@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/indexing/index.js

@@ -8,15 +8,15 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-V7ADQF5O.js";
+} from "../chunk-NYJBYVBG.js";
 import {
   CollectionIndexes
-} from "../chunk-2AFX33YA.js";
+} from "../chunk-3V6LZHUO.js";
 import "../chunk-SUZKW6UR.js";
-import "../chunk-LGNDFRYC.js";
-import "../chunk-5WWDGFOS.js";
-import "../chunk-SYNY3VB5.js";
-import "../chunk-37EPTBBR.js";
+import "../chunk-4CFHL5RY.js";
+import "../chunk-BUE7R3B5.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-VSUQI5Q6.js";
 
 // src/with-lookup/indexing/active.ts
 function withIndexing() {

package/dist/introspection/index.js

@@ -1,26 +1,30 @@
-import "../chunk-UBSFPGVJ.js";
+import "../chunk-2DX4JCRI.js";
 import {
   dumpVaultSchema
-} from "../chunk-PP3K67AJ.js";
+} from "../chunk-EMAWOGVH.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-RXLYKVTF.js";
+import {
+  FieldMetaUnknownFieldError
+} from "../chunk-QJNAHPVT.js";
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-747G6CT3.js";
+import "../chunk-J4KAPKBJ.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-H3YM66EI.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
-import "../chunk-37EPTBBR.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
+import "../chunk-VSUQI5Q6.js";
 export {
+  FieldMetaUnknownFieldError,
   applyListProjection,
   dumpVaultSchema,
   jsonSchemaToFields

package/dist/issue-LPEEEMPP.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-QDHHHI5Q.js";
+import "./chunk-5XONHAFD.js";
+import "./chunk-D5A3GCZ4.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-LPEEEMPP.js.map

package/dist/kernel/cache/index.d.ts

@@ -6,5 +6,5 @@
  * entry point.
  */
 export { Lru } from './lru.js';
-export type { LruEntry, LruOptions, LruStats } from './lru.js';
+export type { LruOptions, LruStats } from './lru.js';
 export { parseBytes, estimateRecordBytes } from './policy.js';

package/dist/kernel/collection.d.ts

@@ -799,6 +799,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /**
      * Delete a record by ID. Runs inside the hub's write-queue tracker
      * so `hub.writeQueue.pending` reflects this write.
+     * ⚠️ Blobs are released (#1451) but a legacy collection defers the erase — a `null` blob read is NOT proof the bytes are gone; see {@link BlobSet.releaseAll} (noy-db/core#28).
      */
     delete(id: string): Promise<void>;
     /**

package/dist/kernel/errors.d.ts

@@ -92,6 +92,7 @@
  * @module
  */
 import type { GateName, GatePolicy } from './types.js';
+import type { CapsuleGroup } from '../capsule/contract.js';
 /**
  * Base class for all NOYDB errors.
  *
@@ -890,7 +891,19 @@ export declare class TierDemoteDeniedError extends NoydbError {
  */
 export declare class DelegationTargetMissingError extends NoydbError {
     readonly toUser: string;
-    constructor(toUser: string);
+    /**
+     * ⚠️ `reason` exists because two call sites were passing a SENTENCE as
+     * `toUser` (core#56), rendering as:
+     *
+     *     Delegation target user "grantor cannot find tier 1 DEK for (any)"
+     *     has no keyring in this vault
+     *
+     * — which names a target user that is not a user, and states a cause that is
+     * not the cause. A grantor-side failure is not a missing target; the class is
+     * kept for both only because it is PUBLISHED and consumers catch it. Pass the
+     * real `toUser` and put the explanation in `reason`.
+     */
+    constructor(toUser: string, reason?: string);
 }
 /**
  * Thrown when a `put()` detects an optimistic concurrency conflict.
@@ -2411,9 +2424,25 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
  * stable, catchable code instead of an ad hoc throw.
  */
 export declare class EnclaveNotSupportedError extends NoydbError {
-    /** The optional group that is not supported by this enclave. */
-    readonly group: 'sealing' | 'deterministic' | 'per-record-keys';
-    constructor(group: 'sealing' | 'deterministic' | 'per-record-keys', detail?: string);
+    /**
+     * The group that is not supported by this enclave.
+     *
+     * ⭐ WIDENED to the full {@link CapsuleGroup} 2026-09-16 (core#42). It used
+     * to be `'sealing' | 'deterministic' | 'per-record-keys'` — three of ten,
+     * and not a subset: it could not name `classify`, which `capsule/contract.ts`
+     * explicitly documents a capsule refusing, nor the six core groups.
+     *
+     * ⚠️ The narrowness was invisible because **hub never constructs this error**
+     * — it exists for a fork to throw (see the note above), so the union is a
+     * contract for THIRD-PARTY capsule authors, and hub's own test only ever
+     * built it with `'sealing'`. Found only when the conformance kit's tests
+     * were finally typechecked against hub's source.
+     *
+     * ⛔ This is a widened published READ: a consumer switching exhaustively on
+     * `err.group` gains cases. Release-noted by name for that reason.
+     */
+    readonly group: CapsuleGroup;
+    constructor(group: CapsuleGroup, detail?: string);
 }
 /**
  * Raised when a collection's `classifiedFields` configuration is invalid

