@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/with-store/partitioned/index.d.ts

@@ -0,0 +1,337 @@
+/**
+ * Partitioned collections — the union read path and the declaration surface
+ * (#1342, ADR 0007 "partitioning is collection-shaped").
+ *
+ * ## What was ruled, and what that left to build
+ *
+ * ADR 0007 ruled **NO** on lifting a partition value into a storage key or
+ * into cleartext envelope metadata: it is a permanent per-record
+ * classification handed to the backend, and it widens `@noy-db/hub/to` across
+ * every `to-*` adapter and the conformance kit to buy a win on one read path.
+ * `NoydbStore.listPage` is untouched by this file, and must stay untouched.
+ *
+ * It ruled instead that **a partition IS a collection**. The store already
+ * sees collection names in cleartext — `listPage(vault, collection, cursor,
+ * limit)` takes the name as a parameter — so `invoices@FY2026-Q1` prunes for
+ * free: `listPage` never fetches an excluded partition because it is never
+ * asked to. No seam change, no new leak class, and partition = collection =
+ * DEK makes it a REAL boundary rather than an advisory one (per-collection
+ * wrapping, #1004): a principal granted only Q1 cannot decrypt Q2, and a
+ * closed period's DEK can be archived or dropped outright — something a
+ * scoped predicate can never do.
+ *
+ * The honest cost of that ruling was three missing pieces. This module is
+ * them:
+ *
+ *   1. **a cross-collection union read path** — there was none, so a query
+ *      spanning four quarters meant running four and merging by hand;
+ *   2. **cheap partition enumeration** — `vault.collections()` is
+ *      `adapter.loadAll(vault)`, the WHOLE vault snapshot, so even LISTING
+ *      partitions cost a full load;
+ *   3. **a declaration** binding a set of collections into one logical
+ *      collection with a partition key, so a `where` on that key can prune.
+ *
+ * ## Where the win actually is
+ *
+ * `collection.query()` runs over an already-decrypted in-memory cache with
+ * hash / sorted / compound dispatch in front of it (#1344, #1345), so pruning
+ * there is strictly weaker than an index that already ships. `scan()` is the
+ * prize: every page is DECRYPTED, so a partition never fetched is a page
+ * never decrypted. {@link PartitionedScan} is where the measured win lives;
+ * {@link PartitionedQuery} exists because a union that only streams is not a
+ * union read path.
+ *
+ * ## Why this is a free function and not `vault.partitioned()`
+ *
+ * `check-architecture`'s kernel-surface ratchet leaves `vault.ts` one line of
+ * headroom, and a service that re-couples itself into the kernel is exactly
+ * what that ratchet exists to catch. It is also not a `with*()` factory: once
+ * ADR 0007 removed the storage-layout policy (there is no key prefixing to
+ * configure — the partition is a collection), nothing is left to opt into.
+ * What remains is a query-shaped helper over collections the caller already
+ * owns, so it is a plain function, tree-shaken when unused.
+ *
+ * ## The immutability precondition, stated once
+ *
+ * ⛔ **A record's partition key must be immutable.** If a record can be edited
+ * from one partition to another, a scope derived at plan time and a scope
+ * derived at read time can disagree, and the difference is silently missing
+ * rows. {@link PartitionedCollection.put} routes on `record[key]` and will
+ * happily write the same id into two partitions if the key changes; it does
+ * not police this, because it cannot see the prior value without reading
+ * every partition — which is the cost the whole design exists to avoid.
+ */
+import type { Collection } from '../../kernel/collection.js';
+import type { Vault } from '../../kernel/vault.js';
+import type { Operator } from '../../kernel/query/predicate.js';
+import type { OrderBy } from '../../kernel/query/builder.js';
+import type { QueryExplanation } from '../../kernel/query/relate/explain.js';
+import { ScanBuilder } from '../../kernel/query/scan-builder.js';
+import type { ScanPageProvider } from '../../kernel/query/scan-builder.js';
+import type { ReduceResult, ReduceSpec } from '../../with-lookup/reduce/reduction.js';
+import type { PartitionScope } from '../../kernel/query/relate/partition.js';
+/**
+ * The collection holding one registry record per partitioned logical
+ * collection. A normal, ENCRYPTED collection — the partition list is record
+ * content, not a record id, so declaring a partition set adds no cleartext
+ * channel of its own. (The partition VALUES do become collection names, and
+ * that exposure is ADR 0007's deliberate, developer-visible trade; this
+ * registry does not widen it.)
