@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/with-cargo/extract-partition.d.ts

@@ -8,7 +8,7 @@
  */
 import type { Vault } from '../kernel/vault.js';
 import type { EncryptedEnvelope } from '../kernel/types.js';
-import { type EnclaveKey } from '../kernel/enclave/index.js';
+import { type EnclaveKey } from '../capsule/index.js';
 import { type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js';
 import { type TransferSealPayload } from '../with-pod/pod.js';
 /** Re-keyed collections snapshot + the fresh DEKs used. */
@@ -50,52 +50,6 @@ export interface ReKeyLedgerResult {
  * `_ledger_deltas`/`_history` are deferred to slice 2.
  */
 export declare function reKeyLedger(vault: Vault, closure: Map<string, Set<string>>, reKeyedCollections: Record<string, Record<string, EncryptedEnvelope>>, ledgerDek: EnclaveKey): Promise<ReKeyLedgerResult>;
-/** Carried blob internals + the fresh transfer `_blob` DEK (present only when
- * the closure references at least one chunk-based blob). */
-export interface ReKeyBlobsResult {
-    /** `_blob_slots_<C>` / `_blob_versions_<C>` / `_blob_index` / `_blob_chunks`
-     * envelopes for the bundle's `_internal` map. */
-    readonly internal: Record<string, Record<string, EncryptedEnvelope>>;
-    /** Fresh transfer `_blob` DEK — seal it so owner-creation wraps it under the
-     * recipient KEK. Undefined when no blob travels (source keyring untouched). */
-    readonly blobDek?: EnclaveKey;
-}
-/**
- * Carry the FK-closed slice's blobs — HARDENED key handling (no master-key leak).
- *
- * The source vault's shared `_blob` DEK decrypts (or unwraps the content CEK of)
- * EVERY blob in the source. Sealing it into the transfer would hand the recipient
- * a key to blobs far outside their slice. Instead we mint a **fresh transfer
- * `_blob` DEK** and arrange every carried blob into per-blob-CEK mode under it:
- *
- *  - **erasable blob** (`_cek` present): unwrap the per-blob content CEK under the
- *    SOURCE `_blob` DEK, re-wrap it under the FRESH transfer DEK. Chunks travel
- *    **verbatim** (still ciphertext under that same content CEK — passthrough).
- *  - **legacy blob** (no `_cek`, chunks under the shared `_blob` DEK): promote it
- *    IN-BUNDLE — mint a fresh content CEK, decrypt each chunk under the source
- *    `_blob` DEK and re-encrypt under the content CEK (same AAD, so the eTag-bound
- *    integrity holds), then wrap the content CEK under the transfer DEK. The
- *    SOURCE is never mutated (non-destructive), and the bundle never holds
- *    plaintext blob bytes (zero-knowledge preserved).
- *
- * **eTag identity is preserved** (not re-HMAC'd). eTags are HMAC-keyed off the
- * `_blob` DEK, but they are stored as OPAQUE keys (`_blob_index/<eTag>`,
- * `_blob_chunks/<eTag>_<i>`) and never recomputed on read — only on a `put()`
- * for dedup. Keeping them verbatim keeps every slot/version/index/chunk key and
- * the chunk AAD coherent with zero chunk-key churn. The only consequence: a
- * future `put()` of identical bytes in the adopted vault computes a different
- * eTag (HMAC under the fresh DEK) and will NOT dedup against the carried blob —
- * an accepted, documented trade for hardened key isolation.
- *
- * Slots/versions are re-keyed under their parent collection's destination DEK
- * (honoring `fieldProjection` — projected-out blob fields' slots never travel);
- * `BlobObject.refCount` is recomputed from carried references only.
- *
- * `external` slots reference an unencrypted shared-bucket object that is not in
- * the bundle — their slot metadata travels (so the catalog entry survives) but
- * the bytes do not (a documented v1 limitation; their eTag is `''`).
- */
-export declare function reKeyBlobs(vault: Vault, closure: Map<string, Set<string>>, destDeks: Map<string, EnclaveKey>, fieldProjection?: Record<string, readonly string[]>): Promise<ReKeyBlobsResult>;
 /** A minted transfer key (raw 32 bytes) + the seal carrying the DEK set. */
 export interface SealResult {
     readonly seal: TransferSealPayload;