package/dist/kernel/export-scope.d.ts

@@ -0,0 +1,40 @@
+/**
+ * How `Vault.exportStream()` decides WHAT to read (core#45b).
+ *
+ * Extracted from `vault.ts` rather than inlined there: the kernel-surface
+ * ratchet had that file at its exact ceiling, and this is the kind of thing
+ * the ceiling exists to push out — a self-contained decision with its own
+ * reasoning, reachable from one call site.
+ *
+ * ## The property this file owns
+ *
+ * A scoped export must not FETCH or DECRYPT the collections it excludes.
+ * Until 0.8 the scope was a filter applied to chunks after `exportStream` had
+ * already decrypted the whole vault, so a caller narrowing an export to limit
+ * what a compromised process could observe got no such limit. Choosing the
+ * enumeration strategy — bulk snapshot vs per-collection `list` — is what
+ * makes the difference real, and it is invisible to every chunk-level
+ * assertion (`__tests__/45-export-scope-narrows-read.test.ts` observes the
+ * store instead, which is the only layer that can tell them apart).
+ *
+ * @module
+ */
+import type { NoydbStore, ExportStreamOptions } from './types.js';
+/** Where an export's collection names and record ids come from. */
+export interface ExportSource {
+    /** Collection names to export, sorted. */
+    readonly collections: readonly string[];
+    /** True when the caller supplied a scope. */
+    readonly scoped: boolean;
+    /** Record ids in one collection. */
+    ids(collection: string): Promise<readonly string[]>;
+}
+/**
+ * Resolve the read strategy for one export.
+ *
+ * ⛔ THE UNDERSCORE FILTER IS APPLIED ON BOTH PATHS. `loadAll` drops
+ * underscore-prefixed internal collections for free; `list` does not, so a
+ * caller naming `_keyring` would export the keyring. A rule that holds only on
+ * the route that happens to be taken is a rule waiting to be lost.
+ */
+export declare function resolveExportSource(adapter: NoydbStore, vault: string, opts: ExportStreamOptions): Promise<ExportSource>;

package/dist/kernel/noydb.d.ts

@@ -1,5 +1,5 @@
 import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
-import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
+import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, RealignResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
 import type { SecretPolicy } from './validation.js';
 import { type NoydbMesh } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
@@ -458,6 +458,8 @@ export declare class Noydb {
      * push-only sink and is never pulled from (#616) — returns an empty result.
      */
     pull(vault: string, options?: PullOptions): Promise<PullResult>;
+    /** core#82 — replace every local envelope that fails to authenticate with the primary target's healthy copy; see `SyncEngine.realign`. */
+    realign(vault: string): Promise<RealignResult>;
     /**
      * Bidirectional sync: pull then push for all targets.
      * `sync-peer` targets do pull+push; `backup`/`archive` targets do push-only.

