@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/via/classified/binding.d.ts

@@ -29,9 +29,9 @@ import { type ClassifiedEntry } from './resolve.js';
 import { type ClassifiedGuardCtx } from './guards.js';
 /**
  * One classified per-slot shred/residue verdict — mirrors
- * `RecordCodec.SealedShredSlot` (`kernel/enclave/record-keys/record-codec.ts`)
+ * `RecordCodec.SealedShredSlot` (`capsule/plumbing/record-codec.ts`)
  * byte-for-byte. Duplicated here (not imported) so this binding never
- * reaches into `kernel/enclave/` (`via-enclave-isolation`, #629) — the
+ * reaches into `capsule/enclave-aes/` (`via-enclave-isolation`, #629) — the
  * closure that PRODUCES real values of this shape is codec-owned and
  * injected via {@link ClassifiedViaConfig.classifySealedShred}.
  */

package/dist/via/classified/config-drift.d.ts

@@ -12,9 +12,9 @@
  * R10 guard.
  *
  * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`
- * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives
+ * (`capsule/enclave-aes/crypto.ts`'s alias for the same type) — this file lives
  * under `via/classified/`, which the `via-enclave-isolation`
- * architecture guard (#629) forbids from importing `kernel/enclave/` at
+ * architecture guard (#629) forbids from importing `capsule/enclave-aes/` at
  * all, even type-only.
  *
  * @module

package/dist/via/classified/errors.d.ts

@@ -2,7 +2,7 @@
  * Configuration/write errors for classified fields. @module
  *
  * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
- * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
+ * (stage 2) so `capsule/enclave-aes/classify/*` can throw them without importing
  * with-*. Re-exported here under the same names so existing import paths
  * keep working.
  */

package/dist/via/classified/presets.d.ts

@@ -8,6 +8,35 @@ export declare const classified: {
         expiry?: string;
         cvc?: string;
     }): ClassifiedGroup;
+    /**
+     * A checksummed government or institutional identifier — a national ID, a
+     * tax number, an employer registration.
+     *
+     * ⭐ The preset exists for the FOUR SECURITY-RELEVANT DEFAULTS, not to save
+     * typing (#26). Hand-rolling a `ClassifiedFieldSpec` means choosing
+     * `storage`, `list`, `sensitivity` and `verifyNormalize` yourself, and
+     * getting `sensitivity` or `list` wrong on a national ID is not cosmetic.
+     * Supply the checksum; the posture is decided here.
+     *
+     * Defaults to `recoverable` + a masked list, which is the shape that lets an
+     * advisor open a list screen without reading every identifier in full while
+     * still allowing an authorised `reveal()`.
+     *
+     * ⛔ IT CANNOT BE UNIQUELY INDEXED, and that is by design rather than a gap
+     * (core#20). A recoverable classified field is sealed, sealed fields are
+     * excluded from the deterministic index, and unique constraints read the
+     * DECRYPTED record — where the value is a `Sealed` handle, not a string. If
+     * you need exact-equality dedup on this identifier, it must stay a plain
+     * field with `unique: true`; the two properties are mutually exclusive.
+     *
+     * @param validate returns `null` when the value passes, or a message. Use
+     *   {@link luhnCheck} for Luhn; supply your own for mod-11 and friends.
+     */
+    checksummed(options: {
+        validate: (value: unknown) => string | null;
+        sensitivity?: ClassifiedFieldSpec["sensitivity"];
+        list?: ClassifiedFieldSpec["list"];
+    }): ClassifiedFieldSpec;
     birthDate(): ClassifiedFieldSpec;
     email(): ClassifiedFieldSpec;
     phone(): ClassifiedFieldSpec;

package/dist/via/classified/resolve.d.ts

@@ -1,5 +1,12 @@
 /** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */
 import { type ClassifiedEntry, type ClassifiedFieldSpec } from './descriptor.js';
+/**
+ * `ClassifiedList` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/classified. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type { ClassifiedEntry, ClassifiedFieldSpec, ClassifiedGroup, ClassifiedList } from './descriptor.js';
 export { ClassifiedConfigError } from './errors.js';
 export interface ResolvedClassified {

