@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/with-audit/forget/strategy.d.ts

@@ -105,6 +105,71 @@ export interface ForgetResult {
     readonly blobsRetainedShared: number;
     /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */
     readonly blobResidueCollections: readonly string[];
+    /**
+     * #28 — the same residue as {@link blobResidueCollections}, at `collection:id`
+     * grain: which RECORDS held blob content that could not be crypto-shredded.
+     *
+     * ⭐ Prefer this one. `blobResidueCollections` answers "some blobs in
+     * `invoices` did not shred"; a specific erasure request asks "which of THIS
+     * subject's records are affected", and only a record-grained answer can say.
+     *
+     * ⚠️ "Could not be shredded" does NOT mean the bytes are still in the live
+     * store — `forget()` deletes legacy chunks, it just cannot crypto-shred them.
+     * See {@link blobResidueETags} for what the exposure actually is.
+     *
+     * ⚠️ `blobResidueCollections` is kept, unchanged, because it is published —
+     * widening it in place would silently change what every existing reader sees,
+     * with no type error (`string[]` either way). Both are populated from the
+     * same sites; this is the finer of the two.
+     *
+     * Reported by pilot-1, who noticed that this result type carries residue at
+     * `collection:id` (`unmigratedRecords`) and `collection:id:field`
+     * (`indexResidue`, `sealedResidue`) elsewhere, so the coarse one read as a
+     * defect rather than a design choice. It was: the record id was in scope on
+     * the line that recorded only the collection.
+     */
+    readonly blobResidueRecords: readonly string[];
+    /**
+     * #28 — the eTags of blob content this erasure could not CRYPTO-SHRED.
+     *
+     * ⛔ READ THE MEANING CAREFULLY; it is not what the name suggests on first
+     * reading, and the obvious reading is wrong in a way that matters.
+     *
+     * On a LEGACY blob (no per-blob `_cek`) `forget()` still DELETES the chunks
+     * and the index row — it passes `reclaimLegacy: true`. What it cannot do is
+     * make them cryptographically unreadable, because there is no per-blob key to
+     * destroy; the bytes were removed rather than shredded. So:
+     *
+     * - the live store IS clean — do not expect these chunks to still be there;
+     * - but any pre-existing BACKUP, replica or snapshot taken before the erasure
+     *   remains decryptable under the retained collection DEK, and that is the
+     *   exposure this field is telling you about.
+     *
+     * ⚠️ THIS CANNOT BE RECONCILED AGAINST `compact({ reclaimLegacyBlobs })`.
+     * That sweep reclaims refCount-0 legacy index rows that still EXIST; these no
+     * longer do. An intersection of the two sets is empty by construction and
+     * means nothing — measured, not assumed (2026-09-14). The reclaim path
+     * belongs to ordinary `collection.delete()`, which passes
+     * `reclaimLegacy: false` and genuinely defers.
+     *
+     * ⭐ What to DO with a non-empty value: treat the subject's data as erased
+     * from the live vault but potentially present in backups, and handle it under
+     * whatever backup-retention policy you operate. Migrating the collection to
+     * per-record keys before the erasure (`blob(id).migrate()`) is what makes a
+     * future erasure a true crypto-shred.
+     *
+     * ⛔ DO NOT PERSIST THESE. An eTag is a CONTENT HASH, so a stored erasure
+     * receipt listing them lets anyone holding a candidate file confirm the vault
+     * once held it — a residual disclosure created by the very artefact meant to
+     * prove the data is gone. `ledgerEntry` records residue COUNTS, never values,
+     * for exactly this reason.
+     *
+     * ⚠️ Narrower than {@link blobResidueRecords}: this is the eTag half only. A
+     * record whose SLOT ROW was undecodable appears there and not here, because
+     * there is no content identity to name. {@link erasureCompleteness} counts
+     * both.
+     */
+    readonly blobResidueETags: readonly string[];
     /**
      * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted
      * across the shredded records. These live under the retained

