@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/with-party/team/keyring.d.ts

@@ -85,17 +85,6 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
-/**
- * The vault roster key held by this keyring, or `null` when the keyring
- * carries none.
- *
- * Null is expected on the resume-style paths (`kek: null` sessions, tier-3
- * PIN resume, plaintext mode) — none of which may write a keyring file.
- * Every stamping site null-guards this exactly as it guards `kek`: minting a
- * file without a verifiable `roster_tag` would be worse than refusing, since
- * it is indistinguishable on the next load from a store having stripped it.
- */
-export declare function rosterKeyOf(keyring: UnlockedKeyring): EnclaveKey | null;
 /**
  * Shared wording for the stamping-site guards — mirrors the `kek` guard's shape.
  * Exported so every roster-stamping site in the hub raises ONE error with one
@@ -120,6 +109,7 @@ export interface LoadKeyringOptions {
  */
 export declare function deriveKekForKeyring(file: KeyringFile, secret: string | EchoSecretParts, salt: Uint8Array): Promise<EnclaveKey>;
 /** Parse a raw keyring envelope. Single sanctioned reader of `_data` for keyring files. */
+/** Parse a keyring envelope's body. Exported for `keyring-mirror.ts` (core#75) — the one non-crypto reader. */
 export declare function parseKeyringEnvelope(envelope: EncryptedEnvelope): KeyringFile;
 /** Fetch + parse a user's keyring file; undefined when the row is missing. */
 export declare function readKeyringFile(store: NoydbStore, vault: string, userId: string): Promise<{
@@ -513,16 +503,6 @@ export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, v
     envelope: UserEnvelope<T> | null;
 }>>;
 export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
-/**
- * The `Permissions` catch-all key (#1010). `Permissions` has always documented
- * `'*'` as "the wildcard collection matching all collections in the vault", but
- * nothing expanded it — a grantee handed the documented catch-all got no keys
- * at all. It is honoured in three places, and they must agree: the DEK wrapping
- * in `grant()`, and both permission checks below.
- */
-export declare const PERMISSION_WILDCARD = "*";
-/** Does this permission map hand over the whole vault? */
-export declare function permissionsAreWildcard(permissions: Permissions | undefined): boolean;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */

package/dist/with-party/team/magic-link-grant.d.ts

@@ -54,7 +54,17 @@ import { type EnclaveKey } from '../../capsule/index.js';
 export declare const MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 /** HKDF `info` for the AES-GCM content key. Version-namespaced. */
 export declare const MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
-/** HKDF `info` for the AES-KW KEK. Matches `@noy-db/on-magic-link`. */
+/**
+ * HKDF `info` for the AES-KW KEK. Matches `@noy-db/on-magic-link`.
+ *
+ * No importer inside hub, and that is not a defect: this is one half of a
+ * CROSS-PACKAGE protocol constant. The satellite derives the same KEK from
+ * the same string, so the value has to be stated here to be reviewable
+ * against it. Deleting it would leave the wire format pinned in one repo
+ * only (#55).
+ *
+ * @seam
+ */
 export declare const MAGIC_LINK_KEK_INFO_PREFIX = "noydb-magic-link-v1:";
 /**
  * Decrypted payload of a magic-link grant record. Mirrors

package/dist/with-party/team/noydb-facade.d.ts

@@ -53,6 +53,11 @@ export interface TeamFacadeDeps {
     getKeyringInternal(vault: string, opts?: {
         create: boolean;
     }): Promise<UnlockedKeyring>;
+    /** core#73 — re-enrol a recovered member with the broker host (kernel-resident; no-op without a broker). */
+    enrolBrokerMember(vault: string, member: {
+        readonly userId: string;
+        readonly secret: string;
+    }): Promise<void>;
     /** Managed-recovery enrolment check (kernel-resident). */
     assertRecoveryEnrolled(vault: string, policy: VaultPolicy, opts?: {
         skipManagedCheck?: boolean;

