@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/indexing/index.js

@@ -8,15 +8,15 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-V7ADQF5O.js";
+} from "../chunk-4CUJLEOA.js";
 import {
   CollectionIndexes
-} from "../chunk-2AFX33YA.js";
+} from "../chunk-Z3STG43F.js";
 import "../chunk-SUZKW6UR.js";
-import "../chunk-LGNDFRYC.js";
-import "../chunk-5WWDGFOS.js";
-import "../chunk-SYNY3VB5.js";
-import "../chunk-37EPTBBR.js";
+import "../chunk-4CFHL5RY.js";
+import "../chunk-GIQJGXV7.js";
+import "../chunk-NCTN2FW4.js";
+import "../chunk-IKPQ2GGB.js";
 
 // src/with-lookup/indexing/active.ts
 function withIndexing() {

package/dist/introspection/index.js

@@ -1,26 +1,30 @@
-import "../chunk-UBSFPGVJ.js";
+import "../chunk-2DX4JCRI.js";
 import {
   dumpVaultSchema
-} from "../chunk-PP3K67AJ.js";
+} from "../chunk-654RE5YC.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-RXLYKVTF.js";
+import {
+  FieldMetaUnknownFieldError
+} from "../chunk-QJNAHPVT.js";
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-747G6CT3.js";
+import "../chunk-UORWAG7K.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+import "../chunk-IF2M43G4.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
-import "../chunk-37EPTBBR.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
+import "../chunk-XX4R7TUB.js";
+import "../chunk-IKPQ2GGB.js";
 export {
+  FieldMetaUnknownFieldError,
   applyListProjection,
   dumpVaultSchema,
   jsonSchemaToFields

package/dist/issue-4ZPSY44M.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-OYEBSWLE.js";
+import "./chunk-B6EWMGFX.js";
+import "./chunk-ZUTUNVFD.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-ZD7WFMV2.js";
+import "./chunk-RRTQAQ3N.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-ZF6JECDT.js";
+import "./chunk-THQ3BHLM.js";
+import "./chunk-XX4R7TUB.js";
+import "./chunk-IKPQ2GGB.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-4ZPSY44M.js.map

package/dist/kernel/cache/index.d.ts

@@ -6,5 +6,5 @@
  * entry point.
  */
 export { Lru } from './lru.js';
-export type { LruEntry, LruOptions, LruStats } from './lru.js';
+export type { LruOptions, LruStats } from './lru.js';
 export { parseBytes, estimateRecordBytes } from './policy.js';