package/dist/with-audit/periods/periods.d.ts

@@ -521,15 +521,6 @@ export interface ReadOnlyCollection<T> {
 export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /** sha256(canonicalJson(record)) over the STORED shape of a period record. @internal */
 export declare function hashStoredPeriod(period: PeriodRecord): Promise<string>;
-/**
- * #1454 — every record's `priorPeriodName` / `priorPeriodHash` must resolve to
- * a stored predecessor in ITS timeline whose hash matches. Followed by name,
- * not by sort position: two closes within one millisecond sort arbitrarily,
- * and a deleted predecessor must read as a break, not as a new root.
- *
- * @internal
- */
-export declare function verifyPeriodChain(records: readonly PeriodRecord[]): Promise<void>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor

package/dist/with-audit/periods/reserved-collections.d.ts

@@ -1,3 +1,10 @@
+/**
+ * `PERIODS_RESERVED_COLLECTIONS` — PUBLISHED API, reachable from @noy-db/hub/periods. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export declare const PERIODS_RESERVED_COLLECTIONS: ReadonlySet<string>;
 /** True when `name` belongs to the periods family (#1454). */
 export declare function isPeriodsReservedCollection(name: string): boolean;

package/dist/with-audit/portability/request-withdrawal.d.ts

@@ -22,7 +22,6 @@
 import type { Vault } from '../../kernel/vault.js';
 import { NoydbError } from '../../kernel/errors.js';
 import { type WithdrawResult } from './withdraw-accessible.js';
-export declare const WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
 /** Raised when a request is missing, already decided, or expired. */
 export declare class WithdrawalRequestError extends NoydbError {
     constructor(message: string);

package/dist/with-audit/portability/withdraw-accessible.d.ts

@@ -17,7 +17,6 @@
  * (`request-withdrawal.ts`).
  */
 import type { Vault } from '../../kernel/vault.js';
-export declare const FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
 /** 24-hex-char random id (used for withdrawal ids + request ids). */
 export declare function randomId(): string;
 export interface FrozenSnapshotRef {

package/dist/with-audit/tiers/index.d.ts

@@ -21,7 +21,7 @@
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 export { withTiers } from './active.js';
-export { NO_TIERS, type TiersStrategy } from './strategy.js';
+export { NO_TIERS, type TiersStrategy, type DelegationReadContext } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
 import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../capsule/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';

package/dist/with-audit/tiers/strategy.d.ts

@@ -9,6 +9,9 @@
  */
 import type { GhostRecord } from '../../kernel/types.js';
 import type { TiersContext, TierMoveResult } from './index.js';
+import type { DelegationToken } from '../../with-party/team/delegation.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+import type { NoydbStore } from '../../kernel/types.js';
 export type { TierMoveResult };
 export interface TiersStrategy {
     putAtTier<T>(ctx: TiersContext<T>, id: string, record: T, tier: number, opts?: {
@@ -35,6 +38,22 @@ export interface TiersStrategy {
      * A tier the writer cannot read is outside the guarantee.
      */
     checkUnique<T>(ctx: TiersContext<T>, id: string, record: T): Promise<void>;
+    /**
+     * core#56 — the delegation READ half. VAULT-scoped, not collection-scoped,
+     * so it takes its own narrow context rather than a `TiersContext`.
+     *
+     * It lives on this strategy rather than in the kernel because delegation IS a
+     * tier feature (the tokens carry tier DEKs and the gate they satisfy is
+     * `assertTierAccess`), and because a consumer who never opts into tiers has no
+     * delegations to read — so this should tree-shake away for them.
+     */
+    refreshDelegations(ctx: DelegationReadContext, now?: Date): Promise<DelegationToken[]>;
+}
+/** The vault-scoped slice the delegation read half needs (core#56). */
+export interface DelegationReadContext {
+    readonly vault: string;
+    readonly adapter: NoydbStore;
+    readonly keyring: UnlockedKeyring;
 }
 /**
  * No-op stub — the floor default. Every capability method throws

