@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/with-party/policy/noydb-facade.d.ts

@@ -1,34 +1,4 @@
-import type { VaultPolicy, ReAuthOperation, NoydbPolicyApi, NoydbPolicyDeps, NoydbPolicyFactory } from '../../kernel/types.js';
-export declare class NoydbPolicy implements NoydbPolicyApi {
-    private readonly deps;
-    constructor(deps: NoydbPolicyDeps);
-    /**
-     * Touch the policy enforcer for a vault (records activity, resets
-     * idle timer). Also touches the legacy session timer. No-op if no enforcer.
-     */
-    touchPolicy(vault?: string): void;
-    /**
-     * Check that a policy-guarded operation is permitted.
-     * Throws `SessionPolicyError` if re-auth is required.
-     */
-    checkPolicyOperation(vault: string, op: ReAuthOperation): void;
-    /**
-     * Read the active policy for a vault. Loads from `_meta/policy` on
-     * first call; subsequent calls hit the in-memory cache. Throws
-     * `ValidationError` if the vault has not been opened.
-     */
-    getPolicy(vault: string): Promise<VaultPolicy>;
-    /**
-     * Replace the policy document at `_meta/policy` and update the
-     * in-memory cache. Gated by the `enroll-user` policy (a policy
-     * change is fundamentally a privilege-management action).
-     */
-    updatePolicy(vault: string, override: Partial<VaultPolicy>): Promise<VaultPolicy>;
-    /** Read or persist the vault policy at `_meta/policy` on first open. */
-    bootstrapPolicy(vault: string, opts?: {
-        skipManagedCheck?: boolean;
-    }): Promise<void>;
-}
+import type { NoydbPolicyFactory } from '../../kernel/types.js';
 /**
  * Factory that builds the `NoydbPolicy` service. `createNoydb()`
  * pre-resolves this via a dynamic import (mirrors

package/dist/with-party/team/delegation.d.ts

@@ -19,11 +19,23 @@
  *   collection,     // collection name OR null for "every collection"
  *   record,         // optional specific record id
  *   until,          // ISO timestamp — token expires at this instant
- *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK
+ *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, under the token's content key
+ *   sealedCek,      // that content key, RSA-OAEP-sealed to the target's inbox public half
  *   createdAt,      // ISO timestamp
  * }
  * ```
  *
+ * ## Cross-user (core#65)
+ *
+ * The wrap key is a per-token CONTENT KEY, not anybody's KEK: the tier DEKs are
+ * AES-KW-wrapped under it exactly as they used to be under a KEK, and the key
+ * itself is RSA-OAEP-sealed to the target's INBOX PUBLIC HALF (core#96 mints
+ * that pair for every grantee, private half sealed under a DEK only that
+ * member's own KEK unwraps). So a grantor delegates to somebody whose secret it
+ * does not know — the thing this module could not do — while the slot NAMES
+ * stay readable to any member holding the `_delegations` DEK, which is what
+ * makes an audit enumeration possible without making the keys usable.
+ *
  * The ciphertext is stored as a normal noy-db envelope — the
  * `_delegations` collection has its own DEK shared across all vault
  * users, so an operator can enumerate active delegations for audit
@@ -52,12 +64,57 @@ export interface DelegationToken {
     readonly toUser: string;
     readonly fromUser: string;
     readonly tier: number;
-    /** Collection name or `null` for all collections. */
+    /**
+     * Collection name, or `null` for a COLLECTION-WIDE token — see
+     * {@link DelegationToken.wrappedDeks} for what that means and what it cannot
+     * mean.
+     */
     readonly collection: string | null;
     /** Optional specific record id scope. */
     readonly record?: string;
     readonly until: string;
-    readonly wrappedDek: string;
+    /**
+     * The delegated tier DEK for {@link DelegationToken.collection}, wrapped
+     * under the target's KEK. Present on a per-collection token; absent on a
+     * collection-wide one, which carries {@link DelegationToken.wrappedDeks}.
