@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/pod/index.js

@@ -5,47 +5,50 @@ import {
   signRedirect,
   verifyRedirect,
   wrapPodStore
-} from "../chunk-7R2Q7CPL.js";
-import "../chunk-MXOQ5JCG.js";
+} from "../chunk-QE3TLZ6Z.js";
+import "../chunk-MRCR7ZMC.js";
 import {
   deriveSchemaManifest,
   loadSchemaManifestEntry
-} from "../chunk-TEHHROZL.js";
+} from "../chunk-T5EXREMW.js";
 import {
   MANIFEST_COLLECTION,
   isManifestReservedCollection
 } from "../chunk-EPFF7LOX.js";
-import "../chunk-Q4UHJ5SN.js";
-import "../chunk-XQRFSKYM.js";
-import "../chunk-JOSPH3E5.js";
-import "../chunk-VAORSCSU.js";
-import "../chunk-Y3LPTBG7.js";
-import "../chunk-2MG3SW7Q.js";
+import "../chunk-O2VQ3K36.js";
+import "../chunk-MCNNZBG7.js";
+import "../chunk-SBAR5JQ6.js";
+import "../chunk-TLIFNRU5.js";
+import "../chunk-UNL6YGL5.js";
+import "../chunk-E2C6FFSI.js";
+import "../chunk-X6Z2SIRF.js";
 import "../chunk-6LJY7X5A.js";
-import "../chunk-DHHGL42E.js";
-import "../chunk-AUKKUPVB.js";
-import "../chunk-52MGURXO.js";
-import "../chunk-3XJQBBZD.js";
-import "../chunk-DIZLQVAA.js";
+import "../chunk-IKS2CPAG.js";
+import "../chunk-IVLRPRXM.js";
+import "../chunk-WBUHHMLN.js";
+import "../chunk-NTVKHQ3L.js";
+import "../chunk-4CHM2TRS.js";
+import "../chunk-RWFQVNXR.js";
 import "../chunk-RXLYKVTF.js";
-import "../chunk-V3RWOOSO.js";
-import "../chunk-IUT3GWP3.js";
+import "../chunk-GYZICGRU.js";
+import "../chunk-IUD7WU67.js";
 import "../chunk-TFMM5DBB.js";
-import "../chunk-M5B2W6YY.js";
-import "../chunk-GUZET4SG.js";
+import "../chunk-TDJVQTXD.js";
+import "../chunk-JAQHWHUN.js";
+import "../chunk-QJNAHPVT.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-747G6CT3.js";
+import "../chunk-UORWAG7K.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-MILI22XQ.js";
-import "../chunk-244QBK7Z.js";
-import "../chunk-HS554XAF.js";
-import "../chunk-T7IR4N2S.js";
-import "../chunk-PD64727P.js";
-import "../chunk-RHVMZSUU.js";
-import "../chunk-3A5DUZ56.js";
+import "../chunk-IF2M43G4.js";
+import "../chunk-ZZZ4VCY2.js";
+import "../chunk-C4XV3PSJ.js";
+import "../chunk-5HQFROZS.js";
+import "../chunk-7UHLO4ZN.js";
+import "../chunk-FMINS2B6.js";
+import "../chunk-NV4OESHC.js";
+import "../chunk-IMIQAGR7.js";
 import "../chunk-GHVIKOHT.js";
-import "../chunk-QBLT6POL.js";
+import "../chunk-FPF5HRBE.js";
 import "../chunk-SMY5X46Z.js";
 import "../chunk-DZFQVICS.js";
 import {
@@ -71,64 +74,65 @@ import {
   verifyPodHeader,
   verifyRecord,
   writePod
-} from "../chunk-KZXDLBY6.js";
-import "../chunk-5A4345TG.js";
+} from "../chunk-XPW7T2GN.js";
+import "../chunk-DMIEKD24.js";
 import "../chunk-GMKGGY7V.js";
-import "../chunk-UA372JHH.js";
+import "../chunk-FZVCZEVI.js";
 import "../chunk-5D2ALSM5.js";
-import "../chunk-RB4DOPGZ.js";
+import "../chunk-AKIEBFIJ.js";
 import "../chunk-AURFOK3D.js";
 import "../chunk-NYMLINRP.js";
-import "../chunk-VFHCKG5M.js";
-import "../chunk-JSMTXZR3.js";
-import "../chunk-G2MVBDFP.js";
-import "../chunk-V7ADQF5O.js";
+import "../chunk-BVRJYMFZ.js";
+import "../chunk-ZWMOHANW.js";
+import "../chunk-QFW4MYGN.js";
