@noy-db/hub 0.10.0-pre.0 → 0.10.0-pre.2

package/dist/indexing/index.js

@@ -8,15 +8,15 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-2ODEFG6K.js";
+} from "../chunk-EWSIJDWO.js";
 import {
   CollectionIndexes
-} from "../chunk-AYOQZJDB.js";
+} from "../chunk-LIX4QPMM.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-4CFHL5RY.js";
-import "../chunk-SXPLIRQH.js";
-import "../chunk-PIO6NW7O.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-NLDBQHDV.js";
+import "../chunk-ZG7DBIVX.js";
+import "../chunk-ISIXU45J.js";
 
 // src/with-lookup/indexing/active.ts
 function withIndexing() {

package/dist/introspection/index.js

@@ -1,7 +1,7 @@
 import "../chunk-2DX4JCRI.js";
 import {
   dumpVaultSchema
-} from "../chunk-654RE5YC.js";
+} from "../chunk-HDAPQF6Q.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
@@ -12,17 +12,14 @@ import {
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-UORWAG7K.js";
+import "../chunk-FY4FFNKK.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-IF2M43G4.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-PBRD75JF.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
+import "../chunk-ISIXU45J.js";
 export {
   FieldMetaUnknownFieldError,
   applyListProjection,

package/dist/issue-EIHEDAXM.js

@@ -0,0 +1,16 @@
+import {
+  issueAttestationCore
+} from "./chunk-HRLMUZLI.js";
+import "./chunk-NUBI6PYH.js";
+import "./chunk-XMARKBUC.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-EIHEDAXM.js.map