+     */
+    readonly wrappedDek?: string;
+    /**
+     * A collection-wide token's payload: `<collection>#<tier>` → wrapped DEK, one
+     * entry per collection the grantor held at that tier (core#56).
+     *
+     * ## ⛔ Why a MAP and not one key
+     *
+     * Every collection has its OWN tier DEK — measured, `docs#1` and `ledger#1`
+     * are different keys. The original design tried to express "every collection"
+     * as a single DEK under a wildcard slot `__any#<tier>`, which cannot work: one
+     * key decrypts one collection. A wildcard accepted at the access gate would
+     * have passed the check and then failed decryption — a gate that says yes
+     * followed by a crypto error. `__any#` is gone; every entry here merges under
+     * its REAL `<collection>#<tier>` key, so `assertTierAccess` needs no wildcard
+     * and gains no new privilege surface.
+     *
+     * ## ⚠️ "Every collection" means "every collection AS OF ISSUE TIME"
+     *
+     * This is a SNAPSHOT. A collection created after the token was issued is not
+     * in it and will not be granted by it — the grantor did not hold its DEK to
+     * wrap. That is a real limit of the shape, not an oversight, and it is stated
+     * here because a caller who reads "all collections" will otherwise assume
+     * otherwise.
+     */
+    readonly wrappedDeks?: Readonly<Record<string, string>>;
+    /**
+     * core#65 — the token's CONTENT KEY, RSA-OAEP-sealed to the target's inbox
+     * public half. `wrappedDek` / `wrappedDeks` are AES-KW-wrapped under it, so
+     * only the target can unwrap them, and only they can: the matching private
+     * half is sealed in their keyring under a DEK their own KEK unwraps.
+     *
+     * Absent on a token written before core#65, whose wraps are under the
+     * grantor's own KEK — those still load for a target that shares that KEK
+     * (the only case that ever worked) and are skipped for anyone else, exactly
+     * as before.
+     */
+    readonly sealedCek?: string;
     readonly createdAt: string;
 }
 export interface IssueDelegationOptions {
@@ -68,11 +125,40 @@ export interface IssueDelegationOptions {
     readonly until: Date | string;
 }
 /**
- * Build and persist a delegation token. The caller must hold a tier-N
- * DEK and must have already located the target user's keyring file
- * (so the `wrappedDek` can be re-wrapped against their KEK).
+ * Build and persist a delegation token. The caller must hold a tier-N DEK; the
+ * target must have a keyring in this vault with an inbox key pair (core#96).
+ *
+ * core#65 — the wraps are keyed to a per-token content key sealed to that
+ * pair, so the grantor needs nothing of the target's but their PUBLIC half.
+ */
+export declare function issueDelegation(store: NoydbStore, vault: string, grantor: UnlockedKeyring, delegationsDek: EnclaveKey, opts: IssueDelegationOptions): Promise<DelegationToken>;
+/**
+ * ## Why the vault calls this EXPLICITLY, and never from `openVault` (core#56)
+ *
+ * The module header above describes a runtime that scans on every open. Doing
+ * that automatically would call `getDEK('_delegations')`, which MINTS a DEK when
+ * absent and persists the keyring — so merely opening a vault would write to it.
+ * Worse, on a vault whose shared `_delegations` DEK this user does not hold, it
+ * would mint a WRONG one and then fail to decrypt every token under it.
+ *
+ * ⛔ A read path must not have that side effect. `Vault.refreshDelegations()`
+ * therefore lists first, returns `[]` when nothing is written, and looks the DEK
+ * up WITHOUT minting — which also makes the module header's "at each open"
+ * cheap to honour, and its "periodic intervals (tracked by the caller)" is what
+ * an explicit method is.
+ *
+ * ## Cross-user delegation (core#65) — and the one thing it still needs
+ *
+ * A token's wraps are keyed to a per-token content key sealed to the target's
+ * INBOX PUBLIC HALF, so any member can be a target. Opening one therefore needs
+ * that member's inbox PRIVATE half, which is sealed in their keyring file under
+ * `deks[INBOX_KEY_ID]` — so this function reads the caller's own keyring file,
+ * once, and only when a sealed token is actually addressed to them.
