@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/indexing/index.js

@@ -8,15 +8,15 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-HBRLNOHL.js";
+} from "../chunk-NYJBYVBG.js";
 import {
   CollectionIndexes
-} from "../chunk-YSK2CU2Q.js";
+} from "../chunk-3V6LZHUO.js";
 import "../chunk-SUZKW6UR.js";
-import "../chunk-LGNDFRYC.js";
-import "../chunk-HLEK5VAN.js";
-import "../chunk-Z5HTYMMQ.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-4CFHL5RY.js";
+import "../chunk-BUE7R3B5.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-VSUQI5Q6.js";
 
 // src/with-lookup/indexing/active.ts
 function withIndexing() {

package/dist/introspection/index.js

@@ -1,27 +1,30 @@
-import "../chunk-UBSFPGVJ.js";
+import "../chunk-2DX4JCRI.js";
 import {
   dumpVaultSchema
-} from "../chunk-BP6DARYA.js";
+} from "../chunk-EMAWOGVH.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-RXLYKVTF.js";
+import {
+  FieldMetaUnknownFieldError
+} from "../chunk-QJNAHPVT.js";
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-PSIV7CJV.js";
+import "../chunk-J4KAPKBJ.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3H5KLDZN.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
-import "../chunk-244VXYPG.js";
+import "../chunk-H3YM66EI.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
+import "../chunk-VSUQI5Q6.js";
 export {
+  FieldMetaUnknownFieldError,
   applyListProjection,
   dumpVaultSchema,
   jsonSchemaToFields

package/dist/issue-LPEEEMPP.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-QDHHHI5Q.js";
+import "./chunk-5XONHAFD.js";
+import "./chunk-D5A3GCZ4.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-LPEEEMPP.js.map

package/dist/kernel/attestation-types.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Hub-owned copies of the attestation types. `@noy-db/attestation` is
+ * BUNDLED into hub (tsup `noExternal`), so hub's emitted `.d.ts` must not
+ * name the package — a consumer would otherwise need it installed to
+ * typecheck. The shapes are structurally identical; the `_Pins` block in
+ * `__tests__/no-runtime-dependencies.test.ts` asserts mutual assignability,
+ * so drift fails typecheck rather than surfacing at a consumer.
+ */
+type Normalizer = 'trim' | 'lower' | 'upper' | 'alnum-upper' | 'digits' | 'cents' | 'iso-date';
+interface AttestationFieldSpec {
+    readonly path: string;
+    readonly normalize: Normalizer;
+}
+export interface AttestationFieldSchema {
+    readonly fields: readonly AttestationFieldSpec[];
+}
+export interface QrPayload {
+    readonly v: 1;
+    readonly docId: string;
+    readonly salt: string;
+    readonly alg: 'ed25519';
+    readonly keyId: string;
+    readonly fieldHashes: readonly string[];
+    readonly sig: string;
+}
+export interface RevocationList {
+    readonly v: 1;
+    readonly revokedDocIds: readonly string[];
+    readonly asOf: string;
+    readonly keyId: string;
+    readonly sig: string;
+}
+export interface VerifyInput {
+    readonly qr: string;
+    readonly claimedFields: Record<string, unknown>;
+    readonly fieldSchema: AttestationFieldSchema;
+    readonly publicKeys: Readonly<Record<string, string>>;
+    readonly revocation?: {
+        list: RevocationList;
+    };
+}
+export interface VerifyResult {
+    readonly valid: boolean;
+    readonly signatureValid: boolean;
+    readonly perField: ReadonlyArray<{
+        path: string;
+        match: boolean;
+    }>;
+    readonly revoked: boolean | null;
+    readonly reason?: string;
+}
+/**
+ * The signature primitive attestation signs and verifies with. Hub declares
+ * its own copy for the same reason as the rest of this file: `ENCLAVE_SCHEME`
+ * is typed by it, so naming attestation here would put the package back in
+ * hub's `.d.ts`.
+ */
+export interface SignatureScheme {
+    sign(privateKeyPkcs8B64: string, message: Uint8Array): Promise<string>;
+    verify(publicKeyB64: string, sigB64url: string, message: Uint8Array): Promise<boolean>;
+}
+export {};