package/dist/with-cargo/floor.d.ts

@@ -13,7 +13,7 @@ export { readPath } from '../kernel/query/predicate.js';
 export { reduceRecords } from '../with-lookup/reduce/reduction.js';
 export { groupAndReduce } from '../with-lookup/reduce/groupby.js';
 export { generateULID } from '../with-pod/ulid.js';
-export { sha256Hex } from '../kernel/enclave/index.js';
+export { sha256Hex } from '../capsule/index.js';
 export { isQuorum, runDrainBarrier } from '../port/by/index.js';
 export { fuseRetrieval } from '../with-lookup/search/fuse.js';
 export { CrossShardJoinError, DataResidencyError, NoAccessError, ReservedVaultNameError, ShardProvisioningError, UnknownShardError, ValidationError, VaultTemplateNotFoundError, } from '../kernel/errors.js';

package/dist/with-commit/history/history.d.ts

@@ -1,6 +1,6 @@
-import type { RecordIdentity } from '../../kernel/enclave/index.js';
+import type { RecordIdentity } from '../../capsule/index.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /**
  * The identity a history snapshot is **sealed against** — its STORAGE location,
  * not the live record it is a copy of (#1041).

package/dist/with-commit/history/index.d.ts

@@ -30,4 +30,4 @@ export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_HISTORY } from './strategy.js';
-export type { RecordIdentity } from '../../kernel/enclave/index.js';
+export type { RecordIdentity } from '../../capsule/index.js';

package/dist/with-commit/history/ledger/store.d.ts

@@ -44,7 +44,7 @@
  * puts via `collection('_ledger')` would bypass the `append()` logic.
  */
 import type { NoydbStore } from '../../../kernel/types.js';
-import { type EnclaveKey } from '../../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../../capsule/index.js';
 import { type LedgerEntry } from './entry.js';
 import type { JsonPatch } from './patch.js';
 import { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from './constants.js';

package/dist/with-commit/history/strategy.d.ts

@@ -33,7 +33,7 @@ import type { LedgerStore } from './ledger/store.js';
 import type { JsonPatch } from './ledger/patch.js';
 import type { DiffEntry } from './diff.js';
 import type { VaultInstant, VaultEngine } from './time-machine.js';
-import type { EnclaveKey, RecordIdentity } from '../../kernel/enclave/index.js';
+import type { EnclaveKey, RecordIdentity } from '../../capsule/index.js';
 /**
  * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the
  * `LedgerStore` constructor verbatim — kept in this file so `core`

package/dist/with-commit/history/time-machine.d.ts

@@ -48,7 +48,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from './ledger/store.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /**
  * Narrow view of a {@link Vault}'s internals that
  * {@link VaultInstant} needs. Passed in by `Vault.at()` rather than

package/dist/with-commit/numbering/index.d.ts

@@ -1,8 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { DeferredNumberingConfig } from './descriptor.js';
-export declare const NUMBERING_HEAD_COLLECTION = "_numbering_head";
-export declare const NUMBERING_PENDING_COLLECTION = "_numbering_pending";
 export interface Assignment {
     recordId: string;
     serial: number;

package/dist/with-commit/sequence/index.d.ts

@@ -19,7 +19,7 @@
  * to its record in the same operation.
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 export { withSequence } from './active.js';
 export { NO_SEQUENCE, type SequenceStrategy } from './strategy.js';
 export { SequenceNotEnabledError } from '../../kernel/errors.js';