+import "../chunk-4CUJLEOA.js";
 import "../chunk-66TQOPFM.js";
 import "../chunk-V4PXLYWM.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-PVEWA2DU.js";
 import "../chunk-GSAK56VF.js";
-import "../chunk-UEFOQH74.js";
+import "../chunk-ADCXTW7L.js";
 import "../chunk-BKT776R5.js";
-import "../chunk-2AFX33YA.js";
-import "../chunk-3EWS67C7.js";
+import "../chunk-Z3STG43F.js";
+import "../chunk-4TG2ITRW.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-XBKH4FOC.js";
-import "../chunk-LGNDFRYC.js";
-import "../chunk-JQYKPKG6.js";
-import "../chunk-AL6ML4LA.js";
+import "../chunk-4CFHL5RY.js";
+import "../chunk-7K42TSCY.js";
+import "../chunk-DWCFGF2K.js";
 import "../chunk-3TDUWVWB.js";
-import "../chunk-FOEDQATO.js";
-import "../chunk-5WWDGFOS.js";
-import "../chunk-2GHDLTPE.js";
-import "../chunk-23D6M6VM.js";
-import "../chunk-OKSTSITU.js";
-import "../chunk-SYNY3VB5.js";
-import "../chunk-DQESF6RP.js";
-import "../chunk-VHBKYN2J.js";
-import "../chunk-XSPFDUDG.js";
-import "../chunk-LIOVX5TJ.js";
-import "../chunk-7XMHMVTS.js";
-import "../chunk-GZT3NQRA.js";
+import "../chunk-66GD7XXU.js";
+import "../chunk-GIQJGXV7.js";
+import "../chunk-OGKMRIIJ.js";
+import "../chunk-KZA3DITX.js";
+import "../chunk-PR7ILCIH.js";
+import "../chunk-NCTN2FW4.js";
+import "../chunk-3G3GOGZZ.js";
+import "../chunk-B3B6HV5S.js";
+import "../chunk-V7AKGAXY.js";
+import "../chunk-QT5ITL25.js";
+import "../chunk-NXQEOC3X.js";
+import "../chunk-25FXU6WS.js";
 import "../chunk-VKQCVU2Z.js";
 import {
   generateULID,
   isULID
 } from "../chunk-4AOERLTV.js";
-import "../chunk-LNSVGRHO.js";
-import "../chunk-N7EVQD5S.js";
+import "../chunk-L4UL4IAR.js";
+import "../chunk-EQ6C2ZPT.js";
+import "../chunk-ONZ3B5EW.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-6QVKPHBF.js";
-import "../chunk-FLPCETP6.js";
-import "../chunk-HW7CMKUG.js";
-import "../chunk-JDEYF3PJ.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-QHG7GQKM.js";
+import "../chunk-2LBS62AC.js";
+import "../chunk-OFD2HD6F.js";
+import "../chunk-P6FATPXQ.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
+import "../chunk-XX4R7TUB.js";
 import {
   BackupCorruptedError,
   BackupLedgerError,
@@ -142,7 +146,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-IKPQ2GGB.js";
 export {
   BackupCorruptedError,
   BackupLedgerError,

package/dist/{pod-handle-A3LET7NO.js → pod-handle-R6Y4MILX.js}

@@ -1,13 +1,13 @@
 import {
   buildRecordEnvelope
-} from "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-WRLWEYHY.js";
+import "./chunk-ZD7WFMV2.js";
+import "./chunk-RRTQAQ3N.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
+import "./chunk-ZF6JECDT.js";
+import "./chunk-THQ3BHLM.js";
+import "./chunk-XX4R7TUB.js";
+import "./chunk-IKPQ2GGB.js";
 
 // src/with-pod/pod-handle.ts
 async function buildPodHandle(adapter, name) {
@@ -36,4 +36,4 @@ async function buildPodHandle(adapter, name) {
 export {
   buildPodHandle
 };
-//# sourceMappingURL=pod-handle-A3LET7NO.js.map
+//# sourceMappingURL=pod-handle-R6Y4MILX.js.map

package/dist/policy/index.js

@@ -6,26 +6,26 @@ import {
   createNoydbPolicy,
   describeGate,