package/dist/kernel/cache/index.d.ts

@@ -6,5 +6,5 @@
  * entry point.
  */
 export { Lru } from './lru.js';
-export type { LruEntry, LruOptions, LruStats } from './lru.js';
+export type { LruOptions, LruStats } from './lru.js';
 export { parseBytes, estimateRecordBytes } from './policy.js';

package/dist/kernel/collection-config.d.ts

@@ -1,6 +1,6 @@
 import type { StrategyBag } from '../port/with/strategies.js';
 import type { NoydbStore, ConflictPolicy, CollectionConflictResolver, HistoryConfig, TierMode, CrossTierAccessEvent, VdigFieldPolicy } from './types.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
 import type { NoydbEventEmitter } from './events.js';
 import type { WriteQueueTracker } from './write-queue.js';
@@ -496,53 +496,6 @@ export declare function matchTargetFieldNames(opts: {
     readonly declared: readonly string[];
     readonly virtual: readonly string[];
 };
-/**
- * Compile a collection's declared config into the ordered list of `NoydbVia`s
- * for its `ViaPipeline`.
- *
- * money then i18n then lookup then classified then blob then computed — order
- * pinned for pipeline parity with the hand-wired baseline this replaces: money
- * encode ran before the i18n write stages, and money decode ran before i18n
- * locale/dict-label resolution on read. Lookup compiles right after i18n
- * (#650 Task 2) — a separate binding for native lookup()/enumOf()/dict()
- * fields (`dictKeyFields`/`dictKey()`/`staticDict()` stay on the i18n
- * binding above, unchanged); its `present` hook only adds `<field>Label`,
- * same shape of read-time addition as i18n's own dict-label dressing, and
- * declares no write-pipeline hooks yet (Task 3 adds `ingest`/`enforceWrite`).
- * Classified compiles after those (#629 Task 6): its
- * `encodeAtRest`/`decodeAtRest` hooks make the pipeline's `hasAtRestHooks`
- * true, retiring the codec's inline `sensitiveFields` seal path
- * (record-codec.ts) for any collection that declares `classifiedFields` —
- * `classifiedGuardCtx` is the SAME `ClassifiedGuardCtx`
- * `resolveCollectionConfig` already built for door 1's
- * `guardClassifiedCompat` call, threaded in by its one caller below. Blob
- * compiles next (#629 Task 7) but its position is inert: the blob binding
- * declares NO write/read pipeline hooks (blob content is out-of-band
- * `BlobSet` side-collections — it must never flip `hasAtRestHooks`), only
- * `erase`/`describeFragment`. Computed compiles LAST (#638 Task 7) — its
- * `present` hook must run AFTER money's own `present` so a virtual field's
- * `deps` read the decoded (quantized) amount, not the raw stored form; at
- * present-time i18n/lookup's DRESSING now runs AFTER computed instead (#665
- * `_presentOrder`, `via/pipeline.ts` — compile order here is unchanged).
- * `via/graph-wiring.ts#applyTaintOverlay` appends the `taint`
- * binding after WHATEVER this function returns, so taint's present-time
- * redaction always runs after computed's regardless of this ordering.
- * {@link Collection._applyMoneyFields} PREPENDS money for the same reason
- * on its own (MV-precreation reconcile) path — see its docstring;
- * {@link Collection._applyClassifiedFields} APPENDS classified on that same
- * reconcile path (blobFields/computed have no late-attach reconcile door —
- * `viaFields`, like i18nFields/dictKeyFields, is construction-only).
- *
- * `eraseCfgOut` (#629 Task 10, optional out-param) — this function runs
- * before the owning `Collection` exists (`this.codec` isn't built yet), so
- * the classified binding's `classifySealedShred` closure can't be wired
- * here. When supplied, `eraseCfgOut.classified` is set to the SAME cfg
- * object instance handed to `viaBinder('classified')`, so a caller
- * (`resolveCollectionConfig`) can thread it out to the `Collection`
- * constructor, which mutates `classifySealedShred` in place once
- * `this.codec` exists. Additive — every existing caller omits it and keeps
- * getting a plain `NoydbVia[]`.
- */
 export declare function compileVias<T>(opts: CollectionOpts<T>, classifiedGuardCtx: ClassifiedGuardCtx, eraseCfgOut?: {
     classified?: ClassifiedViaConfig;
 }): NoydbVia[];