package/dist/kernel/collection.d.ts

@@ -666,6 +666,38 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * never half-writes the receiver.
      */
     validateInput(record: T): Promise<T>;
+    /**
+     * core#74 — ADMISSION of a record arriving by sync. Runs the same
+     * `beforePut` gate bus (guards, periods) and `db.onBeforeWrite` hooks a
+     * local `put` runs, on the DECRYPTED incoming record against this device's
+     * current state, with `origin: 'sync-apply'`. A throw is a refusal; the
+     * engine parks the envelope and leaves the local copy untouched.
+     *
+     * Not gated, deliberately: tombstones and delete markers (erasure wins, as
+     * on every other path), elevated envelopes (#707 — invisible to gate
+     * handlers), and a record this session holds no key for (it cannot judge;
+     * the merge authority's stated residue, #1042). Schema validation does not
+     * run — the writer validated. Zero cost when nothing is registered.
+     * @internal
+     */
+    /**
+     * @internal core#74 — judge a record against THIS device's gates and hooks.
+     *
+     * ⚠️ core#108: under `'push-recheck'` the record is already in the local
+     * store, so `resolveGatePrior` returns the record itself and `existing`
+     * equals `incoming` — the state it was written over is gone and cannot be
+     * reconstructed. That makes the re-check sound for rules that read AMBIENT
+     * state (a closed period, a revoked clearance) and degenerate for rules
+     * that compare against a prior, which see a no-op diff and pass. Widening
+     * it would need the pre-write snapshot kept in the dirty log, which is a
+     * different feature; do not "fix" it by synthesising a prior here.
+     */
+    _admitRemote(id: string, envelope: EncryptedEnvelope, origin?: 'sync-apply' | 'push-recheck'): Promise<{
+        admitted: true;
+    } | {
+        admitted: false;
+        reason: string;
+    }>;
     /**
      * Resolve the prior record as REAL VALUES for the eager write/delete paths
      * (history snapshot, ledger patch, index upkeep). The eager cache holds
@@ -739,7 +771,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * @internal `wave` (#638 Task 4): when present (the sync/cutover/restore dispatch wave),
      * an eager MV already refreshed this wave is skipped (per-target dedup, keyed on spec name).
      */
-    dispatchMaterializedViews(id: string, record: T, wave?: WaveContext): Promise<void>;
+    _dispatchMaterializedViews(id: string, record: T, wave?: WaveContext): Promise<void>;
     /**
      * Fire registered derivation strategies for this source collection.
      * Eager mode runs `derive` inline and writes each output via the
@@ -784,7 +816,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * and from `forgetDerivedFanout` (#638 Task 6), which needs the per-target outcome to fill
      * `ForgetResult.derivedAggregatesRecomputed`/`derivedResidueFrozen`). `wave` (#640): per-target dedup for the sync-apply path; `undefined` on local-delete (byte-identical).
      */
-    dispatchRollupsOnDelete(id: string, deleted: T, wave?: WaveContext): Promise<ReadonlyArray<{
+    _dispatchRollupsOnDelete(id: string, deleted: T, wave?: WaveContext): Promise<ReadonlyArray<{
         readonly into: string;
         readonly parentId: string;
         readonly outcome: RollupOutcome;
@@ -793,12 +825,13 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     _recomputeDeletedRollups(intents: readonly RollupDeleteIntent[], wave: WaveContext): Promise<void>;
     /** @internal `wave` (#638 Task 4) — threaded to `recomputeRollup` for the sync/cutover/restore
      *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
-    dispatchDerivations(id: string, record: T, version: number, wave?: WaveContext, prior?: Record<string, unknown> | null): Promise<void>;
+    _dispatchDerivations(id: string, record: T, version: number, wave?: WaveContext, prior?: Record<string, unknown> | null): Promise<void>;
     /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
-    dispatchTriggerDerivationsOnDelete(id: string, deleted: T): Promise<void>;
+    _dispatchTriggerDerivationsOnDelete(id: string, deleted: T): Promise<void>;
     /**
      * Delete a record by ID. Runs inside the hub's write-queue tracker
      * so `hub.writeQueue.pending` reflects this write.
+     * ⚠️ Blobs are released (#1451) but a legacy collection defers the erase — a `null` blob read is NOT proof the bytes are gone; see {@link BlobSet.releaseAll} (noy-db/core#28).
      */
     delete(id: string): Promise<void>;
     /**
@@ -935,7 +968,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * erasure too — forget()'s fanout, GDPR residue. A delete-of-absent contributes 0 either way.
      * @internal
      */
-    dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
+    _dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
     /**
      * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
      * skip (record's gone); the `internal` gate at `_doDelete` is the recursion guard. Returns the
@@ -945,7 +978,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * manual serves empty until `refreshView()`. `residueUndecodable`/`residueDeclined` (#776/#785) carry `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest` could not decode, resp. decoded+stamp-matched but declined erasure — surfaced, not erased.
      * @internal
      */
-    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+    _dispatchMaterializedViewsOnDelete(id: string): Promise<{
         deleted: number;
         residueUndecodable: string[];
         residueDeclined: string[];
@@ -961,6 +994,35 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      *                each record is locale-resolved before being returned.
      */
     list(locale?: LocaleReadOptions): Promise<T[]>;
+    /**
+     * @internal core#122 — forget everything read from the store, so the next
+     * read re-hydrates.
+     *
+     * ⭐ Why this is needed even though the vault drops its collection cache on
+     * restore: `vault.collection(name)` hands back the instance FROM that cache,
+     * so a handle the caller is already holding IS one of the objects in it.
+     * Dropping the map makes the NEXT `vault.collection()` build a fresh
+     * instance and leaves the caller's handle answering from its own pre-restore
+     * cache — correct for the next caller, invisible to the current one, and the
+     * natural shape of restore code holds the handle across the load.
+     *
+     * ⛔ Not a general "refresh": it deliberately does NOT re-read here. The
+     * next read pays for it, so a restore that touches fifty collections does
+     * not hydrate fifty times for a caller who will look at one.
+     */
+    _invalidateAfterRestore(): void;
+    /**
+     * core#103 — `list()` with the hub-assigned id alongside each record.
+     *
+     * ⭐ The id is not derivable from a record, so a caller keyed on it
+     * previously had to `get()` per row after `list()`. Tuple order mirrors
+     * `putMany`: `[id, record]` reads the same going in and coming out.
+     *
+     * Same eager-mode requirement and the same locale/Via pipeline as `list()`
+     * — deliberately, so the two cannot drift into answering differently about
+     * the same collection. `list()` is unchanged.
+     */
+    listEntries(locale?: LocaleReadOptions): Promise<Array<readonly [id: string, record: T]>>;
     /**
      * Scan-mode full-text search over a plain-text `field`. Decrypts the
      * collection in memory and ranks records by BM25 against the tokenized query.
@@ -1199,6 +1261,24 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         items: T[];
         nextCursor: string | null;
     }>;
+    /**
+     * core#103 — `listPage()` with the hub-assigned id alongside each record.
+     *
+     * ⭐ The id is not derivable from the record. An app that stores its own key
+     * in a field is fine; one that relies on the id hub assigned had no bulk
+     * read that returned it and had to `get()` per row to find out — which is
+     * the shape pilot-1 hit writing a rule keyed on the record id.
+     *
+     * Tuple order mirrors `putMany`, so `[id, record]` reads the same way going
+     * in and coming out. `listPage()` is unchanged and delegates here.
+     */
+    listPageEntries(opts?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: Array<readonly [id: string, record: T]>;
+        nextCursor: string | null;
+    }>;
     /**
      * Stream every record in the collection page-by-page as an async
      * iterable, with chainable `.where()` / `.filter()` clauses and a