package/dist/with-commit/tx/transaction.d.ts

@@ -57,8 +57,8 @@
  * **Crash window.** On the OCC fallback, steps 2–3 are not a
  * storage-layer transaction — if the process dies between two executed
  * ops, the on-disk state is partial. The atomic path above closes that
- * window for the write set itself (`to-memory` and the SQL stores in
- * `noy-db-to` implement `tx()`); a crash between the batch landing and
+ * window for the write set itself (`memoryStore({ full: true })` and the SQL
+ * stores in `noy-db-to` implement `tx()`); a crash between the batch landing and
  * the finalize loop finishing still leaves per-op side effects (history,
  * ledger, cache) incomplete. Stores that cannot commit a batch
  * atomically (file, S3) omit `tx()` and keep the fallback.
@@ -209,27 +209,5 @@ export declare class TxCollection<T> {
  * revert alongside the bulk-put source ops.
  */
 export declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions, txInvariants?: ReadonlyArray<TransactionInvariant>): Promise<T>;
-/**
- * Phase 3 helper — restore captured prior envelopes via the raw store
- * to avoid re-firing Collection-level side effects (we don't want a
- * cascade of change events undoing themselves). The ledger is left
- * as-is: each committed op appended an entry; the revert is
- * deliberately NOT recorded as a compensating entry because the
- * caller-facing contract is "atomic or not at all," not "every write
- * visible in the audit trail." Auditors who need the intermediate
- * state can still reconstruct it by walking the ledger through the
- * failed-tx timestamp.
- *
- * Delegates the reverse/best-effort/raw-revert shape to the shared
- * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache
- * invalidation below rides along as that helper's per-leg `compensate`
- * callback, gated on `db` exactly as before.
- *
- * @internal — shared between `runTransaction` and
- * `Collection.putManyAtomic`. Both register source ops + nested
- * derivation side-effect ops onto `_executed`; this helper unwinds the
- * combined list in reverse on rollback.
- */
-export declare function revertExecuted(executed: ReadonlyArray<ExecutedOp>, store: Noydb['_store'], db?: Noydb): Promise<void>;
 /** @internal — shared (vault, collection, id) key shape; also used by `atomic-eligibility.ts`'s duplicate-key scan. */
 export declare function keyOf(op: StagedOp): string;

package/dist/with-commit/vault-head/head.d.ts

@@ -9,7 +9,7 @@
  *
  * @packageDocumentation
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 /** `{ recordId → version }` for one bucket. */
 export type BucketBody = Record<string, number>;

package/dist/with-commit/vault-head/index.d.ts

@@ -7,4 +7,4 @@ export { withVaultHead } from './active.js';
 export { verifyVaultHead, type HeadDiscrepancy, type HeadVerifyResult, type HeadVerdict, type HeadUnverifiableReason } from './verify.js';
 export { NO_VAULT_HEAD, VAULT_HEAD_COLLECTION, DEFAULT_HEAD_BUCKETS, type VaultHeadStrategy, type WithVaultHeadOptions, type HeadEntry, } from './strategy.js';
 export type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
-export type { EnclaveKey } from '../../kernel/enclave/index.js';
+export type { EnclaveKey } from '../../capsule/index.js';

package/dist/with-commit/vault-head/strategy.d.ts

@@ -63,7 +63,7 @@
  * @packageDocumentation
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection the head's buckets live in. */
 export declare const VAULT_HEAD_COLLECTION: "_head";
 /** Default bucket count — see the sizing table above. */
@@ -124,4 +124,11 @@ export interface VaultHeadStrategy {
  * would look exactly like a clean sweep.
  */
 export declare const NO_VAULT_HEAD: VaultHeadStrategy;
+/**
+ * `EncryptedEnvelope` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/debug, @noy-db/hub/tiers, @noy-db/hub/to, @noy-db/hub/vault-head. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type { EncryptedEnvelope };

package/dist/with-commit/vault-head/verify.d.ts

@@ -9,7 +9,7 @@
  * @packageDocumentation
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { VaultHeadStrategy } from './strategy.js';
 /** One record the store is not serving faithfully. */
 export interface HeadDiscrepancy {

package/dist/with-fork/snapshots/noydb-facade.d.ts

@@ -61,4 +61,11 @@ export declare class NoydbSnapshots {
     /** Stop the cadence scheduler (called from `Noydb.close()`). */
     stop(): void;
 }
+/**
+ * `NO_SNAPSHOTS` — PUBLISHED API, reachable from @noy-db/hub/snapshots. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export { NO_SNAPSHOTS };