package/dist/kernel/collection.d.ts

@@ -11,7 +11,7 @@ import { type ViaDescriptor, type ViaEraseReport } from './via/index.js';
 import type { MutationOrigin } from './mutation.js';
 import { type WaveContext, type RollupOutcome, type RollupDeleteIntent } from './via/dispatch.js';
 import type { ComputedFields } from '../with-formula/computed/index.js';
-import { type SealedShredSlot } from './enclave/index.js';
+import { type SealedShredSlot } from '../capsule/index.js';
 import { type TierMoveResult } from '../with-audit/tiers/index.js';
 import type { GhostRecord } from './types.js';
 import type { StandardSchemaV1 } from './schema.js';
@@ -799,6 +799,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /**
      * Delete a record by ID. Runs inside the hub's write-queue tracker
      * so `hub.writeQueue.pending` reflects this write.
+     * ⚠️ Blobs are released (#1451) but a legacy collection defers the erase — a `null` blob read is NOT proof the bytes are gone; see {@link BlobSet.releaseAll} (noy-db/core#28).
      */
     delete(id: string): Promise<void>;
     /**

package/dist/kernel/cutover-transform.d.ts

@@ -10,7 +10,7 @@
  * @internal
  */
 import type { EncryptedEnvelope, NoydbStore, VdigFieldPolicy } from './types.js';
-import { type RecordCodec, type EnclaveKey } from './enclave/index.js';
+import { type RecordCodec, type EnclaveKey } from '../capsule/index.js';
 import type { MutationOrigin } from './mutation.js';
 /**
  * @internal Structural (not imported) view of `UnlockedKeyring` — only