package/dist/kernel/put-many-atomic.d.ts

@@ -15,7 +15,7 @@ interface BulkTxContext {
     readonly _executed: BulkExecutedOp[];
 }
 /** @internal The slice of `Collection` both branches drive. */
-export interface PutManyAtomicHost<T> {
+interface PutManyAtomicHost<T> {
     put(id: string, record: T): Promise<void>;
     _preparePut(id: string, record: T): Promise<PreparedPut<T>>;
     _finalizePut(prepared: PreparedPut<T>): Promise<void>;

package/dist/kernel/query/live/live.d.ts

@@ -7,7 +7,8 @@
  * mutates.
  *
  * Framework-agnostic by design — core never depends on a UI
- * framework. The binding that wraps a `LiveQuery` is
+ * framework. The framework bindings live in the `noy-db/in` repo
+ * (extracted 2026-09-21). The one that wraps a `LiveQuery` is
  * `@noy-db/in-vue`'s `useLiveQuery(live)`: it subscribes once,
  * mirrors `value` into a `ShallowRef`, re-reads `error` on every
  * notification, and disposes via `onScopeDispose`.

package/dist/kernel/query/sort-key.d.ts

@@ -33,9 +33,7 @@
  * against its own kind.
  */
 export type KeyKind = 0 | 1 | 2;
-export declare const KIND_NUMBER: KeyKind;
 export declare const KIND_STRING: KeyKind;
-export declare const KIND_DATE: KeyKind;
 export interface SortKey {
     readonly kind: KeyKind;
     /** `number` for {@link KIND_NUMBER} and {@link KIND_DATE}, `string` otherwise. */

package/dist/kernel/tx-write-gate.d.ts

@@ -15,8 +15,8 @@
  *     base (two writes, one version bump).
  *
  * Neither raised an error on either side, and the loss was **store-capability
- * dependent** — `to-memory` declares `txAtomic` and takes the atomic commit
- * path, `to-browser-idb` does not and takes the per-op replay — so an app
+ * dependent** — `memoryStore({ full: true })` declares `txAtomic` and takes the
+ * atomic commit path, `to-browser-idb` does not and takes the per-op replay — so an app
  * tested on a memory store could ship lossy on IndexedDB.
  *
  * ## The remedy: make the pre-flight's read honest
@@ -56,8 +56,6 @@
  *
  * @internal
  */
-/** The shared `(vault, collection, id)` key shape. @internal */
-export declare function writeGateKey(vault: string, collection: string, id: string): string;
 /**
  * Run one logical write registered against `(vault, collection, id)` so a
  * concurrent commit can drain it. Returns / throws exactly what `fn` does —