package/dist/kernel/capsule-requirements.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Which hub features need which capsule group, and the two refusal points
+ * (family#156).
+ *
+ * ⛔ AT STARTUP OR NOT AT ALL. A capability discovered on first write is a
+ * half-built vault: some records sealed, a service silently inert, and a
+ * consumer who cannot tell a missing capability from a bug. So this refuses at
+ * `createNoydb()` for a SERVICE, and at `vault.collection()` for a declared
+ * FIELD — the two places a requirement becomes known.
+ *
+ * ⭐ TWO POINTS, BECAUSE A DECLARATION IS NOT A STRATEGY. A `classifiedFields`
+ * declaration writes `_vdig`/`_sealed` with no `classifiedStrategy` at all: the
+ * strategy is the READ side (reveal/verify/matchGroup), while the codec's
+ * `vdigFields` map comes straight from the declaration at construction.
+ * Measured before wiring — a single check at `createNoydb()` would have left
+ * every write-side requirement unenforced while looking complete.
+ *
+ * ⚠️ `authenticate` and `seal` ARE DELIBERATELY ABSENT from both tables, and
+ * that is a measurement, not an omission. `deriveKey` (secret → KEK) and
+ * `wrapKey`/`unwrapKey` (KEK wraps DEK) are called only from the keyring unlock
+ * chain — `with-party/team/keyring.ts` and the DEK-rewrapping paths in
+ * `with-cargo`/`custody`/`delegation` — never from a field form. Mapping
+ * `storage:'recoverable'` to `seal` or `digest-only` to `authenticate` would
+ * have been plausible and invented: those two are the POSTURE groups
+ * (`PRIMITIVE_GROUPS` has no primitive for either), and what actually implies
+ * them is opening a vault with a secret. That is a THIRD refusal point this
+ * ruling did not name, so it is reported rather than added here.
+ * @module
+ */
+import { type CapsuleGroup } from '../capsule/contract.js';
+/** The declaration shape the field check reads — a slice of the collection options. */
+export interface DeclaredFieldGroups {
+    readonly sensitiveFields?: ReadonlySet<string> | readonly string[] | null;
+    readonly deterministicFields?: ReadonlySet<string> | readonly string[] | null;
+    readonly perRecordKeys?: boolean;
+    /** Classified members by field, with the storage form that decides the group. */
+    readonly classifiedByField?: Readonly<Record<string, {
+        readonly storage: string;
+        readonly equatable?: boolean;
+    }>> | null;
+}
+/**
+ * Every (group, requirer) a set of declared fields needs — the pure half.
+ *
+ * ⭐ SEPARATED FROM THE THROW on purpose (the family#172 lesson applied to this
+ * wiring): the reference capsule supports every group, so no integration test
+ * can reach a refusal, and a predicate that only ever runs against a capsule
+ * which never refuses is exactly the shape family#172 had to fix. The decision
+ * is testable against a stub set; what still needs its own test is that
+ * anything CALLS it.
+ */
+export declare function fieldGroupRequirements(collection: string, decl: DeclaredFieldGroups): ReadonlyArray<readonly [CapsuleGroup, string]>;
+/** Every (group, requirer) a set of enabled services needs — the pure half. */
+export declare function serviceGroupRequirements(options: Readonly<Record<string, unknown>>): ReadonlyArray<readonly [CapsuleGroup, string]>;
+/**
+ * The POSTURE groups an encrypted vault needs, and the third refusal point
+ * (family#156, ruled 2026-10-12).
+ *
+ * ⭐ IT IS THE KEYRING, NOT A FIELD OR A SERVICE, and that is what the earlier
+ * measurement found: `deriveKey` (secret → KEK) is `authenticate` and
+ * `wrapKey`/`unwrapKey` (KEK wraps DEK) are `seal`, called only from the
+ * keyring's unlock chain. So nothing in {@link SERVICE_GROUPS} or
+ * {@link fieldGroupRequirements} can imply them — what implies them is opening
+ * a vault that HAS a keyring.
+ *
+ * ⛔ A PLAINTEXT VAULT MUST STILL OPEN, and the gate for that is STRUCTURAL
+ * rather than a condition written here. `createNoydb({ encrypt: false })`
+ * short-circuits in `_getKeyringInternal` to `createPlaintextKeyring()` and
+ * never reaches `loadKeyring`/`createOwnerKeyring` — so calling this at those
+ * two entries means it cannot fire for a vault that has no keyring. An
+ * `encrypted` parameter would have been a condition I maintain and that can
+ * drift; an unreachable path cannot. Refusing unconditionally would make
+ * `exclave-plain` unable to open any vault at all, which is its entire purpose.
+ *
+ * ⚠️ Called at the KEYRING ENTRY rather than in `openVault`: the ruling says
+ * "before any keyring is read or written", and the entry is literally that. It
+ * also covers the creation paths `openVault` does not go through — `grant`,
+ * `rotateSecret`, recovery — which a guard at the open call site would miss.
+ */
+export declare function assertVaultPostureSupported(caps: ReadonlySet<CapsuleGroup>, requirer: string): void;
+/** Refuse at `createNoydb()` — one assertion per enabled service. */
+export declare function assertServicesSupported(options: Readonly<Record<string, unknown>>, caps: ReadonlySet<CapsuleGroup>): void;
+/** Refuse at `vault.collection()` — one assertion per declared field form. */
+export declare function assertFieldsSupported(collection: string, decl: DeclaredFieldGroups, caps: ReadonlySet<CapsuleGroup>): void;

