@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/port/by/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * Kernel coordination port — the injected `CoordinationProvider` seam for the
+ * Kernel coordination port — the injected `NoydbMesh` seam for the
  * schema-fence drain-barrier.
  *
  * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
@@ -15,11 +15,29 @@
  * @module
  */
 import type { Unsubscribe } from '../with/write-hooks.js';
-/** Vault fence state (the existing FenceDoc shape). */
-export interface FenceState {
-    readonly currentSchemaVersion: number;
-    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
-}
+import type { FenceDoc } from '../../with-shape/schema-update/fence.js';
+/**
+ * What the mesh carries about the fence: the vault's schema generation and its
+ * drain phase. This is the vault's OWN fence document — `@noy-db/hub/by`
+ * re-exports it rather than declaring a parallel type.
+ *
+ * Through 0.6 this port declared its own `FenceState` interface with the same
+ * two fields. Two problems, and only the first was visible (#1188):
+ *
+ *  1. `FenceState` ALSO names an unrelated string union
+ *     (`'normal' | 'draining' | …`) on `.` and `./cargo`. A consumer importing
+ *     from `@noy-db/hub` and one importing from `@noy-db/hub/by` got different
+ *     types, both compiling, failing only where they met.
+ *  2. It was a hand-copy — its own comment said "the existing FenceDoc shape" —
+ *     and it had already drifted, missing the `schemaHash` field #946 added.
+ *     Measured mutually assignable with `FenceDoc` under `--strict
+ *     --exactOptionalPropertyTypes`, so there was no type to preserve.
+ *
+ * Re-exporting fixes both: one name, one meaning, one definition to keep
+ * current. `FenceState` on the root barrel is untouched and still means the
+ * string union.
+ */
+export type { FenceDoc };
 /** A writer's presence + ack, tagged with the session that owns it. */
 export interface WriterPresence {
     /** = today's clientId (one per tab/peer). */
@@ -30,18 +48,18 @@ export interface WriterPresence {
     readonly quiescedAtVersion: number | null;
 }
 /** Session-addressable drain-barrier coordination transport. Per-vault ops. */
-export interface CoordinationProvider {
+export interface NoydbMesh {
     /** orchestrator → all writers */
-    setFence(vault: string, fence: FenceState): Promise<void>;
+    setFence(vault: string, fence: FenceDoc): Promise<void>;
     /**
      * Fresh one-shot fence read for the write-path gate (`assertWritable`).
      * A direct read (not a cached `observeFence` snapshot) avoids a staleness
      * window and keeps the timing-sensitive cutover gate exact. The store
      * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
      */
-    readFence(vault: string): Promise<FenceState>;
+    readFence(vault: string): Promise<FenceDoc>;
     /** writer observes fence changes (default: poll-emit; by-*: push) */
-    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
+    observeFence(vault: string, onChange: (f: FenceDoc) => void): Unsubscribe;
     /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
     reportPresence(vault: string, p: WriterPresence): Promise<void>;
     /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
@@ -83,4 +101,4 @@ export interface DrainBarrierOptions {
  * `generation`, at which point `run` is invoked exactly once. Rejects with
  * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
  */
-export declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;
+export declare function runDrainBarrier(provider: NoydbMesh, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;

