@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/with-party/team/index.d.ts

@@ -39,6 +39,6 @@ export { beginEchoUnlock } from './echo-ceremony.js';
 export type { BeginEchoUnlockOptions, EchoCeremony } from './echo-ceremony.js';
 export { MemoryDeviceSeal } from './device-seal.js';
 export type { NoydbDeviceSeal } from './device-seal.js';
-export type { EchoSecretParts } from '../../kernel/enclave/index.js';
+export type { EchoSecretParts } from '../../capsule/index.js';
 export type { KeyringEchoBlock, NoydbStore } from '../../kernel/types.js';
 export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, EncryptedEnvelope, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope } from '../../kernel/types.js';
-import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
+import { type EnclaveKey, type EchoSecretParts } from '../../capsule/index.js';
 import type { KeyringTamperedReason } from '../../kernel/errors.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';
 import type { NoydbDeviceSeal } from './device-seal.js';
@@ -85,17 +85,6 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
-/**
- * The vault roster key held by this keyring, or `null` when the keyring
- * carries none.
- *
- * Null is expected on the resume-style paths (`kek: null` sessions, tier-3
- * PIN resume, plaintext mode) — none of which may write a keyring file.
- * Every stamping site null-guards this exactly as it guards `kek`: minting a
- * file without a verifiable `roster_tag` would be worse than refusing, since
- * it is indistinguishable on the next load from a store having stripped it.
- */
-export declare function rosterKeyOf(keyring: UnlockedKeyring): EnclaveKey | null;
 /**
  * Shared wording for the stamping-site guards — mirrors the `kek` guard's shape.
  * Exported so every roster-stamping site in the hub raises ONE error with one
@@ -120,6 +109,7 @@ export interface LoadKeyringOptions {
  */
 export declare function deriveKekForKeyring(file: KeyringFile, secret: string | EchoSecretParts, salt: Uint8Array): Promise<EnclaveKey>;
 /** Parse a raw keyring envelope. Single sanctioned reader of `_data` for keyring files. */
+/** Parse a keyring envelope's body. Exported for `keyring-mirror.ts` (core#75) — the one non-crypto reader. */
 export declare function parseKeyringEnvelope(envelope: EncryptedEnvelope): KeyringFile;
 /** Fetch + parse a user's keyring file; undefined when the row is missing. */
 export declare function readKeyringFile(store: NoydbStore, vault: string, userId: string): Promise<{
@@ -513,16 +503,6 @@ export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, v
     envelope: UserEnvelope<T> | null;
 }>>;
 export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
-/**
- * The `Permissions` catch-all key (#1010). `Permissions` has always documented
- * `'*'` as "the wildcard collection matching all collections in the vault", but
- * nothing expanded it — a grantee handed the documented catch-all got no keys
- * at all. It is honoured in three places, and they must agree: the DEK wrapping
- * in `grant()`, and both permission checks below.
- */
-export declare const PERMISSION_WILDCARD = "*";
-/** Does this permission map hand over the whole vault? */
-export declare function permissionsAreWildcard(permissions: Permissions | undefined): boolean;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */

package/dist/with-party/team/magic-link-grant.d.ts

@@ -49,12 +49,22 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection holding magic-link grant envelopes. */
 export declare const MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 /** HKDF `info` for the AES-GCM content key. Version-namespaced. */
 export declare const MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
-/** HKDF `info` for the AES-KW KEK. Matches `@noy-db/on-magic-link`. */
+/**
+ * HKDF `info` for the AES-KW KEK. Matches `@noy-db/on-magic-link`.
+ *
+ * No importer inside hub, and that is not a defect: this is one half of a
+ * CROSS-PACKAGE protocol constant. The satellite derives the same KEK from
+ * the same string, so the value has to be stated here to be reviewable
+ * against it. Deleting it would leave the wire format pinned in one repo
+ * only (#55).
+ *
+ * @seam
+ */
 export declare const MAGIC_LINK_KEK_INFO_PREFIX = "noydb-magic-link-v1:";
 /**
  * Decrypted payload of a magic-link grant record. Mirrors

package/dist/with-party/team/noydb-facade.d.ts

@@ -53,6 +53,11 @@ export interface TeamFacadeDeps {
     getKeyringInternal(vault: string, opts?: {
         create: boolean;
     }): Promise<UnlockedKeyring>;
+    /** core#73 — re-enrol a recovered member with the broker host (kernel-resident; no-op without a broker). */
+    enrolBrokerMember(vault: string, member: {
+        readonly userId: string;
+        readonly secret: string;
+    }): Promise<void>;
     /** Managed-recovery enrolment check (kernel-resident). */
     assertRecoveryEnrolled(vault: string, policy: VaultPolicy, opts?: {
         skipManagedCheck?: boolean;