package/dist/kernel/types.d.ts

@@ -182,6 +182,29 @@ export type Permissions = Record<string, Permission>;
  * does not move. What changed is that every READER must now cope with absence
  * — which is the whole point, since the store contract at `@noy-db/hub/to` is
  * what an exclave's rows travel through.
+ *
+ * ⛔⛔ THERE ARE TWO KINDS OF BODY, AND CONFLATING THEM IS A REAL BUG. This
+ * cost a downstream package real time in 0.8.0, so it is written here rather
+ * than left to be rediscovered:
+ *
+ *   - **A SEALED body** — `_iv` is a real IV and `_data` is ciphertext. Ask
+ *     {@link hasSealedBody}, which tests `_iv`.
+ *   - **A PLAINTEXT body** — `_data` holds readable JSON and `_iv` is `''`.
+ *     Reserved collections (`_keyring`, `_meta`) and any collection opened
+ *     with `encrypt: false` are this shape, by a convention that predates the
+ *     widening.
+ *
+ * ⛔ So a record can HAVE a body while having NO SEALED body, and
+ * `hasSealedBody` returns **false** for it. Guarding a `_data` read with
+ * `hasSealedBody` therefore rejects every valid record on those collections —
+ * measured: it would reject every enrolled user of a password unlock. To ask
+ * "is there a body to read as text", test `_data` itself (`if (!env._data)`),
+ * which is exactly what the optional type is for.
+ *
+ * ⚠️ And `_iv === ''` is NOT a safe hand-rolled substitute for
+ * `hasSealedBody`. The comparison stays well-typed when `_iv` is absent and
+ * silently answers `false` — four sites inside hub were wrong that way before
+ * the widening landed.
  */
 export interface Envelope {
     readonly _noydb: typeof NOYDB_FORMAT_VERSION;
@@ -229,7 +252,7 @@ export interface Envelope {
      * value)`) without decrypting every record. Leaks equality as a known
      * side channel.
      */
-    readonly _det?: Record<string, string>;
+    readonly _det?: Record<string, DeterministicCipher>;
     /**
      * Structural group-encryption. Map of sensitive field name →
      * per-field sealed ciphertext in `iv:data` form (same shape as a `_det`
@@ -598,7 +621,7 @@ export interface CrossTierAccessEvent {
  * as `iv:data` (both base64, colon-separated) so a single string per
  * field keeps the envelope compact.
  */
-export type DeterministicCipher = string;
+type DeterministicCipher = string;
 /** All records across all collections for a compartment. */
 export type VaultSnapshot = Record<string, Record<string, EncryptedEnvelope>>;
 /**
@@ -762,9 +785,9 @@ export interface NoydbStore {
      * hub also falls back when the staged batch isn't statically safe
      * to submit as one write set — see `canCommitAtomically`.
      *
-     * Native implementations today: `to-memory` (one synchronous burst of
-     * Map mutations) and the SQL-backed stores in the sibling `noy-db-to`
-     * repo. `to-dynamo` (`TransactWriteItems`) and `to-browser-idb` (one
+     * Native implementations today: hub's own `memoryStore({ full: true })` (one
+     * synchronous burst of Map mutations) and the SQL-backed stores in the
+     * sibling `noy-db-to` repo — `to-memory` among them, since it moved there. `to-dynamo` (`TransactWriteItems`) and `to-browser-idb` (one
      * `readwrite` transaction) CAN implement it but do not yet. File / S3
      * cannot implement it atomically and should omit the method.
      */
@@ -864,7 +887,7 @@ export type VaultPolicyOnDisk = Record<string, unknown>;
  *   `db.recoverSecret` against these throws
  *   {@link RecoveryProfileNotImplementedError}.
  */
-export type RecoveryEnrollment = {
+type RecoveryEnrollment = {
     readonly profile: 'paper';
     /** Number of single-use codes to print at enrollment. */
     readonly codes: number;
@@ -1207,6 +1230,28 @@ export interface ExportStreamOptions {
      * (a full, all-locale backup; format packages apply their own locale strategy).
      */
     readonly resolveLabels?: string;
+    /**
+     * Export only these collections. Omitted (the default) exports every
+     * collection the caller can read.
+     *
+     * ⭐ This NARROWS THE READ — the excluded collections are neither fetched
+     * nor decrypted (core#45b). That is the whole point of the option living
+     * here rather than in a caller's filter: until 0.8 `vault.export`'s