+ */
+export declare const PARTITION_REGISTRY_COLLECTION = "_partition_sets";
+/** How a partition value becomes a collection name. */
+export type PartitionNamer = (logicalName: string, partition: string) => string;
+/** The default: `invoices` + `FY2026-Q1` → `invoices@FY2026-Q1`. */
+export declare const defaultPartitionNamer: PartitionNamer;
+export interface PartitionSpec<T> {
+    /** The logical collection name. Never itself a stored collection. */
+    readonly name: string;
+    /**
+     * The field whose value names the partition. ⛔ Must be immutable per
+     * record — see this module's header.
+     */
+    readonly key: keyof T & string;
+    /**
+     * Partition values known to the caller. Merged with whatever the registry
+     * already holds, so a caller may declare none and rely on the registry, or
+     * declare the full set and never write one.
+     */
+    readonly partitions?: readonly string[];
+    /** Override the partition → collection-name mapping. */
+    readonly namer?: PartitionNamer;
+    /**
+     * Options passed to every member `vault.collection()` — indexes, refs,
+     * schema. Identical across partitions by construction: they are one logical
+     * collection, and a per-partition shape would make the union unsound.
+     */
+    readonly collectionOptions?: unknown;
+}
+/**
+ * Bind a set of collections into one partitioned logical collection.
+ *
+ * ```ts
+ * const invoices = partitioned<Invoice>(vault, {
+ *   name: 'invoices',
+ *   key: 'period',
+ *   partitions: ['FY2026-Q1', 'FY2026-Q2', 'FY2026-Q3', 'FY2026-Q4'],
+ * })
+ *
+ * await invoices.put('inv-1', { id: 'inv-1', period: 'FY2026-Q1', amount: 100 })
+ *
+ * // reads ONE collection — the other three are never asked for
+ * const q1 = await invoices.query().where('period', '==', 'FY2026-Q1').all()
+ *
+ * // reads all four, merged, sorted and paged AFTER the union
+ * const top = await invoices.query().orderBy('amount', 'desc').limit(10).all()
+ * ```
+ */
+export declare function partitioned<T>(vault: Vault, spec: PartitionSpec<T>): PartitionedCollection<T>;
+export declare class PartitionedCollection<T> {
+    readonly name: string;
+    readonly key: string;
+    private readonly vault;
+    private readonly namer;
+    private readonly collectionOptions;
+    private readonly declared;
+    /**
+     * Session cache of the REGISTRY's partition list — deliberately not of the
+     * merged set. The two are different questions and conflating them cost a
+     * red test: `ensurePartition` must persist a partition the caller DECLARED
+     * but never wrote, and a cache of the merged set makes every declared value
+     * look already-known, so the registry stays empty and a later session that
+     * declares nothing enumerates nothing.
+     */
+    private stored;
+    constructor(vault: Vault, spec: PartitionSpec<T>);
+    /** The member collection name for a partition value. */
+    collectionNameOf(partition: string): string;
+    /** The member `Collection` for one partition. */
+    partition(value: string): Collection<T>;
+    /**
+     * The declared partition set, in declaration order.
+     *
+     * ⭐ **This is the "cheap enumeration" half of #1342, and cheap means a
+     * measured thing.** `vault.collections()` is `adapter.loadAll(vault)` — the
+     * whole vault snapshot, every collection, every envelope — so enumerating
+     * twelve quarters cost a full load before this existed. Here it is ONE
+     * record read out of {@link PARTITION_REGISTRY_COLLECTION}, and zero reads
+     * once the session has resolved it.
+     * `__tests__/partitioned-collection.test.ts` asserts the `loadAll` count is
+     * zero rather than trusting the sentence.
+     */
+    partitions(): Promise<readonly string[]>;
+    /**
+     * Declare a partition, persisting it so a later session enumerates it
+     * without the caller re-declaring. Idempotent, and keyed on what the
+     * REGISTRY holds rather than on what this handle declared.