package/dist/kernel/constants.d.ts

@@ -52,3 +52,10 @@ export declare const ROSTER_KEY_ID = "_roster";
  * of rewriting every chunk and index row on every revocation.
  */
 export declare const BLOB_ADDRESS_KEY_ID = "_blob_addr";
+/**
+ * core#96 — the DEK-map slot holding a member's INBOX KEY: the AES key that
+ * seals the private half of their inbox key pair (`KeyringFile.inbox_key`).
+ * A reserved key, not a collection — never propagated to a grantee (it is
+ * per member), never rotated, stripped by `revoke` the way `_roster` is.
+ */
+export declare const INBOX_KEY_ID = "_inbox_key";

package/dist/kernel/errors.d.ts

@@ -92,6 +92,7 @@
  * @module
  */
 import type { GateName, GatePolicy } from './types.js';
+import type { CapsuleGroup } from '../capsule/contract.js';
 /**
  * Base class for all NOYDB errors.
  *
@@ -621,6 +622,15 @@ export declare class DuplicateStoreKindError extends NoydbError {
     readonly kind: string;
     constructor(kind: string);
 }
+/**
+ * core#96 — `updateUser` needs to deliver a DEK to a member whose keyring has
+ * no inbox key pair (written before inboxes existed), or the caller is not
+ * cleared to amend. The member can still be re-granted with a fresh secret.
+ */
+export declare class MemberInboxMissingError extends NoydbError {
+    readonly userId: string;
+    constructor(userId: string, message?: string);
+}
 export declare class PrivilegeEscalationError extends NoydbError {
     readonly offendingCollection: string;
     constructor(offendingCollection: string, message?: string);
@@ -890,7 +900,19 @@ export declare class TierDemoteDeniedError extends NoydbError {
  */
 export declare class DelegationTargetMissingError extends NoydbError {
     readonly toUser: string;
-    constructor(toUser: string);
+    /**
+     * ⚠️ `reason` exists because two call sites were passing a SENTENCE as
+     * `toUser` (core#56), rendering as:
+     *
+     *     Delegation target user "grantor cannot find tier 1 DEK for (any)"
+     *     has no keyring in this vault
+     *
+     * — which names a target user that is not a user, and states a cause that is
+     * not the cause. A grantor-side failure is not a missing target; the class is
+     * kept for both only because it is PUBLISHED and consumers catch it. Pass the
+     * real `toUser` and put the explanation in `reason`.
+     */
+    constructor(toUser: string, reason?: string);
 }
 /**
  * Thrown when a `put()` detects an optimistic concurrency conflict.
@@ -2411,9 +2433,25 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
  * stable, catchable code instead of an ad hoc throw.
  */
 export declare class EnclaveNotSupportedError extends NoydbError {
-    /** The optional group that is not supported by this enclave. */
-    readonly group: 'sealing' | 'deterministic' | 'per-record-keys';
-    constructor(group: 'sealing' | 'deterministic' | 'per-record-keys', detail?: string);
+    /**
+     * The group that is not supported by this enclave.
+     *
+     * ⭐ WIDENED to the full {@link CapsuleGroup} 2026-09-16 (core#42). It used
+     * to be `'sealing' | 'deterministic' | 'per-record-keys'` — three of ten,
+     * and not a subset: it could not name `classify`, which `capsule/contract.ts`
+     * explicitly documents a capsule refusing, nor the six core groups.
+     *
+     * ⚠️ The narrowness was invisible because **hub never constructs this error**
+     * — it exists for a fork to throw (see the note above), so the union is a
+     * contract for THIRD-PARTY capsule authors, and hub's own test only ever
+     * built it with `'sealing'`. Found only when the conformance kit's tests
+     * were finally typechecked against hub's source.
+     *
+     * ⛔ This is a widened published READ: a consumer switching exhaustively on
+     * `err.group` gains cases. Release-noted by name for that reason.
+     */
+    readonly group: CapsuleGroup;
+    constructor(group: CapsuleGroup, detail?: string);
 }
 /**
  * Raised when a collection's `classifiedFields` configuration is invalid