package/dist/with-party/team/recovery.d.ts

@@ -23,7 +23,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import { type WrappedDeksBlob } from './wrapped-deks.js';
 import type { NoydbShamir } from './noydb-shamir.js';
 /**

package/dist/with-party/team/reserved-secret-collections.d.ts

@@ -25,17 +25,19 @@
 /** Reserved collection holding per-adapter sync transport secrets. */
 export declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 /**
- * Reserved (pre-allocated) name for the future credential broker (#479).
- * Not yet implemented — reserved now so that neither the public collection
- * handle nor grant propagation can ever expose it before its dedicated,
- * role-gated API lands.
+ * Reserved collection holding the credential broker's SHARED seed (#479):
+ * one record per `brokerId`, owner/admin only.
  */
 export declare const BROKER_COLLECTION = "_broker";
 /**
- * The set of reserved collection names whose record contents are
- * directly-usable secrets. Membership here means: never served via
- * `vault.collection()`, never propagated to sub-admin grantees.
+ * Reserved collection holding each MEMBER's own broker seed (core#73): one
+ * record per `userId`, each encrypted under a DEK minted for that grantee
+ * alone at `grant()` time. Secret-bearing like `_broker`, with one twist the
+ * propagation loops must honour: the grantor never HOLDS this DEK (it is
+ * per-grantee, minted and wrapped in one step), so there is nothing to
+ * withhold — the guard exists so the name can never be served by
+ * `vault.collection()`.
  */
-export declare const SECRET_BEARING_RESERVED_COLLECTIONS: ReadonlySet<string>;
+export declare const BROKER_MEMBER_COLLECTION = "_broker_member";
 /** True when `name` is a secret-bearing reserved collection. */
 export declare function isSecretBearingReservedCollection(name: string): boolean;

package/dist/with-party/team/roster-tag.d.ts

@@ -39,12 +39,12 @@
  * PR) — it is not written there yet.
  */
 import type { KeyringFile } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 export interface RosterTag {
     readonly iv: string;
     readonly data: string;
 }
-export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch'>;
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch' | 'clearance'>;
 export declare function rosterCanonical(file: RosterAuthorityFields): string;
 export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
 /**
@@ -99,3 +99,44 @@ export declare function assertRosterAuthenticated(file: KeyringFile, deks: Reado
  * the point of the mechanism.
  */
 export declare function assertRosterTagValid(file: KeyringFile, rosterKey: EnclaveKey, userId: string): Promise<void>;
+/**
+ * ⚠️ MOVED HERE from `roster-epoch.ts` (core#58), and the move is the point.
+ *
+ * That module carries an output-domain invariant — every function it exports
+ * must reach a published entry point — because its CALLER API
+ * (`assertRosterEpochCurrent`) once shipped reachable from nowhere (#1097).
+ * `stampAuthority` is writer-side plumbing and has no business on the published
+ * surface, so satisfying that invariant by exporting it would have been the
+ * wrong repair.
+ *
+ * It belongs here regardless: it stamps the derived fields that
+ * `rosterCanonical` below BINDS, and the two must change together. Adding a
+ * derived field means editing both functions in this one file.
+ */
+/**
+ * Stamp a keyring's authority half with BOTH derived fields at once — the next
+ * roster epoch and the advisory clearance (core#58).
+ *
+ * ## Why one helper and not two call sites
+ *
+ * There are thirteen places that build a `KeyringFile`'s authority half, across
+ * `keyring.ts`, `rotate-recover.ts`, `peer-recover.ts`, `custody/liberate.ts`
+ * and `with-cargo/adopt-partition.ts`. Every one of them must stamp every
+ * derived field, or the field FLICKERS: present after a grant, absent after the
+ * next rotate or partition adopt, with no error anywhere.
+ *
+ * ⛔ That is not a hypothetical — it is the exact failure `clearance` already
+ * had in a weaker form, and adding a fourteenth call site is how it would come
+ * back. **Adding a derived field means adding it HERE**, which makes covering
+ * all thirteen sites the default rather than a thing to remember.
+ *
+ * `clearance` is derived from the DEK slot names in the very object being
+ * stamped, so it cannot disagree with them; see `keyringClearance` for why it
+ * is advisory and must stay so.
+ */
+export declare function stampAuthority<T extends {
+    readonly deks?: Record<string, string>;
+}>(authority: T, previousEpoch: number | undefined): T & {
+    roster_epoch: number;
+    clearance: number;
+};