package/dist/with-cargo/extract-partition.d.ts

@@ -50,52 +50,6 @@ export interface ReKeyLedgerResult {
  * `_ledger_deltas`/`_history` are deferred to slice 2.
  */
 export declare function reKeyLedger(vault: Vault, closure: Map<string, Set<string>>, reKeyedCollections: Record<string, Record<string, EncryptedEnvelope>>, ledgerDek: EnclaveKey): Promise<ReKeyLedgerResult>;
-/** Carried blob internals + the fresh transfer `_blob` DEK (present only when
- * the closure references at least one chunk-based blob). */
-export interface ReKeyBlobsResult {
-    /** `_blob_slots_<C>` / `_blob_versions_<C>` / `_blob_index` / `_blob_chunks`
-     * envelopes for the bundle's `_internal` map. */
-    readonly internal: Record<string, Record<string, EncryptedEnvelope>>;
-    /** Fresh transfer `_blob` DEK — seal it so owner-creation wraps it under the
-     * recipient KEK. Undefined when no blob travels (source keyring untouched). */
-    readonly blobDek?: EnclaveKey;
-}
-/**
- * Carry the FK-closed slice's blobs — HARDENED key handling (no master-key leak).
- *
- * The source vault's shared `_blob` DEK decrypts (or unwraps the content CEK of)
- * EVERY blob in the source. Sealing it into the transfer would hand the recipient
- * a key to blobs far outside their slice. Instead we mint a **fresh transfer
- * `_blob` DEK** and arrange every carried blob into per-blob-CEK mode under it:
- *
- *  - **erasable blob** (`_cek` present): unwrap the per-blob content CEK under the
- *    SOURCE `_blob` DEK, re-wrap it under the FRESH transfer DEK. Chunks travel
- *    **verbatim** (still ciphertext under that same content CEK — passthrough).
- *  - **legacy blob** (no `_cek`, chunks under the shared `_blob` DEK): promote it
- *    IN-BUNDLE — mint a fresh content CEK, decrypt each chunk under the source
- *    `_blob` DEK and re-encrypt under the content CEK (same AAD, so the eTag-bound
- *    integrity holds), then wrap the content CEK under the transfer DEK. The
- *    SOURCE is never mutated (non-destructive), and the bundle never holds
- *    plaintext blob bytes (zero-knowledge preserved).
- *
- * **eTag identity is preserved** (not re-HMAC'd). eTags are HMAC-keyed off the
- * `_blob` DEK, but they are stored as OPAQUE keys (`_blob_index/<eTag>`,
- * `_blob_chunks/<eTag>_<i>`) and never recomputed on read — only on a `put()`
- * for dedup. Keeping them verbatim keeps every slot/version/index/chunk key and
- * the chunk AAD coherent with zero chunk-key churn. The only consequence: a
- * future `put()` of identical bytes in the adopted vault computes a different
- * eTag (HMAC under the fresh DEK) and will NOT dedup against the carried blob —
- * an accepted, documented trade for hardened key isolation.
- *
- * Slots/versions are re-keyed under their parent collection's destination DEK
- * (honoring `fieldProjection` — projected-out blob fields' slots never travel);
- * `BlobObject.refCount` is recomputed from carried references only.
- *
- * `external` slots reference an unencrypted shared-bucket object that is not in
- * the bundle — their slot metadata travels (so the catalog entry survives) but
- * the bytes do not (a documented v1 limitation; their eTag is `''`).
- */
-export declare function reKeyBlobs(vault: Vault, closure: Map<string, Set<string>>, destDeks: Map<string, EnclaveKey>, fieldProjection?: Record<string, readonly string[]>): Promise<ReKeyBlobsResult>;
 /** A minted transfer key (raw 32 bytes) + the seal carrying the DEK set. */
 export interface SealResult {
     readonly seal: TransferSealPayload;

package/dist/with-commit/numbering/index.d.ts

@@ -1,8 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../capsule/index.js';
 import type { DeferredNumberingConfig } from './descriptor.js';
-export declare const NUMBERING_HEAD_COLLECTION = "_numbering_head";
-export declare const NUMBERING_PENDING_COLLECTION = "_numbering_pending";
 export interface Assignment {
     recordId: string;
     serial: number;