package/dist/with-formula/derivations/dispatch.d.ts

@@ -26,7 +26,7 @@ import type { TxContext } from '../../with-commit/tx/transaction.js';
 import type { DerivationRegistry } from './registry.js';
 import type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js';
 import type { Collection } from '../../kernel/collection.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { EncryptedEnvelope } from '../../kernel/types.js';
 import type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js';
 /** The per-write dispatch context threaded into `putDerivedOutput`. */

package/dist/with-formula/derivations/fanout-sidecar.d.ts

@@ -21,7 +21,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 type GetDEK = (collectionName: string) => Promise<EnclaveKey>;
 /** Magic-prefixed JSON payload at `_meta/<recordId>`. */
 export interface FanoutSidecar {

package/dist/with-formula/derivations/trigger-match.d.ts

@@ -14,7 +14,7 @@
  * @module
  */
 /** One declared hop through an intermediate collection (#1277). */
-export interface MatchVia {
+interface MatchVia {
     /** The intermediate collection to resolve through. */
     readonly collection: string;
     /** Field on the intermediate whose value equals `written[from]`. */
@@ -27,8 +27,6 @@ export interface MatchPair {
     readonly to: string;
     readonly via?: MatchVia;
 }
-/** True when any pair in this trigger resolves through an intermediate. */
-export declare function hasHop(match: ReadonlyArray<MatchPair>): boolean;
 /** Every intermediate collection named by a trigger's pairs, deduplicated. */
 export declare function hopCollections(match: ReadonlyArray<MatchPair>): string[];
 export interface NormalizedTrigger {
@@ -100,5 +98,10 @@ export declare function sameTuple(a: Array<{
 }> | null): boolean;
 /** Moved to the kernel (#1249) so `collection.ts` can import statically without
  *  dragging derivations code into the floor bundle; re-exported here for
- *  compatibility with existing consumers of this module. */
-export { recordMatchesPairs, findMatchingIdsByPairs } from '../../kernel/match-pairs.js';
+ *  compatibility with existing consumers of this module.
+ *
+ *  ⚠️ `findMatchingIdsByPairs` was re-exported here too and NOTHING took it
+ *  from this module (#55) — consumers import it from the kernel directly.
+ *  Dropped rather than kept as a compatibility shim for a consumer that does
+ *  not exist; the kernel module remains its home. */
+export { recordMatchesPairs } from '../../kernel/match-pairs.js';

package/dist/with-formula/materialized-views/emit-memo.d.ts

@@ -17,8 +17,6 @@ export declare function emitMemoKey(vault: string, mvName: string, outputCollect
 export declare function readEmitMemo(key: string, stamp: number | null): ReadonlyMap<string, string> | null;
 /** Record what this refresh actually left on disk. A `null` stamp records nothing. */
 export declare function writeEmitMemo(key: string, stamp: number | null, rows: Map<string, string>): void;
-/** Forget one MV's output entirely. Used when a refresh could not complete cleanly. */
-export declare function dropEmitMemo(key: string): void;
 /**
  * A canonical string for the row a refresh is about to write, or `null` when no
  * safe one exists.

package/dist/with-lookup/embeddings/index.d.ts

@@ -1,6 +1,5 @@
-export { cosine } from './cosine.js';
 export { embeddingSourceText, type EmbeddingDescriptor } from './descriptor.js';
-export { VectorSet, type StoredVector, type VectorHit } from './vector-set.js';
+export { VectorSet, type StoredVector } from './vector-set.js';
 export { withVectorIndex, DEFAULT_INDEX_MIN_VECTORS, type VectorIndexOptions } from './with-vector-index.js';
 export type { VectorIndex, VectorIndexConfig, VectorIndexSearchOptions } from './vector-index.js';
 export { encodeVecId } from './vec-id.js';