package/dist/with-party/team/rotate-recover.d.ts

@@ -17,7 +17,7 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
+import { type EnclaveKey, type EchoSecretParts } from '../../capsule/index.js';
 import { type PaperRecoveryEntry } from './recovery.js';
 import type { NoydbShamir } from './noydb-shamir.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';

package/dist/with-party/team/tiers.d.ts

@@ -21,12 +21,43 @@ import type { UnlockedKeyring } from './keyring.js';
 import { dekKey } from '../../kernel/tier-visibility.js';
 export { dekKey };
 /**
- * Returns the user's effective clearance for a given collection: the
- * maximum tier for which their keyring holds a DEK. Falls back to 0
- * when the user has only the tier-0 DEK (or none — the getDEK caller
- * will raise separately).
+ * The user's effective clearance for ONE collection: the maximum tier for which
+ * their keyring holds a DEK. `0` when only the tier-0 DEK is held (or none —
+ * the `getDEK` caller raises separately).
+ *
+ * Takes DEK SLOT NAMES rather than an `UnlockedKeyring` (core#58), because the
+ * callers that need this are the ones BUILDING a `KeyringFile`, where the slot
+ * names exist and an unlocked keyring may not. Not published from any entry, so
+ * the signature is free to say what it means.
+ *
+ * ⚠️ `kernel/vault.ts`'s `elevate()` scan is NOT this predicate: that asks
+ * whether ANY collection has a DEK at ONE tier (`#N` suffix match); this asks
+ * the MAXIMUM tier for ONE collection (`name#` prefix match).
+ */
+export declare function effectiveClearance(dekSlots: Iterable<string>, collection: string): number;
+/**
+ * The whole keyring's clearance: the highest tier held for ANY collection.
+ *
+ * ## What this is, and the one thing it must never become (core#58)
+ *
+ * This is the value persisted as `KeyringFile.clearance`. It is **derived**,
+ * not independent — a pure function of the DEK slot names written into the same
+ * file — and that is deliberate on two counts:
+ *
+ *  1. `dek_slots` is already bound into the roster tag (#1115), so a clearance
+ *     computed from it carries no authority the tag does not already cover. A
+ *     store that forges one contradicts data it cannot forge.
+ *  2. Being derived at every write is what stops it drifting. A value computed
+ *     once at grant time and carried forward goes stale the moment a tier DEK
+ *     is added or revoked.
+ *
+ * ⛔ **It is ADVISORY and must stay advisory.** The real check is whether the
+ * DEK map carries a `collection#tier` entry — `assertTierAccess` is the gate,
+ * and access in this system IS the key. Never branch a privilege decision on
+ * this number: it would be a second, weaker representation of access sitting
+ * beside the authoritative one, which is how the two come to disagree.
  */
-export declare function effectiveClearance(keyring: UnlockedKeyring, collection: string): number;
+export declare function keyringClearance(dekSlots: Iterable<string>): number;
 /**
  * Assert the caller is cleared for the requested tier. Owners and
  * admins always pass (they can mint any new tier DEK on demand);

package/dist/with-party/team/wrapped-deks.d.ts

@@ -33,7 +33,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /**
  * The wrap-DEKs primitive — a serialized + AES-GCM-encrypted DEK set
  * keyed under a credential-derived key.

package/dist/with-pod/index.d.ts

@@ -40,4 +40,4 @@ export { ManifestConflictError, MigrationRequiredError, PodHeaderVerificationErr
 export type { Noydb } from '../kernel/noydb.js';
 export type { Vault } from '../kernel/vault.js';
 export type { NoydbOptions, NoydbStore } from '../kernel/types.js';
-export type { EchoSecretParts } from '../kernel/enclave/index.js';
+export type { EchoSecretParts } from '../capsule/index.js';

package/dist/with-shape/blobs/blob-compaction.d.ts

@@ -29,7 +29,7 @@
  * @module
  */
 import type { NoydbStore, SlotInfo } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import { type OrphanChunkReport } from './orphan-report.js';
 import { type UnreferencedLegacyBlobReport } from './legacy-sweep.js';
 export interface BlobFieldPolicy<T = unknown> {