+ *
+ * ⚠️ A pre-core#65 token (no `sealedCek`) is wrapped under the GRANTOR's KEK and
+ * still requires `user.kek`; it is skipped for anyone who does not share it,
+ * which is the behaviour those tokens were written under.
  */
-export declare function issueDelegation(store: NoydbStore, vault: string, grantor: UnlockedKeyring, targetKek: EnclaveKey | null, delegationsDek: EnclaveKey, opts: IssueDelegationOptions): Promise<DelegationToken>;
 /**
  * Enumerate every live (non-expired) delegation addressed to `toUser`
  * and merge the unwrapped tier DEKs into their keyring. Returns the

package/dist/with-party/team/echo-secret.d.ts

@@ -31,8 +31,6 @@
 import { type EchoSecretParts } from '../../capsule/index.js';
 import type { KeyringEchoBlock } from '../../kernel/types.js';
 import type { NoydbDeviceSeal } from './device-seal.js';
-/** Same iteration floor as the KEK (spec resolved question 1). */
-export declare const ECHO_KDF_ITERATIONS = 600000;
 export type EchoRevealChoice = {
     readonly kind: 'portable';
 } | {

package/dist/with-party/team/index.d.ts

@@ -18,6 +18,8 @@ export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { PodRecipient, ListUsersOptions } from './keyring.js';
+export type { RotateResult, QuarantineResult, RosterVerifyResult } from './keyring.js';
+export type { DelegationToken, IssueDelegationOptions } from './delegation.js';
 export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, revokeAuthenticator, // #1445 — the three-step revocation; removeAuthenticator alone only hides
 updateAuthenticator, findAuthenticator, } from './authenticators.js';

package/dist/with-party/team/keyring.d.ts

@@ -85,17 +85,6 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
-/**
- * The vault roster key held by this keyring, or `null` when the keyring
- * carries none.
- *
- * Null is expected on the resume-style paths (`kek: null` sessions, tier-3
- * PIN resume, plaintext mode) — none of which may write a keyring file.
- * Every stamping site null-guards this exactly as it guards `kek`: minting a
- * file without a verifiable `roster_tag` would be worse than refusing, since
- * it is indistinguishable on the next load from a store having stripped it.
- */
-export declare function rosterKeyOf(keyring: UnlockedKeyring): EnclaveKey | null;
 /**
  * Shared wording for the stamping-site guards — mirrors the `kek` guard's shape.
  * Exported so every roster-stamping site in the hub raises ONE error with one
@@ -110,8 +99,18 @@ export interface LoadKeyringOptions {
      * That user's secret — a single string for a standard keyring, or the
      * structured 3-part {@link EchoSecretParts} for an echo keyring (spec
      * #940, AG-1: a single string can never unlock an echo keyring).
+     * One of `secret` / `kek` is required.
      */
-    readonly secret: string | EchoSecretParts;
+    readonly secret?: string | EchoSecretParts;
+    /**
+     * core#96 — a KEK this session already HOLDS, instead of re-deriving one
+     * from a secret. The in-session roster reload (core#82) uses it: the secret
+     * the vault was opened with is stale after an in-session `rotateSecret`,
+     * and 600K PBKDF2 iterations are not needed to adopt a file this KEK
+     * already opens. A file re-keyed under this member by somebody else fails
+     * the canary and reports `InvalidKeyError` — a defined event, not a hang.