package/dist/via/geo/binding.d.ts

@@ -23,9 +23,5 @@
  */
 import type { NoydbVia } from '../../kernel/via/index.js';
 import type { GeoDescriptor } from './descriptor.js';
-/** The geo binder's config bag: field name → its descriptor. */
-export interface GeoBindingConfig {
-    readonly geoFields: Record<string, GeoDescriptor>;
-}
 export declare function geoVia(geoFields: Record<string, GeoDescriptor>): NoydbVia;
 export declare function linkGeoVia(): void;

package/dist/via/lookup/handle.d.ts

@@ -81,9 +81,9 @@ export declare class LookupHandle<Keys extends string = string> {
      * #647 fix wave 1 — mints a version-ordered delete-marker envelope (the reserved-tier
      * mirror of #589's ordinary-collection delete marker). Injected rather than imported:
      * `buildDeleteMarker` constructs the envelope's protected-body fields (`_iv`/`_data`), and
-     * `via/lookup/**` may not reach `kernel/enclave/` directly (Check 11
+     * `via/lookup/**` may not reach `capsule/enclave-aes/` directly (Check 11
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
-     * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
+     * `capsule/enclave-aes` function at construction time, same pattern as `reservedEnvelopes` above.
      */
     private readonly buildDeleteMarker;
     /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */
@@ -128,9 +128,9 @@ export declare class LookupHandle<Keys extends string = string> {
      * #647 fix wave 1 — mints a version-ordered delete-marker envelope (the reserved-tier
      * mirror of #589's ordinary-collection delete marker). Injected rather than imported:
      * `buildDeleteMarker` constructs the envelope's protected-body fields (`_iv`/`_data`), and
-     * `via/lookup/**` may not reach `kernel/enclave/` directly (Check 11
+     * `via/lookup/**` may not reach `capsule/enclave-aes/` directly (Check 11
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
-     * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
+     * `capsule/enclave-aes` function at construction time, same pattern as `reservedEnvelopes` above.
      */
     buildDeleteMarker: (identity: {
         collection: string;

package/dist/via/lookup/index.d.ts

@@ -9,9 +9,41 @@
  * `port/with/lookup-strategy.ts`, and, for the existing `vault.dictionary()`
  * surface, through `via/i18n/active.ts`.
  */
+/**
+ * The engine's own surface, presented at its barrel. Consumers inside hub import these from `port/with/lookup-strategy.ts` (the kernel spine may not reach into `via/lookup/*` at all — Check 14), so the barrel has no importer for them by design.
+ *
+ * @seam
+ */
 export { LookupHandle, DictionaryHandle, DICT_COLLECTION_PREFIX, dictCollectionName, type DictEntry, type DictionaryOptions } from './handle.js';
+/**
+ * Registry surface at the barrel — reached through the port, same reason as above.
+ *
+ * @seam
+ */
 export { enforceStaticDictOnPut, resolveDictSource, updateReferencingRecords, type DictReferencingCollection } from './registry.js';
+/**
+ * The strategy factory. Deliberately NOT on the root barrel or any subpath — check-architecture.mjs:693-707 records the measurement and the reason (one way to configure lookup in front of consumers).
+ *
+ * @seam
+ */
 export { withLookup } from './active.js';
+/**
+ * `LookupBacking` — PUBLISHED API, reachable from @noy-db/hub. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export { lookup, enumOf, enumOf as enum, dict, type LookupDescriptor, type Vocabulary, type LookupBacking, type OnDelete } from './descriptor.js';
+/**
+ * Binding surface at the barrel — `lookupVia` is taken from here; its siblings are reached through the port.
+ *
+ * @seam
+ */
 export { lookupVia, linkLookupVia, type LookupViaConfig } from './binding.js';
+/**
+ * The describeFragment payload shape (#650 Task 7) — its consumer imports it from `binding.js` directly.
+ *
+ * @seam
+ */
 export type { LookupDescribeFragment, LookupDescribeFragmentEntry } from './binding.js';