package/dist/kernel/errors.d.ts

@@ -895,8 +895,9 @@ export declare class TierDemoteDeniedError extends NoydbError {
 }
 /**
  * Thrown when `db.delegate()` is called against a user that has no
- * keyring in the target vault — the delegation token cannot be
- * constructed without the target user's KEK wrap.
+ * keyring in the target vault — the token's content key is sealed to the
+ * target's inbox PUBLIC half (core#65/#96), which lives in that keyring, so
+ * without it there is nothing to seal to. Nothing secret of theirs is needed.
  */
 export declare class DelegationTargetMissingError extends NoydbError {
     readonly toUser: string;
@@ -2402,7 +2403,7 @@ export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
     constructor(vault: string);
 }
 /**
- * Raised by `db.recoverSecret` / `db.enrollRecovery` /
+ * Raised by `db.team.recoverSecret` / `db.team.enrollRecovery` /
  * `db.rotateRecovery` when the developer requests a recovery profile
  * not yet wired in this hub release.
  *
@@ -2418,6 +2419,21 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
     constructor(profile: string, tracking: string);
 }
 /**
+ * @deprecated Since family#168 (2026-10-12). Throw
+ * `CapsuleNotSupportedError` from `@noy-db/hub/capsule` instead; this class is
+ * removed at a later breaking cut.
+ *
+ * ⛔ WHY IT IS GOING. Two not-supported classes shipped side by side with two
+ * DIFFERENT codes — this one (`ENCLAVE_NOT_SUPPORTED`) and
+ * `CapsuleNotSupportedError` (`CAPSULE_NOT_SUPPORTED`). Hub never threw this
+ * one; `exclave-plain` threw the other; and the published conformance kit
+ * matched only this code. So a capsule refusing a group EXACTLY AS THE CONTRACT
+ * SAYS was reported by the kit as not refusing at all. Nothing failed anywhere,
+ * because the one capsule that supports every group never takes the branch.
+ *
+ * ⚠️ The kit now accepts BOTH codes, so a fork already throwing this keeps
+ * passing. That is the only reason this class still exists.
+ *
  * Thrown by a `capsule/enclave-aes` fork's **optional groups** — sealing,
  * deterministic, per-record-key lifecycle — when that fork's crypto
  * engine does not implement the requested behavior.

package/dist/kernel/export-scope.d.ts

@@ -19,7 +19,7 @@
  *
  * @module
  */
-import type { NoydbStore, ExportStreamOptions } from './types.js';
+import type { NoydbStore, ExportStreamOptions, EncryptedEnvelope } from './types.js';
 /** Where an export's collection names and record ids come from. */
 export interface ExportSource {
     /** Collection names to export, sorted. */
@@ -28,6 +28,18 @@ export interface ExportSource {
     readonly scoped: boolean;
     /** Record ids in one collection. */
     ids(collection: string): Promise<readonly string[]>;
+    /**
+     * The raw envelope for one record, for `withEnvelopeMeta` (family#166).
+     *
+     * ⚠️ THE TWO SOURCES ANSWER THIS AT DIFFERENT PRICES, and the caller must
+     * only ask when the option was set. The bulk source already holds the whole
+     * snapshot, so this is a map lookup; the scoped source enumerated with `list`
+     * and has no envelopes, so this is a store `get` per record. Making it part
+     * of the source interface rather than reaching for `adapter` at the call site
+     * is what keeps that difference in ONE place — the same reason core#45b put
+     * the enumeration strategy here.
+     */
+    envelope(collection: string, id: string): Promise<EncryptedEnvelope | null>;
 }
 /**
  * Resolve the read strategy for one export.
@@ -38,3 +50,18 @@ export interface ExportSource {
  * the route that happens to be taken is a rule waiting to be lost.
  */
 export declare function resolveExportSource(adapter: NoydbStore, vault: string, opts: ExportStreamOptions): Promise<ExportSource>;
+/**
+ * `_v`/`_ts` for one exported record (family#166).
+ *
+ * ⚠️ A NULL ENVELOPE YIELDS VERSION 0, not a gap. The record was readable a
+ * moment ago (the caller only asks after a non-null `get`), so null here means
+ * it was deleted mid-export — and family#147 ruled that absence IS version 0
+ * at the store contract, so reporting 0 is the same answer the CAS gives rather
+ * than a new sentinel. Returning `undefined` instead would break the
+ * positional alignment that `ExportChunk.envelopeMeta` is built on, which is
+ * the one property a consumer cannot recover.
+ */
+export declare function readEnvelopeMeta(source: ExportSource, collection: string, id: string): Promise<{
+    version: number;
+    ts: string;
+}>;