package/dist/with-commit/tx/transaction.d.ts

@@ -57,8 +57,8 @@
  * **Crash window.** On the OCC fallback, steps 2–3 are not a
  * storage-layer transaction — if the process dies between two executed
  * ops, the on-disk state is partial. The atomic path above closes that
- * window for the write set itself (`to-memory` and the SQL stores in
- * `noy-db-to` implement `tx()`); a crash between the batch landing and
+ * window for the write set itself (`memoryStore({ full: true })` and the SQL
+ * stores in `noy-db-to` implement `tx()`); a crash between the batch landing and
  * the finalize loop finishing still leaves per-op side effects (history,
  * ledger, cache) incomplete. Stores that cannot commit a batch
  * atomically (file, S3) omit `tx()` and keep the fallback.
@@ -209,27 +209,5 @@ export declare class TxCollection<T> {
  * revert alongside the bulk-put source ops.
  */
 export declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions, txInvariants?: ReadonlyArray<TransactionInvariant>): Promise<T>;
-/**
- * Phase 3 helper — restore captured prior envelopes via the raw store
- * to avoid re-firing Collection-level side effects (we don't want a
- * cascade of change events undoing themselves). The ledger is left
- * as-is: each committed op appended an entry; the revert is
- * deliberately NOT recorded as a compensating entry because the
- * caller-facing contract is "atomic or not at all," not "every write
- * visible in the audit trail." Auditors who need the intermediate
- * state can still reconstruct it by walking the ledger through the
- * failed-tx timestamp.
- *
- * Delegates the reverse/best-effort/raw-revert shape to the shared
- * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache
- * invalidation below rides along as that helper's per-leg `compensate`
- * callback, gated on `db` exactly as before.
- *
- * @internal — shared between `runTransaction` and
- * `Collection.putManyAtomic`. Both register source ops + nested
- * derivation side-effect ops onto `_executed`; this helper unwinds the
- * combined list in reverse on rollback.
- */
-export declare function revertExecuted(executed: ReadonlyArray<ExecutedOp>, store: Noydb['_store'], db?: Noydb): Promise<void>;
 /** @internal — shared (vault, collection, id) key shape; also used by `atomic-eligibility.ts`'s duplicate-key scan. */
 export declare function keyOf(op: StagedOp): string;

package/dist/with-commit/vault-head/strategy.d.ts

@@ -124,4 +124,11 @@ export interface VaultHeadStrategy {
  * would look exactly like a clean sweep.
  */
 export declare const NO_VAULT_HEAD: VaultHeadStrategy;
+/**
+ * `EncryptedEnvelope` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/debug, @noy-db/hub/tiers, @noy-db/hub/to, @noy-db/hub/vault-head. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type { EncryptedEnvelope };

package/dist/with-fork/snapshots/noydb-facade.d.ts

@@ -61,4 +61,11 @@ export declare class NoydbSnapshots {
     /** Stop the cadence scheduler (called from `Noydb.close()`). */
     stop(): void;
 }
+/**
+ * `NO_SNAPSHOTS` — PUBLISHED API, reachable from @noy-db/hub/snapshots. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export { NO_SNAPSHOTS };

package/dist/with-formula/derivations/trigger-match.d.ts

@@ -14,7 +14,7 @@
  * @module
  */
 /** One declared hop through an intermediate collection (#1277). */
-export interface MatchVia {
+interface MatchVia {
     /** The intermediate collection to resolve through. */
     readonly collection: string;
     /** Field on the intermediate whose value equals `written[from]`. */
@@ -27,8 +27,6 @@ export interface MatchPair {
     readonly to: string;
     readonly via?: MatchVia;
 }
-/** True when any pair in this trigger resolves through an intermediate. */
-export declare function hasHop(match: ReadonlyArray<MatchPair>): boolean;
 /** Every intermediate collection named by a trigger's pairs, deduplicated. */
 export declare function hopCollections(match: ReadonlyArray<MatchPair>): string[];
 export interface NormalizedTrigger {
@@ -100,5 +98,10 @@ export declare function sameTuple(a: Array<{
 }> | null): boolean;
 /** Moved to the kernel (#1249) so `collection.ts` can import statically without
  *  dragging derivations code into the floor bundle; re-exported here for
- *  compatibility with existing consumers of this module. */
-export { recordMatchesPairs, findMatchingIdsByPairs } from '../../kernel/match-pairs.js';
+ *  compatibility with existing consumers of this module.
+ *
+ *  ⚠️ `findMatchingIdsByPairs` was re-exported here too and NOTHING took it
+ *  from this module (#55) — consumers import it from the kernel directly.
+ *  Dropped rather than kept as a compatibility shim for a consumer that does
+ *  not exist; the kernel module remains its home. */
+export { recordMatchesPairs } from '../../kernel/match-pairs.js';