package/dist/kernel/errors.d.ts

@@ -92,6 +92,7 @@
  * @module
  */
 import type { GateName, GatePolicy } from './types.js';
+import type { CapsuleGroup } from '../capsule/contract.js';
 /**
  * Base class for all NOYDB errors.
  *
@@ -136,6 +137,34 @@ export declare class DebugReservedFieldError extends NoydbError {
 export declare class DecryptionError extends NoydbError {
     constructor(message?: string);
 }
+/**
+ * **Means exactly: "this envelope carries no sealed body, and this path needs
+ * one."** (#15)
+ *
+ * Since `_iv`/`_data` became optional, an envelope written by an *exclave*
+ * capsule has no ciphertext body at all. Handed to an AES decrypt path, that
+ * is neither corruption nor an attack — it is a capsule mismatch, and it must
+ * not be reported as one of the two errors it superficially resembles:
+ *
+ *  - **not {@link TamperedError}**, whose entire documented meaning is "the
+ *    AEAD tag did not verify under this key". That class is hub's security
+ *    alert; raising it for a structurally absent body would manufacture a
+ *    tamper signal out of a configuration difference, and the operator
+ *    response to the two is completely different.
+ *  - **not a bare `TypeError`**, which is what reading `.length` or passing
+ *    `undefined` into `decrypt()` produced before this issue — an internal
+ *    slip surfacing as if hub had a bug in its own arithmetic.
+ *
+ * `where` names the call path that required the body, because the same
+ * absence is legitimate two frames earlier: {@link hasSealedBody} answers
+ * false for it, and a tombstone, a `_del` marker and a plaintext collection
+ * all reach that answer by design.
+ */
+export declare class MissingEnvelopeBodyError extends NoydbError {
+    /** The operation that required a sealed body, e.g. `'openEnvelopeJson'`. */
+    readonly where: string;
+    constructor(where: string);
+}
 /**
  * **Means exactly: "AEAD failed under this key."** Nothing more (lanna-db #4,
  * 2026-09-03). AES-256-GCM authenticates the ciphertext on every decrypt; if
@@ -862,7 +891,19 @@ export declare class TierDemoteDeniedError extends NoydbError {
  */
 export declare class DelegationTargetMissingError extends NoydbError {
     readonly toUser: string;
-    constructor(toUser: string);
+    /**
+     * ⚠️ `reason` exists because two call sites were passing a SENTENCE as
+     * `toUser` (core#56), rendering as:
+     *
+     *     Delegation target user "grantor cannot find tier 1 DEK for (any)"
+     *     has no keyring in this vault
+     *
+     * — which names a target user that is not a user, and states a cause that is
+     * not the cause. A grantor-side failure is not a missing target; the class is
+     * kept for both only because it is PUBLISHED and consumers catch it. Pass the
+     * real `toUser` and put the explanation in `reason`.
+     */
+    constructor(toUser: string, reason?: string);
 }
 /**
  * Thrown when a `put()` detects an optimistic concurrency conflict.
@@ -2368,7 +2409,7 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
     constructor(profile: string, tracking: string);
 }
 /**
- * Thrown by a `kernel/enclave` fork's **optional groups** — sealing,
+ * Thrown by a `capsule/enclave-aes` fork's **optional groups** — sealing,
  * deterministic, per-record-key lifecycle — when that fork's crypto
  * engine does not implement the requested behavior.
  *
@@ -2383,15 +2424,31 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
  * stable, catchable code instead of an ad hoc throw.
  */
 export declare class EnclaveNotSupportedError extends NoydbError {
-    /** The optional group that is not supported by this enclave. */
-    readonly group: 'sealing' | 'deterministic' | 'per-record-keys';
-    constructor(group: 'sealing' | 'deterministic' | 'per-record-keys', detail?: string);
+    /**
+     * The group that is not supported by this enclave.
+     *
+     * ⭐ WIDENED to the full {@link CapsuleGroup} 2026-09-16 (core#42). It used
+     * to be `'sealing' | 'deterministic' | 'per-record-keys'` — three of ten,
+     * and not a subset: it could not name `classify`, which `capsule/contract.ts`
+     * explicitly documents a capsule refusing, nor the six core groups.
+     *
+     * ⚠️ The narrowness was invisible because **hub never constructs this error**
+     * — it exists for a fork to throw (see the note above), so the union is a
+     * contract for THIRD-PARTY capsule authors, and hub's own test only ever
+     * built it with `'sealing'`. Found only when the conformance kit's tests
+     * were finally typechecked against hub's source.
+     *
+     * ⛔ This is a widened published READ: a consumer switching exhaustively on
+     * `err.group` gains cases. Release-noted by name for that reason.
+     */
+    readonly group: CapsuleGroup;
+    constructor(group: CapsuleGroup, detail?: string);
 }
 /**
  * Raised when a collection's `classifiedFields` configuration is invalid
  * (e.g. a claimed field name collides with a rider companion or another
  * classified field). Homed in `kernel/errors.ts` (rather than the classified
- * feature module) so `kernel/enclave/classify/*` can throw it without
+ * feature module) so `capsule/enclave-aes/classify/*` can throw it without
  * importing with-*; the classified feature module re-exports it under the
  * same name for backward-compatible import paths.
  */