+     */
+    ensurePartition(value: string): Promise<void>;
+    private loadStored;
+    /**
+     * Write a record into the partition its key names, declaring that partition
+     * if it is new.
+     *
+     * Throws when `record[key]` is not a string — a partition value names a
+     * collection, and routing a record to a partition derived by coercion is
+     * how a record ends up somewhere no query will look for it.
+     */
+    put(id: string, record: T): Promise<void>;
+    /** A union query across the member collections, pruned by the predicate. */
+    query(): PartitionedQuery<T>;
+    /**
+     * A union scan across the member collections, pruned by the predicate.
+     * Pages are decrypted, so an excluded partition is decryption never paid.
+     */
+    scan(opts?: {
+        pageSize?: number;
+    }): PartitionedScan<T>;
+    /** @internal — the normalizer for clause shapes, and the union's legs. */
+    _registryName(): string;
+    private registry;
+}
+/** `record[partitionKey]` was absent, empty, or not a string. */
+export declare class PartitionKeyError extends Error {
+    constructor(collection: string, key: string, value: unknown);
+}
+/**
+ * One recorded builder call, replayed onto each in-scope member's own
+ * builder.
+ *
+ * ⭐ **Replay, not re-implementation.** The alternative was to build `Clause`
+ * objects here, which would have meant a second copy of `Query.where()`'s
+ * normalization — the `matches` lowering (#1357), the subquery resolution
+ * (#1351), the Via posture gate and the operand rewrite. A second copy is a
+ * second thing to drift. Instead every leg is a real `Query` / `ScanBuilder`
+ * that normalized the call itself, and the PRUNING reads the normalized
+ * `Clause[]` back off one of them — so the clause the pruner classifies is
+ * byte-identical to the clause the executor evaluates.
+ */
+type Step<T> = {
+    readonly kind: 'where';
+    readonly field: string;
+    readonly op: Operator;
+    readonly value: unknown;
+} | {
+    readonly kind: 'filter';
+    readonly fn: (record: T) => boolean;
+};
+/**
+ * A union query across a partitioned collection's members.
+ *
+ * **Filtering runs per leg; ordering and paging run AFTER the union** — the
+ * same shape `orderBy('client.name')` needed when the sort moved after the
+ * join legs (#1337). A `limit` is deliberately NOT pushed down: the top ten
+ * of the union is not the top ten of any one leg, and a leg-local limit would
+ * be correct only for an unordered query, which is the case nobody writes.
+ */
+export declare class PartitionedQuery<T> {
+    private readonly col;
+    private readonly steps;
+    private readonly orderBys;
+    private readonly limitN;
+    private readonly offsetN;
+    constructor(col: PartitionedCollection<T>, steps: readonly Step<T>[], orderBys: readonly OrderBy[], limitN: number | undefined, offsetN: number);
+    private with;
+    where(field: keyof T & string, op: Operator, value: unknown): PartitionedQuery<T>;
+    filter(fn: (record: T) => boolean): PartitionedQuery<T>;
+    orderBy(field: keyof T & string, direction?: 'asc' | 'desc'): PartitionedQuery<T>;
+    limit(n: number): PartitionedQuery<T>;
+    offset(n: number): PartitionedQuery<T>;
+    /** The pruning decision for this query, and the set it was taken against. */
+    scope(): Promise<{
+        declared: readonly string[];
+        scope: PartitionScope;
+    }>;
+    /**
+     * The matched rows, unordered and unpaged — the set every reduce-shaped
+     * terminal reports over, matching `Query.count()`'s rule that orderBy /
+     * limit / offset describe a page and a reduction is not paginated.
+     */
+    private matched;
+    /** The union, sorted then paged. */
+    all(): Promise<T[]>;
+    first(): Promise<T | null>;
+    count(): Promise<number>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Promise<ReduceResult<Spec>>;
+    /**
+     * The plan, with the partition decision as its first line:
+     *
+     * ```
+     * partitions partitions: 1 of 12 scanned [partitions:pruned] -- key "period"; FY2026-Q1
+     * source snapshot (no indexes) [source] rows=500
+     * where period == "FY2026-Q1" [scan] rows=500
+     * ```
+     *
+     * ⭐ The dispatch label is decided by {@link resolvePartitionScope} — the
+     * SAME call the executor makes, not a mirror of it. `explain.ts`'s header
+     * warns that its index dispatch mirrors `candidateRecords`; #1375 deleted
+     * one such mirror, and a partition dispatch would have been a third site.