package/dist/kernel/store-segment-guard.d.ts

@@ -0,0 +1,29 @@
+import type { NoydbStore } from './types.js';
+/**
+ * Wrap `store` so every segment it is handed is checked first.
+ *
+ * ⛔ A PROXY, NOT `{ ...store, get() {…} }`, and the spread is a real defect
+ * rather than a style preference: it copies OWN ENUMERABLE properties only, so
+ * a store implemented as a CLASS loses every prototype method the wrapper does
+ * not itself redeclare — `listPage`, `tx`, `getStoreTime`, `listSince`, `ping`
+ * all vanish silently, and hub then takes its fallback paths as though the
+ * store never offered them. (`with-store`'s `wrapStore` middleware still has
+ * that shape; it is family#173, not fixed here.)
+ *
+ * ⚠️ `Reflect.apply(fn, target, args)` binds `this` to the TARGET, not the
+ * proxy. That is load-bearing for a class store with `#private` fields: called
+ * through the proxy as the receiver, a method touching `#field` throws
+ * "Cannot read private member" — a failure that looks nothing like a wrapper
+ * bug. Everything unguarded is forwarded the same way, so `name`,
+ * `capabilities` and any vendor extension survive untouched.
+ */
+/**
+ * The raw store behind a guard, or `store` itself if it is not guarded.
+ *
+ * ⚠️ Exists for `Noydb.store`, the published accessor whose whole purpose is
+ * handing back what the caller mounted — `===` against their own argument. A
+ * proxy satisfies every behavioural assertion and fails that one, which is how
+ * `introspection/store-and-sync-targets.test.ts` found it.
+ */
+export declare function unguardedStore(store: NoydbStore): NoydbStore;
+export declare function guardStoreSegments(store: NoydbStore): NoydbStore;