   mergePolicy
-} from "../chunk-VQDZYB2B.js";
+} from "../chunk-T4VTRKCY.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
   loadVaultPolicy,
   saveVaultPolicy
-} from "../chunk-VHBKYN2J.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-B3B6HV5S.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
+import "../chunk-XX4R7TUB.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
   RecoveryNotEnrolledError,
   RecoveryProfileNotImplementedError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-IKPQ2GGB.js";
 export {
   DEFAULT_FRESHNESS_MS,
   META_COLLECTION,

package/dist/port/as/active.d.ts

@@ -6,5 +6,9 @@ import type { FormatsStrategy } from '../with/formats-strategy.js';
  * const db = await createNoydb({ store, user, secret, formatsStrategy: withFormats() })
  * const csv = await vault.export(asCsv(), { collections: ['invoices'] })
  * ```
+ *
+ * ⭐ `collections` scopes the READ: an excluded collection is neither fetched
+ * nor decrypted (core#45b, since 0.8 — through 0.7 it filtered output after a
+ * full decrypt).
  */
 export declare function withFormats(): FormatsStrategy;

package/dist/port/as/index.d.ts

@@ -28,5 +28,6 @@
  * Named re-exports only (no `export *`) so the published surface is explicit.
  */
 export { withFormats } from './active.js';
+export { FormatsNotEnabledError } from '../with/formats-strategy.js';
 export type { FormatsStrategy, FormatExportOptions, FormatImportOptions, } from '../with/formats-strategy.js';
 export type { NoydbFormat, DecodedChunk, ImportPolicy, ImportPlan, ExportChunk, ExportFormat, VaultDiff, } from './types.js';

package/dist/port/by/index.d.ts

@@ -8,11 +8,19 @@
  *
  * `StoreMesh` — the store-polling default — lives in
  * `with-shape/schema-update`, its only consumer, and is intentionally NOT
- * exported here. That is a real cost, recorded rather than worked around: it
- * is hub's own implementation of this port and the one most consumers actually
- * run, and because it is not on the published surface,
- * `@noy-db/test-mesh-conformance` cannot import it. **A port's in-hub default
- * is coverable by its published kit only if it is on the published surface.**
+ * exported here. It is hub's own implementation of this port and the one most
+ * consumers actually run, and `@noy-db/test-mesh-conformance` cannot import
+ * it.
+ *
+ * ⚠️ That was recorded here as a coverage cost, generalised to *"a port's
+ * in-hub default is coverable by its published kit only if it is on the
+ * published surface"*. The generalisation is FALSE and the kit now proves it
+ * (core#46): `createNoydb()` installs this default and `db.mesh` hands it
+ * back, so the kit runs the contract against `StoreMesh` — two clients over
+ * one store — while importing nothing from `with-shape/`. **REACHABILITY
+ * decides, not exportedness**, and the two come apart wherever a port's
+ * default is installed by a constructor. The export decision below is
+ * unchanged; only the cost attributed to it was wrong.
  *
  * ## Why this subpath exists again
  *
@@ -36,4 +44,5 @@
  * sends a consumer — this is additive, and that row stays true.