package/dist/with-lookup/indexing/collection-facade.d.ts

@@ -21,12 +21,12 @@
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
-import type { RecordCodec } from '../../kernel/enclave/index.js';
+import type { RecordCodec } from '../../capsule/index.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
 import { type CollectionIndexes, type IndexDef } from './eager-indexes.js';
 import type { UniqueConstraintSet } from './unique-constraints.js';
 import { type PersistedCollectionIndex } from './persisted-indexes.js';
-import { PersistedFieldIndexes, type FieldIndexCallbacks } from './persisted-field-indexes.js';
+import { PersistedFieldIndexes } from './persisted-field-indexes.js';
 export type { PersistedFieldIndexes } from './persisted-field-indexes.js';
 /** Everything the moving index-maintenance methods touched on `this.*`. */
 export interface IndexingContext<T> {
@@ -68,20 +68,6 @@ export interface IndexingContext<T> {
  * `indexes.upsert()`/`.remove()` directly, so this only fires for full reloads.
  */
 export declare function rebuildEagerIndexesFromCache<T>(ctx: IndexingContext<T>, skip?: ReadonlySet<string>): void;
-/**
- * Bridge the crypto-free {@link PersistedFieldIndexes} to this collection's
- * codec + adapter — the exact division `buildPersistedIndexCallbacks` uses for
- * the search index: crypto lives here, the store does not know it exists.
- *
- * One record per `(collection, index)`, at `_fieldidx / <collection>/<key>`.
- * The freshness stamp rides INSIDE the encrypted body (`{fp, idx}`) rather
- * than on the envelope, so the `EncryptedEnvelope` shape is never extended and
- * the stamp is not readable at rest.
- *
- * Takes a context THUNK for the same reason the search bridge does: it is
- * built from the `Collection` constructor, before `this.codec` is assigned.
- */
-export declare function buildFieldIndexCallbacks<T>(provideCtx: () => IndexingContext<T>, debounceMs?: number): FieldIndexCallbacks;
 /**
  * Build this collection's sidecar coordinator, or `null` when no index asked
  * to be persisted — so every other collection pays nothing. Kept here rather

package/dist/with-lookup/indexing/eager-indexes.d.ts

@@ -81,7 +81,7 @@ export type IndexDef = string | {
  * `orderBy(field).limit(n)`. A `'sorted'` declaration keeps the hash
  * index too — `==`/`in` stay O(1).
  */
-export type IndexKind = 'hash' | 'sorted';
+type IndexKind = 'hash' | 'sorted';
 /**
  * Normalize a declared `IndexDef[]` into a uniform `{ fields, unique? }`
  * shape: `string` → `{fields:[s]}`, `string[]` → `{fields}`, object →
@@ -299,3 +299,4 @@ export declare class CollectionIndexes {
      */
     bucketRepresentatives(field: string): readonly string[] | null;
 }
+export {};

package/dist/with-lookup/search/collection-facade.d.ts

@@ -22,7 +22,7 @@
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { RecordCodec } from '../../kernel/enclave/index.js';
+import type { RecordCodec } from '../../capsule/index.js';
 import { type I18nTextDescriptor } from '../../via/i18n/core.js';
 import { type DictKeyDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../via/i18n/dictionary.js';
 import type { BlobSet } from '../../with-shape/blobs/blob-set.js';
@@ -31,7 +31,6 @@ import { type VectorSet, type EmbeddingDescriptor } from '../embeddings/index.js
 import { type SearchOptions, type SearchResult } from './index.js';
 import type { IndexStore } from './index-store.js';
 import type { PersistedIndexCallbacks } from './persisted-index-store.js';
-import type { IndexDoc, IndexBuildOptions } from './inverted-index.js';
 import type { RetrieveOptions, RetrieveHit, SimilarToOptions } from './retrieve-types.js';
 /** Everything the moving search/retrieval methods touched on `this.*`. */
 export interface SearchContext<T> {
@@ -78,17 +77,6 @@ export interface SearchContext<T> {
  * nothing searchable is written to the store.
  */
 export declare function search<T>(ctx: SearchContext<T>, field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>;
-/** L1 — build IndexDoc[] for the configured text fields over the live cache. */
-export declare function buildRetrievalDocs<T>(ctx: SearchContext<T>, labelMaps: Map<string, Map<string, Record<string, string>>>, blobFilenames: Map<string, Map<string, string[]>>, only?: readonly string[]): IndexDoc[];
-/**
- * L1 — the positional-postings opt-in for this collection (#1354), or
- * `undefined` when nothing opted in. Returning `undefined` rather than
- * `{ positions: [] }` keeps the no-opt-in path byte-identical to a caller that
- * never heard of positions.
- */
-export declare function positionBuildOptions<T>(ctx: SearchContext<T>): IndexBuildOptions | undefined;
-/** L1 — true iff any configured text index is also a blob field (gates ALL slot I/O). */
-export declare function hasIndexedBlobFields<T>(ctx: SearchContext<T>, only?: readonly string[]): boolean;
 /** L1.5 — force-persist the lexical index now (e.g. on save/idle). Persists only when textIndexPersist is enabled; a no-op otherwise. */
 export declare function flushIndex<T>(ctx: SearchContext<T>): Promise<void>;
 /**