package/dist/with-formula/materialized-views/emit-memo.d.ts

@@ -17,8 +17,6 @@ export declare function emitMemoKey(vault: string, mvName: string, outputCollect
 export declare function readEmitMemo(key: string, stamp: number | null): ReadonlyMap<string, string> | null;
 /** Record what this refresh actually left on disk. A `null` stamp records nothing. */
 export declare function writeEmitMemo(key: string, stamp: number | null, rows: Map<string, string>): void;
-/** Forget one MV's output entirely. Used when a refresh could not complete cleanly. */
-export declare function dropEmitMemo(key: string): void;
 /**
  * A canonical string for the row a refresh is about to write, or `null` when no
  * safe one exists.

package/dist/with-lookup/embeddings/index.d.ts

@@ -1,6 +1,5 @@
-export { cosine } from './cosine.js';
 export { embeddingSourceText, type EmbeddingDescriptor } from './descriptor.js';
-export { VectorSet, type StoredVector, type VectorHit } from './vector-set.js';
+export { VectorSet, type StoredVector } from './vector-set.js';
 export { withVectorIndex, DEFAULT_INDEX_MIN_VECTORS, type VectorIndexOptions } from './with-vector-index.js';
 export type { VectorIndex, VectorIndexConfig, VectorIndexSearchOptions } from './vector-index.js';
 export { encodeVecId } from './vec-id.js';

package/dist/with-lookup/indexing/collection-facade.d.ts

@@ -26,7 +26,7 @@ import type { NoydbEventEmitter } from '../../kernel/events.js';
 import { type CollectionIndexes, type IndexDef } from './eager-indexes.js';
 import type { UniqueConstraintSet } from './unique-constraints.js';
 import { type PersistedCollectionIndex } from './persisted-indexes.js';
-import { PersistedFieldIndexes, type FieldIndexCallbacks } from './persisted-field-indexes.js';
+import { PersistedFieldIndexes } from './persisted-field-indexes.js';
 export type { PersistedFieldIndexes } from './persisted-field-indexes.js';
 /** Everything the moving index-maintenance methods touched on `this.*`. */
 export interface IndexingContext<T> {
@@ -68,20 +68,6 @@ export interface IndexingContext<T> {
  * `indexes.upsert()`/`.remove()` directly, so this only fires for full reloads.
  */
 export declare function rebuildEagerIndexesFromCache<T>(ctx: IndexingContext<T>, skip?: ReadonlySet<string>): void;
-/**
- * Bridge the crypto-free {@link PersistedFieldIndexes} to this collection's
- * codec + adapter — the exact division `buildPersistedIndexCallbacks` uses for
- * the search index: crypto lives here, the store does not know it exists.
- *
- * One record per `(collection, index)`, at `_fieldidx / <collection>/<key>`.
- * The freshness stamp rides INSIDE the encrypted body (`{fp, idx}`) rather
- * than on the envelope, so the `EncryptedEnvelope` shape is never extended and
- * the stamp is not readable at rest.
- *
- * Takes a context THUNK for the same reason the search bridge does: it is
- * built from the `Collection` constructor, before `this.codec` is assigned.
- */
-export declare function buildFieldIndexCallbacks<T>(provideCtx: () => IndexingContext<T>, debounceMs?: number): FieldIndexCallbacks;
 /**
  * Build this collection's sidecar coordinator, or `null` when no index asked
  * to be persisted — so every other collection pays nothing. Kept here rather