+     * `collections` filtered the chunks AFTER `exportStream` had decrypted the
+     * entire vault, so a caller scoping an export to limit what a compromised
+     * process could observe got no such limit. The published JSDoc said so
+     * honestly; this makes the caveat false instead of merely known.
+     *
+     * ⚠️ A name that does not exist yields nothing rather than throwing — a
+     * caller exporting "these, if present" is an ordinary call, and refusing it
+     * would push a pre-check onto every caller.
+     *
+     * ⛔ Internal, underscore-prefixed collections stay unexportable even when
+     * named explicitly. The unscoped path gets that filter free from `loadAll`;
+     * the scoped path applies it itself, because a filter that depends on which
+     * route reached the data is a filter waiting to be lost.
+     */
+    readonly collections?: readonly string[];
 }
 /**
  * One chunk yielded by `Vault.exportStream()`.
@@ -1407,6 +1452,35 @@ export interface PushResult {
     /** #590: tombstone enforcements applied during this run (never resolver-visible). */
     readonly erasures?: ErasureEnforcement[];
 }
+/**
+ * core#81 — a progress sample during a pull or push. Emitted as
+ * `sync:progress`, throttled (every 25 records or ~250 ms, whichever first),
+ * and mirrored on `SyncTargetStatus.inFlight` for a UI that polls. `total`
+ * is present once the engine knows it: for a pull, after the remote snapshot
+ * has been downloaded (progress then measures the APPLY phase, which is the
+ * long one on an indexed store); for a push, from the first sample (the
+ * dirty log is local). `bytes` approximates ciphertext payload size.
+ */
+export interface SyncProgress {
+    readonly direction: 'pull' | 'push';
+    readonly phase: 'reserved' | 'summaries' | 'records';
+    readonly records: number;
+    readonly bytes: number;
+    readonly total?: {
+        readonly records: number;
+        readonly bytes?: number;
+    };
+}
+/** core#82 — result of `db.realign(vault)`. */
+export interface RealignResult {
+    /** Local user-collection envelopes examined. */
+    readonly checked: number;
+    /** Envelopes that failed to authenticate locally and were replaced from the target. */
+    readonly replaced: number;
+    /** Envelopes that failed locally AND the target's copy failed or was absent — left as they were, listed in `errors`. */
+    readonly unrecoverable: number;
+    readonly errors: Error[];
+}
 export interface PullResult {
     readonly pulled: number;
     readonly conflicts: Conflict[];
@@ -1450,6 +1524,8 @@ export interface SyncStatus {
     readonly lastPush: string | null;
     /** As {@link SyncStatus.lastPush}, for pulls: last pull that had no errors. */
     readonly lastPull: string | null;
+    /** core#81 — the running sync's latest progress sample, or absent when idle. */
+    readonly inFlight?: SyncProgress;
     /**
      * Whether the **browser** reports network connectivity — driven solely by the
      * global `online`/`offline` events (#1034). It is NOT target reachability: an
@@ -1549,6 +1625,8 @@ export interface SyncTargetStatus {
      * not pulled.
      */
     readonly caughtUp: boolean;
+    /** core#81 — the running sync's latest progress sample, or absent when nothing is in flight. */
+    readonly inFlight?: SyncProgress;
 }
 export interface SyncTargetInfo {
     readonly label: string | undefined;
@@ -1591,6 +1669,8 @@ export interface NoydbEventMap {
     };
     'sync:push': PushResult;
     'sync:pull': PullResult;
+    /** core#81 — emitted while a pull/push runs (throttled); `sync:push`/`sync:pull` stay the terminal events. */
+    'sync:progress': SyncProgress;
     'sync:erasure': ErasureEnforcement;
     'sync:conflict': Conflict;
     'write:conflict': WriteConflict;
@@ -3664,6 +3744,13 @@ export type ActiveTier = 1 | 2 | 3;
  * duplicated here (rather than imported) because the kernel spine may not
  * statically import a with-* service; see {@link PolicyCheckGateFn}.
  */
+/**
+ * `PolicyCheckGateContext` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/policy. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export interface PolicyCheckGateContext {
     /** Tier the active session currently holds. */
     readonly activeTier: ActiveTier;