package/dist/port/on/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `@noy-db/hub/on` — the unlock port (the `on-*` family port).
+ *
+ * ## What this seam is, and what it deliberately is NOT
+ *
+ * The `on-*` family is **not uniform**, and this subpath does not pretend
+ * otherwise. Measured across ten packages (see `check-architecture.mjs`'s
+ * `on-family-classification`):
+ *
+ *   - **one port instance** — `on-shamir` supplies a {@link NoydbShamir} that
+ *     hub calls for `profile: 'shamir'` recovery.
+ *   - **two slot ceremonies** — `on-password` and `on-webauthn` implement
+ *     {@link SlotRewrapCeremony}, which hub calls back during `rotateSecret`
+ *     to preserve a tier-2 slot.
+ *   - **seven libraries** — `on-totp`, `on-threat`, `on-email-otp` and the
+ *     rest. Three import hub zero times, which is the correct amount of
+ *     coupling for a TOTP code generator, not a gap to close.
+ *
+ * So the honest sentence, and the one the docs should carry: **`on-*`
+ * packages that hold or rotate a keyring slot implement contracts from here;
+ * the rest are freestanding utilities.** A seam is a namespace, not a claim
+ * that every package in the family binds it — `/to` already carries two
+ * instance types, and nobody reads that as one contract.
+ *
+ * ## Why it exists NOW and did not before
+ *
+ * `/on` shipped in 0.3.0 and was pruned in 0.4.0 for "zero importers",
+ * alongside `/as`, `/at`, `/in` and `/ui`. It was a second place to find types
+ * already on the root barrel.
+ *
+ * What changed is what stands behind it. `@noy-db/test-ceremony-conformance`
+ * publishes the ceremony contract as an executable suite, and the symbols it
+ * needs are scattered: three live on `/team`, and `KeyringAuthenticator`,
+ * `EnclaveKey` and `NoydbShamir` are reachable only from the whole root
+ * barrel. A third-party unlock method has to import the entire library to name
+ * the five types its ceremony signature uses — which is the coupling this
+ * family's seams exist to remove, and the same argument that brought `/at`
+ * back.
+ *
+ * ⚠️ Re-introducing a retired subpath is declared, not incidental: the
+ * `unretired` list in `codemods/0.7.0-pre.json` records it, and
+ * `codemod-map.test.ts` refuses the claim unless the subpath really resolves.
+ *
+ * Named re-exports only (no `export *`) so the published surface is explicit.
+ */
+export type { NoydbShamir } from '../../with-party/team/noydb-shamir.js';
+export type { SlotRewrapCeremony, SlotRewrapContext, EnrollAuthenticatorOptions, } from '../../with-party/team/index.js';
+export type { KeyringAuthenticator } from '../../kernel/types.js';
+export type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+export type { EnclaveKey } from '../../kernel/enclave/index.js';

package/dist/port/to/index.d.ts

@@ -15,7 +15,7 @@
  * Named re-exports only (no `export *`) so the published surface is explicit and
  * tsup's per-entry bundling keeps class identity stable across subpaths.
  */
-export type { NoydbStore, NoydbBundleStore, NoydbPodStore, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
-export { ConflictError, NetworkError, StoreCapabilityError, BundleVersionConflictError, PodVersionConflictError, UnknownStoreKindError, DuplicateStoreKindError, } from '../../kernel/errors.js';
-export type { StoreClass, StoreDescriptor, StoreBinding, StoreFactory, StoreLocator } from './locator.js';
-export { createStoreLocator } from './locator.js';
+export type { NoydbStore, NoydbPodStore, EncryptedEnvelope, VaultSnapshot, TxOp, StoreCapabilities, StoreCredentials, StoreCredentialSource, StoreTime, ListPageResult, } from '../../kernel/types.js';
+export { ConflictError, NetworkError, StoreCapabilityError, PodVersionConflictError, UnknownStoreKindError, DuplicateStoreKindError, } from '../../kernel/errors.js';
+export type { StoreClass, StoreDescriptor, StoreBinding, StoreFactory, StoreLocator, AnyNoydbStore, } from './locator.js';
+export { createStoreLocator, isPodStore } from './locator.js';