package/dist/kernel/types.d.ts

@@ -640,6 +640,63 @@ export interface ListPageResult {
     /** Opaque cursor for the next page, or `null` if this was the last page. */
     nextCursor: string | null;
 }
+/**
+ * ## Segment shape — part of the contract (family#133)
+ *
+ * `vault` and `collection` are single names: never empty, never `.` or `..`,
+ * and they carry no path separator. A record `id` **may** contain `/` — hub
+ * materialises persisted index side-cars as `_idx/<field>/<recordId>` — but no
+ * slash-separated component of it may be empty, `.` or `..`.
+ *
+ * ⛔ **ABSENCE AND FAILURE ARE DIFFERENT ANSWERS** (family#162). `get` returns
+ * `null`, `list` returns `[]` and `loadAll` returns `{}` for something that is
+ * **not there**. A read that FAILED — a permission error, an I/O error, a
+ * corrupt body — must **throw**, and must never be reported as absence.
+ *
+ * Hub cannot tell the two apart, and it has a fail-closed gate that depends on
+ * doing so: `assertKeyringOpenAllowed` refuses to self-provision into a vault
+ * held by other principals by checking `list(vault, '_keyring')` for emptiness.
+ * A store that answered an EACCES with `[]` made that gate read "a
+ * genuinely-new vault" and hub provisioned a second owner into a vault that
+ * already had one. `@noy-db/to-file` did exactly that until family#162.
+ *
+ * ⚠️ Not kit-enforceable: a conformance suite cannot inject a read failure into
+ * an arbitrary store, so this is a contract a store author honours rather than
+ * one the kit can check. That is why it is stated here, in the authority.
+ *
+ * ⛔ **A NUL (`\x00`) is legal in an id too, and hub emits one** (family#174).
+ * `resolveSequenceKey` and `resolvePeriodKey` join a partition as
+ * `${name}\x00${parts}`, chosen precisely because a NUL cannot occur in a plain
+ * series name — so a partitioned key can never collide with an unpartitioned
+ * one. A store that refuses the byte cannot hold a partitioned sequence or
+ * period at all. A FILESYSTEM-backed store must therefore **encode** id
+ * components (at least NUL and `%`, which the encoding itself needs) and
+ * **decode on `list`** — an encoding without a matching decode reports an id
+ * that no `get` resolves. `@noy-db/ports/to` has the round-trip case.
+ *
+ * ⛔ A store must therefore **accept** `/` in an id. Refusing the separator
+ * breaks hub's own writes, which is a real measured failure rather than a
+ * hypothetical: `to-file` created only the collection directory, so every
+ * side-car write failed with `ENOENT` on its atomic-write leaf and persisted
+ * indexing never worked on that store.
+ *
+ * ✅ **Hub validates this centrally since family#133's second half.**
+ * `createNoydb()` wraps the mounted store in `guardStoreSegments()`
+ * (`kernel/store-segment-guard.ts`), so a malformed vault, collection or id is
+ * refused before any store sees it. The sentence here used to say the opposite,
+ * which was honest and is now wrong.
+ *
+ * ⚠️ A store's own guard is still required, and is not redundant: an
+ * out-of-tree caller can hold a `NoydbStore` reference and never pass through
+ * hub. `@noy-db/ports/to`'s `broken-escapes-namespace` control tests the store
+ * side precisely because hub's check cannot reach it.
+ *
+ * What a store MUST guarantee either way is **containment**: if a malformed id
+ * reaches it, the record must not become readable under a different
+ * `(vault, collection)` pair. A store may also reject outright —
+ * `@noy-db/ports/to` accepts either, and its `broken-escapes-namespace` control
+ * is a store that collapses `..` and lets an id climb out of its vault.
+ */
 export interface NoydbStore {
     /**
      * Optional human-readable store name (e.g. 'memory', 'file', 'dynamo').
@@ -657,13 +714,23 @@ export interface NoydbStore {
     /** Get a single record. Returns null if not found. */
     get(vault: string, collection: string, id: string): Promise<EncryptedEnvelope | null>;
     /**
-     * Put a record. Throws ConflictError if `expectedVersion` doesn't match an
-     * EXISTING record's `_v`.
+     * Put a record. Throws ConflictError if `expectedVersion` doesn't match the
+     * record's current `_v`, **where an absent id counts as version 0** — so the
+     * comparison always happens and the two halves fall out of one rule:
+     *
+     *   - `expectedVersion: 0` against an absent id → `0 === 0`, the write lands;
+     *   - `expectedVersion: N > 0` against an absent id → mismatch, and the
+     *     `ConflictError` carries `version: 0` (family#147).
+     *
+     * ⚠️ The second half is a TIGHTENING, ruled on family#147. The natural
+     * read-then-compare shape guarded the comparison with `&& existing`, so a