package/dist/kernel/export-scope.d.ts

@@ -0,0 +1,40 @@
+/**
+ * How `Vault.exportStream()` decides WHAT to read (core#45b).
+ *
+ * Extracted from `vault.ts` rather than inlined there: the kernel-surface
+ * ratchet had that file at its exact ceiling, and this is the kind of thing
+ * the ceiling exists to push out — a self-contained decision with its own
+ * reasoning, reachable from one call site.
+ *
+ * ## The property this file owns
+ *
+ * A scoped export must not FETCH or DECRYPT the collections it excludes.
+ * Until 0.8 the scope was a filter applied to chunks after `exportStream` had
+ * already decrypted the whole vault, so a caller narrowing an export to limit
+ * what a compromised process could observe got no such limit. Choosing the
+ * enumeration strategy — bulk snapshot vs per-collection `list` — is what
+ * makes the difference real, and it is invisible to every chunk-level
+ * assertion (`__tests__/45-export-scope-narrows-read.test.ts` observes the
+ * store instead, which is the only layer that can tell them apart).
+ *
+ * @module
+ */
+import type { NoydbStore, ExportStreamOptions } from './types.js';
+/** Where an export's collection names and record ids come from. */
+export interface ExportSource {
+    /** Collection names to export, sorted. */
+    readonly collections: readonly string[];
+    /** True when the caller supplied a scope. */
+    readonly scoped: boolean;
+    /** Record ids in one collection. */
+    ids(collection: string): Promise<readonly string[]>;
+}
+/**
+ * Resolve the read strategy for one export.
+ *
+ * ⛔ THE UNDERSCORE FILTER IS APPLIED ON BOTH PATHS. `loadAll` drops
+ * underscore-prefixed internal collections for free; `list` does not, so a
+ * caller naming `_keyring` would export the keyring. A rule that holds only on
+ * the route that happens to be taken is a rule waiting to be lost.
+ */
+export declare function resolveExportSource(adapter: NoydbStore, vault: string, opts: ExportStreamOptions): Promise<ExportSource>;

package/dist/kernel/merge-authority.d.ts

@@ -1,5 +1,5 @@
 import type { MergeAuthority } from '../port/with/merge-authority.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 /**
  * ⚠️ **A client cannot verify what it cannot decrypt** — and that boundary is
  * stated here rather than hidden.

package/dist/kernel/noydb.d.ts

@@ -1,5 +1,5 @@
 import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
-import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
+import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, RealignResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
 import type { SecretPolicy } from './validation.js';
 import { type NoydbMesh } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
@@ -458,6 +458,8 @@ export declare class Noydb {
      * push-only sink and is never pulled from (#616) — returns an empty result.
      */
     pull(vault: string, options?: PullOptions): Promise<PullResult>;
+    /** core#82 — replace every local envelope that fails to authenticate with the primary target's healthy copy; see `SyncEngine.realign`. */
+    realign(vault: string): Promise<RealignResult>;
     /**
      * Bidirectional sync: pull then push for all targets.
      * `sync-peer` targets do pull+push; `backup`/`archive` targets do push-only.

package/dist/kernel/paths.d.ts

@@ -1,11 +1,35 @@
 /**
- * Generic dotted-path / `[]`-wildcard record helpers. Kernel-owned:
- * these carry zero i18n logic — they were extracted out of
- * `via/i18n/core.ts` (Task 7, #623) so kernel call-sites (put-time
- * validation, densify) can import them without a spine→service edge.
+ * Refuse a malformed field path AT DECLARATION TIME.
  *
- * @internal
+ * ⛔ WHY THIS EXISTS. {@link getAtPath} performs no validation by design — it
+ * answers "what is at this path", and "nothing" is a legitimate answer for an
+ * optional field or an empty array. The consequence is that a MALFORMED path
+ * is indistinguishable from an absent value: `'contacts[.name'` contains no
+ * `[].` and no `.`, so it falls through to `obj['contacts[.name']`, resolves
+ * to `undefined`, and the declaration does nothing. Forever. Silently.
+ *
+ * Measured 2026-09-13: an `i18nFields` declaration with `required: 'all'` and
+ * a malformed path accepted a record missing every required language, while
+ * the same spec on a well-formed path refused it. The guarantee was not
+ * weakened — it was never installed.
+ *
+ * ⭐ SAME CLASS AS core#19 AND `moneyFields`. `via/money/paths.ts` already
+ * guards its own grammar and says why in its header ("a declared-but-
+ * unreachable path that was silently ignored ... a latent 100× bug");
+ * `classifiedFields` did not, and a consumer found the leak. This is the third
+ * instance, which is why the check lives HERE, beside the resolver every
+ * path-taking family shares, rather than being written a third time.
+ *
+ * ⚠️ SYNTAX ONLY. A well-formed path naming a field that does not exist
+ * (`titel` for `title`) is NOT caught here and cannot be — that needs the
+ * collection's schema, which is not always declared. It is a real and separate
+ * gap; see the issue filed alongside this guard.
+ *
+ * Trailing `[]` is refused because `getAtPath` cannot consume it: the wildcard
+ * is recognised as the three-character marker `[].`, so `'contacts[]'` with
+ * nothing after it is read as an ordinary key and resolves to nothing.
  */
+export declare function assertFieldPath(path: string, context: string): void;
 /**
  * Return all leaf values at `path`, expanding `[].` array wildcards.
  *