package/dist/with-lookup/indexing/eager-indexes.d.ts

@@ -81,7 +81,7 @@ export type IndexDef = string | {
  * `orderBy(field).limit(n)`. A `'sorted'` declaration keeps the hash
  * index too — `==`/`in` stay O(1).
  */
-export type IndexKind = 'hash' | 'sorted';
+type IndexKind = 'hash' | 'sorted';
 /**
  * Normalize a declared `IndexDef[]` into a uniform `{ fields, unique? }`
  * shape: `string` → `{fields:[s]}`, `string[]` → `{fields}`, object →
@@ -299,3 +299,4 @@ export declare class CollectionIndexes {
      */
     bucketRepresentatives(field: string): readonly string[] | null;
 }
+export {};

package/dist/with-lookup/search/collection-facade.d.ts

@@ -31,7 +31,6 @@ import { type VectorSet, type EmbeddingDescriptor } from '../embeddings/index.js
 import { type SearchOptions, type SearchResult } from './index.js';
 import type { IndexStore } from './index-store.js';
 import type { PersistedIndexCallbacks } from './persisted-index-store.js';
-import type { IndexDoc, IndexBuildOptions } from './inverted-index.js';
 import type { RetrieveOptions, RetrieveHit, SimilarToOptions } from './retrieve-types.js';
 /** Everything the moving search/retrieval methods touched on `this.*`. */
 export interface SearchContext<T> {
@@ -78,17 +77,6 @@ export interface SearchContext<T> {
  * nothing searchable is written to the store.
  */
 export declare function search<T>(ctx: SearchContext<T>, field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>;
-/** L1 — build IndexDoc[] for the configured text fields over the live cache. */
-export declare function buildRetrievalDocs<T>(ctx: SearchContext<T>, labelMaps: Map<string, Map<string, Record<string, string>>>, blobFilenames: Map<string, Map<string, string[]>>, only?: readonly string[]): IndexDoc[];
-/**
- * L1 — the positional-postings opt-in for this collection (#1354), or
- * `undefined` when nothing opted in. Returning `undefined` rather than
- * `{ positions: [] }` keeps the no-opt-in path byte-identical to a caller that
- * never heard of positions.
- */
-export declare function positionBuildOptions<T>(ctx: SearchContext<T>): IndexBuildOptions | undefined;
-/** L1 — true iff any configured text index is also a blob field (gates ALL slot I/O). */
-export declare function hasIndexedBlobFields<T>(ctx: SearchContext<T>, only?: readonly string[]): boolean;
 /** L1.5 — force-persist the lexical index now (e.g. on save/idle). Persists only when textIndexPersist is enabled; a no-op otherwise. */
 export declare function flushIndex<T>(ctx: SearchContext<T>): Promise<void>;
 /**

package/dist/with-party/broker/index.d.ts

@@ -15,7 +15,7 @@ export { withBroker } from './active.js';
 export { NO_BROKER, type BrokerStrategy, type BrokerCtx, type BrokerConfig, type CredentialBrokerHandle, } from '../../port/with/broker-strategy.js';
 export { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js';
 import { verifyBrokerProof } from '../../capsule/index.js';
-import type { IssuedChallenge, VerifyBrokerProofArgs } from '../../capsule/index.js';
+import type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js';
 /**
  * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a
  * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel
@@ -25,5 +25,5 @@ export declare function issueChallenge(opts?: {
     ttlMs?: number;
 }): IssuedChallenge;
 export { verifyBrokerProof };
-export type { VerifyBrokerProofArgs };
+export type { VerifyBrokerProofArgs, BrokerMemberIdentity };
 export type { IssuedChallenge } from '../../capsule/index.js';