package/dist/with-shape/blobs/blob-intent.d.ts

@@ -38,7 +38,7 @@
  * 2, rehome — mint/resume/consume for `op:'rehome'` markers).
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** Reserved collection holding `_blob_intent` marker rows. */
 export declare const BLOB_INTENT_COLLECTION = "_blob_intent";
 /**

package/dist/with-shape/blobs/blob-set.d.ts

@@ -1,7 +1,7 @@
 import type { NoydbStore, BlobObject, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions } from '../../kernel/types.js';
 import type { ObjectProjection } from './object-projection.js';
 import type { BlobFieldsConfig } from './blob-compaction.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import { type BlobPinCache } from './blob-pinning.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 /**
@@ -495,7 +495,7 @@ export declare class BlobSet {
      *     covered by rotation.
      *
      * This also makes one ordering rule true across the blob subsystem rather
-     * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+     * than two opposite ones: `capsule/plumbing/rekey-blob.ts` already
      * re-encrypts chunks before re-sealing their index entry, and documents that
      * order as its resume property.
      *
@@ -608,6 +608,8 @@ export declare class BlobSet {
         shredded: string[];
         retainedShared: string[];
         residue: string[];
+        /** #28 — the eTag half of `residue` alone: the join key to `compact()`'s sweep. */
+        residueETags: string[];
     }>;
     /**
      * Resolve a SHRED `BlobIntent` for this record, or `null` when the entry
@@ -1294,6 +1296,27 @@ export declare class BlobSet {
      * and "its attachments are released" are one operation. Ungated: the record
      * delete itself already passed the gate bus. Ref-counted like any release —
      * content another record still holds survives.
+     *
+     * ⛔ RELEASE IS NOT ERASURE, AND THE API CANNOT TELL YOU WHICH YOU GOT
+     * (noy-db/core#28). Releasing the slot is unconditional; when the BYTES
+     * leave the store depends on the collection's key mode:
+     *
+     * - `perRecordKeys: true` — crypto-shredded on the spot at refCount 0.
+     * - legacy (shared DEK) — chunks RETAINED under the collection DEK until
+     *   `vault.compact({ reclaimLegacyBlobs: true })` runs (#1453).
+     *
+     * Both give the caller the same `null` from `blob(id).get(slot)`, and the
+     * record, the slot list and the store listing all agree it is gone — so
+     * every signal a consumer has says "erased" while the ciphertext is still
+     * on disk, recoverable by anyone holding the DEK. pilot-1 measured exactly
+     * this (chunks 2 → 2 on delete) and reasonably read the deferral as a
+     * broken cascade.
+     *
+     * ⭐ So: if a delete is meant to ERASE — a subject-access request, a
+     * retention policy — either put the blobs on a `perRecordKeys` collection
+     * or run the reclaim pass, and assert on `compact()`'s
+     * `unreferencedLegacyBlobs.reclaimed`, never on the null read. The seam is
+     * pinned in `__tests__/1451-delete-releases-blobs.test.ts`.
      */
     releaseAll(): Promise<void>;
     /** The body of {@link delete}, minus the owner gate. */

package/dist/with-shape/blobs/legacy-sweep.d.ts

@@ -17,7 +17,7 @@
  * are skipped, not counted: this is a tier-0 pass.
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 /** What `vault.compact()` reports (and, on request, reclaims) about legacy blobs. */
 export interface UnreferencedLegacyBlobReport {
     /** `_blob_index` rows with no `_cek` (legacy) and `refCount <= 0`. */
@@ -26,6 +26,22 @@ export interface UnreferencedLegacyBlobReport {
     readonly chunks: number;
     /** How many of those blobs this run deleted (chunks first, then the index row). */
     readonly reclaimed: number;
+    /**
+     * #28 — the eTags this run actually deleted, so a deferred erasure set can be
+     * reconciled against the reclaim that finished it:
+     *
+     * ```ts
+     * const still = before.blobResidueETags.filter((e) => !report.reclaimedETags.includes(e))
+     * ```
+     *
+     * ⛔ DO NOT PERSIST. An eTag is a content hash — see
+     * `ForgetResult.blobResidueETags` for why a stored receipt of them is a
+     * re-identification oracle. Reconcile in memory, persist the verdict.
+     *
+     * Empty on a `dryRun` (nothing was deleted), even though `blobs`/`chunks`
+     * still count what WOULD be.
+     */
+    readonly reclaimedETags: readonly string[];
 }
 export declare function sweepUnreferencedLegacyBlobs(ctx: {
     adapter: NoydbStore;