  */
 export { isQuorum, runDrainBarrier } from './types.js';
+export type { Unsubscribe } from '../with/write-hooks.js';
 export type { NoydbMesh, WriterPresence, FenceDoc, DrainBarrierOptions, } from './types.js';

package/dist/port/on/index.d.ts

@@ -22,6 +22,29 @@
  * that every package in the family binds it — `/to` already carries two
  * instance types, and nobody reads that as one contract.
  *
+ * ## The charter: contracts an unlock method implements AND the API a player calls
+ *
+ * Both halves, deliberately. A method implementer binds the callback types
+ * ({@link SlotRewrapCeremony}) and never drives a ceremony; an unlock *player*
+ * — the app running the anti-phishing echo flow — calls
+ * {@link beginEchoUnlock} and catches what it throws. Until 0.8.x the echo
+ * half lived on the root barrel alone, so a player naming an
+ * {@link EchoCeremony} still had to import the whole library to obtain one,
+ * and the seam removed nothing.
+ *
+ * ⛔ Do not re-narrow this to types-only. `/on` held no value export until
+ * now, which reads like a rule and was an accident of what the extraction
+ * happened to need — `/to` exports four, `/at` two, `/as` and `/by` one each.
+ * **A seam a consumer cannot bind alone is not a seam**, so the function and
+ * the errors a player catches belong here with the types.
+ *
+ * ⚠️ The three error classes are re-exported from the root barrel too, and
+ * `instanceof` must hold across both. That is exactly the case
+ * `tsup.config.ts`'s `splitting: true` protects: shared modules become one
+ * chunk with one class definition, so an `EchoCeremonyRequiredError` thrown
+ * through `dist/index.js` still matches the class imported from
+ * `dist/on/index.js`. Do not "simplify" that build flag.
+ *
  * ## Why it exists NOW and did not before
  *
  * `/on` shipped in 0.3.0 and was pruned in 0.4.0 for "zero importers",
@@ -48,3 +71,6 @@ export type { SlotRewrapCeremony, SlotRewrapContext, EnrollAuthenticatorOptions,
 export type { KeyringAuthenticator } from '../../kernel/types.js';
 export type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 export type { EnclaveKey } from '../../capsule/index.js';
+export type { EchoCeremony, BeginEchoUnlockOptions } from '../../with-party/team/echo-ceremony.js';
+export { beginEchoUnlock } from '../../with-party/team/echo-ceremony.js';
+export { EchoCeremonyRequiredError, WrongPromptError, WrongEchoError } from '../../kernel/errors.js';

package/dist/port/to/index.d.ts

@@ -16,7 +16,7 @@
  * tsup's per-entry bundling keeps class identity stable across subpaths.
  */
 import type { NoydbStore as NoydbStoreType } from '../../kernel/types.js';
-export type { NoydbStore, NoydbPodStore, Envelope, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
+export type { NoydbStore, NoydbPodStore, Envelope, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreAuth, StoreAuthKind, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
 export { ConflictError, NetworkError, StoreCapabilityError, PodVersionConflictError, UnknownStoreKindError, DuplicateStoreKindError, } from '../../kernel/errors.js';
 export { isConflictError } from '../../kernel/errors.js';
 export type { StoreClass, StoreDescriptor, StoreBinding, StoreFactory, StoreLocator, AnyNoydbStore, } from './locator.js';

package/dist/port/with/admission-authority.d.ts

@@ -0,0 +1,34 @@
+/**
+ * core#74 — the ADMISSION capability the vault lends the sync engine.
+ *
+ * `with-sync` is DEK-free (enforced by `check:architecture`), so it cannot
+ * evaluate a rule about a record's content. The vault can: it holds the keys,
+ * the `beforePut` gate bus (guards, periods) and the `db.onBeforeWrite` hooks
+ * that already run on every LOCAL write. This interface hands that judgement
+ * to the engine as a closure bound to the vault, the way `MergeAuthority`
+ * hands it the cryptographic one — so an incoming record is admitted or
+ * refused by the same rules its writer's device would have applied, against
+ * THIS device's view of the vault at the moment it arrives.
