@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/with-shape/blobs/blob-set.d.ts

@@ -1,7 +1,7 @@
 import type { NoydbStore, BlobObject, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions } from '../../kernel/types.js';
 import type { ObjectProjection } from './object-projection.js';
 import type { BlobFieldsConfig } from './blob-compaction.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import { type BlobPinCache } from './blob-pinning.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 /**
@@ -82,6 +82,8 @@ export declare class BlobSet {
      * a cleared view: see `ownerRecordElevated()`/`ownerTier()`.
      */
     private readonly clearedTier;
+    /** #1452 — see `BlobsStrategyOpenArgs.assertOwnerWritable`. */
+    private readonly assertOwnerWritable;
     constructor(opts: {
         store: NoydbStore;
         vault: string;
@@ -99,6 +101,7 @@ export declare class BlobSet {
         keyring?: UnlockedKeyring;
         clearedTier?: number;
         pinCache?: BlobPinCache;
+        assertOwnerWritable?: () => Promise<void>;
     });
     /**
      * #724 I1 completion: a legacy (non-`perRecordKeys`) blob has no per-blob
@@ -492,7 +495,7 @@ export declare class BlobSet {
      *     covered by rotation.
      *
      * This also makes one ordering rule true across the blob subsystem rather
-     * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+     * than two opposite ones: `capsule/plumbing/rekey-blob.ts` already
      * re-encrypts chunks before re-sealing their index entry, and documents that
      * order as its resume property.
      *
@@ -1275,10 +1278,26 @@ export declare class BlobSet {
      */
     list(): Promise<SlotInfo[]>;
     /**
-     * Delete the named slot from this record.
-     * Decrements refCount on the blob. Chunks are GC'd by `vault.blobGC()`.
+     * Delete the named slot from this record and decrement the blob's refCount.
+     * At refCount 0 an erasable blob (`perRecordKeys`) is crypto-shredded on the
+     * spot; a legacy blob keeps its chunks until
+     * `vault.compact({ reclaimLegacyBlobs: true })` reclaims them (#1453), or
+     * `blob(id).migrate()` makes it erasable first.
+     *
+     * Gated on the owning record (#1452): refused where an update of the record
+     * would be refused.
      */
     delete(slotName: string): Promise<void>;
+    /**
+     * #1451 — release EVERY slot this record holds. Called by
+     * `Collection.delete()` after the record is gone, so "the record is deleted"
+     * and "its attachments are released" are one operation. Ungated: the record
+     * delete itself already passed the gate bus. Ref-counted like any release —
+     * content another record still holds survives.
+     */
+    releaseAll(): Promise<void>;
+    /** The body of {@link delete}, minus the owner gate. */
+    private releaseSlot;
     /**
      * Pin the named slot for offline availability ON THIS DEVICE.
      *

package/dist/with-shape/blobs/legacy-sweep.d.ts

@@ -0,0 +1,35 @@
+/**
+ * #1453 — count, and optionally reclaim, legacy blobs nothing references.
+ *
+ * A legacy blob (no per-blob `_cek`) is left at refCount 0 "for deferred GC"
+ * by `releaseRef`; before this the deferred GC had no verb outside
+ * `forget()` (which needs `withForget`), and `orphanBlobChunks` could not see
+ * these rows because they keep their index entry — so `vault.compact()`
+ * reported clean over a vault whose blob storage grew on every overwrite.
+ *
+ * Reclaiming here is SAFE where reclaiming orphans is not (see
+ * `orphan-report.ts`): the decision reads `refCount` off an AAD-bound index
+ * row the hub decrypted itself, never the store's `list()`. A withholding
+ * store cannot make a live blob look unreferenced; it can only hide a row from
+ * this sweep, which then does nothing to it.
+ *
+ * Rows sealed at an elevated tier do not open under the flat `_blob` DEK and
+ * are skipped, not counted: this is a tier-0 pass.
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../capsule/index.js';
+/** What `vault.compact()` reports (and, on request, reclaims) about legacy blobs. */
+export interface UnreferencedLegacyBlobReport {
+    /** `_blob_index` rows with no `_cek` (legacy) and `refCount <= 0`. */
+    readonly blobs: number;
+    /** Chunk rows those blobs still hold. */
+    readonly chunks: number;
+    /** How many of those blobs this run deleted (chunks first, then the index row). */
+    readonly reclaimed: number;
+}
+export declare function sweepUnreferencedLegacyBlobs(ctx: {
+    adapter: NoydbStore;
+    vault: string;
+    getDEK: (name: string) => Promise<EnclaveKey>;
+    encrypted: boolean;
+}, reclaim: boolean): Promise<UnreferencedLegacyBlobReport>;