package/dist/port/to/locator.d.ts

@@ -17,7 +17,7 @@
  * and errors, no Node built-ins, no crypto. It adds zero runtime
  * dependencies to `@noy-db/hub/to`.
  */
-import type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js';
+import type { NoydbStore, NoydbPodStore, StoreCredentialSource } from '../../kernel/types.js';
 /**
  * The broad topology bucket a store descriptor's kind falls into —
  * used by callers/UI to group or filter descriptors without knowing every
@@ -51,22 +51,68 @@ export interface StoreDescriptor {
  */
 export type StoreBinding = unknown;
 /**
- * Reconstructs a live `NoydbStore` from a `StoreDescriptor`. Registered
- * against a `StoreLocator` under the descriptor's `kind`.
+ * Either store shape a factory may produce: the 6-method KV `NoydbStore`, or
+ * the whole-vault `NoydbPodStore` implemented by `to-drive` / `to-icloud`.
+ *
+ * The two are DISJOINT, not sub/supertypes — a pod store has none of the six
+ * KV methods — which is why moving between them needs a double cast and why
+ * `isPodStore()` exists to narrow instead.
  */
-export type StoreFactory = (descriptor: StoreDescriptor, opts: {
+export type AnyNoydbStore = NoydbStore | NoydbPodStore;
+/**
+ * Narrow an `AnyNoydbStore` to the pod shape. Discriminates on the
+ * `kind: 'bundle'` tag `NoydbPodStore` carries for exactly this purpose; a
+ * `NoydbStore` has no `kind` field at all.
+ *
+ * Use this at a `resolve()` boundary instead of casting — a store resolved
+ * from a descriptor read out of a pod is only known to be one of the two
+ * shapes at runtime.
+ */
+export declare function isPodStore(store: AnyNoydbStore): store is NoydbPodStore;
+/**
+ * Reconstructs a live store from a `StoreDescriptor`. Registered against a
+ * `StoreLocator` under the descriptor's `kind`.
+ *
+ * The type parameter says WHICH shape this factory builds. It defaults to
+ * `NoydbStore`, so a bare `StoreFactory` means exactly what it always has;
+ * a pod-store factory declares `StoreFactory<NoydbPodStore>` and registers
+ * without a cast (#988).
+ */
+export type StoreFactory<S extends AnyNoydbStore = NoydbStore> = (descriptor: StoreDescriptor, opts: {
     binding?: StoreBinding;
     credentials?: StoreCredentialSource;
-}) => NoydbStore | Promise<NoydbStore>;
+}) => S | Promise<S>;
 /** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */
 export interface StoreLocator {
-    /** Register a factory for `kind`. Throws if `kind` is already registered. */
-    register(kind: string, factory: StoreFactory): void;
-    /** Resolve `descriptor` to a live store via its kind's registered factory. */
+    /**
+     * Register a factory for `kind`. Throws if `kind` is already registered.
+     *
+     * Accepts a factory building EITHER store shape — `S` is inferred from the
+     * factory's own return type, so a `NoydbPodStore` factory needs no cast.
+     */
+    register<S extends AnyNoydbStore>(kind: string, factory: StoreFactory<S>): void;
+    /**
+     * Resolve `descriptor` to a live store via its kind's registered factory.
+     *
+     * Returns `NoydbStore`. If the `kind` was registered with a pod-store
+     * factory, the resolved value is really a `NoydbPodStore`: this signature
+     * is the seam's remaining unsoundness, kept because widening it to
+     * `AnyNoydbStore` would break every existing caller. Where the descriptor's
+     * kind is not statically known, prefer `resolveAny()` and `isPodStore()`.
+     */
     resolve(descriptor: StoreDescriptor, opts?: {
         binding?: StoreBinding;
         credentials?: StoreCredentialSource;
     }): NoydbStore | Promise<NoydbStore>;
+    /**
+     * As `resolve()`, but typed honestly: the registry is keyed by a runtime
+     * `kind` string, so which of the two shapes comes back is not knowable
+     * statically. Narrow the result with `isPodStore()`.
+     */
+    resolveAny(descriptor: StoreDescriptor, opts?: {
+        binding?: StoreBinding;
+        credentials?: StoreCredentialSource;
+    }): AnyNoydbStore | Promise<AnyNoydbStore>;
 }
 /**
  * Creates a fresh, empty `StoreLocator`.

package/dist/port/with/computed-strategy.d.ts

@@ -10,7 +10,7 @@
  * (money/i18n's `installViaBinder` call inside their own factory) would leave
  * `viaBinder('computed')` unresolved for that path. This port module is already
  * unconditionally imported by the kernel spine (`collection-config.ts`), so linking here
- * guarantees the binder is installed before `compileViaBindings` ever needs it, regardless
+ * guarantees the binder is installed before `compileVias` ever needs it, regardless
  * of which surface (sugar object-form or `via(computed(...))`) declared the virtual field.
  *
  * @internal

package/dist/port/with/device-seal-strategy.d.ts

@@ -3,11 +3,11 @@
  * #940). Lives on the `/with` port (the one seam the kernel spine may
  * import statically) so `NoydbOptions.deviceSeal` can reference this type
  * without a spine→service static import. The concrete implementation
- * (`MemoryDeviceSealProvider`) and the canonical re-export of this type
+ * (`MemoryDeviceSeal`) and the canonical re-export of this type
  * live in `with-party/team/device-seal.ts`.
  * @internal
  */
-export interface DeviceSealProvider {
+export interface NoydbDeviceSeal {
     /** Non-sensitive identifier persisted as `provider_hint`. */
     readonly id: string;
     seal(plain: Uint8Array): Promise<Uint8Array>;

package/dist/port/with/formats-strategy.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Formats strategy seam — the service half of the `as-*` port.
+ *
+ * `/as` publishes the {@link NoydbFormat} contract a format implements; this
+ * is what CONSUMES it. `vault.export(fmt)` gates, reads, redacts and calls
+ * `encode`; `vault.import(fmt, input)` gates, decodes and plans.
+ *
+ * Opt-in, not kernel. `vault.ts` had room under its ceiling, but "lean hub"
+ * is preserved by making a vault that never exports ship none of this — the
+ * same trade every other `with-*` service makes.
+ *
+ * Core imports `FormatsStrategy` type-only and `NO_FORMATS` as the default, so
+ * the spine never statically reaches the implementation.
+ *
+ * @internal
+ */
+import type { NoydbFormat, ImportPlan, ImportPolicy } from '../as/types.js';
+export type { NoydbFormat, ImportPlan, ImportPolicy };
+import type { ExportChunk } from '../../kernel/types.js';
+import type { Vault } from '../../kernel/vault.js';
+/** Options common to an export. */
+export interface FormatExportOptions {
+    /** Restrict to these collections. Omitted: everything the caller can read. */
+    readonly collections?: readonly string[];
+    /**
+     * Redact before `encode` sees a record. Hub applies the projection, so a
+     * format never needs the vault to know what is sensitive — which is what
+     * lets {@link NoydbFormat} be pure.
+     */
+    readonly redact?: true | {
+        readonly sensitivity?: string;
+    };
+}
+/** Options for an import. */
+export interface FormatImportOptions {
+    /** Target collection, for formats whose input carries no collection name. */
+    readonly collection?: string;
+    /** How to reconcile with what is already there. Default `'merge'`. */
+    readonly policy?: ImportPolicy;
+    /** Record identity field. Default `'id'`. A diff concern, so hub owns it. */
+    readonly idKey?: string;
+}
+/**
+ * The seam `withFormats()` fills.
+ *
+ * `chunksFor` is separate from `encode` on purpose: it is the gated, redacted
+ * read, and it is the half a format must never be able to perform itself.
+ */
+export interface FormatsStrategy {
+    readonly enabled: boolean;
+    exportWith<Out extends string | Uint8Array>(vault: Vault, format: NoydbFormat<Out>, options?: FormatExportOptions): Promise<Out>;
+    importWith<Out extends string | Uint8Array>(vault: Vault, format: NoydbFormat<Out>, input: Out, options?: FormatImportOptions): Promise<ImportPlan>;
+}
+/**
+ * The SERVICE receives the vault — it is doing the gated read, so that is
+ * unavoidable and fine. The invariant the port protects is narrower and is
+ * enforced one layer in: a {@link NoydbFormat} never receives it.
+ * `port/as/active.ts` derives this five-method context and the format sees
+ * only records.
+ */
+/** The narrow capability the format-facing half runs against. */
+export interface FormatsContext {
+    assertCanExport(tier: 'plaintext' | 'bundle', format?: string): void;
+    assertCanImport(tier: 'plaintext' | 'bundle', format?: string): void;
+    chunks(collections?: readonly string[]): AsyncIterable<ExportChunk>;
+    describe(collection: string): {
+        readonly fields: readonly unknown[];
+    } | undefined;
+    plan(records: Readonly<Record<string, readonly unknown[]>>, policy: ImportPolicy, formatId: string, idKey?: string): Promise<ImportPlan>;
+}
+/** Thrown by every method on {@link NO_FORMATS}. */
+export declare class FormatsNotEnabledError extends Error {
+    constructor(op: string);
+}
+/** The no-op default: a vault that never exports ships none of the service. */
+export declare const NO_FORMATS: FormatsStrategy;

package/dist/port/with/i18n-strategy.d.ts

@@ -82,7 +82,10 @@ export interface BuildDictionaryHandleOptions<Keys extends string = string> {
      * `buildLookupHandle`. See `port/with/lookup-strategy.ts`'s `BuildLookupHandleOptions` doc
      * comment for why this is injected rather than imported by the handle itself.
      */
-    buildDeleteMarker: (version: number, actor: string) => EncryptedEnvelope;
+    buildDeleteMarker: (identity: {
+        collection: string;
+        id: string;
+    }, version: number, actor: string) => EncryptedEnvelope;
     /** #650 Task 5 (#648) — the real reference check, passed through to `buildLookupHandle`. */
     checkReferencesOnDelete?: ((key: string) => Promise<unknown>) | undefined;
 }

package/dist/port/with/lookup-strategy.d.ts

@@ -62,7 +62,10 @@ export interface BuildLookupHandleOptions<Keys extends string = string> {
      * may not import `kernel/enclave/` itself (Check 11/15), so this capability is injected the
      * same way `reservedEnvelopes` above is.
      */
-    readonly buildDeleteMarker: (version: number, actor: string) => EncryptedEnvelope;
+    readonly buildDeleteMarker: (identity: {
+        collection: string;
+        id: string;
+    }, version: number, actor: string) => EncryptedEnvelope;
     /** #650 Task 4 (#647) — choke-point participation hooks. */
     readonly onDirty?: ((collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>) | undefined;
     readonly onRecordMutated?: ((collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>) | undefined;

package/dist/port/with/merge-authority.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The merge's capability to verify and re-stamp store-supplied ciphertext (#1042).
+ *
+ * ## The problem this seam exists to solve
+ *
+ * `with-sync` is DEK-free by design, and `check:architecture` enforces it: the
+ * engine's only enclave import is shape predicates. That is why AAD alone
+ * cannot make the merge fail closed — AAD is verified inside `subtle.decrypt`,
+ * and `applyRemote` never decrypts. It commits the remote envelope and the
+ * client discovers the problem at read time, *after* its own newer copy is
+ * gone.
+ *
+ * Two consequences follow from the same root, and one seam resolves both:
+ *
+ *  1. **The merge cannot reject a forged envelope**, because it holds no key.
+ *  2. **`advancePastRemote` re-stamps `_v` on existing ciphertext** without a
+ *     DEK, which is precisely why `_v` could not be bound into the AAD by
+ *     #1041. Version rollback stayed open as a result.
+ *
+ * ## Why a capability rather than an import
+ *
+ * The engine takes a `MergeAuthority` at construction. The closure holds the
+ * DEK; the engine's import graph is unchanged, so `check:architecture` passes
+ * **unweakened** — no allowlist entry, no guard edit. ADR 0003 states the test
+ * plainly: *if the guard needs relaxing, the design is wrong.*
+ *
+ * @packageDocumentation
+ */
+import type { EncryptedEnvelope } from '../../kernel/types.js';
+export interface MergeAuthority {
+    /**
+     * Does `envelope` authenticate at the identity and version it claims?
+     *
+     * Called **before** `local.put`, so a rejection costs the client nothing: its
+     * existing copy is untouched. Returns a boolean rather than throwing because
+     * a hostile store must not be able to halt an entire sync by poisoning one
+     * record — the caller records the rejection and moves to the next entry.
+     */
+    verify(collection: string, id: string, envelope: EncryptedEnvelope): Promise<boolean>;
+    /**
+     * Re-stamp `envelope` to `toVersion`, re-sealing it under the same DEK.
+     *
+     * Replaces the `{ ...winner, _v: remote._v + 1 }` spread. That spread is the
+     * single reason `_v` is not yet AEAD-bound: it rewrites a version onto
+     * ciphertext nobody re-sealed, so a reader recomputing AAD from the stamped
+     * `_v` would find a body sealed at a different one.
+     *
+     * With this, advancing becomes a re-seal, and binding `_v` becomes possible —
+     * which converts rollback detection into rollback *prevention*.
+     */
+    advance(collection: string, id: string, envelope: EncryptedEnvelope, toVersion: number): Promise<EncryptedEnvelope>;
+}

package/dist/port/with/service-bus.d.ts

@@ -150,7 +150,3 @@ export declare class ServiceBus {
      */
     dispatchGate<P extends GatePoint>(point: P, event: GateEventMap[P]): Promise<void>;
 }
-/** @deprecated Use ServiceBus. */
-export declare const SubsystemBus: typeof ServiceBus;
-/** @deprecated Use ServiceBus. */
-export type SubsystemBus = ServiceBus;

package/dist/port/with/strategies.d.ts

@@ -41,15 +41,21 @@
  *    is a real strategy, which is why this table maps keys to defaults rather
  *    than assuming a `NO_*` naming convention.
  *
- * `coordinationStrategy` is deliberately NOT in the bag. It is a
- * `CoordinationProvider`, not a service strategy — it has no `with*()`
+ * The `mesh` option is deliberately NOT in the bag. It is a
+ * `NoydbMesh`, not a service strategy — it has no `with*()`
  * factory, no `NO_*` stub, and is resolved asynchronously from the store
- * (`createDefaultCoordinationProvider`) rather than passed through. The
- * completeness assertion at the bottom of this file excludes it by name so
- * that the exclusion is explicit and survives future edits.
+ * (`createDefaultMesh`) rather than passed through.
+ *
+ * It used to be spelled `coordinationStrategy`, and the completeness assertion
+ * below had to exclude it BY NAME because a `*Strategy`-shaped key that is not
+ * a strategy is exactly what that assertion hunts for. The 0.7 rename removed
+ * the collision rather than documenting it: `mesh` is not matched by
+ * `${string}Strategy`, so no exclusion is needed and none is written.
  *
  * @internal
  */
+import type { FormatsStrategy } from './formats-strategy.js';
+import { type VaultHeadStrategy } from '../../with-commit/vault-head/strategy.js';
 import type { NoydbOptions } from '../../kernel/types.js';
 import { type ReduceStrategy } from '../../with-lookup/reduce/strategy.js';
 import { type AttestationStrategy } from '../../with-audit/attestation/strategy.js';
@@ -86,6 +92,7 @@ import type { ArchiveStrategy } from '../../with-fork/archive/index.js';
  * completeness assertion below pins that correspondence.
  */
 export interface StrategyBag {
+    readonly formats: FormatsStrategy;
     readonly reduce: ReduceStrategy;
     readonly archive: ArchiveStrategy;
     readonly attestation: AttestationStrategy;
@@ -98,6 +105,7 @@ export interface StrategyBag {
     readonly custody: CustodyStrategy;
     readonly forget: ForgetStrategy;
     readonly history: HistoryStrategy;
+    readonly vaultHead: VaultHeadStrategy;
     readonly i18n: I18nStrategy;
     readonly indexing: IndexingStrategy;
     readonly lazy: LazyStrategy;

package/dist/port/with/team-strategy.d.ts

@@ -22,12 +22,16 @@
  * @internal
  */
 import type { GrantOptions, RevokeOptions, FactorProofBundle } from '../../kernel/types.js';
-import type { RotateResult } from '../../with-party/team/keyring.js';
+import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../../with-party/team/keyring.js';
 import type { TeamFacade } from '../../with-party/team/noydb-facade.js';
 export interface TeamStrategy {
     grant(team: TeamFacade, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
     revoke(team: TeamFacade, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     rotate(team: TeamFacade, vault: string, collections: string[]): Promise<RotateResult>;
+    /** #1121 — read-only sweep naming every `_keyring` file that fails authentication. */
+    verifyRoster(team: TeamFacade, vault: string): Promise<RosterVerifyResult>;
+    /** #1121 — remove an unauthenticatable `_keyring` file and re-key behind it. */
+    quarantineKeyring(team: TeamFacade, vault: string, userId: string, factors?: FactorProofBundle): Promise<QuarantineResult>;
 }
 /**
  * No-op stub — the floor default. Every multi-user team operation throws

package/dist/portability/index.js

@@ -1,36 +1,36 @@
 import {
   NO_PORTABILITY
-} from "../chunk-FUHKW252.js";
+} from "../chunk-J4MN6XIU.js";
 import {
   PortabilityNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-JBIV4FLR.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/portability/active.ts
 function withPortability() {
   return {
     async exportAccessibleData(vault, opts) {
-      const { exportAccessibleData } = await import("../export-accessible-4S36PQNR.js");
+      const { exportAccessibleData } = await import("../export-accessible-BX2ILB4C.js");
       return exportAccessibleData(vault, opts);
     },
     async withdrawAccessibleData(vault, opts) {
-      const { withdrawAccessibleData } = await import("../withdraw-accessible-7PG4DYQK.js");
+      const { withdrawAccessibleData } = await import("../withdraw-accessible-ILTSXTIE.js");
       return withdrawAccessibleData(vault, opts);
     },
     async requestWithdrawal(vault, opts) {
-      const { requestWithdrawal } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { requestWithdrawal } = await import("../request-withdrawal-NM5VYR6F.js");
       return requestWithdrawal(vault, opts);
     },
     async listWithdrawalRequests(vault, opts) {
-      const { listWithdrawalRequests } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { listWithdrawalRequests } = await import("../request-withdrawal-NM5VYR6F.js");
       return listWithdrawalRequests(vault, opts);
     },
     async approveWithdrawal(vault, requestId, opts) {
-      const { approveWithdrawal } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { approveWithdrawal } = await import("../request-withdrawal-NM5VYR6F.js");
       return approveWithdrawal(vault, requestId, opts);
     },
     async rejectWithdrawal(vault, requestId, opts) {
-      const { rejectWithdrawal } = await import("../request-withdrawal-KGXGDPVQ.js");
+      const { rejectWithdrawal } = await import("../request-withdrawal-NM5VYR6F.js");
       return rejectWithdrawal(vault, requestId, opts);
     }
   };

package/dist/{post-register-2XSSMGEQ.js → post-register-53O7AJRZ.js}

@@ -1,9 +1,9 @@
 import {
   hashFields
-} from "./chunk-HVQGCKY4.js";
+} from "./chunk-JVLSU7S2.js";
 import {
   SatelliteConfigError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/marker.ts
@@ -14,7 +14,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     joined: spec.joined,
     epoch: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const { loadPersistedSchema } = await import("./storage-V7MTFAQJ.js");
+  const { loadPersistedSchema } = await import("./storage-ZXUT476I.js");
   const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek);
   const prior = persisted?.satellite;
   if (prior) {
@@ -25,7 +25,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     }
     return;
   }
-  const { persistSatelliteMarker } = await import("./register-4EFJCVYD.js");
+  const { persistSatelliteMarker } = await import("./register-6TCBR6XD.js");
   await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next });
 }
 
@@ -39,7 +39,7 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
   }
   if (baseSchema !== void 0) {
     try {
-      const { derivePersistedSchema } = await import("./derive-IUA6JFLB.js");
+      const { derivePersistedSchema } = await import("./derive-CXHCY46K.js");
       const envelope = await derivePersistedSchema(baseSchema);
       const properties = envelope.jsonSchema?.["properties"];
       const baseFields = Object.keys(properties ?? {});
@@ -57,4 +57,4 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
 export {
   postRegister
 };
-//# sourceMappingURL=post-register-2XSSMGEQ.js.map
+//# sourceMappingURL=post-register-53O7AJRZ.js.map

package/dist/query/index.js

@@ -4,22 +4,22 @@ import {
   ScanBuilder,
   buildLiveQuery,
   executePlan
-} from "../chunk-3737A6EA.js";
+} from "../chunk-S2VG3ABP.js";
 import {
   DEFAULT_JOIN_MAX_ROWS,
   applyJoins,
   resetJoinWarnings
-} from "../chunk-E6427JU2.js";
+} from "../chunk-XSN63FUS.js";
 import {
   CollectionIndexes
-} from "../chunk-GQ3BX5EA.js";
+} from "../chunk-I3ISCYT7.js";
 import "../chunk-YMUFFJCO.js";
-import "../chunk-CADUYBQD.js";
+import "../chunk-ATL3ZVXT.js";
 import {
   evaluateClause,
   evaluateFieldClause,
   readPath
-} from "../chunk-IGJCYUT5.js";
+} from "../chunk-NSITFOCJ.js";
 import {
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
@@ -29,7 +29,7 @@ import {
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-JBIV4FLR.js";
 import "../chunk-PZ5AY32C.js";
 export {
   CollectionIndexes,

package/dist/reduce/index.js

@@ -9,7 +9,7 @@ import {
   groupAndReduce,
   reduceRecords,
   resetGroupByWarnings
-} from "../chunk-CCZJJ4I2.js";
+} from "../chunk-4G25SDQL.js";
 import "../chunk-XZHEOSQ2.js";
 import {
   NO_REDUCE
@@ -24,11 +24,11 @@ import {
   moneySum,
   reducerBuilder,
   sum
-} from "../chunk-CADUYBQD.js";
-import "../chunk-IGJCYUT5.js";
-import "../chunk-7G6VDWXB.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-HNGSV2YC.js";
+} from "../chunk-ATL3ZVXT.js";
+import "../chunk-NSITFOCJ.js";
+import "../chunk-X67FCULK.js";
+import "../chunk-XDVVBETV.js";
+import "../chunk-JBIV4FLR.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/reduce/active.ts