package/dist/with-party/broker/seed.d.ts

@@ -37,16 +37,6 @@
  */
 import type { StoreCredentials } from '../../kernel/types.js';
 import type { BrokerSeedCtx } from '../../port/with/broker-strategy.js';
-/** The `_broker/<brokerId>` record payload (spec §3). */
-export interface BrokerSeedRecord {
-    readonly brokerId: string;
-    /** base64(32 random bytes). */
-    readonly seed: string;
-    readonly endpoint: string;
-    readonly createdAt: string;
-    /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */
-    readonly registered: boolean;
-}
 /**
  * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`
  * seed (I4), derive+register its proof key with the broker host, and only
@@ -65,6 +55,31 @@ export declare function enrollSeed(ctx: BrokerSeedCtx): Promise<void>;
  * cache lives in that closure, not here.
  */
 export declare function rotateSeed(ctx: BrokerSeedCtx): Promise<void>;
+/**
+ * core#73 — enrol a freshly granted MEMBER with the host under its own key.
+ * Called by the kernel right after `grant()`, while the grantor still holds
+ * the grantee's secret: that secret opens the grantee's keyring, whose
+ * `_broker_member` DEK (minted by `grant()` for this grantee alone) is the
+ * only key that can seal the member record. Register-first, then persist,
+ * so a record on disk always means a registered member (the same order as
+ * `rotateSeed`). Owner/admin grantees use the shared seed and are skipped.
+ *
+ * A re-grant (role change) lands here again with a NEW DEK and mints a NEW
+ * seed, so the host's record for this userId is REPLACED — key and role — and
+ * a device still holding the previous enrolment is refused from then on.
+ */
+export declare function enrolMemberSeed(ctx: BrokerSeedCtx, member: {
+    readonly userId: string;
+    readonly secret: string;
+}): Promise<void>;
+/**
+ * core#73 — de-register a member with the host and drop its record. Called
+ * by the kernel right after `revoke()`; the local record goes first (cheap,
+ * always succeeds), then the host — a host failure surfaces as
+ * {@link BrokerEnrolmentError} AFTER the keyring revocation has completed,
+ * so the caller retries the host half, never the revocation.
+ */
+export declare function revokeMemberSeed(ctx: BrokerSeedCtx, userId: string): Promise<void>;
 /**
  * The challenge/response round trip: `POST /challenge`, derive+sign the
  * proof from the decrypted seed, `POST /credentials`. One network round

package/dist/with-party/policy/noydb-facade.d.ts

@@ -1,34 +1,4 @@
-import type { VaultPolicy, ReAuthOperation, NoydbPolicyApi, NoydbPolicyDeps, NoydbPolicyFactory } from '../../kernel/types.js';
-export declare class NoydbPolicy implements NoydbPolicyApi {
-    private readonly deps;
-    constructor(deps: NoydbPolicyDeps);
-    /**
-     * Touch the policy enforcer for a vault (records activity, resets
-     * idle timer). Also touches the legacy session timer. No-op if no enforcer.
-     */
-    touchPolicy(vault?: string): void;
-    /**
-     * Check that a policy-guarded operation is permitted.
-     * Throws `SessionPolicyError` if re-auth is required.
-     */
-    checkPolicyOperation(vault: string, op: ReAuthOperation): void;
-    /**
-     * Read the active policy for a vault. Loads from `_meta/policy` on
-     * first call; subsequent calls hit the in-memory cache. Throws
-     * `ValidationError` if the vault has not been opened.
-     */
-    getPolicy(vault: string): Promise<VaultPolicy>;
-    /**
-     * Replace the policy document at `_meta/policy` and update the
-     * in-memory cache. Gated by the `enroll-user` policy (a policy
-     * change is fundamentally a privilege-management action).
-     */
-    updatePolicy(vault: string, override: Partial<VaultPolicy>): Promise<VaultPolicy>;
-    /** Read or persist the vault policy at `_meta/policy` on first open. */
-    bootstrapPolicy(vault: string, opts?: {
-        skipManagedCheck?: boolean;
-    }): Promise<void>;
-}
+import type { NoydbPolicyFactory } from '../../kernel/types.js';
 /**
  * Factory that builds the `NoydbPolicy` service. `createNoydb()`
  * pre-resolves this via a dynamic import (mirrors