package/dist/via/money/binding.d.ts

@@ -8,14 +8,5 @@
  */
 import type { NoydbVia } from '../../kernel/via/index.js';
 import type { MoneyDescriptor } from './descriptor.js';
-/** #669 — the money binder's config bag. `virtualMoneyFields` is the money∩virtual-mode-
- *  computed field-name intersection (`kernel/collection-config.ts#resolveVirtualMoneyFields`);
- *  absent/empty means no field on this collection composes money with a virtual computed
- *  field on itself — the pre-#669 behavior (no `presentLate`, ordinary `present()` for
- *  every declared money field). */
-export interface MoneyBindingConfig {
-    readonly moneyFields: Record<string, MoneyDescriptor>;
-    readonly virtualMoneyFields?: ReadonlySet<string>;
-}
 export declare function moneyVia(moneyFields: Record<string, MoneyDescriptor>, virtualMoneyFields?: ReadonlySet<string>): NoydbVia;
 export declare function linkMoneyVia(): void;

package/dist/walk-F4OLXI5H.js

@@ -0,0 +1,20 @@
+import {
+  dumpVaultSchema
+} from "./chunk-EMAWOGVH.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-J4KAPKBJ.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-H3YM66EI.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-F4OLXI5H.js.map

package/dist/with-audit/attestation/index.d.ts

@@ -13,4 +13,5 @@ export { ATTESTATIONS_COLLECTION } from './signer.js';
 export { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js';
 export type { RevokeContext } from './revoke.js';
 export { AttestationError } from '../../kernel/errors.js';
-export { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation';
+export { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList } from './verifier.js';
+export type { QrPayload, AttestationFieldSchema, VerifyResult, VerifyInput, RevocationList } from './types.js';

package/dist/with-audit/attestation/issue.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type AttestationFieldSchema, type QrPayload } from '@noy-db/attestation';
+import { type EnclaveKey } from '../../capsule/index.js';
+import type { AttestationFieldSchema, QrPayload } from './types.js';
 /** Everything issueAttestationCore needs from the Vault, injected for testability. */
 export interface IssueContext {
     readonly store: NoydbStore;

package/dist/with-audit/attestation/revoke.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type RevocationList } from '@noy-db/attestation';
+import { type EnclaveKey } from '../../capsule/index.js';
+import type { RevocationList } from './types.js';
 /** Everything the revoke core needs from the Vault, injected for testability. */
 export interface RevokeContext {
     readonly store: NoydbStore;

package/dist/with-audit/attestation/scheme.d.ts

@@ -0,0 +1,7 @@
+import type { SignatureScheme } from './types.js';
+/**
+ * Attestation signs and verifies with the ENCLAVE's sign group, not with the
+ * attestation package's bundled Ed25519 — so a different enclave (Stage B/C)
+ * changes what hub signs with, without touching attestation.
+ */
+export declare const ENCLAVE_SCHEME: SignatureScheme;

package/dist/with-audit/attestation/signer.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 export declare const ATTESTATIONS_COLLECTION = "_attestations";
 export declare const SIGNER_RECORD_ID = "_signer";
 export declare const REVOKED_RECORD_ID = "_revoked";

package/dist/with-audit/attestation/strategy.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
-import type { RevocationList } from '@noy-db/attestation';
+import type { EnclaveKey } from '../../capsule/index.js';
+import type { RevocationList } from './types.js';
 import type { IssueContext, IssueArgs, IssueResult } from './issue.js';
 import type { RevokeContext } from './revoke.js';
 /**
@@ -8,7 +8,7 @@ import type { RevokeContext } from './revoke.js';
  * per-call context object for it, so the vault facade assembles this at call
  * time (reading `role` fresh).
  */
-export interface SignerLookupDeps {
+interface SignerLookupDeps {
     readonly adapter: NoydbStore;
     readonly vault: string;
     /** The invoking keyring's role, read fresh by the caller per call. */
@@ -42,3 +42,4 @@ export interface AttestationStrategy {
  * `attestationStrategy: withAttestation()` in createNoydb. @internal
  */
 export declare const NO_ATTESTATION: AttestationStrategy;
+export {};

