@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/with-audit/forget/index.d.ts

@@ -24,6 +24,8 @@
  */
 export { withForget } from './active.js';
 export { NO_FORGET } from './strategy.js';
+export { erasureCompleteness } from './completeness.js';
+export type { ErasureCompleteness } from './completeness.js';
 export type { SubjectDeclaration, ForgetStrategy, ForgetResult, ScopedPurgeResidueNotice, } from './strategy.js';
 export type { SubjectRef } from './subject-index.js';
 export { SUBJECT_INDEX_COLLECTION } from './subject-index.js';

package/dist/with-audit/forget/strategy.d.ts

@@ -105,6 +105,71 @@ export interface ForgetResult {
     readonly blobsRetainedShared: number;
     /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */
     readonly blobResidueCollections: readonly string[];
+    /**
+     * #28 — the same residue as {@link blobResidueCollections}, at `collection:id`
+     * grain: which RECORDS held blob content that could not be crypto-shredded.
+     *
+     * ⭐ Prefer this one. `blobResidueCollections` answers "some blobs in
+     * `invoices` did not shred"; a specific erasure request asks "which of THIS
+     * subject's records are affected", and only a record-grained answer can say.
+     *
+     * ⚠️ "Could not be shredded" does NOT mean the bytes are still in the live
+     * store — `forget()` deletes legacy chunks, it just cannot crypto-shred them.
+     * See {@link blobResidueETags} for what the exposure actually is.
+     *
+     * ⚠️ `blobResidueCollections` is kept, unchanged, because it is published —
+     * widening it in place would silently change what every existing reader sees,
+     * with no type error (`string[]` either way). Both are populated from the
+     * same sites; this is the finer of the two.
+     *
+     * Reported by pilot-1, who noticed that this result type carries residue at
+     * `collection:id` (`unmigratedRecords`) and `collection:id:field`
+     * (`indexResidue`, `sealedResidue`) elsewhere, so the coarse one read as a
+     * defect rather than a design choice. It was: the record id was in scope on
+     * the line that recorded only the collection.
+     */
+    readonly blobResidueRecords: readonly string[];
+    /**
+     * #28 — the eTags of blob content this erasure could not CRYPTO-SHRED.
+     *
+     * ⛔ READ THE MEANING CAREFULLY; it is not what the name suggests on first
+     * reading, and the obvious reading is wrong in a way that matters.
+     *
+     * On a LEGACY blob (no per-blob `_cek`) `forget()` still DELETES the chunks
+     * and the index row — it passes `reclaimLegacy: true`. What it cannot do is
+     * make them cryptographically unreadable, because there is no per-blob key to
+     * destroy; the bytes were removed rather than shredded. So:
+     *
+     * - the live store IS clean — do not expect these chunks to still be there;
+     * - but any pre-existing BACKUP, replica or snapshot taken before the erasure
+     *   remains decryptable under the retained collection DEK, and that is the
+     *   exposure this field is telling you about.
+     *
+     * ⚠️ THIS CANNOT BE RECONCILED AGAINST `compact({ reclaimLegacyBlobs })`.
+     * That sweep reclaims refCount-0 legacy index rows that still EXIST; these no
+     * longer do. An intersection of the two sets is empty by construction and
+     * means nothing — measured, not assumed (2026-09-14). The reclaim path
+     * belongs to ordinary `collection.delete()`, which passes
+     * `reclaimLegacy: false` and genuinely defers.
+     *
+     * ⭐ What to DO with a non-empty value: treat the subject's data as erased
+     * from the live vault but potentially present in backups, and handle it under
+     * whatever backup-retention policy you operate. Migrating the collection to
+     * per-record keys before the erasure (`blob(id).migrate()`) is what makes a
+     * future erasure a true crypto-shred.
+     *
+     * ⛔ DO NOT PERSIST THESE. An eTag is a CONTENT HASH, so a stored erasure
+     * receipt listing them lets anyone holding a candidate file confirm the vault
+     * once held it — a residual disclosure created by the very artefact meant to
+     * prove the data is gone. `ledgerEntry` records residue COUNTS, never values,
+     * for exactly this reason.
+     *
+     * ⚠️ Narrower than {@link blobResidueRecords}: this is the eTag half only. A
+     * record whose SLOT ROW was undecodable appears there and not here, because
+     * there is no content identity to name. {@link erasureCompleteness} counts
+     * both.
+     */
+    readonly blobResidueETags: readonly string[];
     /**
      * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted
      * across the shredded records. These live under the retained

package/dist/with-audit/guards/types.d.ts

@@ -26,6 +26,8 @@ export interface GuardContext<T> {
     vault: ReadOnlyVaultFacade;
     userId: string;
     role: Role;
+    /** core#74 — `'sync-apply'` when the record is arriving by sync and this check runs as its admission gate; core#108 — `'push-recheck'` when it is this device's OWN dirty record being re-judged against current local state before it is pushed; absent on a local write. */
+    origin?: 'local-write' | 'sync-apply' | 'push-recheck';
 }
 /**
  * One {before, after} pair handed to an `invariant` function. `before`

package/dist/with-audit/periods/periods.d.ts

@@ -521,15 +521,6 @@ export interface ReadOnlyCollection<T> {
 export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /** sha256(canonicalJson(record)) over the STORED shape of a period record. @internal */
 export declare function hashStoredPeriod(period: PeriodRecord): Promise<string>;
-/**
- * #1454 — every record's `priorPeriodName` / `priorPeriodHash` must resolve to
- * a stored predecessor in ITS timeline whose hash matches. Followed by name,
- * not by sort position: two closes within one millisecond sort arbitrarily,
- * and a deleted predecessor must read as a break, not as a new root.
- *
- * @internal
- */
-export declare function verifyPeriodChain(records: readonly PeriodRecord[]): Promise<void>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor

package/dist/with-audit/periods/reserved-collections.d.ts

@@ -1,3 +1,10 @@
+/**
+ * `PERIODS_RESERVED_COLLECTIONS` — PUBLISHED API, reachable from @noy-db/hub/periods. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export declare const PERIODS_RESERVED_COLLECTIONS: ReadonlySet<string>;
 /** True when `name` belongs to the periods family (#1454). */
 export declare function isPeriodsReservedCollection(name: string): boolean;

package/dist/with-audit/portability/request-withdrawal.d.ts

@@ -22,7 +22,6 @@
 import type { Vault } from '../../kernel/vault.js';
 import { NoydbError } from '../../kernel/errors.js';
 import { type WithdrawResult } from './withdraw-accessible.js';
-export declare const WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
 /** Raised when a request is missing, already decided, or expired. */
 export declare class WithdrawalRequestError extends NoydbError {
     constructor(message: string);

package/dist/with-audit/portability/withdraw-accessible.d.ts

@@ -17,7 +17,6 @@
  * (`request-withdrawal.ts`).
  */
 import type { Vault } from '../../kernel/vault.js';
-export declare const FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
 /** 24-hex-char random id (used for withdrawal ids + request ids). */
 export declare function randomId(): string;
 export interface FrozenSnapshotRef {

package/dist/with-audit/tiers/index.d.ts

@@ -21,7 +21,7 @@
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 export { withTiers } from './active.js';
-export { NO_TIERS, type TiersStrategy } from './strategy.js';
+export { NO_TIERS, type TiersStrategy, type DelegationReadContext } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
 import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../capsule/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
@@ -335,16 +335,16 @@ export declare function assertTierComposition(collectionName: string, cfg: {
  * structurally — no cast needed at the `tiersContext()` call site).
  */
 export interface DerivedOutputsHost<T> {
-    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+    _dispatchMaterializedViewsOnDelete(id: string): Promise<{
         deleted: number;
         residueUndecodable: string[];
         residueDeclined: string[];
     }>;
-    dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
-    dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>;
+    _dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
+    _dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>;
     /** Task 2 (#722) add-direction: the same local-write dispatchers an ordinary `put()` fires. */
-    dispatchMaterializedViews(id: string, record: T): Promise<void>;
-    dispatchDerivations(id: string, record: T, version: number): Promise<void>;
+    _dispatchMaterializedViews(id: string, record: T): Promise<void>;
+    _dispatchDerivations(id: string, record: T, version: number): Promise<void>;
 }
 /**
  * The {@link TiersContext.syncDerived} implementation collection.ts's

package/dist/with-audit/tiers/strategy.d.ts

@@ -9,6 +9,9 @@
  */
 import type { GhostRecord } from '../../kernel/types.js';
 import type { TiersContext, TierMoveResult } from './index.js';
+import type { DelegationToken } from '../../with-party/team/delegation.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
+import type { NoydbStore } from '../../kernel/types.js';
 export type { TierMoveResult };
 export interface TiersStrategy {
     putAtTier<T>(ctx: TiersContext<T>, id: string, record: T, tier: number, opts?: {
@@ -35,6 +38,22 @@ export interface TiersStrategy {
      * A tier the writer cannot read is outside the guarantee.
      */
     checkUnique<T>(ctx: TiersContext<T>, id: string, record: T): Promise<void>;
+    /**
+     * core#56 — the delegation READ half. VAULT-scoped, not collection-scoped,
+     * so it takes its own narrow context rather than a `TiersContext`.
+     *
+     * It lives on this strategy rather than in the kernel because delegation IS a
+     * tier feature (the tokens carry tier DEKs and the gate they satisfy is
+     * `assertTierAccess`), and because a consumer who never opts into tiers has no
+     * delegations to read — so this should tree-shake away for them.
+     */
+    refreshDelegations(ctx: DelegationReadContext, now?: Date): Promise<DelegationToken[]>;
+}
+/** The vault-scoped slice the delegation read half needs (core#56). */
+export interface DelegationReadContext {
+    readonly vault: string;
+    readonly adapter: NoydbStore;
+    readonly keyring: UnlockedKeyring;
 }
 /**
  * No-op stub — the floor default. Every capability method throws

package/dist/with-cargo/extract-partition.d.ts

@@ -50,52 +50,6 @@ export interface ReKeyLedgerResult {
  * `_ledger_deltas`/`_history` are deferred to slice 2.
  */
 export declare function reKeyLedger(vault: Vault, closure: Map<string, Set<string>>, reKeyedCollections: Record<string, Record<string, EncryptedEnvelope>>, ledgerDek: EnclaveKey): Promise<ReKeyLedgerResult>;
-/** Carried blob internals + the fresh transfer `_blob` DEK (present only when
- * the closure references at least one chunk-based blob). */
-export interface ReKeyBlobsResult {
-    /** `_blob_slots_<C>` / `_blob_versions_<C>` / `_blob_index` / `_blob_chunks`
-     * envelopes for the bundle's `_internal` map. */
-    readonly internal: Record<string, Record<string, EncryptedEnvelope>>;
-    /** Fresh transfer `_blob` DEK — seal it so owner-creation wraps it under the
-     * recipient KEK. Undefined when no blob travels (source keyring untouched). */
-    readonly blobDek?: EnclaveKey;
-}
-/**
- * Carry the FK-closed slice's blobs — HARDENED key handling (no master-key leak).
- *
- * The source vault's shared `_blob` DEK decrypts (or unwraps the content CEK of)
- * EVERY blob in the source. Sealing it into the transfer would hand the recipient
- * a key to blobs far outside their slice. Instead we mint a **fresh transfer
- * `_blob` DEK** and arrange every carried blob into per-blob-CEK mode under it:
- *
- *  - **erasable blob** (`_cek` present): unwrap the per-blob content CEK under the
- *    SOURCE `_blob` DEK, re-wrap it under the FRESH transfer DEK. Chunks travel
- *    **verbatim** (still ciphertext under that same content CEK — passthrough).
- *  - **legacy blob** (no `_cek`, chunks under the shared `_blob` DEK): promote it
- *    IN-BUNDLE — mint a fresh content CEK, decrypt each chunk under the source
- *    `_blob` DEK and re-encrypt under the content CEK (same AAD, so the eTag-bound
- *    integrity holds), then wrap the content CEK under the transfer DEK. The
- *    SOURCE is never mutated (non-destructive), and the bundle never holds
- *    plaintext blob bytes (zero-knowledge preserved).
- *
- * **eTag identity is preserved** (not re-HMAC'd). eTags are HMAC-keyed off the
- * `_blob` DEK, but they are stored as OPAQUE keys (`_blob_index/<eTag>`,
- * `_blob_chunks/<eTag>_<i>`) and never recomputed on read — only on a `put()`
- * for dedup. Keeping them verbatim keeps every slot/version/index/chunk key and
- * the chunk AAD coherent with zero chunk-key churn. The only consequence: a
- * future `put()` of identical bytes in the adopted vault computes a different
- * eTag (HMAC under the fresh DEK) and will NOT dedup against the carried blob —
- * an accepted, documented trade for hardened key isolation.
- *
- * Slots/versions are re-keyed under their parent collection's destination DEK
- * (honoring `fieldProjection` — projected-out blob fields' slots never travel);
- * `BlobObject.refCount` is recomputed from carried references only.
- *
- * `external` slots reference an unencrypted shared-bucket object that is not in
- * the bundle — their slot metadata travels (so the catalog entry survives) but
- * the bytes do not (a documented v1 limitation; their eTag is `''`).
- */
-export declare function reKeyBlobs(vault: Vault, closure: Map<string, Set<string>>, destDeks: Map<string, EnclaveKey>, fieldProjection?: Record<string, readonly string[]>): Promise<ReKeyBlobsResult>;
 /** A minted transfer key (raw 32 bytes) + the seal carrying the DEK set. */
 export interface SealResult {
     readonly seal: TransferSealPayload;

package/dist/with-commit/history/history.d.ts

@@ -26,6 +26,22 @@ import { type EnclaveKey } from '../../capsule/index.js';
  * both at once, by construction.
  */
 export declare function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
+/**
+ * core#76 — the inverse of `historyId`. Used by `restoreTo(T)` to discover
+ * collections that exist in history but not in the live store, which is
+ * exactly the case a point-in-time restore has to cover: a collection dropped
+ * since T would otherwise be invisible to a restore meant to bring T back.
+ *
+ * ⚠️ A collection name containing `:` would parse wrong here. That is not
+ * reachable today — `vault.collection()` rejects those names — and this
+ * function is deliberately not hardened against it, because the guard belongs
+ * at the naming boundary, not in every parser downstream of it.
+ */
+export declare function parseHistoryId(id: string): {
+    collection: string;
+    recordId: string;
+    version: number;
+} | null;
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */

package/dist/with-commit/history/restore-to.d.ts

@@ -0,0 +1,40 @@
+/**
+ * core#76 — point-in-time RESTORE, as forward writes.
+ *
+ * `vault.at(T)` reconstructs any record at T and is read-only by contract.
+ * `restoreTo(T)` takes that reconstruction and WRITES it: for every record
+ * whose state at T differs from its state now, put the T-state as a new
+ * version; for every record that exists now and did not exist at T, delete it.
+ *
+ * ## Why forward writes, and not a rewrite of history
+ *
+ * Every write goes through `Collection.put` / `.delete`, so guards, periods,
+ * history and the ledger all see it. The restore is therefore itself an
+ * audited, reversible event — `restoreTo(T)` can be undone by another
+ * `restoreTo`, the ledger's tamper-evidence is untouched, and the result
+ * replicates through ordinary sync because it IS ordinary versioned writes.
+ * ⭐ That is the whole argument for this over a pod: a pod restore is state
+ * REPLACEMENT and needs core#71/#72 to be safe under sync; this needs nothing,
+ * because the stack already knows how to gate, audit and replicate a write.
+ *
+ * ## What bounds it
+ *
+ * ⚠️ Accuracy is bounded by history retention. If `historyConfig.maxVersions`
+ * pruned the versions around T, the reconstruction at T is incomplete and so
+ * is the restore — `at(T)` returns null for a record whose earliest retained
+ * snapshot is after T, and this treats that as "did not exist at T". A vault
+ * that prunes history cannot honestly point-in-time restore past the prune
+ * horizon, and a pod is the answer there (core#77).
+ *
+ * ⛔ BLOBS ARE NOT RESTORED AND ARE NOT REPORTED. `_history` holds record
+ * envelopes, not chunks; a record's blob fields at T reference chunks that may
+ * since have been compacted away. The record comes back with its handles
+ * intact and the chunks may or may not still be there. Detecting that
+ * reliably means resolving every handle against `_blob_chunks`, which is a
+ * blob-subsystem concern this module deliberately does not reach into — a
+ * `blobsUnrecoverable: []` that is empty because nothing looked would be worse
+ * than the silence, because it would read as a guarantee.
+ */
+import type { RestoreToOptions, RestoreToResult } from '../../kernel/types.js';
+import type { RestoreToHost } from '../../port/with/restore-host.js';
+export declare function restoreTo(host: RestoreToHost, timestamp: string, options?: RestoreToOptions): Promise<RestoreToResult>;

package/dist/with-commit/numbering/index.d.ts

@@ -1,8 +1,6 @@
 import type { NoydbStore } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../capsule/index.js';
 import type { DeferredNumberingConfig } from './descriptor.js';
-export declare const NUMBERING_HEAD_COLLECTION = "_numbering_head";
-export declare const NUMBERING_PENDING_COLLECTION = "_numbering_pending";
 export interface Assignment {
     recordId: string;
     serial: number;

package/dist/with-commit/tx/transaction.d.ts

@@ -57,8 +57,8 @@
  * **Crash window.** On the OCC fallback, steps 2–3 are not a
  * storage-layer transaction — if the process dies between two executed
  * ops, the on-disk state is partial. The atomic path above closes that
- * window for the write set itself (`to-memory` and the SQL stores in
- * `noy-db-to` implement `tx()`); a crash between the batch landing and
+ * window for the write set itself (`memoryStore({ full: true })` and the SQL
+ * stores in `noy-db-to` implement `tx()`); a crash between the batch landing and
  * the finalize loop finishing still leaves per-op side effects (history,
  * ledger, cache) incomplete. Stores that cannot commit a batch
  * atomically (file, S3) omit `tx()` and keep the fallback.
@@ -209,27 +209,5 @@ export declare class TxCollection<T> {
  * revert alongside the bulk-put source ops.
  */
 export declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions, txInvariants?: ReadonlyArray<TransactionInvariant>): Promise<T>;
-/**
- * Phase 3 helper — restore captured prior envelopes via the raw store
- * to avoid re-firing Collection-level side effects (we don't want a
- * cascade of change events undoing themselves). The ledger is left
- * as-is: each committed op appended an entry; the revert is
- * deliberately NOT recorded as a compensating entry because the
- * caller-facing contract is "atomic or not at all," not "every write
- * visible in the audit trail." Auditors who need the intermediate
- * state can still reconstruct it by walking the ledger through the
- * failed-tx timestamp.
- *
- * Delegates the reverse/best-effort/raw-revert shape to the shared
- * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache
- * invalidation below rides along as that helper's per-leg `compensate`
- * callback, gated on `db` exactly as before.
- *
- * @internal — shared between `runTransaction` and
- * `Collection.putManyAtomic`. Both register source ops + nested
- * derivation side-effect ops onto `_executed`; this helper unwinds the
- * combined list in reverse on rollback.
- */
-export declare function revertExecuted(executed: ReadonlyArray<ExecutedOp>, store: Noydb['_store'], db?: Noydb): Promise<void>;
 /** @internal — shared (vault, collection, id) key shape; also used by `atomic-eligibility.ts`'s duplicate-key scan. */
 export declare function keyOf(op: StagedOp): string;

package/dist/with-commit/vault-head/strategy.d.ts

@@ -124,4 +124,11 @@ export interface VaultHeadStrategy {
  * would look exactly like a clean sweep.
  */
 export declare const NO_VAULT_HEAD: VaultHeadStrategy;
+/**
+ * `EncryptedEnvelope` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/debug, @noy-db/hub/tiers, @noy-db/hub/to, @noy-db/hub/vault-head. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type { EncryptedEnvelope };

package/dist/with-fork/snapshots/noydb-facade.d.ts

@@ -61,4 +61,11 @@ export declare class NoydbSnapshots {
     /** Stop the cadence scheduler (called from `Noydb.close()`). */
     stop(): void;
 }
+/**
+ * `NO_SNAPSHOTS` — PUBLISHED API, reachable from @noy-db/hub/snapshots. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export { NO_SNAPSHOTS };

package/dist/with-formula/derivations/trigger-match.d.ts

@@ -14,7 +14,7 @@
  * @module
  */
 /** One declared hop through an intermediate collection (#1277). */
-export interface MatchVia {
+interface MatchVia {
     /** The intermediate collection to resolve through. */
     readonly collection: string;
     /** Field on the intermediate whose value equals `written[from]`. */
@@ -27,8 +27,6 @@ export interface MatchPair {
     readonly to: string;
     readonly via?: MatchVia;
 }
-/** True when any pair in this trigger resolves through an intermediate. */
-export declare function hasHop(match: ReadonlyArray<MatchPair>): boolean;
 /** Every intermediate collection named by a trigger's pairs, deduplicated. */
 export declare function hopCollections(match: ReadonlyArray<MatchPair>): string[];
 export interface NormalizedTrigger {
@@ -100,5 +98,10 @@ export declare function sameTuple(a: Array<{
 }> | null): boolean;
 /** Moved to the kernel (#1249) so `collection.ts` can import statically without
  *  dragging derivations code into the floor bundle; re-exported here for
- *  compatibility with existing consumers of this module. */
-export { recordMatchesPairs, findMatchingIdsByPairs } from '../../kernel/match-pairs.js';
+ *  compatibility with existing consumers of this module.
+ *
+ *  ⚠️ `findMatchingIdsByPairs` was re-exported here too and NOTHING took it
+ *  from this module (#55) — consumers import it from the kernel directly.
+ *  Dropped rather than kept as a compatibility shim for a consumer that does
+ *  not exist; the kernel module remains its home. */
+export { recordMatchesPairs } from '../../kernel/match-pairs.js';

package/dist/with-formula/materialized-views/emit-memo.d.ts

@@ -17,8 +17,6 @@ export declare function emitMemoKey(vault: string, mvName: string, outputCollect
 export declare function readEmitMemo(key: string, stamp: number | null): ReadonlyMap<string, string> | null;
 /** Record what this refresh actually left on disk. A `null` stamp records nothing. */
 export declare function writeEmitMemo(key: string, stamp: number | null, rows: Map<string, string>): void;
-/** Forget one MV's output entirely. Used when a refresh could not complete cleanly. */
-export declare function dropEmitMemo(key: string): void;
 /**
  * A canonical string for the row a refresh is about to write, or `null` when no
  * safe one exists.

package/dist/with-lookup/embeddings/index.d.ts

@@ -1,6 +1,5 @@
-export { cosine } from './cosine.js';
 export { embeddingSourceText, type EmbeddingDescriptor } from './descriptor.js';
-export { VectorSet, type StoredVector, type VectorHit } from './vector-set.js';
+export { VectorSet, type StoredVector } from './vector-set.js';
 export { withVectorIndex, DEFAULT_INDEX_MIN_VECTORS, type VectorIndexOptions } from './with-vector-index.js';
 export type { VectorIndex, VectorIndexConfig, VectorIndexSearchOptions } from './vector-index.js';
 export { encodeVecId } from './vec-id.js';

package/dist/with-lookup/indexing/collection-facade.d.ts

@@ -26,7 +26,7 @@ import type { NoydbEventEmitter } from '../../kernel/events.js';
 import { type CollectionIndexes, type IndexDef } from './eager-indexes.js';
 import type { UniqueConstraintSet } from './unique-constraints.js';
 import { type PersistedCollectionIndex } from './persisted-indexes.js';
-import { PersistedFieldIndexes, type FieldIndexCallbacks } from './persisted-field-indexes.js';
+import { PersistedFieldIndexes } from './persisted-field-indexes.js';
 export type { PersistedFieldIndexes } from './persisted-field-indexes.js';
 /** Everything the moving index-maintenance methods touched on `this.*`. */
 export interface IndexingContext<T> {
@@ -68,20 +68,6 @@ export interface IndexingContext<T> {
  * `indexes.upsert()`/`.remove()` directly, so this only fires for full reloads.
  */
 export declare function rebuildEagerIndexesFromCache<T>(ctx: IndexingContext<T>, skip?: ReadonlySet<string>): void;
-/**
- * Bridge the crypto-free {@link PersistedFieldIndexes} to this collection's
- * codec + adapter — the exact division `buildPersistedIndexCallbacks` uses for
- * the search index: crypto lives here, the store does not know it exists.
- *
- * One record per `(collection, index)`, at `_fieldidx / <collection>/<key>`.
- * The freshness stamp rides INSIDE the encrypted body (`{fp, idx}`) rather
- * than on the envelope, so the `EncryptedEnvelope` shape is never extended and
- * the stamp is not readable at rest.
- *
- * Takes a context THUNK for the same reason the search bridge does: it is
- * built from the `Collection` constructor, before `this.codec` is assigned.
- */
-export declare function buildFieldIndexCallbacks<T>(provideCtx: () => IndexingContext<T>, debounceMs?: number): FieldIndexCallbacks;
 /**
  * Build this collection's sidecar coordinator, or `null` when no index asked
  * to be persisted — so every other collection pays nothing. Kept here rather

package/dist/with-lookup/indexing/eager-indexes.d.ts

@@ -81,7 +81,7 @@ export type IndexDef = string | {
  * `orderBy(field).limit(n)`. A `'sorted'` declaration keeps the hash
  * index too — `==`/`in` stay O(1).
  */
-export type IndexKind = 'hash' | 'sorted';
+type IndexKind = 'hash' | 'sorted';
 /**
  * Normalize a declared `IndexDef[]` into a uniform `{ fields, unique? }`
  * shape: `string` → `{fields:[s]}`, `string[]` → `{fields}`, object →
@@ -299,3 +299,4 @@ export declare class CollectionIndexes {
      */
     bucketRepresentatives(field: string): readonly string[] | null;
 }
+export {};

package/dist/with-lookup/search/collection-facade.d.ts

@@ -31,7 +31,6 @@ import { type VectorSet, type EmbeddingDescriptor } from '../embeddings/index.js
 import { type SearchOptions, type SearchResult } from './index.js';
 import type { IndexStore } from './index-store.js';
 import type { PersistedIndexCallbacks } from './persisted-index-store.js';
-import type { IndexDoc, IndexBuildOptions } from './inverted-index.js';
 import type { RetrieveOptions, RetrieveHit, SimilarToOptions } from './retrieve-types.js';
 /** Everything the moving search/retrieval methods touched on `this.*`. */
 export interface SearchContext<T> {
@@ -78,17 +77,6 @@ export interface SearchContext<T> {
  * nothing searchable is written to the store.
  */
 export declare function search<T>(ctx: SearchContext<T>, field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>;
-/** L1 — build IndexDoc[] for the configured text fields over the live cache. */
-export declare function buildRetrievalDocs<T>(ctx: SearchContext<T>, labelMaps: Map<string, Map<string, Record<string, string>>>, blobFilenames: Map<string, Map<string, string[]>>, only?: readonly string[]): IndexDoc[];
-/**
- * L1 — the positional-postings opt-in for this collection (#1354), or
- * `undefined` when nothing opted in. Returning `undefined` rather than
- * `{ positions: [] }` keeps the no-opt-in path byte-identical to a caller that
- * never heard of positions.
- */
-export declare function positionBuildOptions<T>(ctx: SearchContext<T>): IndexBuildOptions | undefined;
-/** L1 — true iff any configured text index is also a blob field (gates ALL slot I/O). */
-export declare function hasIndexedBlobFields<T>(ctx: SearchContext<T>, only?: readonly string[]): boolean;
 /** L1.5 — force-persist the lexical index now (e.g. on save/idle). Persists only when textIndexPersist is enabled; a no-op otherwise. */
 export declare function flushIndex<T>(ctx: SearchContext<T>): Promise<void>;
 /**

package/dist/with-party/broker/index.d.ts

@@ -15,7 +15,7 @@ export { withBroker } from './active.js';
 export { NO_BROKER, type BrokerStrategy, type BrokerCtx, type BrokerConfig, type CredentialBrokerHandle, } from '../../port/with/broker-strategy.js';
 export { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js';
 import { verifyBrokerProof } from '../../capsule/index.js';
-import type { IssuedChallenge, VerifyBrokerProofArgs } from '../../capsule/index.js';
+import type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js';
 /**
  * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a
  * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel
@@ -25,5 +25,5 @@ export declare function issueChallenge(opts?: {
     ttlMs?: number;
 }): IssuedChallenge;
 export { verifyBrokerProof };
-export type { VerifyBrokerProofArgs };
+export type { VerifyBrokerProofArgs, BrokerMemberIdentity };
 export type { IssuedChallenge } from '../../capsule/index.js';

package/dist/with-party/broker/seed.d.ts

@@ -36,17 +36,8 @@
  * @module
  */
 import type { StoreCredentials } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { BrokerSeedCtx } from '../../port/with/broker-strategy.js';
-/** The `_broker/<brokerId>` record payload (spec §3). */
-export interface BrokerSeedRecord {
-    readonly brokerId: string;
-    /** base64(32 random bytes). */
-    readonly seed: string;
-    readonly endpoint: string;
-    readonly createdAt: string;
-    /** `true` only once `/enroll` has returned a 2xx for this seed (I9). */
-    readonly registered: boolean;
-}
 /**
  * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`
  * seed (I4), derive+register its proof key with the broker host, and only
@@ -65,6 +56,34 @@ export declare function enrollSeed(ctx: BrokerSeedCtx): Promise<void>;
  * cache lives in that closure, not here.
  */
 export declare function rotateSeed(ctx: BrokerSeedCtx): Promise<void>;
+/**
+ * core#73 — enrol a freshly granted MEMBER with the host under its own key.
+ * Called by the kernel right after `grant()`, while the grantor still holds
+ * the grantee's secret: that secret opens the grantee's keyring, whose
+ * `_broker_member` DEK (minted by `grant()` for this grantee alone) is the
+ * only key that can seal the member record. Register-first, then persist,
+ * so a record on disk always means a registered member (the same order as
+ * `rotateSeed`). Owner/admin grantees use the shared seed and are skipped.
+ *
+ * A re-grant (role change) lands here again with a NEW DEK and mints a NEW
+ * seed, so the host's record for this userId is REPLACED — key and role — and
+ * a device still holding the previous enrolment is refused from then on.
+ */
+export declare function enrolMemberSeed(ctx: BrokerSeedCtx, member: {
+    readonly userId: string;
+    readonly secret: string;
+} | {
+    readonly userId: string;
+    readonly dek: EnclaveKey;
+}): Promise<void>;
+/**
+ * core#73 — de-register a member with the host and drop its record. Called
+ * by the kernel right after `revoke()`; the local record goes first (cheap,
+ * always succeeds), then the host — a host failure surfaces as
+ * {@link BrokerEnrolmentError} AFTER the keyring revocation has completed,
+ * so the caller retries the host half, never the revocation.
+ */
+export declare function revokeMemberSeed(ctx: BrokerSeedCtx, userId: string): Promise<void>;
 /**
  * The challenge/response round trip: `POST /challenge`, derive+sign the
  * proof from the decrypted seed, `POST /credentials`. One network round

package/dist/with-party/custody/strategy.d.ts

@@ -20,7 +20,7 @@
  */
 import type { GrantOptions, RevokeOptions, FactorProofBundle, NoydbStore } from '../../kernel/types.js';
 import type { Vault } from '../../kernel/vault.js';
-import type { UnlockedKeyring } from '../team/keyring.js';
+import type { UnlockedKeyring, RevokeResult } from '../team/keyring.js';
 import type { GrantCustodianOptions } from './index.js';
 import type { LiberateOptions, LiberateResult } from './liberate.js';
 /**
@@ -33,7 +33,7 @@ import type { LiberateOptions, LiberateResult } from './liberate.js';
  */
 export interface CustodyHost {
     _grantCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
-    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
 }
 export interface CustodyStrategy {
     grantCustodian(host: CustodyHost, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;