RecordIdentity } from '../../kernel/enclave/index.js';
+import type { EnclaveKey, RecordIdentity } from '../../capsule/index.js';
 /**
  * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the
  * `LedgerStore` constructor verbatim — kept in this file so `core`

package/dist/with-commit/history/time-machine.d.ts

@@ -48,7 +48,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from './ledger/store.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /**
  * Narrow view of a {@link Vault}'s internals that
  * {@link VaultInstant} needs. Passed in by `Vault.at()` rather than

package/dist/with-commit/numbering/index.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { DeferredNumberingConfig } from './descriptor.js';
 export declare const NUMBERING_HEAD_COLLECTION = "_numbering_head";
 export declare const NUMBERING_PENDING_COLLECTION = "_numbering_pending";