+     * writer saying "I expect version 5" against nothing silently UPSERTED. Absence
+     * satisfies "I expect no record" and contradicts "I expect the record I read",
+     * which is why the halves differ. Both are asserted by `@noy-db/ports/to`
+     * (core#134, core#138, family#147).
      *
-     * ⚠️ **Against an ABSENT id the comparison does not happen and the write
-     * lands.** That is not an implementation detail of the reference store — it is
-     * the contract, asserted by `@noy-db/ports/to` (core#134, core#138) and run
-     * green across all 19 `to-*` adapters.
+     * ⛔ Implement it as `(existing?._v ?? 0) !== expectedVersion`, never
+     * `existing && existing._v !== expectedVersion`.
      *
      * ⭐ **So `expectedVersion: 0` is an exact "write only if absent."** hub never
      * stores a version below 1, so the first create is let through and every
@@ -686,7 +753,30 @@ export interface NoydbStore {
     list(vault: string, collection: string): Promise<string[]>;
     /** Load all records for a vault (initial hydration). */
     loadAll(vault: string): Promise<VaultSnapshot>;
-    /** Save all records for a vault (bulk write / restore). */
+    /**
+     * Save all records for a vault (bulk write / restore).
+     *
+     * ⭐ **This REPLACES, it does not merge** (family#147). Every non-underscore
+     * collection in the vault is dropped and the snapshot written over the top, so
+     * a collection absent from `data` is GONE afterwards, and a collection present
+     * with an EMPTY record set is EMPTIED. `saveAll` is the restore half of
+     * `loadAll`, and a merging restore cannot express "this collection is gone" —
+     * omitting a key and passing `{}` would mean the same thing, so a backup would
+     * silently resurrect what the snapshot was taken to exclude.
+     *
+     * ⚠️ **Reserved (`_`-prefixed) collections are asymmetric, deliberately.** They
+     * are never DROPPED — a partial snapshot must not strand `_keyring` and leave
+     * the vault unopenable — but they ARE overwritten when `data` carries them,
+     * which is what makes a full restore possible.
+     *
+     * ⛔ The consequence worth stating rather than leaving to be discovered: a
+     * snapshot carrying `_keyring` **replaces the live keyring without passing
+     * through any keyring code path** — no epoch check, no roster validation, no
+     * grant. Treat a `saveAll` payload as exactly as trusted as the vault itself.
+     *
+     * Note `loadAll` SKIPS reserved collections, so `loadAll` → `saveAll` does not
+     * round-trip them; a restore that needs the keyring must carry it explicitly.
+     */
     saveAll(vault: string, data: VaultSnapshot): Promise<void>;
     /** Optional connectivity check for sync engine. */
     ping?(): Promise<boolean>;
@@ -906,7 +996,7 @@ export type VaultPolicyOnDisk = Record<string, unknown>;
  * - `paper` — `on-recovery` codes (the standard end-to-end profile).
  * - `shamir` / `multi-channel` / `admin-mediated` — API surface ships;
  *   per-profile dispatch lands in follow-up issues. Calling
- *   `db.recoverSecret` against these throws
+ *   `db.team.recoverSecret` against these throws
  *   {@link RecoveryProfileNotImplementedError}.
  */
 type RecoveryEnrollment = {
@@ -1359,6 +1449,23 @@ export interface ExportStreamOptions {
      * per-partition. Default: `false`.
      */
     readonly withLedgerHead?: boolean;
+    /**
+     * When `true`, every chunk carries {@link ExportChunk.envelopeMeta} — the
+     * store-level `_v` and `_ts` of each exported record, positionally aligned
+     * with `records` (family#166).
+     *
+     * ⚠️ OPT-IN BECAUSE THE COST IS ASYMMETRIC, and the asymmetry is the whole
+     * reason this is a flag rather than always-on. An unscoped export already
+     * holds every envelope — `resolveExportSource` does ONE `loadAll` — so the
+     * metadata is free. A SCOPED export deliberately enumerates with `list` and
+     * never pulls the envelopes (core#45b: that avoidance is what makes
+     * "scoping" a property rather than a word), so it costs one `get` per
+     * exported record. Default `false` keeps a scoped export's read as narrow as
+     * core#45b made it.
+     *
+     * Default: `false`.
+     */
+    readonly withEnvelopeMeta?: boolean;
     /**
      * Export locale (BCP 47, e.g. `'th'`). When set, records are read at this
      * locale through the **`export` layer**: `i18nText` fields collapse to
@@ -1458,6 +1565,54 @@ export interface ExportChunk<T = unknown> {
         readonly index: number;
         readonly ts: string;
     };
+    /**
+     * Store-level version and write timestamp of each exported record
+     * (family#166). Present only when `exportStream({ withEnvelopeMeta: true })`
+     * was called.
+     *