package/dist/with-party/team/delegation.d.ts

@@ -52,12 +52,45 @@ export interface DelegationToken {
     readonly toUser: string;
     readonly fromUser: string;
     readonly tier: number;
-    /** Collection name or `null` for all collections. */
+    /**
+     * Collection name, or `null` for a COLLECTION-WIDE token — see
+     * {@link DelegationToken.wrappedDeks} for what that means and what it cannot
+     * mean.
+     */
     readonly collection: string | null;
     /** Optional specific record id scope. */
     readonly record?: string;
     readonly until: string;
-    readonly wrappedDek: string;
+    /**
+     * The delegated tier DEK for {@link DelegationToken.collection}, wrapped
+     * under the target's KEK. Present on a per-collection token; absent on a
+     * collection-wide one, which carries {@link DelegationToken.wrappedDeks}.
+     */
+    readonly wrappedDek?: string;
+    /**
+     * A collection-wide token's payload: `<collection>#<tier>` → wrapped DEK, one
+     * entry per collection the grantor held at that tier (core#56).
+     *
+     * ## ⛔ Why a MAP and not one key
+     *
+     * Every collection has its OWN tier DEK — measured, `docs#1` and `ledger#1`
+     * are different keys. The original design tried to express "every collection"
+     * as a single DEK under a wildcard slot `__any#<tier>`, which cannot work: one
+     * key decrypts one collection. A wildcard accepted at the access gate would
+     * have passed the check and then failed decryption — a gate that says yes
+     * followed by a crypto error. `__any#` is gone; every entry here merges under
+     * its REAL `<collection>#<tier>` key, so `assertTierAccess` needs no wildcard
+     * and gains no new privilege surface.
+     *
+     * ## ⚠️ "Every collection" means "every collection AS OF ISSUE TIME"
+     *
+     * This is a SNAPSHOT. A collection created after the token was issued is not
+     * in it and will not be granted by it — the grantor did not hold its DEK to
+     * wrap. That is a real limit of the shape, not an oversight, and it is stated
+     * here because a caller who reads "all collections" will otherwise assume
+     * otherwise.
+     */
+    readonly wrappedDeks?: Readonly<Record<string, string>>;
     readonly createdAt: string;
 }
 export interface IssueDelegationOptions {
@@ -73,6 +106,29 @@ export interface IssueDelegationOptions {
  * (so the `wrappedDek` can be re-wrapped against their KEK).
  */
 export declare function issueDelegation(store: NoydbStore, vault: string, grantor: UnlockedKeyring, targetKek: EnclaveKey | null, delegationsDek: EnclaveKey, opts: IssueDelegationOptions): Promise<DelegationToken>;
+/**
+ * ## Why the vault calls this EXPLICITLY, and never from `openVault` (core#56)
+ *
+ * The module header above describes a runtime that scans on every open. Doing
+ * that automatically would call `getDEK('_delegations')`, which MINTS a DEK when
+ * absent and persists the keyring — so merely opening a vault would write to it.
+ * Worse, on a vault whose shared `_delegations` DEK this user does not hold, it
+ * would mint a WRONG one and then fail to decrypt every token under it.
+ *
+ * ⛔ A read path must not have that side effect. `Vault.refreshDelegations()`
+ * therefore lists first, returns `[]` when nothing is written, and looks the DEK
+ * up WITHOUT minting — which also makes the module header's "at each open"
+ * cheap to honour, and its "periodic intervals (tracked by the caller)" is what
+ * an explicit method is.
+ *
+ * ## ⚠️ Cross-user delegation does not work yet
+ *
+ * `Vault.delegate()` wraps against the GRANTOR's own KEK — its own comment calls
+ * that "a simpler first cut" pending a per-target KEK exchange. A token issued
+ * to somebody else cannot be unwrapped by them, and this function skips it. What
+ * works today is a token whose target shares the issuing KEK. That limit belongs
+ * to `delegate()`; do not "fix" it here.
+ */
 /**
  * Enumerate every live (non-expired) delegation addressed to `toUser`
  * and merge the unwrapped tier DEKs into their keyring. Returns the

package/dist/with-party/team/echo-secret.d.ts

@@ -31,8 +31,6 @@
 import { type EchoSecretParts } from '../../capsule/index.js';
 import type { KeyringEchoBlock } from '../../kernel/types.js';
 import type { NoydbDeviceSeal } from './device-seal.js';
-/** Same iteration floor as the KEK (spec resolved question 1). */
-export declare const ECHO_KDF_ITERATIONS = 600000;
 export type EchoRevealChoice = {
     readonly kind: 'portable';
 } | {