package/dist/kernel/export-scope.d.ts

@@ -0,0 +1,40 @@
+/**
+ * How `Vault.exportStream()` decides WHAT to read (core#45b).
+ *
+ * Extracted from `vault.ts` rather than inlined there: the kernel-surface
+ * ratchet had that file at its exact ceiling, and this is the kind of thing
+ * the ceiling exists to push out — a self-contained decision with its own
+ * reasoning, reachable from one call site.
+ *
+ * ## The property this file owns
+ *
+ * A scoped export must not FETCH or DECRYPT the collections it excludes.
+ * Until 0.8 the scope was a filter applied to chunks after `exportStream` had
+ * already decrypted the whole vault, so a caller narrowing an export to limit
+ * what a compromised process could observe got no such limit. Choosing the
+ * enumeration strategy — bulk snapshot vs per-collection `list` — is what
+ * makes the difference real, and it is invisible to every chunk-level
+ * assertion (`__tests__/45-export-scope-narrows-read.test.ts` observes the
+ * store instead, which is the only layer that can tell them apart).
+ *
+ * @module
+ */
+import type { NoydbStore, ExportStreamOptions } from './types.js';
+/** Where an export's collection names and record ids come from. */
+export interface ExportSource {
+    /** Collection names to export, sorted. */
+    readonly collections: readonly string[];
+    /** True when the caller supplied a scope. */
+    readonly scoped: boolean;
+    /** Record ids in one collection. */
+    ids(collection: string): Promise<readonly string[]>;
+}
+/**
+ * Resolve the read strategy for one export.
+ *
+ * ⛔ THE UNDERSCORE FILTER IS APPLIED ON BOTH PATHS. `loadAll` drops
+ * underscore-prefixed internal collections for free; `list` does not, so a
+ * caller naming `_keyring` would export the keyring. A rule that holds only on
+ * the route that happens to be taken is a rule waiting to be lost.
+ */
+export declare function resolveExportSource(adapter: NoydbStore, vault: string, opts: ExportStreamOptions): Promise<ExportSource>;

package/dist/kernel/merge-authority.d.ts

@@ -15,11 +15,15 @@ import type { EnclaveKey } from '../capsule/index.js';
  */
 export declare function buildMergeAuthority(
 /**
+ * A GETTER for the DEK map (core#100): the vault reloads its keyring in
+ * place after a pull that replaced its file (core#82) — a delivered DEK, a
+ * rotation — and an authority that captured the object at wiring kept
+ * verifying with the map that no longer opened the records.
  * Just the DEK map, not the whole keyring. `port-layering` refused a type
  * import of `UnlockedKeyring` from `with-party` — correctly, and the narrower
  * shape is better anyway: this needs to look up keys, not to know what a
  * keyring is.
  */
-keyring: {
+keyring: () => {
     readonly deks: ReadonlyMap<string, EnclaveKey>;
 }): MergeAuthority;