+     */
+    readonly kek?: EnclaveKey;
 }
 /**
  * KDF dispatch for tier-1 unlock (spec #940). An echo keyring accepts
@@ -120,6 +119,7 @@ export interface LoadKeyringOptions {
  */
 export declare function deriveKekForKeyring(file: KeyringFile, secret: string | EchoSecretParts, salt: Uint8Array): Promise<EnclaveKey>;
 /** Parse a raw keyring envelope. Single sanctioned reader of `_data` for keyring files. */
+/** Parse a keyring envelope's body. Exported for `keyring-mirror.ts` (core#75) — the one non-crypto reader. */
 export declare function parseKeyringEnvelope(envelope: EncryptedEnvelope): KeyringFile;
 /** Fetch + parse a user's keyring file; undefined when the row is missing. */
 export declare function readKeyringFile(store: NoydbStore, vault: string, userId: string): Promise<{
@@ -196,8 +196,18 @@ export interface CreateOwnerKeyringOptions extends SecretPolicy {
 export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
 export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
+/**
+ * Reserved DEK-map slots that are KEYS, not collections, and can never be
+ * rotated — `rotateKeys` refuses each by name. Every caller that derives a
+ * rotation scope from a DEK map (`revoke`, `quarantineKeyring`) strips these
+ * first. ⛔ Kept as ONE set rather than a filter per caller: `quarantineKeyring`
+ * stripped only `_roster` and broke the moment the owner keyring gained an
+ * inbox key (core#65), which is the second time this list grew and a caller
+ * was missed.
+ */
+export declare const NON_ROTATABLE_SLOTS: ReadonlySet<string>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
-export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<RevokeResult>;
 /** What {@link verifyRoster} found. */
 export interface RosterVerifyResult {
     /**
@@ -316,7 +326,19 @@ export declare function quarantineKeyring(store: NoydbStore, vault: string, call
  * @throws `ValidationError` when the diff is empty (nothing to update).
  *
  */
-export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
+/** What `updateKeyringIdentity` hands back to the kernel (core#96). */
+export interface UpdateKeyringResult {
+    /** The role moved. The kernel re-registers the member with a broker host, if one is configured. */
+    readonly roleChanged: boolean;
+    /**
+     * A fresh `_broker_member` DEK, delivered through the inbox, when the member
+     * is (still) a sub-admin after a role change — the kernel seals the new seed
+     * under it and re-enrols. Absent otherwise (a promotion to owner/admin drops
+     * the slot: those roles use the shared `_broker` seed).
+     */
+    readonly brokerMemberDek?: EnclaveKey;
+}
+export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<UpdateKeyringResult>;
 /**
  * Rotate DEKs for specified collections:
  * 1. Generate new DEKs
@@ -361,11 +383,38 @@ export interface RotateResult {
         readonly userId: string;
         readonly reason: KeyringTamperedReason;
     }>;
+    /**
+     * core#100 — every record this rotation re-encrypted, with its version.
+     * Rotation writes through the raw store, invisible to the sync dirty log,
+     * so a replica kept the OLD ciphertext until each record was edited again —
+     * a revoked member with store access went on reading it, and a survivor
+     * handed the new DEK read `TamperedError` (measured by pilot-1). The kernel
+     * dirty-tracks these on every sync engine so the next push carries them.
+     */
+    readonly rewritten: ReadonlyArray<{
+        readonly collection: string;
+        readonly id: string;
+        readonly version: number;
+    }>;
+}
+/** core#100 — what `revoke` hands the kernel: the rotation's rewrites, for the dirty log. */
+export interface RevokeResult {
+    readonly rewritten: RotateResult['rewritten'];
 }
 /** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
 export interface RotateKeysOptions {
     /** Collections whose DEKs are re-minted. */
     readonly collections: readonly string[];
+    /**
+     * core#100 — members who must NOT be delivered the new keys: the member
+     * being revoked or quarantined (a store that suppresses the `_keyring`
+     * delete leaves their file in place — #1043 — and delivering to it would
+     * hand the revoked member the very key the rotation exists to take away),
+     * and a member being narrowed (the collection just left their file, but a
+     * pending inbox slot for it cannot be pulled out of its box). They get the
+     * drop, and appear in `needsRegrant` as before.
+     */
+    readonly exclude?: readonly string[];
 }
 export declare function rotateKeys(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions): Promise<RotateResult>;
 /** Options for {@link changeSecret} (#846b). */
@@ -513,21 +562,42 @@ export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, v
     envelope: UserEnvelope<T> | null;
 }>>;
 export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
-/**
- * The `Permissions` catch-all key (#1010). `Permissions` has always documented
- * `'*'` as "the wildcard collection matching all collections in the vault", but
- * nothing expanded it — a grantee handed the documented catch-all got no keys
- * at all. It is honoured in three places, and they must agree: the DEK wrapping
- * in `grant()`, and both permission checks below.
- */
-export declare const PERMISSION_WILDCARD = "*";
-/** Does this permission map hand over the whole vault? */
-export declare function permissionsAreWildcard(permissions: Permissions | undefined): boolean;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */
 export declare function hasAccess(keyring: UnlockedKeyring, collectionName: string): boolean;
+export declare function mintInboxKey(kek: EnclaveKey): Promise<{
+    wrappedInboxKey: string;
+    inboxKeyAes: EnclaveKey;
+    inboxKey: NonNullable<KeyringFile['inbox_key']>;
+}>;
+/** core#96 — the collections a member has pending in their inbox, over every box. */
+export declare function inboxSlots(file: Pick<KeyringFile, 'inbox'>): string[];
+/**
+ * core#65 — this member's INBOX KEY PAIR, rebuilt from their keyring file: the
+ * private half is sealed under `deks[INBOX_KEY_ID]`, which only their own KEK
+ * unwraps. The inbox drain below opens boxes with it; `with-party/team/
+ * delegation.ts` opens a delegation's content key with the same pair, so a
+ * grantor can hand a member a key without knowing their secret.
+ */
+export declare function openInboxKeyPair(inboxKey: NonNullable<KeyringFile['inbox_key']>, inboxKeyAes: EnclaveKey): Promise<CryptoKeyPair>;
 /** Persist a keyring file to the store. */
+/**
+ * ⛔⛔ core#132 — DO NOT ADD A RETRY HERE. An earlier cut of this change did,
+ * and it was wrong in a way that looked like a fix.
+ *
+ * This function writes the caller's in-memory `keyring.deks` WHOLESALE. If a
+ * CAS fails, the write that lost was based on a stale version — retrying it
+ * re-persists that same map over the winner's, which is exactly the clobber
+ * the CAS just caught, laundered into a success. The suite went green and the
+ * data loss stayed.
+ *
+ * ⭐ The resolution belongs where the intent is, not where the write is. The
+ * only caller that races in practice is the lazy DEK mint in
+ * `ensureCollectionDEK`, and it can resolve correctly because it has not
+ * encrypted anything yet: on conflict it adopts the winner's key and returns
+ * that. See the comment there.
+ */
 export declare function persistKeyring(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
@@ -579,3 +649,42 @@ export declare function hasImportCapability(keyring: UnlockedKeyring, tier: 'bun
  */
 export declare function evaluateImportCapability(capability: ImportCapability | undefined, role: Role, tier: 'plaintext', format: ExportFormat): boolean;
 export declare function evaluateImportCapability(capability: ImportCapability | undefined, role: Role, tier: 'bundle'): boolean;
+/**
+ * core#132 — what this write is based on.
+ *
+ * `{ on }` is the envelope the edit was computed from; the write then CASes
+ * against its `_v` and lands at `_v + 1`. `'create'` is a keyring that did not
+ * exist.
+ *
+ * ⭐ REQUIRED, not optional, and that is the point: keyring writes were a bare
+ * `store.put` with no `expectedVersion`, so two concurrent edits to one member
+ * were last-writer-wins, silently. Making the basis a required parameter means
+ * the COMPILER enumerates every call site — `NON_ROTATABLE_SLOTS`' own comment
+ * records two defects caused by enumerating callers with grep instead.
+ *
+ * ⛔ `'create'` is NOT protected, and the limit is in the store contract, not
+ * in this function: two concurrent creates of the same userId still clobber,
+ * because this path passes no `expectedVersion` at all. Do not read a
+ * `'create'` basis as protected.
+ *
+ * ⚠️ It is not that absence is inexpressible — core#134 measured that claim and
+ * it was wrong. Every version hub writes starts at 1, so on a store that
+ * compares only when the record is present, `expectedVersion: 0` lets the
+ * first create through and conflicts every later one: an exact "write only if
+ * absent", for free. Censused 2026-09-24, every record store in the family
+ * already behaves that way, `to-aws-s3` deliberately and by name.
+ *
+ * ⛔ What stops this call site adopting it is that NOTHING HOLDS that
+ * convergence: `@noy-db/ports/to` asserts none of it, so a third-party adapter
+ * owes it nothing and this would become a silent correctness dependency on
+ * behaviour no gate checks. Adopt it after the conformance case lands, not
+ * before. core#134 carries the decision.
+ */
+export type KeyringWriteBasis = {
+    readonly on: EncryptedEnvelope;
+} | 'create';
+/** The basis for a write computed from a `readKeyringFile` result. */
+export declare const basisOf: (found: {
+    readonly envelope: EncryptedEnvelope;
+} | undefined) => KeyringWriteBasis;
+export declare function writeKeyringFile(store: NoydbStore, vault: string, userId: string, keyringFile: KeyringFile, basis: KeyringWriteBasis): Promise<void>;

package/dist/with-party/team/magic-link-grant.d.ts

@@ -54,7 +54,17 @@ import { type EnclaveKey } from '../../capsule/index.js';
 export declare const MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 /** HKDF `info` for the AES-GCM content key. Version-namespaced. */
 export declare const MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
-/** HKDF `info` for the AES-KW KEK. Matches `@noy-db/on-magic-link`. */
+/**
+ * HKDF `info` for the AES-KW KEK. Matches `@noy-db/on-magic-link`.
+ *
+ * No importer inside hub, and that is not a defect: this is one half of a
+ * CROSS-PACKAGE protocol constant. The satellite derives the same KEK from
+ * the same string, so the value has to be stated here to be reviewable
+ * against it. Deleting it would leave the wire format pinned in one repo
+ * only (#55).
+ *
+ * @seam
+ */
 export declare const MAGIC_LINK_KEK_INFO_PREFIX = "noydb-magic-link-v1:";
 /**
  * Decrypted payload of a magic-link grant record. Mirrors

package/dist/with-party/team/noydb-facade.d.ts

@@ -24,7 +24,7 @@ import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResu
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
 import type { Vault } from '../../kernel/vault.js';
-import type { UnlockedKeyring } from './keyring.js';
+import type { UnlockedKeyring, RevokeResult } from './keyring.js';
 import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from './authenticators.js';
 import type { QuickUnlockStore, QuickUnlockState } from '../session/unlock-state.js';
 import type { SecretPolicy } from '../../kernel/validation.js';
@@ -53,6 +53,13 @@ export interface TeamFacadeDeps {
     getKeyringInternal(vault: string, opts?: {
         create: boolean;
     }): Promise<UnlockedKeyring>;
+    /** core#73 — re-enrol a recovered member with the broker host (kernel-resident; no-op without a broker). */
+    enrolBrokerMember(vault: string, member: {
+        readonly userId: string;
+        readonly secret: string;
+    }): Promise<void>;
+    /** core#96 — pull a member's keyring file from every sync target before an authority edit. */
+    refreshRoster(vault: string, userId: string): Promise<void>;
     /** Managed-recovery enrolment check (kernel-resident). */
     assertRecoveryEnrolled(vault: string, policy: VaultPolicy, opts?: {
         skipManagedCheck?: boolean;
@@ -71,7 +78,7 @@ export declare class TeamFacade {
     /** Gate + run a `grant` engine. See `Noydb.grant` for the public contract. */
     runGrant(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
-    runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<RevokeResult>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
     runRotate(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
     /** Gate + run the `verifyRoster` engine (#1121). See `Noydb.verifyRoster`. */
@@ -166,6 +173,7 @@ export declare class TeamFacade {
      *     meta: {
      *       credentialId: e.credentialId,
      *       wrapIv: e.wrapIv,
+     *       rpId: e.rpId,
      *       prfUsed: e.prfUsed,
      *       beFlag: e.beFlag,
      *       requireSingleDevice: e.requireSingleDevice,
@@ -174,6 +182,15 @@ export declare class TeamFacade {
      * })
      * ```
      *
+     * `meta` is a free-form blob — hub validates `credentialId` and nothing
+     * else, so this example IS the contract for what a slot carries. Record
+     * `rpId` (core#140): the slot rewrap / rotation ceremony falls back to
+     * `meta.rpId` when the caller passes no `options.rpId` and the enrollment
+     * record predates `WebAuthnEnrollment.rpId`. Omitting it does not break
+     * single-hostname deployments — absence correctly reads as "send no RP ID"
+     * — but on a shared registrable domain rotation then works only if every
+     * caller remembers to pass the RP ID by hand.
+     *
      * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
      * for the caller's lookup index (a bootstrap vault, a Cover,
      * a server-side allowlist).

package/dist/with-party/team/reserved-secret-collections.d.ts

@@ -25,17 +25,19 @@
 /** Reserved collection holding per-adapter sync transport secrets. */
 export declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 /**
- * Reserved (pre-allocated) name for the future credential broker (#479).
- * Not yet implemented — reserved now so that neither the public collection
- * handle nor grant propagation can ever expose it before its dedicated,
- * role-gated API lands.
+ * Reserved collection holding the credential broker's SHARED seed (#479):
+ * one record per `brokerId`, owner/admin only.
  */
 export declare const BROKER_COLLECTION = "_broker";
 /**
- * The set of reserved collection names whose record contents are
- * directly-usable secrets. Membership here means: never served via
- * `vault.collection()`, never propagated to sub-admin grantees.
+ * Reserved collection holding each MEMBER's own broker seed (core#73): one
+ * record per `userId`, each encrypted under a DEK minted for that grantee
+ * alone at `grant()` time. Secret-bearing like `_broker`, with one twist the
+ * propagation loops must honour: the grantor never HOLDS this DEK (it is
+ * per-grantee, minted and wrapped in one step), so there is nothing to
+ * withhold — the guard exists so the name can never be served by
+ * `vault.collection()`.
  */
-export declare const SECRET_BEARING_RESERVED_COLLECTIONS: ReadonlySet<string>;
+export declare const BROKER_MEMBER_COLLECTION = "_broker_member";
 /** True when `name` is a secret-bearing reserved collection. */
 export declare function isSecretBearingReservedCollection(name: string): boolean;

package/dist/with-party/team/roster-tag.d.ts

@@ -44,7 +44,7 @@ export interface RosterTag {
     readonly iv: string;
     readonly data: string;
 }
-export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch'>;
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch' | 'clearance' | 'inbox_key' | 'inbox'>;
 export declare function rosterCanonical(file: RosterAuthorityFields): string;
 export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
 /**
@@ -99,3 +99,44 @@ export declare function assertRosterAuthenticated(file: KeyringFile, deks: Reado
  * the point of the mechanism.
  */
 export declare function assertRosterTagValid(file: KeyringFile, rosterKey: EnclaveKey, userId: string): Promise<void>;
+/**
+ * ⚠️ MOVED HERE from `roster-epoch.ts` (core#58), and the move is the point.
+ *
+ * That module carries an output-domain invariant — every function it exports
+ * must reach a published entry point — because its CALLER API
+ * (`assertRosterEpochCurrent`) once shipped reachable from nowhere (#1097).
+ * `stampAuthority` is writer-side plumbing and has no business on the published
+ * surface, so satisfying that invariant by exporting it would have been the
+ * wrong repair.
+ *
+ * It belongs here regardless: it stamps the derived fields that
+ * `rosterCanonical` below BINDS, and the two must change together. Adding a
+ * derived field means editing both functions in this one file.
+ */
+/**
+ * Stamp a keyring's authority half with BOTH derived fields at once — the next
+ * roster epoch and the advisory clearance (core#58).
+ *
+ * ## Why one helper and not two call sites
+ *
+ * There are thirteen places that build a `KeyringFile`'s authority half, across
+ * `keyring.ts`, `rotate-recover.ts`, `peer-recover.ts`, `custody/liberate.ts`
+ * and `with-cargo/adopt-partition.ts`. Every one of them must stamp every
+ * derived field, or the field FLICKERS: present after a grant, absent after the
+ * next rotate or partition adopt, with no error anywhere.
+ *
+ * ⛔ That is not a hypothetical — it is the exact failure `clearance` already
+ * had in a weaker form, and adding a fourteenth call site is how it would come
+ * back. **Adding a derived field means adding it HERE**, which makes covering
+ * all thirteen sites the default rather than a thing to remember.
+ *
+ * `clearance` is derived from the DEK slot names in the very object being
+ * stamped, so it cannot disagree with them; see `keyringClearance` for why it
+ * is advisory and must stay so.
+ */
+export declare function stampAuthority<T extends {
+    readonly deks?: Record<string, string>;
+}>(authority: T, previousEpoch: number | undefined): T & {
+    roster_epoch: number;
+    clearance: number;
+};

package/dist/with-party/team/tiers.d.ts

@@ -21,12 +21,43 @@ import type { UnlockedKeyring } from './keyring.js';
 import { dekKey } from '../../kernel/tier-visibility.js';
 export { dekKey };
 /**
- * Returns the user's effective clearance for a given collection: the
- * maximum tier for which their keyring holds a DEK. Falls back to 0
- * when the user has only the tier-0 DEK (or none — the getDEK caller
- * will raise separately).
+ * The user's effective clearance for ONE collection: the maximum tier for which
+ * their keyring holds a DEK. `0` when only the tier-0 DEK is held (or none —
+ * the `getDEK` caller raises separately).
+ *
+ * Takes DEK SLOT NAMES rather than an `UnlockedKeyring` (core#58), because the
+ * callers that need this are the ones BUILDING a `KeyringFile`, where the slot
+ * names exist and an unlocked keyring may not. Not published from any entry, so
+ * the signature is free to say what it means.
+ *
+ * ⚠️ `kernel/vault.ts`'s `elevate()` scan is NOT this predicate: that asks
+ * whether ANY collection has a DEK at ONE tier (`#N` suffix match); this asks
+ * the MAXIMUM tier for ONE collection (`name#` prefix match).
+ */
+export declare function effectiveClearance(dekSlots: Iterable<string>, collection: string): number;
+/**
+ * The whole keyring's clearance: the highest tier held for ANY collection.
+ *
+ * ## What this is, and the one thing it must never become (core#58)
+ *
+ * This is the value persisted as `KeyringFile.clearance`. It is **derived**,
+ * not independent — a pure function of the DEK slot names written into the same
+ * file — and that is deliberate on two counts:
+ *
+ *  1. `dek_slots` is already bound into the roster tag (#1115), so a clearance
+ *     computed from it carries no authority the tag does not already cover. A
+ *     store that forges one contradicts data it cannot forge.
+ *  2. Being derived at every write is what stops it drifting. A value computed
+ *     once at grant time and carried forward goes stale the moment a tier DEK
+ *     is added or revoked.
+ *
+ * ⛔ **It is ADVISORY and must stay advisory.** The real check is whether the
+ * DEK map carries a `collection#tier` entry — `assertTierAccess` is the gate,
+ * and access in this system IS the key. Never branch a privilege decision on
+ * this number: it would be a second, weaker representation of access sitting
+ * beside the authoritative one, which is how the two come to disagree.
  */
-export declare function effectiveClearance(keyring: UnlockedKeyring, collection: string): number;
+export declare function keyringClearance(dekSlots: Iterable<string>): number;
 /**
  * Assert the caller is cleared for the requested tier. Owners and
  * admins always pass (they can mint any new tier DEK on demand);