+     *
+     * The nodes after the partition line are the FIRST in-scope member's own
+     * explanation. Every member runs the same plan over the same shape, so one
+     * leg's nodes describe them all; the partition line is what says how many
+     * legs there are.
+     */
+    explain(): Promise<QueryExplanation>;
+}
+/**
+ * A union scan across a partitioned collection's members — **the path where
+ * pruning pays.**
+ *
+ * Each page is fetched through the member collection's `listPage`, which
+ * DECRYPTS it. An excluded partition is therefore not merely a store call
+ * skipped, it is every envelope in that partition never decrypted. That is
+ * the whole return on ADR 0007, and `__tests__/partitioned-scan-cost.test.ts`
+ * measures it rather than asserting it.
+ *
+ * The builder records `where`/`filter` and only materializes a
+ * {@link ScanBuilder} at the terminal, because the partition set cannot be
+ * decided before the predicate is known — a provider fixed at `scan()` time
+ * would already have committed to every partition.
+ */
+export declare class PartitionedScan<T> {
+    private readonly col;
+    private readonly steps;
+    private readonly pageSize;
+    constructor(col: PartitionedCollection<T>, steps: readonly Step<T>[], pageSize: number);
+    where(field: keyof T & string, op: Operator, value: unknown): PartitionedScan<T>;
+    filter(fn: (record: T) => boolean): PartitionedScan<T>;
+    /** The pruning decision for this scan, and the set it was taken against. */
+    scope(): Promise<{
+        declared: readonly string[];
+        scope: PartitionScope;
+    }>;
+    /**
+     * The union as a single {@link ScanBuilder} — so `.aggregate()`,
+     * `.groupBy()` and `for await` come from the streaming machinery that
+     * already exists, at its existing O(reducers) memory bound, rather than
+     * from a second implementation of it.
+     */
+    builder(): Promise<ScanBuilder<T>>;
+    [Symbol.asyncIterator](): AsyncIterator<T>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Promise<ReduceResult<Spec>>;
+    /**
+     * **ASYNC here, unlike `Query.toArray()` (#1413).** Same method name, a
+     * different contract, because the surface underneath differs: this one
+     * genuinely fetches across every partition leg, so it genuinely awaits. `Query`'s terminal reads an
+     * already-decrypted in-memory cache and returns `T[]` synchronously.
+     */
+    toArray(): Promise<T[]>;
+}
+/**
+ * Walk a list of member collections as ONE paged stream.
+ *
+ * The composite cursor is `"<memberIndex>|<memberCursor>"`. Two properties
+ * make it safe to hand back to a consumer that stores it:
+ *
+ *   - it is opaque in exactly the way a store's own cursor is — the member
+ *     cursor is passed through verbatim and never parsed;
+ *   - a member's LAST page returns a cursor pointing at the NEXT member with
+ *     an empty inner cursor, so exhaustion is detected once, not per page.
+ *
+ * ⚠️ A member that returns an empty page with a non-null cursor is walked
+ * again rather than treated as exhausted — the store contract explicitly
+ * allows a store to return fewer items than the limit while more exist.
+ */
+export declare function unionPageProvider<T>(members: readonly Collection<T>[]): ScanPageProvider<T>;
+export {};

package/dist/with-sync/change-broadcast.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Cross-tab / cross-process change signals for `.live()` — #1362.
+ *
+ * A live query is in-process only: a write in tab A leaves tab B's `.live()`
+ * showing the old rows until B happens to read again. This module closes that
+ * without an external coordinator: every locally-committed change posts a
+ * compact ADDRESS on a channel named per store, and every listening instance
+ * re-reads that address **through its own keyring** and re-fires the live
+ * queries that touch it.
+ *
+ * ## The zero-knowledge constraint is the feature
+ *
+ * The frame is `{ vault, collection, id, ts }` and nothing else. No record, no
+ * field, no ciphertext, no key, not even the VERB — see below. Encryption
+ * happens in hub before any store, and a broadcast channel is **not a store**:
+ * it is a side channel with no authentication and no access control, so it is
+ * treated as untrusted in BOTH directions.