package/dist/kernel/prepared-write.d.ts

@@ -11,7 +11,7 @@
  * kernel-surface line budget.
  */
 import type { EncryptedEnvelope } from './types.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 /** @internal Everything `_commitPut` needs after `_preparePut` produced the envelope. */
 export interface PreparedPut<T> {
     readonly id: string;

package/dist/kernel/put-many-atomic.d.ts

@@ -15,7 +15,7 @@ interface BulkTxContext {
     readonly _executed: BulkExecutedOp[];
 }
 /** @internal The slice of `Collection` both branches drive. */
-export interface PutManyAtomicHost<T> {
+interface PutManyAtomicHost<T> {
     put(id: string, record: T): Promise<void>;
     _preparePut(id: string, record: T): Promise<PreparedPut<T>>;
     _finalizePut(prepared: PreparedPut<T>): Promise<void>;

package/dist/kernel/query/live/live.d.ts

@@ -7,7 +7,8 @@
  * mutates.
  *
  * Framework-agnostic by design — core never depends on a UI
- * framework. The binding that wraps a `LiveQuery` is
+ * framework. The framework bindings live in the `noy-db/in` repo
+ * (extracted 2026-09-21). The one that wraps a `LiveQuery` is
  * `@noy-db/in-vue`'s `useLiveQuery(live)`: it subscribes once,
  * mirrors `value` into a `ShallowRef`, re-reads `error` on every
  * notification, and disposes via `onScopeDispose`.

package/dist/kernel/query/sort-key.d.ts

@@ -33,9 +33,7 @@
  * against its own kind.
  */
 export type KeyKind = 0 | 1 | 2;
-export declare const KIND_NUMBER: KeyKind;
 export declare const KIND_STRING: KeyKind;
-export declare const KIND_DATE: KeyKind;
 export interface SortKey {
     readonly kind: KeyKind;
     /** `number` for {@link KIND_NUMBER} and {@link KIND_DATE}, `string` otherwise. */

package/dist/kernel/secret-mode.d.ts

@@ -14,7 +14,7 @@
  * @module
  */
 import type { NoydbOptions, NoydbStore } from './types.js';
-import type { EchoSecretParts } from './enclave/index.js';
+import type { EchoSecretParts } from '../capsule/index.js';
 /**
  * Cross-check the secret-mode-related options at `createNoydb` time, before
  * any store touch. Throws `ValidationError` on the first violation.

package/dist/kernel/tx-write-gate.d.ts

@@ -15,8 +15,8 @@
  *     base (two writes, one version bump).
  *
  * Neither raised an error on either side, and the loss was **store-capability
- * dependent** — `to-memory` declares `txAtomic` and takes the atomic commit
- * path, `to-browser-idb` does not and takes the per-op replay — so an app
+ * dependent** — `memoryStore({ full: true })` declares `txAtomic` and takes the
+ * atomic commit path, `to-browser-idb` does not and takes the per-op replay — so an app
  * tested on a memory store could ship lossy on IndexedDB.
  *
  * ## The remedy: make the pre-flight's read honest
@@ -56,8 +56,6 @@
  *
  * @internal
  */
-/** The shared `(vault, collection, id)` key shape. @internal */
-export declare function writeGateKey(vault: string, collection: string, id: string): string;
 /**
  * Run one logical write registered against `(vault, collection, id)` so a
  * concurrent commit can drain it. Returns / throws exactly what `fn` does —