package/dist/with-party/broker/index.d.ts

@@ -14,8 +14,8 @@
 export { withBroker } from './active.js';
 export { NO_BROKER, type BrokerStrategy, type BrokerCtx, type BrokerConfig, type CredentialBrokerHandle, } from '../../port/with/broker-strategy.js';
 export { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js';
-import { verifyBrokerProof } from '../../kernel/enclave/index.js';
-import type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js';
+import { verifyBrokerProof } from '../../capsule/index.js';
+import type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js';
 /**
  * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a
  * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel
@@ -25,5 +25,5 @@ export declare function issueChallenge(opts?: {
     ttlMs?: number;
 }): IssuedChallenge;
 export { verifyBrokerProof };
-export type { VerifyBrokerProofArgs };
-export type { IssuedChallenge } from '../../kernel/enclave/index.js';
+export type { VerifyBrokerProofArgs, BrokerMemberIdentity };
+export type { IssuedChallenge } from '../../capsule/index.js';

package/dist/with-party/broker/seed.d.ts

@@ -37,16 +37,6 @@
  */
 import type { StoreCredentials } from '../../kernel/types.js';
 import type { BrokerSeedCtx } from '../../port/with/broker-strategy.js';
-/** The `_broker/<brokerId>` record payload (spec §3). */
-export interface BrokerSeedRecord {
-    readonly brokerId: string;
-    /** base64(32 random bytes). */
-    readonly seed: string;
-    readonly endpoint: string;
-    readonly createdAt: string;
-    /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */
-    readonly registered: boolean;
-}
 /**
  * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`
  * seed (I4), derive+register its proof key with the broker host, and only
@@ -65,6 +55,31 @@ export declare function enrollSeed(ctx: BrokerSeedCtx): Promise<void>;
  * cache lives in that closure, not here.
  */
 export declare function rotateSeed(ctx: BrokerSeedCtx): Promise<void>;
+/**
+ * core#73 — enrol a freshly granted MEMBER with the host under its own key.
+ * Called by the kernel right after `grant()`, while the grantor still holds
+ * the grantee's secret: that secret opens the grantee's keyring, whose
+ * `_broker_member` DEK (minted by `grant()` for this grantee alone) is the
+ * only key that can seal the member record. Register-first, then persist,
+ * so a record on disk always means a registered member (the same order as
+ * `rotateSeed`). Owner/admin grantees use the shared seed and are skipped.
+ *
+ * A re-grant (role change) lands here again with a NEW DEK and mints a NEW
+ * seed, so the host's record for this userId is REPLACED — key and role — and
+ * a device still holding the previous enrolment is refused from then on.
+ */
+export declare function enrolMemberSeed(ctx: BrokerSeedCtx, member: {
+    readonly userId: string;
+    readonly secret: string;
+}): Promise<void>;
+/**
+ * core#73 — de-register a member with the host and drop its record. Called
+ * by the kernel right after `revoke()`; the local record goes first (cheap,
+ * always succeeds), then the host — a host failure surfaces as
+ * {@link BrokerEnrolmentError} AFTER the keyring revocation has completed,
+ * so the caller retries the host half, never the revocation.
+ */
+export declare function revokeMemberSeed(ctx: BrokerSeedCtx, userId: string): Promise<void>;
 /**
  * The challenge/response round trip: `POST /challenge`, derive+sign the
  * proof from the decrypted seed, `POST /credentials`. One network round