+ *
+ * A refusal is never an error: the engine parks the envelope under
+ * `_sync_rejected`, leaves the local copy untouched, reports it in
+ * `PullResult.rejected` and emits `sync:rejected`.
+ */
+import type { EncryptedEnvelope } from '../../kernel/types.js';
+export type AdmissionVerdict = {
+    readonly admitted: true;
+} | {
+    readonly admitted: false;
+    readonly reason: string;
+};
+export interface AdmissionAuthority {
+    /**
+     * `origin` says which judgement this is. `'sync-apply'` (the default) is a
+     * record ARRIVING from another device. core#108 — `'push-recheck'` is this
+     * device's OWN dirty record, re-judged against current local state before
+     * it leaves: a record written offline may no longer pass the rules its
+     * writer's device now holds, and catching that here means the writer finds
+     * out before anyone else sees the record.
+     */
+    admit(collection: string, id: string, envelope: EncryptedEnvelope, origin?: 'sync-apply' | 'push-recheck'): Promise<AdmissionVerdict>;
+}

package/dist/port/with/broker-strategy.d.ts

@@ -16,6 +16,7 @@
  */
 import type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /** Construction-time options for `withBroker(config)` (spec §5 client surface). */
 export interface BrokerConfig {
     /**
@@ -66,6 +67,29 @@ export interface BrokerStrategy {
     enroll(ctx: BrokerCtx): Promise<void>;
     rotate(ctx: BrokerCtx): Promise<void>;
     credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource;
+    /**
+     * core#73 — called by the kernel right after `grant()`: register the
+     * grantee with the broker host under its own per-member key. Needs the
+     * grantee's `secret` because the member's `_broker_member` DEK can only be
+     * opened with it, and only at this moment does the grantor hold it. A
+     * no-op for owner/admin grantees (they use the shared seed) and for the
+     * floor stub (no broker ⇒ nothing to register).
+     */
+    /**
+     * core#73 — register a sub-admin member with the host. With `secret` (a
+     * grant) the member's `_broker_member` DEK is read from their keyring; with
+     * `dek` (core#96, a role change through `updateUser`) it is the fresh key
+     * just delivered through the member's inbox.
+     */
+    enrolMember(ctx: BrokerCtx, member: {
+        readonly userId: string;
+        readonly secret: string;
+    } | {
+        readonly userId: string;
+        readonly dek: EnclaveKey;
+    }): Promise<void>;
+    /** core#73 — called by the kernel right after `revoke()`: de-register the member with the host and drop its record. */
+    revokeMember(ctx: BrokerCtx, userId: string): Promise<void>;
 }
 /**
  * No-op stub — the floor default. Every broker operation throws

package/dist/port/with/coverage-strategy.d.ts

@@ -19,7 +19,23 @@
  * binary-search, and a signal is not. Adding "just an option" to refuse
  * reintroduces exactly the objection the shape was chosen to dissolve.
  *
- * @internal
+ * ⭐ PUBLISHED SEAM — ruled 2026-09-16 (core#38, recorded in the family's seam
+ * registry). {@link CoverageEvent} is re-exported from `@noy-db/hub/coverage`
+ * and shipped in 0.8.0's `.d.ts`; consumers already hold it. This module
+ * previously ended `@internal`, which strips nothing (`stripInternal` is set
+ * in no tsconfig here) and so described the opposite of what shipped. The tag
+ * is gone rather than made true, because adding `stripInternal` now would
+ * break every importer at 0.8.0.
+ *
+ * Consequences, additive-only from here:
+ *   - a new sensor ADDS fields and never redefines `served` / `novel` /
+ *     `coverage` / `window` — their horizons are mixed BY DESIGN (see each
+ *     field), and redefining one per `source` is what makes a controller
+ *     subscribe once and compute nonsense;
+ *   - `source` stays `string` — an enum would make every new sensor a
+ *     breaking change to hub — and its VALUES are allocated in the family
+ *     registry as `<repo>/<sensor>`. A new sensor claims its value there
+ *     before it ships.