package/dist/with-party/team/reserved-secret-collections.d.ts

@@ -25,17 +25,19 @@
 /** Reserved collection holding per-adapter sync transport secrets. */
 export declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 /**
- * Reserved (pre-allocated) name for the future credential broker (#479).
- * Not yet implemented — reserved now so that neither the public collection
- * handle nor grant propagation can ever expose it before its dedicated,
- * role-gated API lands.
+ * Reserved collection holding the credential broker's SHARED seed (#479):
+ * one record per `brokerId`, owner/admin only.
  */
 export declare const BROKER_COLLECTION = "_broker";
 /**
- * The set of reserved collection names whose record contents are
- * directly-usable secrets. Membership here means: never served via
- * `vault.collection()`, never propagated to sub-admin grantees.
+ * Reserved collection holding each MEMBER's own broker seed (core#73): one
+ * record per `userId`, each encrypted under a DEK minted for that grantee
+ * alone at `grant()` time. Secret-bearing like `_broker`, with one twist the
+ * propagation loops must honour: the grantor never HOLDS this DEK (it is
+ * per-grantee, minted and wrapped in one step), so there is nothing to
+ * withhold — the guard exists so the name can never be served by
+ * `vault.collection()`.
  */
-export declare const SECRET_BEARING_RESERVED_COLLECTIONS: ReadonlySet<string>;
+export declare const BROKER_MEMBER_COLLECTION = "_broker_member";
 /** True when `name` is a secret-bearing reserved collection. */
 export declare function isSecretBearingReservedCollection(name: string): boolean;

package/dist/with-party/team/roster-tag.d.ts

@@ -44,7 +44,7 @@ export interface RosterTag {
     readonly iv: string;
     readonly data: string;
 }
-export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch'>;
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch' | 'clearance'>;
 export declare function rosterCanonical(file: RosterAuthorityFields): string;
 export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
 /**
@@ -99,3 +99,44 @@ export declare function assertRosterAuthenticated(file: KeyringFile, deks: Reado
  * the point of the mechanism.
  */
 export declare function assertRosterTagValid(file: KeyringFile, rosterKey: EnclaveKey, userId: string): Promise<void>;
+/**
+ * ⚠️ MOVED HERE from `roster-epoch.ts` (core#58), and the move is the point.
+ *
+ * That module carries an output-domain invariant — every function it exports
+ * must reach a published entry point — because its CALLER API
+ * (`assertRosterEpochCurrent`) once shipped reachable from nowhere (#1097).
+ * `stampAuthority` is writer-side plumbing and has no business on the published
+ * surface, so satisfying that invariant by exporting it would have been the
+ * wrong repair.
+ *
+ * It belongs here regardless: it stamps the derived fields that
+ * `rosterCanonical` below BINDS, and the two must change together. Adding a
+ * derived field means editing both functions in this one file.
+ */
+/**
+ * Stamp a keyring's authority half with BOTH derived fields at once — the next
+ * roster epoch and the advisory clearance (core#58).
+ *
+ * ## Why one helper and not two call sites
+ *
+ * There are thirteen places that build a `KeyringFile`'s authority half, across
+ * `keyring.ts`, `rotate-recover.ts`, `peer-recover.ts`, `custody/liberate.ts`
+ * and `with-cargo/adopt-partition.ts`. Every one of them must stamp every
+ * derived field, or the field FLICKERS: present after a grant, absent after the
+ * next rotate or partition adopt, with no error anywhere.
+ *
+ * ⛔ That is not a hypothetical — it is the exact failure `clearance` already
+ * had in a weaker form, and adding a fourteenth call site is how it would come
+ * back. **Adding a derived field means adding it HERE**, which makes covering
+ * all thirteen sites the default rather than a thing to remember.
+ *
+ * `clearance` is derived from the DEK slot names in the very object being
+ * stamped, so it cannot disagree with them; see `keyringClearance` for why it
+ * is advisory and must stay so.
+ */
+export declare function stampAuthority<T extends {
+    readonly deks?: Record<string, string>;
+}>(authority: T, previousEpoch: number | undefined): T & {
+    roster_epoch: number;
+    clearance: number;
+};