package/dist/with-shape/introspection/describe.d.ts

@@ -22,7 +22,7 @@ import type { ComputedFields } from '../../with-formula/computed/index.js';
 import type { RefDescriptor } from '../../kernel/refs.js';
 import type { ClassifiedFieldSpec } from '../../via/classified/descriptor.js';
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 export interface DescribedField {
     readonly key: string;
     /**
@@ -48,6 +48,12 @@ export interface DescribedField {
     readonly semanticType?: string;
     readonly unit?: string;
     readonly sensitivity?: 'public' | 'pii' | 'secret';
+    /**
+     * Read-shape sensitivity (#1363) — orthogonal to {@link DescribedField.sensitivity}.
+     * Telemetry plumbing, never a control: it tells a sensor which collections
+     * have a coverage worth accounting for. See `FieldMeta.bulk`.
+     */
+    readonly bulk?: 'sensitive';
     readonly aggregate?: 'sum' | 'count' | 'distinct' | 'none';
     readonly aliases?: readonly string[];
     readonly ref?: {

package/dist/with-shape/introspection/field-meta.d.ts

@@ -19,6 +19,24 @@ export interface FieldMeta {
     unit?: string;
     /** Data classification driving redaction/inspector masking. */
     sensitivity?: 'public' | 'pii' | 'secret';
+    /**
+     * Sensitivity that is a property of the READ SHAPE, not the value (#1251).
+     *
+     * ⚠️ Declaring this prevents nothing. Against an insider holding the device
+     * and local keys it is TELEMETRY: it lets an opt-in sensor make bulk
+     * extraction visible early, attributable and loud. The real remediation is
+     * key custody — tiers and per-collection DEKs — not this label.
+     *
+     * Reads as: *this field's collection is a corpus whose COVERAGE is a
+     * protected quantity.* Deliberately ORTHOGONAL to {@link FieldMeta.sensitivity}:
+     * a company tax id stays `'public'` (it is public by law) and is still
+     * `bulk: 'sensitive'`, because the book of business is the set, not the value.
+     *
+     * The kernel does NOTHING with it beyond carrying it through introspection
+     * (`describe()` / `dumpSchema()`), so a sensor can discover which
+     * collections to account for. Zero runtime cost when unused.
+     */
+    bulk?: 'sensitive';
     /** Default aggregation for this field. */
     aggregate?: 'sum' | 'count' | 'distinct' | 'none';
     /** Canonical search synonyms (data vocabulary, not UI). */

package/dist/with-shape/introspection/types.d.ts

@@ -46,6 +46,16 @@ export interface FieldDescriptor {
     readonly optional?: boolean;
     /** Foreign-key target as `<collection>.<field>` when declared. */
     readonly references?: string;
+    /**
+     * Read-shape sensitivity, declared as `FieldMeta.bulk` (#1363). Present only
+     * when the collection is live in this process (the declaration lives in the
+     * `fieldMeta` channel, which is not persisted with the schema).
+     *
+     * ⚠️ Telemetry, never a control: it tells a coverage sensor which
+     * collections have a corpus worth accounting for. Against an insider holding
+     * the device and local keys it prevents nothing — key custody does.
+     */
+    readonly bulk?: 'sensitive';
 }
 export interface CollectionStats {
     readonly records: number;
@@ -113,6 +123,23 @@ export interface CollectionDescriptor {
     readonly stats?: CollectionStats;
     readonly meta?: CollectionMeta;
     readonly config?: CollectionConfig;
+    /**
+     * #1447 — fields the datastore itself computes or resolves, as
+     * `field → the via brands covering it` (`money`, `computed`, `i18n`,
+     * `lookup`, `geo`, `classified`, `blob`). Absent when the collection
+     * declares no via pipeline.
+     *
+     * Exists so a consumer can gate documentation against what the vault
+     * actually enforces. The reported case: a rulebook described three
+     * vault-computed fields as app-owned — the UNDERSTATING direction, which is
+     * silent, because it produces app-side reimplementation of a guarantee that
+     * already exists rather than a missing behaviour someone trips over.
+     *
+     * ⛔ Brand and field only. A binding's CONFIGURATION is deliberately absent:
+     * a dump saying "this field is classified, sensitivity pii" is a map of the
+     * columns worth attacking, in an artefact that by design leaves the vault.
+     */
+    readonly via?: Record<string, readonly string[]>;
 }
 export interface MaterializedViewDescriptor {
     readonly sources: ReadonlyArray<string>;
@@ -134,8 +161,37 @@ export interface InternalCollectionStats {
     readonly records: number;
     readonly bytes: number;
 }
+/**
+ * A report section `dumpSchema()` is capable of emitting (#1447).
+ *
+ * ⛔ CAPABILITY OF THE EMITTER, NEVER CONTENT OF THIS DUMP. `reports` lists
+ * what this hub *would* have reported, not what it found — a vault that
+ * genuinely declares no via fields still lists `'via'`.
+ *
+ * That distinction is the entire point. A content-based list reintroduces the
+ * ambiguity it exists to remove: a consumer could not tell "no via fields
+ * here" from "this hub cannot report them", which is exactly how a
+ * documentation gate switching to the live report passes VACUOUSLY on a hub
+ * too old to answer. Measured by a consumer attempting that adoption.
+ */
+export type SnapshotReport = 'via' | 'stats';
 export interface VaultSchemaSnapshot {
-    readonly _noydb_snapshot: 1;
+    readonly _noydb_snapshot: 2;
+    /**
+     * Which report sections this snapshot's emitter can produce (#1447).
+     *
+     * Check this before concluding anything from an ABSENT section:
+     *
+     * ```ts
+     * if (!snap.reports.includes('via')) throw new Error('hub cannot report via')
+     * // only now is a missing `via` key evidence that a collection declares none
+     * ```
+     *
+     * Required, and required deliberately: an optional field would leave
+     * `undefined` meaning "old emitter", which is the same ambiguity one level up.
+     * Every snapshot states what it can say.
+     */
+    readonly reports: readonly SnapshotReport[];
     readonly vault: string;
     readonly emittedAt: string;
     readonly subsystems: Record<string, boolean>;