+     * ⛔ POSITIONALLY ALIGNED WITH `records`, NOT KEYED BY ID, and that is
+     * deliberate. A record need not carry an `id` field at all — hub's id is the
+     * store key, not a property of the plaintext — so a `{ [id]: meta }` map
+     * would silently drop every id-less record and quietly mis-key any record
+     * whose own `id` field disagrees with its store key. That is family#151's
+     * defect in `diffVault` exactly, and repeating it here would put it on a
+     * PUBLISHED type.
+     *
+     * ⚠️ So `envelopeMeta[i]` describes `records[i]`, and the two always have the
+     * same length. A record the caller cannot read is skipped from BOTH, which is
+     * the alignment hazard this shape has to get right: `records` already drops a
+     * null `get()`, so the metadata must be appended in that same branch and
+     * never in a second loop over `ids`.
+     *
+     * `version` is the envelope's `_v` — monotonic per record, what a CAS
+     * `expectedVersion` compares against. `ts` is its `_ts`, the store-visible
+     * write time, which is NOT the same as any business timestamp inside the
+     * record.
+     */
+    readonly envelopeMeta?: ReadonlyArray<{
+        readonly version: number;
+        readonly ts: string;
+    }>;
+    /**
+     * The HUB ID of each exported record, positionally aligned with `records`
+     * (family#151).
+     *
+     * ⭐ ALWAYS POPULATED BY `exportStream`, and not behind a flag. Unlike
+     * {@link ExportChunk.envelopeMeta} it costs nothing — both yield paths
+     * already iterate the id list — and a flag is a way to forget it. The id is
+     * NOT derivable from a record: hub's id is the store key, and a record need
+     * not carry an `id` field at all, which is why `diffVault` keyed by a FIELD
+     * and silently dropped every record that had none.
+     *
+     * ⚠️ Optional in the TYPE so a consumer constructing an `ExportChunk` — an
+     * `as-*` format fixture, say — stays valid. Hub never omits it.
+     *
+     * ⛔ Positionally aligned, like `envelopeMeta`, and for the same reason: a
+     * `{ [id]: record }` map cannot represent a record whose own `id` field
+     * disagrees with its store key, and that disagreement is the bug this field
+     * exists to make visible.
+     */
+    readonly ids?: readonly string[];
 }
 export interface DirtyEntry {
     readonly vault: string;
@@ -1620,7 +1775,8 @@ export type ConflictStrategy = 'local-wins' | 'remote-wins' | 'version' | ((conf
  * Overrides the db-level `conflict` option for the specific collection.
  *
  * - `'last-writer-wins'` — higher `_ts` wins (timestamp LWW).
- * - `'first-writer-wins'` — lower `_v` wins (earlier version is preserved).
+ * - `'first-writer-wins'` — lower `_v` wins (earlier version is preserved); on a
+ *   tie the copy already on the remote wins, since it reached the remote first.
  * - `'manual'` — emits `sync:conflict` with a `resolve` callback. Call
  *   `resolve(winner)` synchronously to commit or `resolve(null)` to defer.
  * - Custom fn — synchronous `(local: T, remote: T) => T`. Must be pure.
@@ -3476,7 +3632,7 @@ export interface NoydbOptions {
     /**
      * Vault-level policy gate document. When present, the hub
      * persists the merged policy at `_meta/policy` on first-time vault
-     * creation and gates sensitive operations (`db.rotateSecret`,
+     * creation and gates sensitive operations (`db.team.rotateSecret`,
      * `db.export*`, …) against it. Omitted ⇒ the engine uses
      * {@link PERSONAL_POLICY}. Use {@link STRICT_POLICY} for regulated
      * deployments.
@@ -3998,7 +4154,7 @@ export type BuiltInGateName = 'rotate-secret' | 'recover-secret' | 'enroll-authe
 /** Authorize reading other principals' user envelopes. */
  | 'view-team-profiles'
 /**
- * Authorize an atomic peer-recovery — `db.recoverUser`.
+ * Authorize an atomic peer-recovery — `db.team.recoverUser`.
  * Distinct from `revoke-user` because peer-recovery is intentional
  * re-issuance of someone's keyring under a temp secret, NOT
  * removal. Allows owner→owner natively (matches the threat model:
@@ -4080,8 +4236,8 @@ export interface FactorProof {
  * Noydb method. Used as the optional last parameter of every method
  * that runs through `checkGate`: `db.grant`, `db.revoke`, `db.updateUser`,
  * `db.enrollAuthenticator`, `db.removeAuthenticator`, `db.updateAuthenticator`,
- * `db.enrollWebAuthn`, `db.rotateSecret`, `db.recoverSecret`,
- * `db.recoverUser`, `db.enrollUnlock`, `db.describeUserAuth`,
+ * `db.team.enrollWebAuthn`, `db.team.rotateSecret`, `db.team.recoverSecret`,
+ * `db.team.recoverUser`, `db.team.enrollUnlock`, `db.team.describeUserAuth`,
  * `db.describeAllUsersAuth`.
  *
  * Previously this type was inlined at every call site as