package/dist/kernel/validation.d.ts

@@ -135,16 +135,6 @@ export declare function assertStrongSecret(s: string, opts?: SecretPolicy & {
  * weak inputs visible in any UI that displays an entropy meter.
  */
 export declare function estimateEntropy(secret: string): number;
-/**
- * Internal compatibility shim. Older code paths used the throwing
- * `validateSecret(s)` directly; some still do via re-exports. Routes
- * to the new `assertStrongSecret` so the contract holds for both
- * shapes during the transition. New code should call
- * {@link assertStrongSecret} directly.
- *
- * @internal
- */
-export declare function legacyAssertSecret(s: string): void;
 /** Dedicated floors for the echo mode's three parts (spec resolved Q1/Q5). */
 export interface EchoSecretPolicy {
     /** Floor for the typed prompt — the brute-forceable-in-isolation part. */

package/dist/kernel/vault.d.ts

@@ -1152,6 +1152,8 @@ export declare class Vault {
      * collection.
      */
     delegate(opts: IssueDelegationOptions): Promise<DelegationToken>;
+    /** Merge live delegations into the keyring — core#56's read half. Explicit, not automatic; cross-user delegation does not work yet. Both reasons: `with-party/team/delegation.ts`. */
+    refreshDelegations(now?: Date): Promise<DelegationToken[]>;
     /**
      * revoke an issued delegation by id. Safe to call even
      * if the id does not exist.
@@ -1389,6 +1391,8 @@ export declare class Vault {
      * collection-cache clear, ledger-store reset) that `load()` performs on this
      * Vault's private state.
      */
+    /** core#82 — sync pulled a newer copy of THIS user's keyring file: reload it in place, rebuild the DEK resolver, drop cached collections. */
+    _reloadKeyringAfterSync(): Promise<void>;
     private backupContext;
     /**
      * Restore a vault from a verifiable backup.

package/dist/kernel/via/reconcile.d.ts

@@ -39,8 +39,7 @@ import { type HasWritableViaPipeline } from './pipeline.js';
 import { type MergedViaFields } from './compose.js';
 import type { ViaGraph } from './graph.js';
 import type { RefDescriptor } from '../refs.js';
-import { type I18nStrategy, type I18nTextDescriptor, type DictKeyDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../port/with/i18n-strategy.js';
-import { type LookupDescriptor } from '../../port/with/lookup-strategy.js';
+import { type I18nStrategy, type I18nTextDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../port/with/i18n-strategy.js';
 type AnyCollection = Collection<Record<string, unknown>>;
 /**
  * Structural reconcile-capable collection handle: `_via`/`_setVia` (#666's writer seam) plus the
@@ -98,46 +97,6 @@ export interface ViaReconcileVaultCtx {
      *  gate has already confirmed it is open — never the door that opens it. */
     getCollection(name: string): AnyCollection;
 }
-/**
- * #664 Part 2 — late-attach i18nText fields. First-wins (mirrors `_applyMoneyFields`'s own
- * first-wins convention): a no-op once the collection already has an 'i18n' binding, whether
- * that binding came from fresh construction or an earlier reconcile call. `dictKeyFields` is an
- * optional SECOND family arriving in the SAME `vault.collection()` call (`mergeViaFields` already
- * combined them for this one call) — passed through so ONE binding rebuild covers both, exactly
- * like `compileVias` builds ONE 'i18n' binding from both maps at fresh construction.
- */
-export declare function reconcileI18nFields(coll: ReconcilableCollection, vaultCtx: ViaReconcileVaultCtx, name: string, i18nFields: Record<string, I18nTextDescriptor> | undefined, dictKeyFields?: Record<string, DictKeyDescriptor | StaticDictDescriptor>): void;
-/**
- * #664 Part 2 — late-attach dictKeyFields (dictKey()/staticDict()) with NO i18nFields in the same
- * call — the dictKey-only late-attach door. First-wins, same convention as
- * {@link reconcileI18nFields} (and, transitively, a no-op if that sibling function already
- * handled a combined i18nFields+dictKeyFields call for this collection).
- */
-export declare function reconcileDictKeyFields(coll: ReconcilableCollection, vaultCtx: ViaReconcileVaultCtx, name: string, dictKeyFields: Record<string, DictKeyDescriptor | StaticDictDescriptor> | undefined): void;
-/**
- * #664 Part 2b — late-attach lookup()/enumOf()/dict() fields, tier-scoped (issue #664, spec-
- * ratified tier policy):
- *
- *  - **enum** (`backing:'static'`, no `table`) / **static** (`+table`) — self-contained:
- *    membership/labels come from the declared `keys`/`table` alone, no vault registry touch, no
- *    cross-collection read. Clean attach, same shape as i18n/dictKey's own reconcile door.
- *  - **reserved** (`dict()` / `lookup(dim, { backing:'reserved' })`) — additionally registers into
- *    the SAME vault registries the fresh path populates (`vault.ts`'s dictKeyFields/lookupFields
- *    registry-population loop) — `dictKeyFieldRegistry`/`reservedLookupCollections` for a bare
- *    dict field; `staticDescriptorByField`/`staticByName`/`staticDictNames` for a table-bearing
- *    static field — via `collectLookupDictCompat` (#650 Task 2's alias-equivalence bridge, the
- *    SAME helper the fresh path already calls), reused verbatim, not duplicated.
- *  - **matrix** (`backing:'collection'`) — gated by {@link refuseUnattachableMatrixLookupFields}.
- *
- * First-wins (mirrors {@link reconcileI18nFields}): a no-op once the collection already has a
- * 'lookup' binding, whether from fresh construction or an earlier reconcile call.
- *
- * Post-attach, registers the SAME cross-collection `'ref'` graph edges the fresh path does
- * (`registerLookupRefEdges` — internally skips the static tier, which has no backing collection to
- * reference-check) — `ViaGraph.referencingEdgesOf` sees them immediately, so delete-time
- * restrict/cascade/nullify semantics are live post-attach too, same as a fresh declaration.
- */
-export declare function reconcileLookupFields(coll: ReconcilableCollection, vaultCtx: ViaReconcileVaultCtx, graph: ViaGraph, name: string, lookupFields: Record<string, LookupDescriptor> | undefined): void;
 /** The late-attach reconcile call's field-declaring options — the slice of `vault.collection()`'s
  *  `options` a reconcile call may carry, plus the `mergeViaFields` output that feeds both the
  *  guard and the money/i18n/dictKey/lookup reconciles. `blobFields` has no `_apply*` door (guard