package/dist/with-party/directory/user-envelope/storage.d.ts

@@ -17,7 +17,7 @@
  * @module
  */
 import type { NoydbStore, UserEnvelope } from '../../../kernel/types.js';
-import { type EnclaveKey } from '../../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../../capsule/index.js';
 /**
  * Read and decrypt the user envelope for `keyringId`. Returns `null`
  * when no envelope has been persisted (either the principal has never

package/dist/with-party/policy/noydb-facade.d.ts

@@ -1,34 +1,4 @@
-import type { VaultPolicy, ReAuthOperation, NoydbPolicyApi, NoydbPolicyDeps, NoydbPolicyFactory } from '../../kernel/types.js';
-export declare class NoydbPolicy implements NoydbPolicyApi {
-    private readonly deps;
-    constructor(deps: NoydbPolicyDeps);
-    /**
-     * Touch the policy enforcer for a vault (records activity, resets
-     * idle timer). Also touches the legacy session timer. No-op if no enforcer.
-     */
-    touchPolicy(vault?: string): void;
-    /**
-     * Check that a policy-guarded operation is permitted.
-     * Throws `SessionPolicyError` if re-auth is required.
-     */
-    checkPolicyOperation(vault: string, op: ReAuthOperation): void;
-    /**
-     * Read the active policy for a vault. Loads from `_meta/policy` on
-     * first call; subsequent calls hit the in-memory cache. Throws
-     * `ValidationError` if the vault has not been opened.
-     */
-    getPolicy(vault: string): Promise<VaultPolicy>;
-    /**
-     * Replace the policy document at `_meta/policy` and update the
-     * in-memory cache. Gated by the `enroll-user` policy (a policy
-     * change is fundamentally a privilege-management action).
-     */
-    updatePolicy(vault: string, override: Partial<VaultPolicy>): Promise<VaultPolicy>;
-    /** Read or persist the vault policy at `_meta/policy` on first open. */
-    bootstrapPolicy(vault: string, opts?: {
-        skipManagedCheck?: boolean;
-    }): Promise<void>;
-}
+import type { NoydbPolicyFactory } from '../../kernel/types.js';
 /**
  * Factory that builds the `NoydbPolicy` service. `createNoydb()`
  * pre-resolves this via a dynamic import (mirrors