+ *
+ *   - **Untrusted egress** — only the address leaves. A peer that should not
+ *     be able to read a record learns, at most, that a record at that address
+ *     changed. `change-broadcast.test.ts` asserts on the exact bytes posted and
+ *     fails if anything resembling record content ever appears in them; that
+ *     test is the thing that catches a future change which starts sending
+ *     payloads.
+ *   - **Untrusted ingress** — the frame carries no `action`. A peer's claim
+ *     "this was a delete" is not evidence, and it is free not to need it: the
+ *     receiver re-reads the address and decides the verb from what IT can
+ *     decrypt. So a hostile or buggy peer on the channel can cost a wasted
+ *     re-read, and cannot make a receiver report a state its own store does
+ *     not hold.
+ *
+ * ## Why the receiver re-reads rather than patches
+ *
+ * #1341's `LiveMaintainer` patches a result set from a delta it TRUSTS —
+ * trustworthy because it was derived from a local write the same process
+ * observed, with the record in hand. A remote signal is a different animal: it
+ * says only "id X in collection Y changed", and the receiving instance has not
+ * decrypted the new record and knows neither the before nor the after state.
+ * Feeding it to the maintainer as if it were a local delta would patch a set
+ * from an address. So a remote-origin change re-reads and re-runs: the
+ * `ChangeEvent` it produces is tagged `remote: true`, and `Collection`'s query
+ * source hands the live query NO delta for such an event — which the maintainer
+ * already understands as "rebuild from scratch", the pre-#1341 behaviour.
+ *
+ * ## Transport
+ *
+ * `BroadcastChannel` when the host has one (browsers, Node >= 18,
+ * Deno, Bun) — feature-detected at enable time, never assumed. With no channel
+ * the whole feature is an inert no-op and behaviour is exactly what it is
+ * today. Any other host transport (Electron IPC, a worker `MessagePort`, a
+ * test bus) is supported by passing a `channel` that satisfies `TabChannel`.
+ */
+import type { TabChannel } from './tab-coordination.js';
+import type { ChangeEvent } from '../kernel/types.js';
+/**
+ * The frame on the wire. `kind` discriminates it from any other traffic
+ * sharing the channel; `origin` identifies the sender so a channel that echoes
+ * to itself cannot feed an instance its own signal.
+ *
+ * ⛔ **Do not add a field carrying record state to this interface.** Not the
+ * record, not a field of it, not a hash of it, not the verb. Everything here
+ * is an ADDRESS plus routing. The test asserting on the posted bytes is what
+ * holds the line; it will fail loudly, which is the point.
+ */
+export interface ChangeSignal {
+    readonly kind: 'noydb:change';
+    /** Sending instance's id — an incoming frame with our own id is ignored. */
+    readonly origin: string;
+    readonly vault: string;
+    readonly collection: string;
+    readonly id: string;
+    /** Sender's wall clock at post time. Diagnostic only; never compared for ordering. */
+    readonly ts: number;
+}
+export interface ChangeBroadcastOptions {
+    /**
+     * Host-provided transport. Supply this for a host with no
+     * `BroadcastChannel` (Electron IPC, a worker `MessagePort`, a test bus) or to
+     * take ownership of the channel's lifetime. Default: an inline
+     * `BroadcastChannel` if the host has one, else nothing at all.
+     */
+    readonly channel?: TabChannel;
+    /**
+     * Discriminator for the default channel name — `noydb:change:<storeId>`.
+     *
+     * ⚠️ Defaults to `store.name`, which is the backend KIND ('memory', 'file',
+     * 'idb'), not a per-dataset identity: two different IndexedDB databases both
+     * reporting `'idb'` would share one channel and re-read each other's
+     * addresses (harmless — a miss costs one read that finds nothing — but
+     * wasteful). Pass a `storeId` that names the DATASET whenever a host can
+     * open more than one.