package/dist/with-party/team/tiers.d.ts

@@ -21,12 +21,43 @@ import type { UnlockedKeyring } from './keyring.js';
 import { dekKey } from '../../kernel/tier-visibility.js';
 export { dekKey };
 /**
- * Returns the user's effective clearance for a given collection: the
- * maximum tier for which their keyring holds a DEK. Falls back to 0
- * when the user has only the tier-0 DEK (or none — the getDEK caller
- * will raise separately).
+ * The user's effective clearance for ONE collection: the maximum tier for which
+ * their keyring holds a DEK. `0` when only the tier-0 DEK is held (or none —
+ * the `getDEK` caller raises separately).
+ *
+ * Takes DEK SLOT NAMES rather than an `UnlockedKeyring` (core#58), because the
+ * callers that need this are the ones BUILDING a `KeyringFile`, where the slot
+ * names exist and an unlocked keyring may not. Not published from any entry, so
+ * the signature is free to say what it means.
+ *
+ * ⚠️ `kernel/vault.ts`'s `elevate()` scan is NOT this predicate: that asks
+ * whether ANY collection has a DEK at ONE tier (`#N` suffix match); this asks
+ * the MAXIMUM tier for ONE collection (`name#` prefix match).
+ */
+export declare function effectiveClearance(dekSlots: Iterable<string>, collection: string): number;
+/**
+ * The whole keyring's clearance: the highest tier held for ANY collection.
+ *
+ * ## What this is, and the one thing it must never become (core#58)
+ *
+ * This is the value persisted as `KeyringFile.clearance`. It is **derived**,
+ * not independent — a pure function of the DEK slot names written into the same
+ * file — and that is deliberate on two counts:
+ *
+ *  1. `dek_slots` is already bound into the roster tag (#1115), so a clearance
+ *     computed from it carries no authority the tag does not already cover. A
+ *     store that forges one contradicts data it cannot forge.
+ *  2. Being derived at every write is what stops it drifting. A value computed
+ *     once at grant time and carried forward goes stale the moment a tier DEK
+ *     is added or revoked.
+ *
+ * ⛔ **It is ADVISORY and must stay advisory.** The real check is whether the
+ * DEK map carries a `collection#tier` entry — `assertTierAccess` is the gate,
+ * and access in this system IS the key. Never branch a privilege decision on
+ * this number: it would be a second, weaker representation of access sitting
+ * beside the authoritative one, which is how the two come to disagree.
  */
-export declare function effectiveClearance(keyring: UnlockedKeyring, collection: string): number;
+export declare function keyringClearance(dekSlots: Iterable<string>): number;
 /**
  * Assert the caller is cleared for the requested tier. Owners and
  * admins always pass (they can mint any new tier DEK on demand);