package/dist/with-shape/introspection/describe.d.ts

@@ -11,7 +11,7 @@
  * @module
  */
 import type { FieldMeta } from './field-meta.js';
-import { FieldMetaUnknownFieldError, schemaFieldKeys } from './field-meta.js';
+import { schemaFieldKeys } from './field-meta.js';
 export { schemaFieldKeys };
 import type { CollectionMeta } from './meta.js';
 import type { ViaDescriptor, ViaPosture } from '../../kernel/via/index.js';
@@ -22,7 +22,7 @@ import type { ComputedFields } from '../../with-formula/computed/index.js';
 import type { RefDescriptor } from '../../kernel/refs.js';
 import type { ClassifiedFieldSpec } from '../../via/classified/descriptor.js';
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 export interface DescribedField {
     readonly key: string;
     /**
@@ -275,7 +275,6 @@ export interface BuildDescriptionInput {
      */
     readonly fieldIds?: Record<string, string> | undefined;
 }
-export { FieldMetaUnknownFieldError };
 /**
  * Pure assembler: no I/O, no side effects.
  * Builds a {@link CollectionDescription} from the collection's in-memory config.

package/dist/with-shape/introspection/index.d.ts

@@ -13,6 +13,7 @@ export type { VaultIntrospectState } from './walk.js';
 export { jsonSchemaToFields } from './fields.js';
 export type { SchemaIntrospection } from './types.js';
 export type { FieldMeta, SemanticType } from './field-meta.js';
+export { FieldMetaUnknownFieldError } from './field-meta.js';
 export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
 export type { StandardSchemaV1Issue } from '../../kernel/schema.js';
 export { applyListProjection } from './projection.js';

package/dist/with-shape/introspection/types.d.ts

@@ -174,7 +174,7 @@ export interface InternalCollectionStats {
  * documentation gate switching to the live report passes VACUOUSLY on a hub
  * too old to answer. Measured by a consumer attempting that adoption.
  */
-export type SnapshotReport = 'via' | 'stats';
+type SnapshotReport = 'via' | 'stats';
 export interface VaultSchemaSnapshot {
     readonly _noydb_snapshot: 2;
     /**
@@ -209,3 +209,4 @@ export interface DumpSchemaOptions {
     /** Sample N records per collection lacking a persisted/live schema. Default 50. `0` disables sampling. */
     readonly sampleSize?: number;
 }
+export {};

package/dist/with-shape/introspection/walk.d.ts

@@ -10,7 +10,7 @@ import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { RefRegistry } from '../../kernel/refs.js';
 import type { VaultMeta } from './meta.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /**
  * The minimal slice of Vault internal state the walker needs.
  * Exposed via `vault._introspectState()` to keep the public Vault

package/dist/with-shape/links/lazy-handle.d.ts

@@ -14,7 +14,7 @@
 import { type LinkRow, type LinkSpec, type LinkSetHandle } from './names.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /** @internal The lazy handle: public surface + facade cascade internals. */
 export type LazyLinkSetHandle = LinkSetHandle & {
     readonly _collectionName: string;

package/dist/with-shape/links/link-set.d.ts

@@ -19,7 +19,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import { NoydbError } from '../../kernel/errors.js';
 export { LINK_COLLECTION_PREFIX, linkCollectionName, isLinkCollectionName, linkRowKey, LinkIntegrityError, } from './names.js';
 export type { LinkOnDelete, LinkSpec, LinkRow, LinkSetHandle } from './names.js';

package/dist/with-shape/manifest/derive.d.ts

@@ -42,7 +42,7 @@
  *
  * @module
  */
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { SchemaManifest } from './types.js';
 /**

package/dist/with-shape/manifest/storage.d.ts

@@ -20,7 +20,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import { type SchemaManifest, type SchemaManifestEntry } from './types.js';
 /** A resolver for a collection's DEK — the same shape as `Vault`'s internal `getDEK`. */

package/dist/with-shape/persisted-schemas/register.d.ts

@@ -18,7 +18,7 @@ import type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/type
 import type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js';
 import type { PersistedSchemaEnvelope } from './types.js';
 import type { PairingMarker } from '../satellites/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 export interface PersistSchemaResult {
     /** True when a fresh envelope was written to storage. */
     readonly written: boolean;

package/dist/with-shape/persisted-schemas/storage.d.ts

@@ -14,7 +14,7 @@
  *
  * @module
  */
-import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type EnclaveKey } from '../../capsule/index.js';
 import type { NoydbStore } from '../../kernel/types.js';
 import type { PersistedSchemaEnvelope } from './types.js';
 /** Reserved collection name where persisted schemas live. */

package/dist/with-shape/satellites/dead-filter.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 /**
  * Build a live-base id set for every satellite collection detectable from
  * its persisted `_schemas/<name>` pairing marker (#591 Task 10).