+     */
+    readonly storeId?: string;
+    /** This instance's id. Default: a random one. */
+    readonly originId?: string;
+    /** Clock for the frame's `ts`. Default: `Date.now`. */
+    readonly now?: () => number;
+}
+/** The slice of `Noydb` this needs. Structural, so there is no import cycle. */
+export interface ChangeBroadcastHost {
+    on(event: 'change', handler: (e: ChangeEvent) => void): void;
+    off(event: 'change', handler: (e: ChangeEvent) => void): void;
+    /** @internal Store backend name, for the default channel name. */
+    readonly _storeName: string | undefined;
+    /** @internal Re-read one address through this instance's own keyring. */
+    _applyRemoteSignal(vault: string, collection: string, id: string): Promise<void>;
+}
+/**
+ * An inline `BroadcastChannel` wrapper, or `undefined` when the host has none.
+ *
+ * ⚠️ Deliberately does NOT gate on `window`, and that asymmetry with
+ * `defaultChannel()` is the cross-process half of this feature, not an
+ * oversight. That gate exists because a presence HEARTBEAT and a Web-Locks role
+ * ELECTION are browser-tab concepts that should not start running in Node; a
+ * change signal is the opposite — Node workers and Electron processes sharing a
+ * store are exactly the case #1362 names, and gating on `window` would silently
+ * exclude them.
+ */
+export declare function defaultChangeChannel(name: string): TabChannel | undefined;
+/** Channel name for a store. One namespace per store so unrelated datasets never cross-signal. */
+export declare function changeChannelName(storeId: string): string;
+/**
+ * The relay itself: local change out as an address, remote address in as a
+ * re-read. Started by {@link enableChangeBroadcast}.
+ */
+export declare class ChangeBroadcast {
+    #private;
+    constructor(host: ChangeBroadcastHost, channel: TabChannel, opts: {
+        originId: string;
+        now: () => number;
+        ownsChannel: boolean;
+    });
+    get originId(): string;
+    start(): void;
+    dispose(): void;
+}
+/**
+ * Opt in to cross-tab / cross-process live-query reactivity.
+ *
+ * ```ts
+ * const stop = enableChangeBroadcast(db, { storeId: 'invoices-2026' })
+ * // …a put in another tab now re-fires this tab's `.live()` queries…
+ * stop.dispose()
+ * ```
+ *
+ * Opt-in on purpose: it is a side channel, and a host that does not want one
+ * gets exactly today's behaviour by not calling this. **With no channel
+ * available it is also a no-op** — it returns a disposable that does nothing,
+ * never throws, and leaves in-process reactivity untouched.
+ */
+export declare function enableChangeBroadcast(host: ChangeBroadcastHost, opts?: ChangeBroadcastOptions): {
+    dispose: () => void;
+};

package/dist/with-sync/presence.d.ts

@@ -15,7 +15,7 @@
  *     (if available) or local adapter, and polled periodically.
  */
 import type { NoydbStore, PresencePeer } from '../kernel/types.js';
-import { type EnclaveKey } from '../kernel/enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 /** Options for constructing a PresenceHandle. @internal */
 export interface PresenceHandleOpts {
     /** Local adapter for storage-poll fallback. */
@@ -82,10 +82,10 @@ export declare class PresenceHandle<P> {
     /**
      * Derive (and cache) the presence-tag key — a non-extractable, sign-only
      * HMAC-SHA256 key HKDF-derived from the collection DEK, domain-separated
-     * from the presence payload key by {@link PRESENCE_TAG_KEY_DOMAIN}.
-     * Mirrors `deriveClassifyIndexKey` (kernel/enclave/classify/bidx.ts). No
-     * PBKDF2 stretch — the adapter never holds this key, so a plain keyed HMAC
-     * tag is sufficient and deterministic. Returns `null` when unencrypted
+     * from the presence payload key by the enclave's `derivePresenceTagKey`
+     * domain. Mirrors `deriveClassifyIndexKey` (capsule/enclave-aes/classify/bidx.ts).
+     * No PBKDF2 stretch — the adapter never holds this key, so a plain keyed
+     * HMAC tag is sufficient and deterministic. Returns `null` when unencrypted
      * (no DEK to derive from).
      */
     private getPresenceTagKey;
@@ -94,11 +94,6 @@ export declare class PresenceHandle<P> {
      * storage-poll record id in encrypted mode so the adapter never sees the
      * userId. Falls back to the raw `userId` when unencrypted (no key exists
      * to tag with — see {@link PresenceHandleOpts.userId}).