package/dist/with-shape/blobs/blob-set.d.ts

@@ -608,6 +608,8 @@ export declare class BlobSet {
         shredded: string[];
         retainedShared: string[];
         residue: string[];
+        /** #28 — the eTag half of `residue` alone: the join key to `compact()`'s sweep. */
+        residueETags: string[];
     }>;
     /**
      * Resolve a SHRED `BlobIntent` for this record, or `null` when the entry
@@ -1294,6 +1296,27 @@ export declare class BlobSet {
      * and "its attachments are released" are one operation. Ungated: the record
      * delete itself already passed the gate bus. Ref-counted like any release —
      * content another record still holds survives.
+     *
+     * ⛔ RELEASE IS NOT ERASURE, AND THE API CANNOT TELL YOU WHICH YOU GOT
+     * (noy-db/core#28). Releasing the slot is unconditional; when the BYTES
+     * leave the store depends on the collection's key mode:
+     *
+     * - `perRecordKeys: true` — crypto-shredded on the spot at refCount 0.
+     * - legacy (shared DEK) — chunks RETAINED under the collection DEK until
+     *   `vault.compact({ reclaimLegacyBlobs: true })` runs (#1453).
+     *
+     * Both give the caller the same `null` from `blob(id).get(slot)`, and the
+     * record, the slot list and the store listing all agree it is gone — so
+     * every signal a consumer has says "erased" while the ciphertext is still
+     * on disk, recoverable by anyone holding the DEK. pilot-1 measured exactly
+     * this (chunks 2 → 2 on delete) and reasonably read the deferral as a
+     * broken cascade.
+     *
+     * ⭐ So: if a delete is meant to ERASE — a subject-access request, a
+     * retention policy — either put the blobs on a `perRecordKeys` collection
+     * or run the reclaim pass, and assert on `compact()`'s
+     * `unreferencedLegacyBlobs.reclaimed`, never on the null read. The seam is
+     * pinned in `__tests__/1451-delete-releases-blobs.test.ts`.
      */
     releaseAll(): Promise<void>;
     /** The body of {@link delete}, minus the owner gate. */

package/dist/with-shape/blobs/legacy-sweep.d.ts

@@ -26,6 +26,22 @@ export interface UnreferencedLegacyBlobReport {
     readonly chunks: number;
     /** How many of those blobs this run deleted (chunks first, then the index row). */
     readonly reclaimed: number;
+    /**
+     * #28 — the eTags this run actually deleted, so a deferred erasure set can be
+     * reconciled against the reclaim that finished it:
+     *
+     * ```ts
+     * const still = before.blobResidueETags.filter((e) => !report.reclaimedETags.includes(e))
+     * ```
+     *
+     * ⛔ DO NOT PERSIST. An eTag is a content hash — see
+     * `ForgetResult.blobResidueETags` for why a stored receipt of them is a
+     * re-identification oracle. Reconcile in memory, persist the verdict.
+     *
+     * Empty on a `dryRun` (nothing was deleted), even though `blobs`/`chunks`
+     * still count what WOULD be.
+     */
+    readonly reclaimedETags: readonly string[];
 }
 export declare function sweepUnreferencedLegacyBlobs(ctx: {
     adapter: NoydbStore;

package/dist/with-shape/introspection/describe.d.ts

@@ -11,7 +11,7 @@
  * @module
  */
 import type { FieldMeta } from './field-meta.js';
-import { FieldMetaUnknownFieldError, schemaFieldKeys } from './field-meta.js';
+import { schemaFieldKeys } from './field-meta.js';
 export { schemaFieldKeys };
 import type { CollectionMeta } from './meta.js';
 import type { ViaDescriptor, ViaPosture } from '../../kernel/via/index.js';
@@ -275,7 +275,6 @@ export interface BuildDescriptionInput {
      */
     readonly fieldIds?: Record<string, string> | undefined;
 }
-export { FieldMetaUnknownFieldError };
 /**
  * Pure assembler: no I/O, no side effects.
  * Builds a {@link CollectionDescription} from the collection's in-memory config.

package/dist/with-shape/introspection/index.d.ts

@@ -13,6 +13,7 @@ export type { VaultIntrospectState } from './walk.js';
 export { jsonSchemaToFields } from './fields.js';
 export type { SchemaIntrospection } from './types.js';
 export type { FieldMeta, SemanticType } from './field-meta.js';
+export { FieldMetaUnknownFieldError } from './field-meta.js';
 export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
 export type { StandardSchemaV1Issue } from '../../kernel/schema.js';
 export { applyListProjection } from './projection.js';

package/dist/with-shape/introspection/types.d.ts

@@ -174,7 +174,7 @@ export interface InternalCollectionStats {
  * documentation gate switching to the live report passes VACUOUSLY on a hub
  * too old to answer. Measured by a consumer attempting that adoption.
  */
-export type SnapshotReport = 'via' | 'stats';
+type SnapshotReport = 'via' | 'stats';
 export interface VaultSchemaSnapshot {
     readonly _noydb_snapshot: 2;
     /**
@@ -209,3 +209,4 @@ export interface DumpSchemaOptions {
     /** Sample N records per collection lacking a persisted/live schema. Default 50. `0` disables sampling. */
     readonly sampleSize?: number;
 }
+export {};

package/dist/with-shape/schema-update/fence.d.ts

@@ -18,6 +18,13 @@ export interface FenceDoc {
      */
     readonly schemaHash?: string;
 }
+/**
+ * `FENCE_RECORD_ID` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/cover. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export declare const FENCE_RECORD_ID = "schema-fence";
 export declare const DEFAULT_FENCE: FenceDoc;
 export declare function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc>;

package/dist/with-sync/engine.d.ts

@@ -1,4 +1,4 @@
-import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole } from '../kernel/types.js';
+import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole, RealignResult } from '../kernel/types.js';
 import type { MergeAuthority } from '../port/with/merge-authority.js';
 import { type PeriodPullSource } from './period-scope.js';
 import type { NoydbEventEmitter } from '../kernel/events.js';
@@ -89,11 +89,27 @@ export declare class SyncEngine {
     private periodPullSource?;
     /** Wire the period-window source (#807). Same injection pattern as `setReservedLookupSource`. */
     setPeriodPullSource(source: PeriodPullSource): void;
+    /** core#82 — when a pull replaces the caller's OWN keyring file, the vault reloads it in place. */
+    private rosterReload?;
+    /** Wire the roster-reload seam (core#82). Same injection pattern as `setCacheInvalidator`. */
+    setRosterReload(seam: {
+        userId: string;
+        reload: () => Promise<void>;
+    }): void;
+    /** core#81 — the running sync's latest progress sample; `null` when idle. Read by `status()`. */
+    private inFlight;
+    private progressLastEmit;
+    private progressLastRecords;
+    /** Emit `sync:progress` no more than every 25 records or ~250 ms; `force` for the final sample. */
+    private progress;
+    private progressDone;
     /** #807: KPI accumulator `applyRemote` feeds during a period-scoped `pull()` — pointed at the
      *  active phase's counters (summaries → records) and cleared before pull returns. Approximate
      *  by design: a push interleaved mid-pull on the same engine would attribute its converge
      *  applies to the open phase; the counters are a download-budget KPI, not an audit source. */
     private pullByteSink;
+    /** core#81 — ciphertext bytes applied by the running pull, for `sync:progress`. */
+    private pullBytes;
     constructor(opts: {
         local: NoydbStore;
         remote: NoydbStore;
@@ -181,6 +197,19 @@ export declare class SyncEngine {
      */
     private recordOutcome;
     /** Get current sync status. */
+    /**
+     * core#82 — re-align a CORRUPTED local from the target. An ordinary pull
+     * cannot repair a damaged local envelope: it keeps its `_v`, so it wins
+     * (or ties) against the target's healthy copy. Here every local
+     * user-collection envelope is verified with the same `MergeAuthority`
+     * check pull runs on remote envelopes; one that fails is replaced by the
+     * target's copy when THAT verifies, and the dirty log is dropped (a dirty
+     * entry over a damaged record would push the damage). Records at a tier
+     * the caller holds no key for pass unverified, as in pull — this repairs
+     * what the caller can read. Requires a `MergeAuthority` (a vault-attached
+     * engine on an encrypted vault).
+     */
+    realign(): Promise<RealignResult>;
     status(): SyncStatus;
     /** Start auto-sync: listen for online/offline events, optional periodic sync. */
     startAutoSync(intervalMs?: number): void;

package/dist/with-sync/reserved-mirror.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Reserved-record replication between two stores (core#75, core#83, core#82).
+ *
+ * `loadAll()` skips every `_`-prefixed collection, so nothing reserved
+ * travels through a sync target unless it is named here. `_keyring` was the
+ * first (core#75): a target was never a full replica — a device that lost
+ * its local store re-opened by MINTING a new owner keyring whose DEKs open
+ * nothing, and a granted member could not open on their own device at all.
+ * The invite audit doc was the second (core#83): `acceptInvite` refuses
+ * without it, by design, so magic-link onboarding onto a fresh sync-peer
+ * device was closed.
+ *
+ * ## Declared, never blanket
+ *
+ * `_meta` mixes VAULT state (deed, adoption, recovery docs, invite audit
+ * docs) with DEVICE/SESSION state (`schema-fence`, the pod `handle`) that
+ * must never reach another device — a replicated fence would break every
+ * other device's cutover. So replication is a declared set of
+ * `(collection, id prefix)` rules, each with its own ordering, and a
+ * reserved record travels only when a rule names it. The decision per
+ * collection, written down (core#82):
+ *
+ * | collection | rule | why |
+ * |---|---|---|
+ * | `_keyring` | higher `roster_epoch` wins | the roster; replay-anchored by #1097 |
+ * | `_meta/invite-audit-*` | higher `_v` wins | single-use evidence for magic links (core#83) |
+ * | `_users` | higher `_v` wins | the directory's user envelopes; a member app renders these |
+ * | `_delegations` | higher `_v` wins | delegation tokens; revocation is a delete |
+ * | `_history`, `_ledger` | NOT replicated | per-device evidence: the ledger is a hash chain per writer, two devices appending would fork it; `vault.at(T)` runs where history lives |
+ * | `_sync` | NOT replicated | this device's dirty log and watermarks |
+ * | `_meta/schema-fence`, `_meta/handle`, other `_meta` | NOT replicated | session and instance state; the rest of `_meta` is decided one id at a time |
+ *
+ * DEK-free by construction: every rule compares a field the mover can read
+ * without a key — `roster_epoch` (plaintext JSON on purpose, #1097, read
+ * through `team/keyring.ts`'s parser) or the envelope's `_v`.
+ *
+ * ## The one rule, both directions
+ *
+ * **The candidate wins when it supersedes; the absent side receives; equal
+ * is a no-op.** For `_keyring`, a file with no epoch (pre-#1097) never
+ * overwrites one that has an epoch. Why an ordering and not bytes: a device
+ * holding a STALE copy (epoch 3, or `_v` 1) must not push it over the newer
+ * one (epoch 4, `_v` 2) — byte-difference alone would re-introduce exactly
+ * the replay the ordering exists to anchor.
+ *
+ * ## Deletion
+ *
+ * A revocation (keyring, delegation, user envelope) deletes the record on
+ * the acting device and is pushed through the dirty log as
+ * `(collection, id, 'delete')`. On PULL, a record the remote lacks and the
+ * local holds is deleted locally only when (a) the remote carries at least
+ * one record of that collection — a target never pushed to is not evidence
+ * of revocation — and (b) no dirty entry protects it (a grant made offline,
+ * not yet pushed). Invite audit docs are never deleted; revocation is a
+ * field update, which the `_v` rule carries.
+ */
+import type { NoydbStore } from '../kernel/types.js';
+export interface ReservedMirrorResult {
+    /** Records written to `to`. */
+    readonly copied: number;
+    /** Records deleted from `to` (pull-side revocation propagation only). */
+    readonly deleted: number;
+    /** Ids of `_keyring` files copied — the roster reload seam reads this for the caller's own file. */
+    readonly keyringsCopied: readonly string[];
+}
+/** The push half: mirror every declared rule from `local` to `remote`. Never deletes. */
+export declare function pushReserved(local: NoydbStore, remote: NoydbStore, vault: string): Promise<ReservedMirrorResult>;
+/**
+ * The pull half: mirror every declared rule from `remote` into `local`, then
+ * propagate revocations under the two guards in the module doc.
+ * `protectedIds` maps a collection to the ids a pending local dirty entry
+ * protects.
+ *
+ * Costs one `list()` per rule per pull, and nothing at all for a vault with
+ * no local keyring: an encrypted vault always holds the caller's own file
+ * after open (bootstrapped or minted), so "no local keyring" means
+ * `encrypt: false` — nothing reserved to mirror, nothing to ask.
+ */
+export declare function pullReserved(remote: NoydbStore, local: NoydbStore, vault: string, protectedIds: ReadonlyMap<string, ReadonlySet<string>>): Promise<ReservedMirrorResult>;
+/**
+ * Open-path bootstrap: an EMPTY local store is not evidence of a new vault
+ * when a `sync-peer` already carries the roster. Mirror its keyring files in
+ * first; `assertKeyringOpenAllowed` then decides — own file → open, other
+ * principals only → refuse, still nothing → genuinely new. Backups are
+ * never consulted (never pulled from, #616). No-op when the local already
+ * holds any keyring. Only the roster: the rest of the declared set arrives
+ * on the first `pull()`.
+ */
+export declare function bootstrapKeyrings(local: NoydbStore, peer: NoydbStore | undefined, vault: string): Promise<void>;

package/dist/with-sync/strategy.d.ts

@@ -56,6 +56,13 @@ export interface BuildSyncEngineOptions {
  */
 export interface SyncStrategy {
     buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine;
+    /**
+     * core#75 — open-path roster bootstrap: an EMPTY local store is not a new
+     * vault when a `sync-peer` already carries the roster. Runs inside keyring
+     * resolution, BEFORE any engine exists; the un-opted-in stub is a no-op
+     * (no sync ⇒ no target to bootstrap from).
+     */
+    bootstrapKeyrings(local: NoydbStore, peer: NoydbStore | undefined, vault: string): Promise<void>;
     buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction;
     buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P>;
 }

package/dist/with-sync/tab-write-relay.d.ts

@@ -7,16 +7,6 @@
  */
 import type { TabChannel, Unsubscribe } from './tab-coordination.js';
 import type { WriteEvent } from '../port/with/write-hooks.js';
-export interface TabWriteMsg {
-    readonly kind: 'tab-write';
-    readonly writerId: string;
-    readonly vault: string;
-    readonly collection: string;
-    readonly docId: string;
-    readonly action: 'put' | 'delete';
-    readonly baseV: number;
-    readonly v: number;
-}
 export interface CrossTabWriteRelayOptions {
     /** The broadcast channel (its own — distinct from the presence channel). */
     readonly channel: TabChannel;

package/dist/withdraw-accessible-ZKPLZ66E.js

@@ -0,0 +1,25 @@
+import {
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-SNM7LSYG.js";
+import "./chunk-55P6OBB7.js";
+import "./chunk-RDOEOPOI.js";
+import "./chunk-YQFBH5ZJ.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4J3MNVVX.js";
+import "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
+export {
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-ZKPLZ66E.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.8.0",
+  "version": "0.9.0-pre.0",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "Apache-2.0",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -276,8 +276,8 @@
     "happy-dom": "^18.0.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/attestation": "0.8.0",
-    "@noy-db/shamir": "0.8.0"
+    "@noy-db/attestation": "0.9.0-pre.0",
+    "@noy-db/shamir": "0.9.0-pre.0"
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0",

package/dist/api-OS747DS4.js

@@ -1,18 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-AEQGFRU4.js";
-import "./chunk-LIOVX5TJ.js";
-import "./chunk-EZGV6F47.js";
-import "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-OS747DS4.js.map