  */
 /**
  * The one event every sensor in the #1251 design emits, whatever its

package/dist/port/with/formats-strategy.d.ts

@@ -15,12 +15,32 @@
  * @internal
  */
 import type { NoydbFormat, ImportPlan, ImportPolicy } from '../as/types.js';
+/**
+ * `ImportPolicy` — PUBLISHED API, reachable from @noy-db/hub/as. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type { NoydbFormat, ImportPlan, ImportPolicy };
 import type { ExportChunk } from '../../kernel/types.js';
 import type { Vault } from '../../kernel/vault.js';
 /** Options common to an export. */
 export interface FormatExportOptions {
-    /** Restrict to these collections. Omitted: everything the caller can read. */
+    /**
+     * Export only these collections. Omitted: everything the caller can read.
+     *
+     * ⭐ **This narrows the READ** — the excluded collections are neither
+     * fetched nor decrypted (core#45b, since 0.8).
+     *
+     * ⚠️ It did not always. Through 0.7 this filtered the chunks AFTER hub had
+     * decrypted the whole vault, and the JSDoc here said so: scoping an export
+     * bought output shaping and no reduction in what a compromised process
+     * could observe. If you are reading a version of this note that still says
+     * that, you are reading 0.7's. The narrowing is asserted by observing the
+     * store, because no assertion on the returned chunks can tell the two
+     * implementations apart.
+     */
     readonly collections?: readonly string[];
     /**
      * Redact before `encode` sees a record. Hub applies the projection, so a
@@ -69,6 +89,19 @@ export interface FormatsContext {
     plan(records: Readonly<Record<string, readonly unknown[]>>, policy: ImportPolicy, formatId: string, idKey?: string): Promise<ImportPlan>;
 }
 /** Thrown by every method on {@link NO_FORMATS}. */
+/**
+ * `FormatsNotEnabledError` — PUBLISHED API, reachable from `@noy-db/hub` and
+ * `@noy-db/hub/as`. Flagged by knip as unused because nothing inside hub imports
+ * it from this module; a consumer does. Do not narrow or delete without a seam
+ * change (#55).
+ *
+ * ⚠️ This comment claimed `@noy-db/hub` + `@noy-db/hub/tiers` until #57, and both
+ * were false — the class reached NO published entry, so the only way to handle it
+ * was `err.name`. A comment naming who can import something is not evidence;
+ * `__tests__/error-classes-reachable.test.ts` is.
+ *
+ * @public
+ */
 export declare class FormatsNotEnabledError extends Error {
     constructor(op: string);
 }

package/dist/port/with/lookup-strategy.d.ts

@@ -32,6 +32,11 @@ import type { LookupDescriptor } from '../../via/lookup/descriptor.js';
  * `DictionaryOptions` (kept as a distinct alias since the "lookup" name is
  * the forward-looking one; `DictionaryOptions` stays the dict-tier name).
  */
+/**
+ * Frozen seam shape (#650 Task 1): the backing-options alias the later phase-D tasks bind onto.
+ *
+ * @seam
+ */
 export type LookupBackingOptions = DictionaryOptions;
 /**
  * Options accepted by `LookupStrategy.buildLookupHandle`. Mirrors the
@@ -99,34 +104,110 @@ export interface LookupStrategy {
  * (`Vault.i18nStrategy.buildDictionaryHandle` → `withLookup().buildLookupHandle`) never reaches
  * here. Kept as forward scaffolding for a later task that wires an independent lookup opt-in.
  */
+/**
+ * Frozen seam shape, named in this file's header: `NO_LOOKUP` is what later phase-D tasks bind `vault.collection()`'s lookup fields onto — unused by Task 1's wiring on purpose.
+ *
+ * @seam
+ */
 export declare const NO_LOOKUP: LookupStrategy;
 /** `_dict_*` (legacy dict tier) and `_lookup_*` (the phase-D reserved backing). */
+/**
+ * Frozen seam shape (#650 Task 1, header): bound by later phase-D tasks, deliberately unused by the wiring that landed first.