package/dist/with-audit/attestation/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The attestation types, re-exported at their service-layer home.
+ *
+ * The declarations live in `kernel/attestation-types.ts` because
+ * `kernel/vault.ts` names `RevocationList` on its public surface, and the
+ * kernel spine may not statically import a `with-*` service (`port-layering`,
+ * the S4 gate). This file keeps `./types.js` the natural import for everything
+ * inside `with-audit/attestation/`.
+ */
+export type { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, SignatureScheme, } from '../../kernel/attestation-types.js';

package/dist/with-audit/attestation/vault-facade.d.ts

@@ -1,7 +1,14 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
-import type { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
+import type { EnclaveKey } from '../../capsule/index.js';
+import type { AttestationFieldSchema, RevocationList } from './types.js';
 import type { AttestationStrategy } from './strategy.js';
+/**
+ * `NO_ATTESTATION` — PUBLISHED API, reachable from @noy-db/hub/attestation. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';
 /** Everything the moving attestation methods touched on the vault's `this.*`. */
 export interface VaultAttestationDeps {

package/dist/with-audit/attestation/verifier.d.ts

@@ -0,0 +1,6 @@
+import type { QrPayload, RevocationList, SignatureScheme, VerifyInput, VerifyResult } from './types.js';
+export declare const verifyAttestation: (input: VerifyInput, scheme?: SignatureScheme) => Promise<VerifyResult>;
+export declare const decodeQr: (s: string) => QrPayload;
+export declare const verifyRevocationList: (list: RevocationList, publicKeyB64: string, scheme?: SignatureScheme) => Promise<boolean>;
+export declare const isRevoked: (docId: string, list: RevocationList) => boolean;
+export declare const signRevocationList: (revokedDocIds: readonly string[], asOf: string, keyId: string, privateKeyPkcs8B64: string, scheme?: SignatureScheme) => Promise<RevocationList>;

package/dist/with-audit/consent/consent.d.ts

@@ -49,7 +49,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection for consent-audit entries. */
 export declare const CONSENT_AUDIT_COLLECTION = "_consent_audit";
 /**

package/dist/with-audit/consent/strategy.d.ts

@@ -11,7 +11,7 @@
  * @internal
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { ConsentAuditEntry, ConsentAuditFilter } from './consent.js';
 /**
  * @internal

package/dist/with-audit/forget/completeness.d.ts

@@ -0,0 +1,66 @@
+/**
+ * #34 — "was the erasure complete?", which is the only question a caller of
+ * {@link vault.forget} actually has, and the one `ForgetResult` could not
+ * answer.
+ *
+ * ⛔ THE PROBLEM THIS SOLVES. `ForgetResult` carries ELEVEN independent residue
+ * channels. None of them throws. Only two say in their own doc that non-empty
+ * means erasure is INCOMPLETE. So "erasure succeeded" is not
+ * `recordsShredded > 0` — it is all eleven empty — while the result's SHAPE
+ * suggests the opposite: the counts read like a success report and the residues
+ * read like diagnostics you consult when something looks wrong. A consumer
+ * building a subject-facing "your data has been deleted" on the obvious field
+ * is making a false statement in writing, and nothing in the surface tells them.
+ *
+ * ⭐ WHY THIS IS DEFAULT-DENY AND NOT A LIST OF ELEVEN NAMES. Enumerating the
+ * channels would reproduce the defect one level up: every new channel would
+ * silently weaken every existing caller's check, so a correct caller today
+ * becomes an incorrect one tomorrow with no diagnostic anywhere — a correctness
+ * regression delivered by an additive change, which is the kind that passes
+ * review. Instead EVERY array-valued field counts as residue unless it appears
+ * in {@link NON_RESIDUE_FIELDS}. A twelfth channel is therefore included by
+ * construction, and exempting a field is a deliberate edit with a visible diff.
+ * `__tests__/34-erasure-completeness.test.ts` fails if any array field is
+ * neither a known channel nor exempt, so the exemption list cannot rot quietly.
+ *
+ * ⚠️ `derivedResidueFrozen` counts as incomplete, and that is CORRECT rather
+ * than a bug to fix. An append-only closed period or a frozen receipt keeps the
+ * subject's contribution permanently, by design. The erasure genuinely is not
+ * total, and a caller who must answer a subject needs to know that — which is
+ * precisely why it must not be quietly excluded here. What a consumer does with
+ * it (a lawful-retention position) belongs in their layer, not this one.
+ *
+ * ⛔ SCOPE, deliberately: this reports what the MECHANISM did. It does not know
+ * whether a retention is lawful, and must never grow vocabulary implying it
+ * does — `blobsRetainedShared` means "still referenced", never "retained
+ * lawfully". The legal decomposition sits above this, in the consumer.
+ */
+import type { ForgetResult } from './strategy.js';
+/** The verdict {@link erasureCompleteness} returns. */
+export interface ErasureCompleteness {
+    /**
+     * `true` only when every residue channel is empty. ⛔ This — not
+     * `recordsShredded > 0` — is what "the subject's data was erased" means.
+     */
+    readonly complete: boolean;
+    /** Names of the channels that are non-empty, sorted. Empty iff `complete`. */
+    readonly channels: readonly string[];
+    /** The non-empty channels and their entries, for a caller that must report which. */
+    readonly residue: Readonly<Record<string, readonly unknown[]>>;
+}
+/**
+ * Decide whether a {@link ForgetResult} represents a COMPLETE erasure.
+ *
+ * ```ts
+ * const result = await vault.forget(subjectId)
+ * const { complete, channels, residue } = erasureCompleteness(result)
+ * if (!complete) {
+ *   // Do NOT tell the subject their data is gone. `channels` says what remains;
+ *   // some of it (a frozen period aggregate) is permanent by design.
+ * }
+ * ```
+ *
+ * Every array field of the result is treated as a residue channel except those
+ * in {@link NON_RESIDUE_FIELDS} — see this module's doc for why that direction.
+ */
+export declare function erasureCompleteness(result: ForgetResult): ErasureCompleteness;