package/dist/with-shape/satellites/declare.d.ts

@@ -8,7 +8,7 @@
  * `Vault` import — the kernel supplies a {@link SatelliteDeclareContext}.
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import { SatelliteRegistry } from './registry.js';
 /** The narrow slice of Vault that declaration wiring needs. */
 export interface SatelliteDeclareContext {

package/dist/with-shape/satellites/marker.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { SatelliteSpec } from './types.js';
 /**
  * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.

package/dist/with-shape/satellites/post-register.d.ts

@@ -1,5 +1,5 @@
 import type { NoydbStore } from '../../kernel/types.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { SatelliteSpec } from './types.js';
 import type { SatelliteRegistry } from './registry.js';
 /** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */

package/dist/with-shape/schema-update/fence.d.ts

@@ -18,6 +18,13 @@ export interface FenceDoc {
      */
     readonly schemaHash?: string;
 }
+/**
+ * `FENCE_RECORD_ID` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/cover. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export declare const FENCE_RECORD_ID = "schema-fence";
 export declare const DEFAULT_FENCE: FenceDoc;
 export declare function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc>;

package/dist/with-sync/engine.d.ts

@@ -1,4 +1,4 @@
-import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole } from '../kernel/types.js';
+import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole, RealignResult } from '../kernel/types.js';
 import type { MergeAuthority } from '../port/with/merge-authority.js';
 import { type PeriodPullSource } from './period-scope.js';
 import type { NoydbEventEmitter } from '../kernel/events.js';
@@ -89,11 +89,27 @@ export declare class SyncEngine {
     private periodPullSource?;
     /** Wire the period-window source (#807). Same injection pattern as `setReservedLookupSource`. */
     setPeriodPullSource(source: PeriodPullSource): void;
+    /** core#82 — when a pull replaces the caller's OWN keyring file, the vault reloads it in place. */
+    private rosterReload?;
+    /** Wire the roster-reload seam (core#82). Same injection pattern as `setCacheInvalidator`. */
+    setRosterReload(seam: {
+        userId: string;
+        reload: () => Promise<void>;
+    }): void;
+    /** core#81 — the running sync's latest progress sample; `null` when idle. Read by `status()`. */
+    private inFlight;
+    private progressLastEmit;
+    private progressLastRecords;
+    /** Emit `sync:progress` no more than every 25 records or ~250 ms; `force` for the final sample. */
+    private progress;
+    private progressDone;
     /** #807: KPI accumulator `applyRemote` feeds during a period-scoped `pull()` — pointed at the
      *  active phase's counters (summaries → records) and cleared before pull returns. Approximate
      *  by design: a push interleaved mid-pull on the same engine would attribute its converge
      *  applies to the open phase; the counters are a download-budget KPI, not an audit source. */
     private pullByteSink;
+    /** core#81 — ciphertext bytes applied by the running pull, for `sync:progress`. */
+    private pullBytes;
     constructor(opts: {
         local: NoydbStore;
         remote: NoydbStore;
@@ -181,6 +197,19 @@ export declare class SyncEngine {
      */
     private recordOutcome;
     /** Get current sync status. */
+    /**
+     * core#82 — re-align a CORRUPTED local from the target. An ordinary pull
+     * cannot repair a damaged local envelope: it keeps its `_v`, so it wins
+     * (or ties) against the target's healthy copy. Here every local
+     * user-collection envelope is verified with the same `MergeAuthority`
+     * check pull runs on remote envelopes; one that fails is replaced by the
+     * target's copy when THAT verifies, and the dirty log is dropped (a dirty
+     * entry over a damaged record would push the damage). Records at a tier
+     * the caller holds no key for pass unverified, as in pull — this repairs
+     * what the caller can read. Requires a `MergeAuthority` (a vault-attached
+     * engine on an encrypted vault).
+     */
+    realign(): Promise<RealignResult>;
     status(): SyncStatus;
     /** Start auto-sync: listen for online/offline events, optional periodic sync. */
     startAutoSync(intervalMs?: number): void;