+ *
+ * @seam
+ */
 export declare const LOOKUP_COLLECTION_PREFIXES: readonly ["_dict_", "_lookup_"];
 /** Return true when a collection name is a reserved lookup-backing collection. */
+/**
+ * Frozen seam shape, named in this file's header alongside `NO_LOOKUP`.
+ *
+ * @seam
+ */
 export declare function isLookupCollectionName(name: string): boolean;
 export { enforceStaticDictOnPut, resolveDictSource, updateReferencingRecords };
+/**
+ * Engine type through the port — same boundary reason as the line above.
+ *
+ * @seam
+ */
 export type { DictReferencingCollection };
 export { dictCollectionName } from '../../via/lookup/handle.js';
-export { resolveLabelFromMap, collectLookupDictCompat, lookupToStaticDictCompat };
+export { resolveLabelFromMap, collectLookupDictCompat };
+/**
+ * Dict-compat helper through the port — same boundary reason; no importer
+ * takes it from here today.
+ *
+ * @seam
+ */
+export { lookupToStaticDictCompat };
+/**
+ * Dict-compat type through the port — same boundary reason.
+ *
+ * @seam
+ */
 export type { LookupDictCompat };
 export { reservedDictDepsOf };
-export { materializeBackingTable, checkLookupMembership, buildLookupAltIndex };
+export { checkLookupMembership, buildLookupAltIndex };
+/**
+ * Backing-table helper through the port — same boundary reason; no importer
+ * takes it from here today.
+ *
+ * @seam
+ */
+export { materializeBackingTable };
 export type { MaterializedBacking };
 export { registerLookupRefEdges };
 export { buildLookupSnapshotRows, buildPresentForJoin };
+/**
+ * Snapshot type through the port — same boundary reason.
+ *
+ * @seam
+ */
 export type { LookupSnapshot } from '../../via/lookup/snapshot.js';
-export { coerceLookupKey, resolveBackingRowKey, matchesReferencingValue };
+export { coerceLookupKey, matchesReferencingValue };
+/**
+ * Key-coercion helper through the port — same boundary reason; no importer
+ * takes it from here today.
+ *
+ * @seam
+ */
+export { resolveBackingRowKey };
 /** Runtime predicate for detecting a `LookupDescriptor` (any of the three tiers). */
 export declare function isLookupDescriptor(x: unknown): x is LookupDescriptor;
 /** Runtime predicate for the bare enum tier (`backing:'static'`, no in-code `table` — no label source). */
+/**
+ * Descriptor predicate, frozen with the seam it belongs to (#650 Task 1).
+ *
+ * @seam
+ */
 export declare function isEnumDescriptor(x: unknown): x is LookupDescriptor;
 /**
  * Type-only re-exports — the kernel spine imports these descriptor/handle
  * types through the port instead of reaching into `via/lookup/*` or
  * `via/i18n/*` directly. `isolatedModules: true` erases these at
  * build time — no runtime coupling.
+ *
+ * @seam
  */
 export type { LookupHandle, DictEntry, DictionaryOptions } from '../../via/lookup/handle.js';
-export type { LookupDescriptor, Vocabulary, LookupBacking, OnDelete } from '../../via/lookup/descriptor.js';
+export type { LookupDescriptor } from '../../via/lookup/descriptor.js';
+/**
+ * Descriptor types through the port. The spine may not reach into
+ * `via/lookup/*` (Check 14), so these exist for the boundary, not for a
+ * current importer.
+ *
+ * @seam
+ */
+export type { Vocabulary, LookupBacking, OnDelete } from '../../via/lookup/descriptor.js';
+/**
+ * Binding config through the port — same boundary reason as the descriptor types above.
+ *
+ * @seam
+ */
 export type { LookupViaConfig } from '../../via/lookup/binding.js';
+/**
+ * i18n dictionary descriptors through the port — same boundary reason.
+ *
+ * @seam
+ */
 export type { DictKeyDescriptor, StaticDictDescriptor } from '../../via/i18n/dictionary.js';