package/dist/kernel/validation.d.ts

@@ -117,6 +117,38 @@ export declare class WeakSecretError extends NoydbError {
     readonly suggestion: string;
     constructor(reason: WeakSecretReason, suggestion?: string);
 }
+/**
+ * The bar an EXPORT secret must clear (family#177).
+ *
+ * ⭐ DELIBERATELY NOT THE OWNER BAR, and the difference is not laxity. The
+ * owner default is phrase-shaped — six lowercase words, each ≥3 characters,
+ * `/^[a-z]+( [a-z]+)*$/` — because it is a thing a human memorises and types
+ * daily, and because that is the shape the EFF generator emits. An export
+ * secret is typed once into a dialog or produced by a password manager, so the
+ * phrase rules refuse the strongest things a caller is likely to use:
+ * `8f3a9c2b1d4e7f0a` fails on `invalid-chars`, and `Tax-Returns-2026!` fails
+ * twice over.
+ *
+ * ⛔ SO THE BAR IS LENGTH, 12 CHARACTERS, AND NOTHING ELSE. Measured against
+ * the real secrets in this repo and the shapes a consumer actually passes:
+ *
+ *   BLOCKED  p · pw · pw1 · r-pw · aud-pw · bob-pw · new-pw · alice-pw · hunter2
+ *   ALLOWED  Tax-Returns-2026! · 8f3a9c2b1d4e7f0a · source-pw-2026 ·
+ *            client-takeaway · correct horse battery staple
+ *
+ * That is the whole claim: it refuses what a human picks when they are not
+ * thinking, and refuses nothing a human or a generator picks when they are.
+ *
+ * ⚠️ A single repeated character is refused too, because `aaaaaaaaaaaa` clears
+ * any length floor and clears no attacker's wordlist.
+ *
+ * ⚠️ 12 characters is a FLOOR, not a claim about entropy — roughly 40-50 bits
+ * for a human-chosen password, well under the owner phrase's ~77. It is sized
+ * to stop the hazard (a one-character export secret on a file built to travel)
+ * without blocking ordinary use, and the PBKDF2 600K derivation still sits
+ * underneath it. A consumer who wants more passes a longer secret.
+ */
+export declare const EXPORT_SECRET_POLICY: SecretPolicy;
 /**
  * Inspect a phrase against the format rules and return a structured
  * verdict. Never throws — callers either branch on `ok` or pass the

package/dist/kernel/vault.d.ts

@@ -670,9 +670,9 @@ export declare class Vault {
      */
     /**
      * Atomic, gap-free numbering. `vault.sequence('invoice-2026').next()`
-     * returns 1, 2, 3, … with no gaps or duplicates under concurrency, via
-     * an optimistic-CAS counter at `_sequences/<name>`. Each name is an
-     * independent sequence.
+     * returns 1, 2, 3, … with no duplicates under concurrency ON THIS DEVICE
+     * — ⛔ counters never sync; two devices issue the SAME numbers (family#206).
+     * Optimistic-CAS counter at `_sequences/<name>`; each name is independent.
      *
      * **Online-only:** `next()` throws `SequenceOfflineError` unless the
      * store advertises `capabilities.casAtomic` — gap-free numbering cannot
@@ -1159,8 +1159,8 @@ export declare class Vault {
     /**
      * issue a time-boxed cross-tier delegation. Writes an
      * encrypted envelope to the reserved `_delegations` collection that
-     * the target user's runtime will pick up next time they open the
-     * vault.
+     * the target picks up at their next `refreshDelegations()` call —
+     * explicit, never automatic (core#56).
      *
      * Caller must hold the tier DEK for the requested tier and
      * collection.

package/dist/{ledger-UFJCB6T5.js → ledger-BMVUFQ3R.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-Y22JWHCP.js";
+} from "./chunk-BEKMLYQ4.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,15 +15,12 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-QHG7GQKM.js";
-import "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+} from "./chunk-5JNEDW7I.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
 export {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
@@ -37,4 +34,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-UFJCB6T5.js.map
+//# sourceMappingURL=ledger-BMVUFQ3R.js.map

package/dist/liberate-7KHXCLNJ.js

@@ -0,0 +1,23 @@
+import {
+  liberateVault
+} from "./chunk-DS2JXSUA.js";
+import "./chunk-XROQP6IQ.js";
+import "./chunk-23A4SBRR.js";
+import "./chunk-OIBFIWVJ.js";
+import "./chunk-2NVQ5SEA.js";
+import "./chunk-OQA7UF2Q.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-UXH4AKH3.js";
+import "./chunk-ZQQLOEWN.js";
+import "./chunk-KHSBMLQE.js";
+import "./chunk-VKZ3TDET.js";
+import "./chunk-F2FD4LSB.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-7KHXCLNJ.js.map