package/dist/{ledger-5ZMGE44K.js → ledger-MSJGWKGW.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-N7EVQD5S.js";
+} from "./chunk-L2F3CFCH.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,15 +15,15 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-6QVKPHBF.js";
-import "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-2WJKJZSO.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -37,4 +37,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-5ZMGE44K.js.map
+//# sourceMappingURL=ledger-MSJGWKGW.js.map

package/dist/liberate-LEKDYKTC.js

@@ -0,0 +1,25 @@
+import {
+  liberateVault
+} from "./chunk-XITHENBI.js";
+import "./chunk-SNM7LSYG.js";
+import "./chunk-55P6OBB7.js";
+import "./chunk-XKBTJGFP.js";
+import "./chunk-RDOEOPOI.js";
+import "./chunk-YQFBH5ZJ.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-45VHWE4C.js";
+import "./chunk-FZXRLNJO.js";
+import "./chunk-UHFGK6YA.js";
+import "./chunk-RIZTZJX6.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-LEKDYKTC.js.map

package/dist/{link-set-MFXC24VK.js → link-set-QXXSPPHL.js}

@@ -1,22 +1,22 @@
 import {
   LinkEndpointError,
   LinkSet
-} from "./chunk-WXE4W2U6.js";
+} from "./chunk-EUD3HQM4.js";
 import {
   LINK_COLLECTION_PREFIX,
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-Q4UHJ5SN.js";
-import "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-UAKY6E4N.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
 export {
   LINK_COLLECTION_PREFIX,
   LinkEndpointError,
@@ -26,4 +26,4 @@ export {
   linkCollectionName,
   linkRowKey
 };
-//# sourceMappingURL=link-set-MFXC24VK.js.map
+//# sourceMappingURL=link-set-QXXSPPHL.js.map