package/dist/kernel/noydb.d.ts

@@ -1,5 +1,5 @@
-import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
-import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
+import type { RotateResult, RevokeResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
+import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, RealignResult, PushOptions, PullOptions, SyncStatus, SyncTarget, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy, SyncRejectedApi, ReplaceRemoteResult } from './types.js';
 import type { SecretPolicy } from './validation.js';
 import { type NoydbMesh } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
@@ -51,6 +51,8 @@ export declare class Noydb {
     private readonly vaultOpening;
     private readonly keyringCache;
     private readonly syncEngines;
+    /** core#90 — conflict resolvers registered per vault, replayed onto a target attached after open. */
+    private readonly conflictResolvers;
     /**
      * Per-vault active session tier — defaults to `1` after a secret
      * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
@@ -90,10 +92,10 @@ export declare class Noydb {
     /**
      * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
      * `withCustody()` was passed. Kept as a public accessor because `Vault`
-     * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+     * routes `vault.custody.liberate` through `this.noydb._custodyStrategy`.
      * @internal
      */
-    get custodyStrategy(): CustodyStrategy;
+    get _custodyStrategy(): CustodyStrategy;
     private readonly snapshots;
     private readonly policyManager;
     /** Pre-resolved policy-gate engine function (mirrors `meshPort`/`userApiFactory` above). */
@@ -176,6 +178,13 @@ export declare class Noydb {
     /**
      * Grant access to a user for a vault.
      *
+     * ⚠️ On an EXISTING user this RE-KEYS them: a new KEK from `secret`,
+     * authenticator slots dropped, the file overwritten. So it needs the
+     * member's CURRENT secret — after `acceptInvite` or `rotateSecret` an
+     * owner never holds it, and a re-grant with a stale one locks the member
+     * out. To change what an existing member may do, use `updateUser`
+     * (core#96); re-grant only to re-key, with a fresh temporary secret.
+     *
      * Gated by `enroll-user`. `STRICT_POLICY` requires a TOTP / email-OTP
      * factor proof so the operator affirmatively re-asserts identity at
      * the moment of grant; `PERSONAL_POLICY` accepts a tier-1 unlock alone.
@@ -220,23 +229,37 @@ export declare class Noydb {
     revokeCustodian(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** @internal — revoke-custodian engine, reached only via withCustody().
      * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
-    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
-    /**
-     * Mutate post-grant identity fields on an existing keyring — `role`,
-     * `displayName`, and/or `permissions`. Pure plaintext-header rewrite:
-     * no DEK rewrap, no KEK required, no authenticator slots touched.
-     * Tier-2 enrollments and recovery codes survive.
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Change what an EXISTING member may do — `role`, `displayName`, and/or
+     * `permissions` — without holding their secret. The member's KEK, salt
+     * and authenticator slots are untouched; tier-2 enrollments and recovery
+     * codes survive.
+     *
+     * core#96 — the keys follow the header. A change that widens access
+     * delivers the DEKs the member lacks through their keyring INBOX
+     * (sealed to a per-member key pair only their KEK opens; drained at
+     * their next tier-1 unlock, or at the next pull of an open session). A
+     * change that narrows access drops the DEKs and rotates those
+     * collections, as a narrowing `grant` does (#1097). A role change
+     * re-registers the member with a configured broker host under a fresh
+     * `_broker_member` key. This is the widening path: `db.grant` on an
+     * existing user RE-KEYS them from `secret`, so it needs their CURRENT
+     * secret — after `acceptInvite` or `rotateSecret` an owner never holds it.
      *
      * Different from `db.revoke + db.grant`:
      *
-     *   - Same `userId`, same DEK wrappings, same `granted_by`, same
-     *     `_users/<keyringId>` envelope. Only the specified header
-     *     fields move. Last-write-wins via the standard keyring put.
+     *   - Same `userId`, same KEK, same `granted_by`, same
+     *     `_users/<keyringId>` envelope. Last-write-wins via the standard
+     *     keyring put.
      *   - No cascade on role demotion (admins demoted to operator keep
      *     the keyrings they previously granted; the cascade rules are
      *     a `db.revoke` concern, not `db.updateUser`).
      *   - Tier-2 slots NOT dropped — the wrapping is unaffected.
      *
+     * @throws `MemberInboxMissingError` when a DEK must be delivered to a
+     *   member whose keyring predates inboxes — re-grant them once.
+     *
      * Role-elevation guard: BOTH the old and new role must satisfy
      * `db.grant`'s hierarchy. Owner can do anything; admin manages
      * admin/operator/viewer/client laterally; admin cannot promote to
@@ -257,6 +280,46 @@ export declare class Noydb {
      * }, { factors: [{ kind: 'totp' }] })
      * ```
      *
+     * ## ⚠️ A NARROWING DOES NOT REACH A SESSION THAT IS ALREADY OPEN
+     *
+     * This writes the target's keyring. It cannot reach into a `Noydb` the
+     * target already has open: an eager collection holds the records it
+     * hydrated, and nothing polls the keyring, so that session keeps serving
+     * rows it read while it still had the key. A FRESH open throws
+     * `NoAccessError` correctly (core#101), and so does that session for any
+     * collection it had not already hydrated.
+     *
+     * ⭐ A long-lived admin console — one holding a vault open while changing
+     * somebody's permissions — must RE-OPEN the affected session rather than
+     * expect its next read to start failing.
+     *
+     * ## What the window is, MEASURED — it is narrower than it sounds
+     *
+     * The consumer building that console asked the two questions a security
+     * reviewer asks, and reasoning would have got both wrong in the cautious
+     * direction. Measured on a synced vault, after `updateUser` narrowed the
+     * member away and `rotate()` re-keyed:
+     *
+     * 1. **Records arriving AFTER the narrowing are not readable.** A `pull()`
+     *    into the open session brings the new roster, the session reloads its
+     *    keyring, and reads then throw `NoAccessError` — including for rows it
+     *    had already cached. ⭐ So with sync on, the window CLOSES at the next
+     *    pull; it is not open until re-open.
+     * 2. **Writes are refused locally.** `put()` throws `ReadOnlyError` on the
+     *    narrowed collection — the record is never encrypted, never queued, and
+     *    `push()` carries nothing. Nothing reaches the remote to be judged, so
+     *    this does not even rest on the admission gate (core#74).
+     *
+     * ⛔ So it is not a confidentiality hole and not a write hole: no access is
+     * gained, nothing new becomes readable, and nothing can be written. What
+     * survives is a read of rows the session ALREADY HELD, on a device with no
+     * sync or one that has not pulled since.
+     *
+     * ⚠️ Which is still the window that matters when a narrowing is
+     * security-motivated rather than administrative — a departing member, a
+     * suspected device. `rotate()` is the answer there and a console should
+     * REQUIRE it for that case rather than offer it.
+     *
      * @throws `NoAccessError` when no keyring exists for the target.
      * @throws `PermissionDeniedError` when the role hierarchy rejects.
      * @throws `ValidationError` when no field is provided.
@@ -291,6 +354,14 @@ export declare class Noydb {
      * reaching into internals. See `noy-db rotate` for the CLI wrapper.
      * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
+    /**
+     * core#74 — the records this device's admission gate refused on pull
+     * (`PullResult.rejected`, `sync:rejected`), parked under `_sync_rejected`
+     * with the envelope intact. `list()` them; `readmit()` applies one after all
+     * (bypassing the gate); `discard()` drops the parking record. Per device:
+     * a refusal is local to the device that judged it.
+     */
+    rejected(vault: string): SyncRejectedApi;
     rotate(vault: string, collections: string[]): Promise<RotateResult>;
     /**
      * Verify every `_keyring` file in the vault. Read-only (#1121).
@@ -423,9 +494,13 @@ export declare class Noydb {
      */
     queryAcross<T>(vaultIds: string[], fn: (vault: Vault) => Promise<T>, options?: QueryAcrossOptions): Promise<QueryAcrossResult<T>[]>;
     /**
-     * @internal True once `close()` has been called. Read by outward
-     * orchestration frameworks whose entry points can't see the private
-     * `closed` field.
+     * True once `close()` has been called.
+     *
+     * ⭐ NOT `@internal`, and core#128 removed that tag rather than `_`-prefixing
+     * this: the doc's own reason — "read by outward orchestration frameworks
+     * whose entry points can't see the private `closed` field" — IS a public
+     * contract. Prefixing it would have broken the readers it exists for. The
+     * tag was the defect, not the name.
      */
     get isClosed(): boolean;
     /**
@@ -458,6 +533,20 @@ export declare class Noydb {
      * push-only sink and is never pulled from (#616) — returns an empty result.
      */
     pull(vault: string, options?: PullOptions): Promise<PullResult>;
+    /** core#82 — replace every local envelope that fails to authenticate with the primary target's healthy copy; see `SyncEngine.realign`. */
+    realign(vault: string): Promise<RealignResult>;
+    /**
+     * core#72 — make THIS device's vault authoritative on its primary target:
+     * every local record is written unconditionally (re-versioned above the
+     * target's copy where the target moved on), every id the target holds that
+     * the local vault does not gets a delete marker, the reserved collections
+     * are mirrored, and a new restore EPOCH is written on the target. Every
+     * other device's next pull crosses that epoch: its unpushed edits are parked
+     * (`db.rejected(vault)`, reason `restore-epoch`), its dirty log dropped, the
+     * target adopted wholesale. The act of a restore (`vault.load` then this), or
+     * of declaring one replica the truth. Owner/admin, ledgered by the pushes.
+     */
+    replaceRemote(vault: string): Promise<ReplaceRemoteResult>;
     /**
      * Bidirectional sync: pull then push for all targets.
      * `sync-peer` targets do pull+push; `backup`/`archive` targets do push-only.
@@ -523,7 +612,7 @@ export declare class Noydb {
     get store(): NoydbStore;
     /**
      * Currently-running multi-record transaction, or `null` outside
-     * Phase 2. `Collection.dispatchDerivations` consults this so a
+     * Phase 2. `Collection._dispatchDerivations` consults this so a
      * recursive derived-output write inside `Collection.put` can register
      * its envelope onto `ctx._executed` and roll back with the main
      * staged ops on mid-batch failure.
@@ -580,6 +669,8 @@ export declare class Noydb {
      */
     listSyncTargets(vault: string): SyncTargetInfo[];
     private getSyncEngine;
+    /** core#90 — attach a sync target to an OPEN vault (primary when it had none, else keyed by position); records written before it are sent by `push({ full: true })`. Rationale in `kernel/sync-wiring.ts`. */
+    attachSyncTarget(vault: string, target: NoydbStore | SyncTarget): Promise<void>;
     _forEachSyncEngine(vault: string, fn: (engine: SyncEngine) => void): void;
     on<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
     off<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
@@ -639,9 +730,15 @@ export declare class Noydb {
     /** @internal Session that owns this instance's writers. */
     get _sessionId(): string;
     /**
-     * @internal Drain-barrier coordination transport for the schema fence.
-     * The default store-backed provider reproduces today's fence behavior; a
-     * `by-*` real-time transport is injected via `mesh`.
+     * Drain-barrier coordination transport for the schema fence. The default
+     * store-backed provider reproduces today's fence behavior; a `by-*`
+     * real-time transport is injected via the `mesh` option.
+     *
+     * ⭐ NOT `@internal`, and core#128 removed that tag rather than
+     * `_`-prefixing this. `db.mesh` is documented as a public handle in
+     * `port/by/index.ts` — "a `Noydb` handle (`db.mesh`) without ever naming a
+     * `by-*` pack" — and `createNoydb({ mesh })` is a public option. The tag
+     * contradicted both; prefixing would have broken the documented handle.
      */
     get mesh(): NoydbMesh;
     /**
@@ -687,7 +784,7 @@ export declare class Noydb {
      *
      * @internal — not part of the public API surface
      */
-    invokeTranslator(text: string, from: string, to: string, field: string, collection: string): Promise<string>;
+    _invokeTranslator(text: string, from: string, to: string, field: string, collection: string): Promise<string>;
     /**
      * Read the active policy for a vault. Loads from `_meta/policy` on
      * first call; subsequent calls hit the in-memory cache. Throws

package/dist/kernel/put-many-atomic.d.ts

@@ -15,7 +15,7 @@ interface BulkTxContext {
     readonly _executed: BulkExecutedOp[];
 }
 /** @internal The slice of `Collection` both branches drive. */
-export interface PutManyAtomicHost<T> {
+interface PutManyAtomicHost<T> {
     put(id: string, record: T): Promise<void>;
     _preparePut(id: string, record: T): Promise<PreparedPut<T>>;
     _finalizePut(prepared: PreparedPut<T>): Promise<void>;

package/dist/kernel/query/live/live.d.ts

@@ -7,7 +7,8 @@
  * mutates.
  *
  * Framework-agnostic by design — core never depends on a UI
- * framework. The binding that wraps a `LiveQuery` is
+ * framework. The framework bindings live in the `noy-db/in` repo
+ * (extracted 2026-09-21). The one that wraps a `LiveQuery` is
  * `@noy-db/in-vue`'s `useLiveQuery(live)`: it subscribes once,
  * mirrors `value` into a `ShallowRef`, re-reads `error` on every
  * notification, and disposes via `onScopeDispose`.