package/dist/with-party/team/delegation.d.ts

@@ -40,7 +40,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 export declare const DELEGATIONS_COLLECTION = "_delegations";
 /**
  * Durable payload of a delegation token. Encrypted under the vault's
@@ -52,12 +52,45 @@ export interface DelegationToken {
     readonly toUser: string;
     readonly fromUser: string;
     readonly tier: number;
-    /** Collection name or `null` for all collections. */
+    /**
+     * Collection name, or `null` for a COLLECTION-WIDE token — see
+     * {@link DelegationToken.wrappedDeks} for what that means and what it cannot
+     * mean.
+     */
     readonly collection: string | null;
     /** Optional specific record id scope. */
     readonly record?: string;
     readonly until: string;
-    readonly wrappedDek: string;
+    /**
+     * The delegated tier DEK for {@link DelegationToken.collection}, wrapped
+     * under the target's KEK. Present on a per-collection token; absent on a
+     * collection-wide one, which carries {@link DelegationToken.wrappedDeks}.
+     */
+    readonly wrappedDek?: string;
+    /**
+     * A collection-wide token's payload: `<collection>#<tier>` → wrapped DEK, one
+     * entry per collection the grantor held at that tier (core#56).
+     *
+     * ## ⛔ Why a MAP and not one key
+     *
+     * Every collection has its OWN tier DEK — measured, `docs#1` and `ledger#1`
+     * are different keys. The original design tried to express "every collection"
+     * as a single DEK under a wildcard slot `__any#<tier>`, which cannot work: one
+     * key decrypts one collection. A wildcard accepted at the access gate would
+     * have passed the check and then failed decryption — a gate that says yes
+     * followed by a crypto error. `__any#` is gone; every entry here merges under
+     * its REAL `<collection>#<tier>` key, so `assertTierAccess` needs no wildcard
+     * and gains no new privilege surface.
+     *
+     * ## ⚠️ "Every collection" means "every collection AS OF ISSUE TIME"
+     *
+     * This is a SNAPSHOT. A collection created after the token was issued is not
+     * in it and will not be granted by it — the grantor did not hold its DEK to
+     * wrap. That is a real limit of the shape, not an oversight, and it is stated
+     * here because a caller who reads "all collections" will otherwise assume
+     * otherwise.
+     */
+    readonly wrappedDeks?: Readonly<Record<string, string>>;
     readonly createdAt: string;
 }
 export interface IssueDelegationOptions {
@@ -73,6 +106,29 @@ export interface IssueDelegationOptions {
  * (so the `wrappedDek` can be re-wrapped against their KEK).
  */
 export declare function issueDelegation(store: NoydbStore, vault: string, grantor: UnlockedKeyring, targetKek: EnclaveKey | null, delegationsDek: EnclaveKey, opts: IssueDelegationOptions): Promise<DelegationToken>;
+/**
+ * ## Why the vault calls this EXPLICITLY, and never from `openVault` (core#56)
+ *
+ * The module header above describes a runtime that scans on every open. Doing
+ * that automatically would call `getDEK('_delegations')`, which MINTS a DEK when
+ * absent and persists the keyring — so merely opening a vault would write to it.
+ * Worse, on a vault whose shared `_delegations` DEK this user does not hold, it
+ * would mint a WRONG one and then fail to decrypt every token under it.
+ *
+ * ⛔ A read path must not have that side effect. `Vault.refreshDelegations()`
+ * therefore lists first, returns `[]` when nothing is written, and looks the DEK
+ * up WITHOUT minting — which also makes the module header's "at each open"
+ * cheap to honour, and its "periodic intervals (tracked by the caller)" is what
+ * an explicit method is.
+ *
+ * ## ⚠️ Cross-user delegation does not work yet
+ *
+ * `Vault.delegate()` wraps against the GRANTOR's own KEK — its own comment calls
+ * that "a simpler first cut" pending a per-target KEK exchange. A token issued
+ * to somebody else cannot be unwrapped by them, and this function skips it. What
+ * works today is a token whose target shares the issuing KEK. That limit belongs
+ * to `delegate()`; do not "fix" it here.
+ */
 /**
  * Enumerate every live (non-expired) delegation addressed to `toUser`
  * and merge the unwrapped tier DEKs into their keyring. Returns the

package/dist/with-party/team/echo-secret.d.ts

@@ -17,7 +17,7 @@
  *     (`verifyTypedEcho`) for that degraded path.
  *
  * Deriving the actual KEK from all three parts together is
- * `deriveEchoKey`/`encodeEchoParts` (`kernel/enclave/crypto.ts`) — a
+ * `deriveEchoKey`/`encodeEchoParts` (`capsule/enclave-aes/crypto.ts`) — a
  * separate concern from this module's per-part verifiers.
  *
  * Known, accepted disclosure: `prompt_verifier` and `echo_verifier` are
@@ -28,11 +28,9 @@
  *
  * @module
  */
-import { type EchoSecretParts } from '../../kernel/enclave/index.js';
+import { type EchoSecretParts } from '../../capsule/index.js';
 import type { KeyringEchoBlock } from '../../kernel/types.js';
 import type { NoydbDeviceSeal } from './device-seal.js';
-/** Same iteration floor as the KEK (spec resolved question 1). */
-export declare const ECHO_KDF_ITERATIONS = 600000;
 export type EchoRevealChoice = {
     readonly kind: 'portable';
 } | {