package/dist/with-shape/introspection/walk.d.ts

@@ -10,7 +10,7 @@ import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { RefRegistry } from '../../kernel/refs.js';
 import type { VaultMeta } from './meta.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /**
  * The minimal slice of Vault internal state the walker needs.
  * Exposed via `vault._introspectState()` to keep the public Vault

package/dist/with-shape/links/lazy-handle.d.ts

@@ -14,7 +14,7 @@
 import { type LinkRow, type LinkSpec, type LinkSetHandle } from './names.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /** @internal The lazy handle: public surface + facade cascade internals. */
 export type LazyLinkSetHandle = LinkSetHandle & {
     readonly _collectionName: string;

package/dist/with-shape/links/link-set.d.ts

@@ -19,7 +19,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import { NoydbError } from '../../kernel/errors.js';
 export { LINK_COLLECTION_PREFIX, linkCollectionName, isLinkCollectionName, linkRowKey, LinkIntegrityError, } from './names.js';
 export type { LinkOnDelete, LinkSpec, LinkRow, LinkSetHandle } from './names.js';

package/dist/with-shape/links/vault-facade.d.ts

@@ -16,7 +16,7 @@
  */
 import { type RefDescriptor, type RefViolation, type RefRegistry } from '../../kernel/refs.js';
 import { type LinkSpec, type LinkSetHandle } from './names.js';
-import type { JoinableSource } from '../../kernel/query/index.js';
+import type { JoinableSource } from '../../kernel/query/relate/join.js';
 import type { Collection } from '../../kernel/collection.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { TxContext } from '../../with-commit/tx/transaction.js';

package/dist/with-shape/manifest/derive.d.ts

@@ -42,7 +42,7 @@
  *
  * @module
  */
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { SchemaManifest } from './types.js';
 /**

package/dist/with-shape/manifest/storage.d.ts

@@ -20,7 +20,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import { type SchemaManifest, type SchemaManifestEntry } from './types.js';
 /** A resolver for a collection's DEK — the same shape as `Vault`'s internal `getDEK`. */

package/dist/with-shape/persisted-schemas/register.d.ts

@@ -18,7 +18,7 @@ import type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/type
 import type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js';
 import type { PersistedSchemaEnvelope } from './types.js';
 import type { PairingMarker } from '../satellites/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 export interface PersistSchemaResult {
     /** True when a fresh envelope was written to storage. */
     readonly written: boolean;

package/dist/with-shape/persisted-schemas/storage.d.ts

@@ -14,7 +14,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { PersistedSchemaEnvelope } from './types.js';
 /** Reserved collection name where persisted schemas live. */

package/dist/with-shape/satellites/dead-filter.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /**
  * Build a live-base id set for every satellite collection detectable from
  * its persisted `_schemas/<name>` pairing marker (#591 Task 10).

package/dist/with-shape/satellites/declare.d.ts

@@ -8,7 +8,7 @@
  * `Vault` import — the kernel supplies a {@link SatelliteDeclareContext}.
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import { SatelliteRegistry } from './registry.js';
 /** The narrow slice of Vault that declaration wiring needs. */
 export interface SatelliteDeclareContext {

package/dist/with-shape/satellites/marker.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { SatelliteSpec } from './types.js';
 /**
  * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.

package/dist/with-shape/satellites/post-register.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { SatelliteSpec } from './types.js';
 import type { SatelliteRegistry } from './registry.js';
 /** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */