@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/with-lookup/search/retrieve-types.d.ts

@@ -15,8 +15,50 @@ export interface RetrieveOptions<T = unknown> {
     readonly mode?: 'lexical' | 'semantic' | 'hybrid';
     /** L2 — minimum cosine score for semantic hits (semantic mode only). */
     readonly minScore?: number;
-    /** L3 — intersect hits with a structured query (retrieve ∩ where). Eager-mode only. */
+    /**
+     * L3 — intersect hits with a structured query (retrieve ∩ where). Eager-mode
+     * only. Also the typed half of retrieval (#1343): money / number / date /
+     * boolean fields are not tokenised into the lexical index, so a typed match
+     * is expressed here as a `Query` and compared in the field's canonical space
+     * by the query engine. Scoring stays global, `limit` counts NARROWED hits,
+     * an empty result set yields no hits, and an empty text query paired with a
+     * `within` is typed-only retrieval. See `retrieve()` in `collection-facade`.
+     */
     readonly within?: Query<T>;
+    /**
+     * Per-field score weights (#1354), e.g. `{ boost: { name: 3, notes: 1 } }`.
+     * Query-side only — the index is unchanged, and omitting this leaves every
+     * score exactly as it was. Fields not named weigh 1.
+     */
+    readonly boost?: Readonly<Record<string, number>>;
+    /**
+     * #1360 part 2 — force an EXACT brute-force semantic scan for this call,
+     * bypassing any approximate index the collection opted into. Ignored in
+     * lexical mode. Exactness must stay reachable per query: a caller who needs
+     * a guaranteed complete top-k (an audit, a recall measurement, a test) asks
+     * for it here rather than being told to reconfigure the collection.
+     */
+    readonly exact?: boolean;
+    /**
+     * #1360 part 2 — per-query recall dial for the approximate index (lists
+     * probed). Overrides `withVectorIndex({ nprobe })` for this call. No effect
+     * when the query is exact.
+     */
+    readonly nprobe?: number;
+}
+/**
+ * Options for `collection.similarTo()` — raw-vector kNN. Lives here beside
+ * {@link RetrieveOptions} because it is the same kind of thing: a public
+ * option bag on the retrieval surface.
+ */
+export interface SimilarToOptions {
+    readonly k?: number;
+    readonly minScore?: number;
+    readonly includeRecord?: boolean;
+    /** #1360 part 2 — force the exact brute-force scan, whatever the index policy says. */
+    readonly exact?: boolean;
+    /** #1360 part 2 — per-query recall dial (lists probed) for the approximate index. */
+    readonly nprobe?: number;
 }
 export interface RetrieveHit<T> {
     readonly id: string;
@@ -26,4 +68,18 @@ export interface RetrieveHit<T> {
     readonly snippet: string;
     readonly locale?: string;
     readonly record?: T;
+    /**
+     * #1360 — for a semantic hit on a CHUNKED record: the winning chunk's id and
+     * its `[start, end)` character offsets into
+     * `embeddingSourceText(record, descriptor.source)` (the joined source text,
+     * not a single field). `snippet` already carries `sourceText.slice(start,
+     * end)` when the record is in the eager cache; the offsets are returned so a
+     * consumer can highlight in place. Absent for lexical hits and for
+     * unchunked (single-vector) semantic hits.
+     */
+    readonly chunk?: {
+        readonly id: string;
+        readonly start: number;
+        readonly end: number;
+    };
 }

package/dist/with-lookup/search/serialize.d.ts

@@ -1,4 +1,30 @@
-/** (De)serialize an InvertedIndex to/from a JSON string for persistence (L1.5). */
-import { InvertedIndex } from './inverted-index.js';
+/**
+ * (De)serialize an InvertedIndex to/from a JSON string for persistence (L1.5).
+ *
+ * ## Why a validator, and why its failure mode is "rebuild" (#1354)
+ *
+ * Positional postings changed the persisted shape, so this module adopts the
+ * discipline #1359 established for the field-index sidecars: a blob is used
+ * only if it is EXACTLY the current format, and anything else is discarded
+ * whole and rebuilt from the record cache. There is no migration path and no
+ * partial load, because a half-trusted index answers confidently and wrongly —
+ * a pre-#1354 blob read leniently would report "no positions here", which a
+ * phrase query cannot distinguish from "your phrase is not in this record".
+ *
+ * ⭐ An out-of-order position list is REJECTED, not re-sorted. Re-sorting would
+ * launder a corrupt blob into a plausible-looking answer; the cache can always
+ * rebuild the truth.
+ */
+import { InvertedIndex, type IndexSnapshot } from './inverted-index.js';
 export declare function serializeIndex(idx: InvertedIndex): string;
-export declare function deserializeIndex(json: string): InvertedIndex;
+/** `null` ⇒ the blob is unusable and the caller must rebuild. Never throws. */
+export declare function deserializeIndex(json: string): InvertedIndex | null;
+/**
+ * Decode + structurally validate a persisted index snapshot. Returns `null` for
+ * anything that is not exactly the current format: torn JSON, a stamp from
+ * another release, a shape mismatch, a position list that is not strictly
+ * ascending or that names a token the doc does not have, or a `pos`/`posFields`
+ * disagreement (a doc whose field opted in but carries no positions would make
+ * every phrase query silently miss it).
+ */
+export declare function parseIndexSnapshot(json: string): IndexSnapshot | null;

package/dist/with-lookup/search/strategy.d.ts

@@ -16,15 +16,11 @@
  */
 import type { SearchContext } from './collection-facade.js';
 import type { SearchOptions, SearchResult } from './index.js';
-import type { RetrieveOptions, RetrieveHit } from './retrieve-types.js';
+import type { RetrieveOptions, RetrieveHit, SimilarToOptions } from './retrieve-types.js';
 export interface SearchStrategy {
     search<T>(ctx: SearchContext<T>, field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>;
     retrieve<T>(ctx: SearchContext<T>, query: string, opts?: RetrieveOptions<T>): Promise<RetrieveHit<T>[]>;
-    similarTo<T>(ctx: SearchContext<T>, vector: Float32Array, opts?: {
-        k?: number;
-        minScore?: number;
-        includeRecord?: boolean;
-    }): Promise<RetrieveHit<T>[]>;
+    similarTo<T>(ctx: SearchContext<T>, vector: Float32Array, opts?: SimilarToOptions): Promise<RetrieveHit<T>[]>;
     warmIndex<T>(ctx: SearchContext<T>): Promise<void>;
     flushIndex<T>(ctx: SearchContext<T>): Promise<void>;
     embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void>;

package/dist/with-party/broker/index.d.ts

@@ -14,8 +14,8 @@
 export { withBroker } from './active.js';
 export { NO_BROKER, type BrokerStrategy, type BrokerCtx, type BrokerConfig, type CredentialBrokerHandle, } from '../../port/with/broker-strategy.js';
 export { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js';
-import { verifyBrokerProof } from '../../kernel/enclave/index.js';
-import type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js';
+import { verifyBrokerProof } from '../../capsule/index.js';
+import type { IssuedChallenge, VerifyBrokerProofArgs } from '../../capsule/index.js';
 /**
  * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a
  * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel
@@ -26,4 +26,4 @@ export declare function issueChallenge(opts?: {
 }): IssuedChallenge;
 export { verifyBrokerProof };
 export type { VerifyBrokerProofArgs };
-export type { IssuedChallenge } from '../../kernel/enclave/index.js';
+export type { IssuedChallenge } from '../../capsule/index.js';

package/dist/with-party/directory/cover/index.d.ts

@@ -2,7 +2,7 @@
  * Cover service — barrel export. (Formerly "public envelope"; the
  * old names remain as deprecated aliases for one pre-release window.)
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md
  *
  * @module
  */

package/dist/with-party/directory/cover/storage.d.ts

@@ -50,6 +50,6 @@ export declare function resolveLocale(cover: Cover, locale: string): Cover;
  *   3. First non-empty value in the map.
  *   4. Empty string (only if every translation is empty — pathological).
  *
- * This deviation is documented in `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`.
+ * This deviation is documented in `https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md`.
  */
 export declare function pickLocale(value: string | Record<string, string>, locale: string, defaultLocale: string | undefined): string;

package/dist/with-party/directory/cover/types.d.ts

@@ -8,7 +8,7 @@
  * record still lives at `_meta/public-envelope` and carries the
  * `_noydb_public: 1` discriminator.)
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md
  *
  * @module
  */

package/dist/with-party/directory/index.d.ts

@@ -2,7 +2,7 @@
  * User-list visibility — barrel export for the
  * `@noy-db/hub/directory` surface.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
  *
  * @module
  */

package/dist/with-party/directory/types.d.ts

@@ -14,7 +14,7 @@
  * flags exist to keep admin-UI listings tidy, not to hide principals
  * from a determined attacker.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
  *
  * @module
  */

package/dist/with-party/directory/user-envelope/api.d.ts

@@ -130,7 +130,7 @@ export declare class UserApi implements VaultUserApi {
      * Honest caveat: this is a UX flag, not a privacy guarantee. The
      * envelope ciphertext at `_users/<keyringId>` and the keyring file at
      * `_keyring/<userId>` are both still observable to anyone with direct
-     * store read access. See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
+     * store read access. See `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` →
      * "Directory visibility".
      */
     setMyVisibility(visibility: UserVisibility): Promise<void>;

package/dist/with-party/directory/user-envelope/storage.d.ts

@@ -17,7 +17,7 @@
  * @module
  */
 import type { NoydbStore, UserEnvelope } from '../../../kernel/types.js';
-import { type EnclaveKey } from '../../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../../capsule/index.js';
 /**
  * Read and decrypt the user envelope for `keyringId`. Returns `null`
  * when no envelope has been persisted (either the principal has never

package/dist/with-party/policy/engine.d.ts

@@ -7,7 +7,7 @@
  * a stable {@link PolicyDenyReason} so consumers can branch in error
  * UIs.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → checkGate() API
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → checkGate() API
  *
  * @module
  */

package/dist/with-party/policy/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Policy gate DSL — barrel export for the `@noy-db/hub/policy` surface.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Policy gates DSL
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Policy gates DSL
  *
  * @module
  */

package/dist/with-party/policy/presets.d.ts

@@ -9,7 +9,7 @@ import type { VaultPolicy } from '../../kernel/types.js';
  * The unspecified gates (e.g. `view-user-auth`) inherit the engine
  * default of `{ enabled: false, minTier: 1 }` — they fail closed.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Built-in gates
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Built-in gates
  */
 export declare const PERSONAL_POLICY: VaultPolicy;
 /**

package/dist/with-party/team/authenticators.d.ts

@@ -9,12 +9,14 @@
  * (`on-webauthn`, `on-oidc`, `on-password`); this module accepts the
  * package's `wrapped_kek` ciphertext + `meta` payload and persists it.
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Tier 2 — Authenticate
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Tier 2 — Authenticate
  *
  * @module
  */
 import type { NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
+import { type SlotRewrapCeremony } from './rotate-recover.js';
+import type { RotateSecretInput } from './rotate-recover.js';
 /** Fields shared across both wrap-KEK and wrap-DEKs enroll inputs. */
 interface EnrollAuthenticatorBase {
     readonly id: string;
@@ -84,6 +86,29 @@ export declare function updateAuthenticator(store: NoydbStore, vault: string, ke
 /**
  * Drop a slot by id. No-op if the slot doesn't exist (idempotent —
  * removing a non-existent slot is a recoverable retry, not an error).
+ *
+ * ⛔ **THIS HIDES A CREDENTIAL. IT DOES NOT REVOKE ONE.** (#1445) The slot
+ * leaves the keyring file and nothing else happens — no key material moves. A
+ * slot blob captured before removal, or cached by an honest client earlier in
+ * the same session, still unwraps the FULL LIVE DEK SET and reads every record,
+ * for as long as those DEKs remain current.
+ *
+ * That is not a leak in one `on-*` package. `@noy-db/on-password`'s
+ * `unwrapDeksWithPassword` and `@noy-db/on-webauthn`'s `unwrapKeyringSummary`
+ * both carry the DEK map inside the blob and need no store, no keyring and no
+ * network — the blob authenticates itself. A membership check inside a verifier
+ * cannot close it, because a blob holder calls the primitive directly and never
+ * reaches the verifier.
+ *
+ * ⭐ To actually revoke, see {@link revokeAuthenticator} — removal, then a DEK
+ * rotation, then a re-wrap of the slots that stay. Every step is required and
+ * the reasons are measured, not assumed; read that doc before assembling the
+ * sequence by hand.
+ *
+ * ⚠️ Idempotency is only sound when the slot list is actually
+ * visible — see {@link assertSlotListVisible} (#1426).
+ *
+ * @throws `ValidationError` when the session cannot see the slot list.
  */
 export declare function removeAuthenticator(store: NoydbStore, vault: string, keyring: UnlockedKeyring, slotId: string): Promise<UnlockedKeyring>;
 /**
@@ -92,4 +117,69 @@ export declare function removeAuthenticator(store: NoydbStore, vault: string, ke
  * before invoking the method-specific verifier.
  */
 export declare function findAuthenticator(keyring: UnlockedKeyring, slotId: string): KeyringAuthenticator | undefined;
+/** Inputs for {@link revokeAuthenticator}. */
+export interface RevokeAuthenticatorOptions {
+    /** The slot to revoke. */
+    readonly slotId: string;
+    /**
+     * The vault owner's CURRENT secret. Passed as both `oldSecret` and
+     * `newSecret` to `rotateSecret`, which accepts them being equal — measured,
+     * so revoking one credential does not force everyone onto a new phrase.
+     */
+    readonly secret: RotateSecretInput['oldSecret'];
+    /**
+     * A re-wrap ceremony for EVERY slot that stays, keyed by slot id.
+     *
+     * ⛔ A slot with no ceremony is DROPPED, not preserved — that is
+     * `rotateSecret`'s existing behaviour (#29 / PR5: "without `slotCeremonies`,
+     * rotation drops every slot"), and it is the honest outcome, because after
+     * step 2 its blob wraps DEKs that no longer exist. Supplying one requires
+     * that credential to be present: the password for `on-password`, a live
+     * assertion for `on-webauthn`. There is no way around that — re-wrapping a
+     * credential is the credential's own operation.
+     */
+    readonly slotCeremonies?: {
+        readonly [slotId: string]: SlotRewrapCeremony;
+    };
+}
+/**
+ * Actually revoke an authenticator slot: remove it, mint fresh DEKs, and
+ * re-wrap the slots that stay (#1445).
+ *
+ * ## Why this is three steps and not one
+ *
+ * Each was measured, because the composition looks obvious and the obvious
+ * compositions do not work:
+ *
+ * 1. **{@link removeAuthenticator}** hides the slot. On its own it revokes
+ *    nothing — the captured blob carries its own DEKs.
+ * 2. **`rotateKeys`** is the step that revokes. It is the ONLY one that calls
+ *    `generateDEK()`. Measured: a collection's DEK is byte-identical across a
+ *    `rotateSecret` and different across a `rotateKeys`.
+ *    ⚠️ `rotateSecret` alone does NOT revoke, however it reads:
+ *    it unwraps every DEK with the old KEK and rewraps THE SAME KEY MATERIAL
+ *    under the new one. A captured blob holds DEK VALUES and records are
+ *    encrypted with DEKs, so rewrapping them changes nothing the holder needs.
+ * 3. **`rotateSecret` with `slotCeremonies`** re-wraps the remaining slots
+ *    around the new DEKs. Without it they survive step 2 BYTE-IDENTICAL
+ *    (measured: `rotateKeys` never touches `authenticators[]`) and therefore
+ *    silently wrap keys that no longer exist — every other credential in the
+ *    vault dies quietly. This step is what makes the operation safe for
+ *    everyone who was not being revoked.
+ *
+ * ⭐ Neither primitive is sufficient alone and they are not interchangeable:
+ * `rotateKeys` mints keys but cannot re-wrap slots; `rotateSecret` re-wraps
+ * slots but cannot mint keys.
+ *
+ * ## Cost
+ *
+ * Step 2 re-encrypts every record in every affected collection, and every
+ * remaining credential holder must be present for step 3. This is expensive on
+ * purpose: it is what revocation costs when the credential is a bearer token.
+ *
+ * @throws `ValidationError` when the session cannot see the slot list
+ *   ({@link assertSlotListVisible}) — a tier-1 unlock is required, and #1432
+ *   guarantees the KEK rotation needs is present at this point.
+ */
+export declare function revokeAuthenticator(store: NoydbStore, vault: string, keyring: UnlockedKeyring, options: RevokeAuthenticatorOptions): Promise<UnlockedKeyring>;
 export {};

package/dist/with-party/team/delegation.d.ts

@@ -40,7 +40,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 export declare const DELEGATIONS_COLLECTION = "_delegations";
 /**
  * Durable payload of a delegation token. Encrypted under the vault's

package/dist/with-party/team/echo-secret.d.ts

@@ -17,7 +17,7 @@
  *     (`verifyTypedEcho`) for that degraded path.
  *
  * Deriving the actual KEK from all three parts together is
- * `deriveEchoKey`/`encodeEchoParts` (`kernel/enclave/crypto.ts`) — a
+ * `deriveEchoKey`/`encodeEchoParts` (`capsule/enclave-aes/crypto.ts`) — a
  * separate concern from this module's per-part verifiers.
  *
  * Known, accepted disclosure: `prompt_verifier` and `echo_verifier` are
@@ -28,7 +28,7 @@
  *
  * @module
  */
-import { type EchoSecretParts } from '../../kernel/enclave/index.js';
+import { type EchoSecretParts } from '../../capsule/index.js';
 import type { KeyringEchoBlock } from '../../kernel/types.js';
 import type { NoydbDeviceSeal } from './device-seal.js';
 /** Same iteration floor as the KEK (spec resolved question 1). */

package/dist/with-party/team/index.d.ts

@@ -19,8 +19,9 @@ export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { PodRecipient, ListUsersOptions } from './keyring.js';
 export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
-export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
-export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
+export { enrollAuthenticator, removeAuthenticator, revokeAuthenticator, // #1445 — the three-step revocation; removeAuthenticator alone only hides
+updateAuthenticator, findAuthenticator, } from './authenticators.js';
+export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, RevokeAuthenticatorOptions, } from './authenticators.js';
 export { rotateSecret, recoverSecret, } from './rotate-recover.js';
 export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
 export { recoverUser } from './peer-recover.js';
@@ -38,6 +39,6 @@ export { beginEchoUnlock } from './echo-ceremony.js';
 export type { BeginEchoUnlockOptions, EchoCeremony } from './echo-ceremony.js';
 export { MemoryDeviceSeal } from './device-seal.js';
 export type { NoydbDeviceSeal } from './device-seal.js';
-export type { EchoSecretParts } from '../../kernel/enclave/index.js';
+export type { EchoSecretParts } from '../../capsule/index.js';
 export type { KeyringEchoBlock, NoydbStore } from '../../kernel/types.js';
 export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, EncryptedEnvelope, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope } from '../../kernel/types.js';
-import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
+import { type EnclaveKey, type EchoSecretParts } from '../../capsule/index.js';
 import type { KeyringTamperedReason } from '../../kernel/errors.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';
 import type { NoydbDeviceSeal } from './device-seal.js';
@@ -497,7 +497,7 @@ export interface ListUsersOptions {
  * strong as the role the calling layer passes in. The hub-level wrapper
  * on `Vault` sources `callerRole` from the unlocked keyring's `role`
  * field, which is signed-by-construction (it lives in the user's own
- * keyring file). See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
+ * keyring file). See `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` →
  * "Directory visibility".
  *
  * Principals without a persisted envelope (legacy keyrings predating

package/dist/with-party/team/magic-link-grant.d.ts

@@ -49,7 +49,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection holding magic-link grant envelopes. */
 export declare const MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 /** HKDF `info` for the AES-GCM content key. Version-namespaced. */

package/dist/with-party/team/managed-secret.d.ts

@@ -43,7 +43,7 @@
  *   - Mandatory strong-recovery enforcement.
  *   - Recovery flow under managed mode (generates fresh sealed phrase).
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
+ * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
  *
  * @module
  */

package/dist/with-party/team/noydb-facade.d.ts

@@ -19,7 +19,7 @@
  * Internal service — reached through `noydb.team.rotateSecret(...)` etc.
  */
 import type { NoydbOptions, NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
-import type { RotateResult, RotateKeysOptions, RosterVerifyResult, QuarantineResult } from './keyring.js';
+import { type RotateResult, type RotateKeysOptions, type RosterVerifyResult, type QuarantineResult } from './keyring.js';
 import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
@@ -92,9 +92,18 @@ export declare class TeamFacade {
      */
     enrollAuthenticator(vault: string, options: EnrollAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
     /**
-     * Remove a tier-2 authenticator slot. Idempotent — removing a
-     * non-existent slot is a successful no-op. Gated by
+     * Remove a tier-2 authenticator slot. Idempotent — removing a slot
+     * that is not in the keyring is a successful no-op. Gated by
      * `remove-authenticator`.
+     *
+     * ⚠️ Idempotency needs the slot list to be VISIBLE, and a tier-3
+     * PIN-resumed / session-restored keyring carries an empty one
+     * (#1426). Such a session throws `ValidationError` rather than
+     * reporting a removal it did not perform — re-authenticate at tier 1
+     * first.
+     *
+     * @throws `ValidationError` when the active keyring cannot see its
+     *   slot list (`kek === null`).
      */
     removeAuthenticator(vault: string, slotId: string, factors?: FactorProofBundle): Promise<void>;
     /** Read the slot list for a vault. Internal — `describeAuthConfig` consumes this. */

package/dist/with-party/team/recovery.d.ts

@@ -23,7 +23,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import { type WrappedDeksBlob } from './wrapped-deks.js';
 import type { NoydbShamir } from './noydb-shamir.js';
 /**

package/dist/with-party/team/roster-tag.d.ts

@@ -39,7 +39,7 @@
  * PR) — it is not written there yet.
  */
 import type { KeyringFile } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 export interface RosterTag {
     readonly iv: string;
     readonly data: string;

package/dist/with-party/team/rotate-recover.d.ts

@@ -17,7 +17,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
+import { type EnclaveKey, type EchoSecretParts } from '../../capsule/index.js';
 import { type PaperRecoveryEntry } from './recovery.js';
 import type { NoydbShamir } from './noydb-shamir.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';

package/dist/with-party/team/wrapped-deks.d.ts

@@ -33,7 +33,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /**
  * The wrap-DEKs primitive — a serialized + AES-GCM-encrypted DEK set
  * keyed under a credential-derived key.

package/dist/with-pod/format.d.ts

@@ -113,7 +113,7 @@ export interface NoydbPodHeader {
     /** SHA-256 of the compressed body bytes (lowercase hex). Lets readers verify integrity without decompressing. */
     readonly bodySha256: string;
     /**
-     * Owner-curated cover (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`).
+     * Owner-curated cover (`https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md`).
      * Optional — present only when the source vault has a
      * `_meta/public-envelope` document AND the writer's hub is opted
      * into the feature. Treat as **untrusted hint**; the body's

package/dist/with-pod/index.d.ts

@@ -40,4 +40,4 @@ export { ManifestConflictError, MigrationRequiredError, PodHeaderVerificationErr
 export type { Noydb } from '../kernel/noydb.js';
 export type { Vault } from '../kernel/vault.js';
 export type { NoydbOptions, NoydbStore } from '../kernel/types.js';
-export type { EchoSecretParts } from '../kernel/enclave/index.js';
+export type { EchoSecretParts } from '../capsule/index.js';

package/dist/with-pod/pod.d.ts

@@ -471,7 +471,7 @@ export interface PodVerifyResult {
  */
 export declare function verifyPodHeader(bytes: Uint8Array, trustedKeys: Readonly<Record<string, string>>): Promise<PodVerifyResult>;
 /**
- * Read just the bundle's cover (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`)
+ * Read just the bundle's cover (`https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md`)
  * — without verifying the body or even parsing the dump JSON. Pass
  * the raw bundle bytes; receive the owner-curated metadata or
  * `undefined` if the bundle was written without one.

package/dist/with-shape/blobs/blob-compaction.d.ts

@@ -29,8 +29,9 @@
  * @module
  */
 import type { NoydbStore, SlotInfo } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import { type OrphanChunkReport } from './orphan-report.js';
+import { type UnreferencedLegacyBlobReport } from './legacy-sweep.js';
 export interface BlobFieldPolicy<T = unknown> {
     /**
      * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's
@@ -158,6 +159,15 @@ export interface CompactionResult {
      * is the expected reading everywhere else.
      */
     readonly orphanBlobChunks: OrphanChunkReport;
+    /**
+     * #1453 — legacy (no `_cek`) blobs at `refCount <= 0`: released by every
+     * reference-drop path but never reclaimed, because a legacy chunk has no
+     * eager shred. Counted on every run; deleted only with
+     * `reclaimLegacyBlobs: true`. Not an orphan in the `orphanBlobChunks`
+     * sense — these rows keep their index entry, which is exactly why that
+     * report could not see them.
+     */
+    readonly unreferencedLegacyBlobs: UnreferencedLegacyBlobReport;
 }
 export interface CompactRunOptions {
     /** Override "now" for deterministic testing. */
@@ -189,6 +199,12 @@ export interface CompactRunOptions {
     readonly cacheBudget?: {
         readonly maxBytes: number;
     };
+    /**
+     * #1453 — reclaim unreferenced legacy blobs (chunks first, then the index
+     * row). Off by default: reclaiming is irreversible and the default posture
+     * for a maintenance pass is to report. Ignored under `dryRun`.
+     */
+    readonly reclaimLegacyBlobs?: boolean;
 }
 export interface CompactionContext {
     readonly adapter: NoydbStore;

package/dist/with-shape/blobs/blob-intent.d.ts

@@ -38,7 +38,7 @@
  * 2, rehome — mint/resume/consume for `op:'rehome'` markers).
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection holding `_blob_intent` marker rows. */
 export declare const BLOB_INTENT_COLLECTION = "_blob_intent";
 /**