-     *
-     * Signs directly via `subtle.sign` (like `bidx.ts`'s `mintAt`) rather than
-     * the barrel's `hmacSha256Hex` helper: that helper re-exports its key
-     * argument's raw bytes internally, which only works for extractable keys
-     * (e.g. an AES-GCM DEK) — `presenceTagKey` is deliberately non-extractable.
      */
     private presenceTag;
     private getPubSubAdapter;

package/dist/withdraw-accessible-HL7GACUE.js

@@ -0,0 +1,27 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-IMQKWR46.js";
+import "./chunk-EJLV62NI.js";
+import "./chunk-KZXDLBY6.js";
+import "./chunk-5A4345TG.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-HL7GACUE.js.map

package/dist/withdraw-accessible-HL7GACUE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,25 +1,41 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.7.1-pre.0",
+  "version": "0.8.0",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "vLannaAi <vicio@lanna.ai>",
-  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/hub#readme",
+  "homepage": "https://github.com/noy-db/core/tree/main/packages/hub#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "url": "git+https://github.com/noy-db/core.git",
     "directory": "packages/hub"
   },
   "bugs": {
-    "url": "https://github.com/vLannaAi/noy-db/issues"
+    "url": "https://github.com/noy-db/core/issues"
   },
   "type": "module",
-  "sideEffects": false,
+  "sideEffects": [
+    "./dist/query/live/index.js",
+    "./dist/query/reduce/index.js",
+    "./dist/query/relate/index.js"
+  ],
+  "imports": {
+    "#capsule": {
+      "noy-db:exclave-plain": "@noy-db/exclave-plain",
+      "noy-db:enclave-pqc": "@noy-db/enclave-pqc",
+      "default": "./dist/capsule/enclave-aes/index.js"
+    }
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./capsule": {
+      "types": "./dist/capsule/contract.d.ts",
+      "default": "./dist/capsule/contract.js"
+    },
+    "./package.json": "./package.json",
     "./codemods/0.4.0-pre.json": "./codemods/0.4.0-pre.json",
     "./i18n": {
       "types": "./dist/via/i18n/index.d.ts",
@@ -57,6 +73,22 @@
       "types": "./dist/kernel/query/index.d.ts",
       "default": "./dist/query/index.js"
     },
+    "./query/live": {
+      "types": "./dist/kernel/query/live/index.d.ts",
+      "default": "./dist/query/live/index.js"
+    },
+    "./query/reduce": {
+      "types": "./dist/kernel/query/reduce/index.d.ts",
+      "default": "./dist/query/reduce/index.js"
+    },
+    "./query/relate": {
+      "types": "./dist/kernel/query/relate/index.d.ts",
+      "default": "./dist/query/relate/index.js"
+    },
+    "./query/all": {
+      "types": "./dist/kernel/query/all.d.ts",
+      "default": "./dist/query/all/index.js"
+    },
     "./debug": {
       "types": "./dist/kernel/debug.d.ts",
       "default": "./dist/debug/index.js"
@@ -81,6 +113,10 @@
       "types": "./dist/with-audit/consent/index.d.ts",
       "default": "./dist/consent/index.js"
     },
+    "./coverage": {
+      "types": "./dist/with-audit/coverage/index.d.ts",
+      "default": "./dist/coverage/index.js"
+    },
     "./periods": {
       "types": "./dist/with-audit/periods/index.d.ts",
       "default": "./dist/periods/index.js"
@@ -218,7 +254,8 @@
       "default": "./dist/reduce/index.js"
     },
     "./codemods/0.6.0-pre.json": "./codemods/0.6.0-pre.json",
-    "./codemods/0.7.0-pre.json": "./codemods/0.7.0-pre.json"
+    "./codemods/0.7.0-pre.json": "./codemods/0.7.0-pre.json",
+    "./codemods/0.8.0-pre.json": "./codemods/0.8.0-pre.json"
   },
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -227,21 +264,20 @@
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
-    "codemods"
+    "codemods",
+    "NOTICE"
   ],
   "engines": {
     "node": ">=22.0.0"
   },
-  "dependencies": {
-    "@noy-db/attestation": "0.7.1-pre.0"
-  },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "happy-dom": "^18.0.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/shamir": "0.7.1-pre.0"
+    "@noy-db/attestation": "0.8.0",
+    "@noy-db/shamir": "0.8.0"
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0",