package/dist/with-audit/forget/index.d.ts

@@ -24,6 +24,8 @@
  */
 export { withForget } from './active.js';
 export { NO_FORGET } from './strategy.js';
+export { erasureCompleteness } from './completeness.js';
+export type { ErasureCompleteness } from './completeness.js';
 export type { SubjectDeclaration, ForgetStrategy, ForgetResult, ScopedPurgeResidueNotice, } from './strategy.js';
 export type { SubjectRef } from './subject-index.js';
 export { SUBJECT_INDEX_COLLECTION } from './subject-index.js';

package/dist/with-audit/forget/strategy.d.ts

@@ -105,6 +105,71 @@ export interface ForgetResult {
     readonly blobsRetainedShared: number;
     /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */
     readonly blobResidueCollections: readonly string[];
+    /**
+     * #28 — the same residue as {@link blobResidueCollections}, at `collection:id`
+     * grain: which RECORDS held blob content that could not be crypto-shredded.
+     *
+     * ⭐ Prefer this one. `blobResidueCollections` answers "some blobs in
+     * `invoices` did not shred"; a specific erasure request asks "which of THIS
+     * subject's records are affected", and only a record-grained answer can say.
+     *
+     * ⚠️ "Could not be shredded" does NOT mean the bytes are still in the live
+     * store — `forget()` deletes legacy chunks, it just cannot crypto-shred them.
+     * See {@link blobResidueETags} for what the exposure actually is.
+     *
+     * ⚠️ `blobResidueCollections` is kept, unchanged, because it is published —
+     * widening it in place would silently change what every existing reader sees,
+     * with no type error (`string[]` either way). Both are populated from the
+     * same sites; this is the finer of the two.
+     *
+     * Reported by pilot-1, who noticed that this result type carries residue at
+     * `collection:id` (`unmigratedRecords`) and `collection:id:field`
+     * (`indexResidue`, `sealedResidue`) elsewhere, so the coarse one read as a
+     * defect rather than a design choice. It was: the record id was in scope on
+     * the line that recorded only the collection.
+     */
+    readonly blobResidueRecords: readonly string[];
+    /**
+     * #28 — the eTags of blob content this erasure could not CRYPTO-SHRED.
+     *
+     * ⛔ READ THE MEANING CAREFULLY; it is not what the name suggests on first
+     * reading, and the obvious reading is wrong in a way that matters.
+     *
+     * On a LEGACY blob (no per-blob `_cek`) `forget()` still DELETES the chunks
+     * and the index row — it passes `reclaimLegacy: true`. What it cannot do is
+     * make them cryptographically unreadable, because there is no per-blob key to
+     * destroy; the bytes were removed rather than shredded. So:
+     *
+     * - the live store IS clean — do not expect these chunks to still be there;
+     * - but any pre-existing BACKUP, replica or snapshot taken before the erasure
+     *   remains decryptable under the retained collection DEK, and that is the
+     *   exposure this field is telling you about.
+     *
+     * ⚠️ THIS CANNOT BE RECONCILED AGAINST `compact({ reclaimLegacyBlobs })`.
+     * That sweep reclaims refCount-0 legacy index rows that still EXIST; these no
+     * longer do. An intersection of the two sets is empty by construction and
+     * means nothing — measured, not assumed (2026-09-14). The reclaim path
+     * belongs to ordinary `collection.delete()`, which passes
+     * `reclaimLegacy: false` and genuinely defers.
+     *
+     * ⭐ What to DO with a non-empty value: treat the subject's data as erased
+     * from the live vault but potentially present in backups, and handle it under
+     * whatever backup-retention policy you operate. Migrating the collection to
+     * per-record keys before the erasure (`blob(id).migrate()`) is what makes a
+     * future erasure a true crypto-shred.
+     *
+     * ⛔ DO NOT PERSIST THESE. An eTag is a CONTENT HASH, so a stored erasure
+     * receipt listing them lets anyone holding a candidate file confirm the vault
+     * once held it — a residual disclosure created by the very artefact meant to
+     * prove the data is gone. `ledgerEntry` records residue COUNTS, never values,
+     * for exactly this reason.
+     *
+     * ⚠️ Narrower than {@link blobResidueRecords}: this is the eTag half only. A
+     * record whose SLOT ROW was undecodable appears there and not here, because
+     * there is no content identity to name. {@link erasureCompleteness} counts
+     * both.
+     */
+    readonly blobResidueETags: readonly string[];
     /**
      * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted
      * across the shredded records. These live under the retained

package/dist/with-audit/forget/subject-index.d.ts

@@ -32,7 +32,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 /** Reserved collection holding the encrypted subject → records index. */
 export declare const SUBJECT_INDEX_COLLECTION = "_subject_index";

package/dist/with-audit/periods/periods.d.ts

@@ -521,15 +521,6 @@ export interface ReadOnlyCollection<T> {
 export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /** sha256(canonicalJson(record)) over the STORED shape of a period record. @internal */
 export declare function hashStoredPeriod(period: PeriodRecord): Promise<string>;
-/**
- * #1454 — every record's `priorPeriodName` / `priorPeriodHash` must resolve to
- * a stored predecessor in ITS timeline whose hash matches. Followed by name,
- * not by sort position: two closes within one millisecond sort arbitrarily,
- * and a deleted predecessor must read as a break, not as a new root.
- *
- * @internal
- */
-export declare function verifyPeriodChain(records: readonly PeriodRecord[]): Promise<void>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor

package/dist/with-audit/periods/reserved-collections.d.ts

@@ -1,3 +1,10 @@
+/**
+ * `PERIODS_RESERVED_COLLECTIONS` — PUBLISHED API, reachable from @noy-db/hub/periods. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export declare const PERIODS_RESERVED_COLLECTIONS: ReadonlySet<string>;
 /** True when `name` belongs to the periods family (#1454). */
 export declare function isPeriodsReservedCollection(name: string): boolean;

package/dist/with-audit/periods/vault-facade.d.ts

@@ -1,4 +1,4 @@
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/store.js';
 import type { Collection } from '../../kernel/collection.js';

package/dist/with-audit/portability/request-withdrawal.d.ts

@@ -22,7 +22,6 @@
 import type { Vault } from '../../kernel/vault.js';
 import { NoydbError } from '../../kernel/errors.js';
 import { type WithdrawResult } from './withdraw-accessible.js';
-export declare const WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
 /** Raised when a request is missing, already decided, or expired. */
 export declare class WithdrawalRequestError extends NoydbError {
     constructor(message: string);

package/dist/with-audit/portability/withdraw-accessible.d.ts

@@ -17,7 +17,6 @@
  * (`request-withdrawal.ts`).
  */
 import type { Vault } from '../../kernel/vault.js';
-export declare const FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
 /** 24-hex-char random id (used for withdrawal ids + request ids). */
 export declare function randomId(): string;
 export interface FrozenSnapshotRef {

package/dist/with-audit/sealed-record/index.d.ts

@@ -57,8 +57,8 @@ export { SealedRecordNotEnabledError } from '../../kernel/errors.js';
  * opens, even with a valid sealed CEK.
  */
 export declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
-    readonly _iv: string;
-    readonly _data: string;
+    readonly _iv?: string;
+    readonly _data?: string;
     /** Bound into the AAD since #1093 — a rewound body no longer opens. */
     readonly _v: number;
     readonly _tier?: number | undefined;

package/dist/with-audit/sealed-record/strategy.d.ts

@@ -12,7 +12,7 @@
  * stays ungated). Only the vault-side grantor operations are the capability.
  * @internal
  */
-import type { SealingContext } from '../../kernel/enclave/index.js';
+import type { SealingContext } from '../../capsule/index.js';
 import type { RecipientSealer } from '../../with-party/team/managed-secret.js';
 export interface SealedRecordStrategy {
     sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {

package/dist/with-audit/tiers/index.d.ts

@@ -21,9 +21,9 @@
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 export { withTiers } from './active.js';
-export { NO_TIERS, type TiersStrategy } from './strategy.js';
+export { NO_TIERS, type TiersStrategy, type DelegationReadContext } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
-import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
+import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../capsule/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
@@ -458,4 +458,4 @@ export declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: numb
 export declare function classifySealedShred<T>(ctx: TiersContext<T>, live: EncryptedEnvelope): Promise<{
     readonly slots: readonly SealedShredSlot[];
 }>;
-export type { SealedShredSlot } from '../../kernel/enclave/index.js';
+export type { SealedShredSlot } from '../../capsule/index.js';

package/dist/with-audit/tiers/strategy.d.ts

@@ -9,6 +9,9 @@
  */
 import type { GhostRecord } from '../../kernel/types.js';
 import type { TiersContext, TierMoveResult } from './index.js';
+import type { DelegationToken } from '../../with-party/team/delegation.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+import type { NoydbStore } from '../../kernel/types.js';
 export type { TierMoveResult };
 export interface TiersStrategy {
     putAtTier<T>(ctx: TiersContext<T>, id: string, record: T, tier: number, opts?: {
@@ -35,6 +38,22 @@ export interface TiersStrategy {
      * A tier the writer cannot read is outside the guarantee.
      */
     checkUnique<T>(ctx: TiersContext<T>, id: string, record: T): Promise<void>;
+    /**
+     * core#56 — the delegation READ half. VAULT-scoped, not collection-scoped,
+     * so it takes its own narrow context rather than a `TiersContext`.
+     *
+     * It lives on this strategy rather than in the kernel because delegation IS a
+     * tier feature (the tokens carry tier DEKs and the gate they satisfy is
+     * `assertTierAccess`), and because a consumer who never opts into tiers has no
+     * delegations to read — so this should tree-shake away for them.
+     */
+    refreshDelegations(ctx: DelegationReadContext, now?: Date): Promise<DelegationToken[]>;
+}
+/** The vault-scoped slice the delegation read half needs (core#56). */
+export interface DelegationReadContext {
+    readonly vault: string;
+    readonly adapter: NoydbStore;
+    readonly keyring: UnlockedKeyring;
 }
 /**
  * No-op stub — the floor default. Every capability method throws

package/dist/with-cargo/adopt-partition.d.ts

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../kernel/enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import type { NoydbStore } from '../kernel/types.js';
 import type { NoydbSealer } from '../with-party/team/managed-secret.js';
 import type { NoydbShamir } from '../with-party/team/noydb-shamir.js';