@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/indexing/index.js

@@ -8,15 +8,15 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-NYJBYVBG.js";
+} from "../chunk-2ODEFG6K.js";
 import {
   CollectionIndexes
-} from "../chunk-3V6LZHUO.js";
+} from "../chunk-AYOQZJDB.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-4CFHL5RY.js";
-import "../chunk-BUE7R3B5.js";
-import "../chunk-PTJY5R3O.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-SXPLIRQH.js";
+import "../chunk-PIO6NW7O.js";
+import "../chunk-2RH5SEY7.js";
 
 // src/with-lookup/indexing/active.ts
 function withIndexing() {

package/dist/introspection/index.js

@@ -1,7 +1,7 @@
 import "../chunk-2DX4JCRI.js";
 import {
   dumpVaultSchema
-} from "../chunk-EMAWOGVH.js";
+} from "../chunk-654RE5YC.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
@@ -12,17 +12,17 @@ import {
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-J4KAPKBJ.js";
+import "../chunk-UORWAG7K.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-H3YM66EI.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+import "../chunk-IF2M43G4.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
+import "../chunk-2RH5SEY7.js";
 export {
   FieldMetaUnknownFieldError,
   applyListProjection,

package/dist/issue-5ZHXK4HJ.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-5SMCBPJ2.js";
+import "./chunk-B6EWMGFX.js";
+import "./chunk-IPF5ORDI.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-5ZHXK4HJ.js.map

package/dist/kernel/collection.d.ts

@@ -666,6 +666,38 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * never half-writes the receiver.
      */
     validateInput(record: T): Promise<T>;
+    /**
+     * core#74 — ADMISSION of a record arriving by sync. Runs the same
+     * `beforePut` gate bus (guards, periods) and `db.onBeforeWrite` hooks a
+     * local `put` runs, on the DECRYPTED incoming record against this device's
+     * current state, with `origin: 'sync-apply'`. A throw is a refusal; the
+     * engine parks the envelope and leaves the local copy untouched.
+     *
+     * Not gated, deliberately: tombstones and delete markers (erasure wins, as
+     * on every other path), elevated envelopes (#707 — invisible to gate
+     * handlers), and a record this session holds no key for (it cannot judge;
+     * the merge authority's stated residue, #1042). Schema validation does not
+     * run — the writer validated. Zero cost when nothing is registered.
+     * @internal
+     */
+    /**
+     * @internal core#74 — judge a record against THIS device's gates and hooks.
+     *
+     * ⚠️ core#108: under `'push-recheck'` the record is already in the local
+     * store, so `resolveGatePrior` returns the record itself and `existing`
+     * equals `incoming` — the state it was written over is gone and cannot be
+     * reconstructed. That makes the re-check sound for rules that read AMBIENT
+     * state (a closed period, a revoked clearance) and degenerate for rules
+     * that compare against a prior, which see a no-op diff and pass. Widening
+     * it would need the pre-write snapshot kept in the dirty log, which is a
+     * different feature; do not "fix" it by synthesising a prior here.
+     */
+    _admitRemote(id: string, envelope: EncryptedEnvelope, origin?: 'sync-apply' | 'push-recheck'): Promise<{
+        admitted: true;
+    } | {
+        admitted: false;
+        reason: string;
+    }>;
     /**
      * Resolve the prior record as REAL VALUES for the eager write/delete paths
      * (history snapshot, ledger patch, index upkeep). The eager cache holds
@@ -739,7 +771,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * @internal `wave` (#638 Task 4): when present (the sync/cutover/restore dispatch wave),
      * an eager MV already refreshed this wave is skipped (per-target dedup, keyed on spec name).
      */
-    dispatchMaterializedViews(id: string, record: T, wave?: WaveContext): Promise<void>;
+    _dispatchMaterializedViews(id: string, record: T, wave?: WaveContext): Promise<void>;
     /**
      * Fire registered derivation strategies for this source collection.
      * Eager mode runs `derive` inline and writes each output via the
@@ -784,7 +816,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * and from `forgetDerivedFanout` (#638 Task 6), which needs the per-target outcome to fill
      * `ForgetResult.derivedAggregatesRecomputed`/`derivedResidueFrozen`). `wave` (#640): per-target dedup for the sync-apply path; `undefined` on local-delete (byte-identical).
      */
-    dispatchRollupsOnDelete(id: string, deleted: T, wave?: WaveContext): Promise<ReadonlyArray<{
+    _dispatchRollupsOnDelete(id: string, deleted: T, wave?: WaveContext): Promise<ReadonlyArray<{
         readonly into: string;
         readonly parentId: string;
         readonly outcome: RollupOutcome;
@@ -793,9 +825,9 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     _recomputeDeletedRollups(intents: readonly RollupDeleteIntent[], wave: WaveContext): Promise<void>;
     /** @internal `wave` (#638 Task 4) — threaded to `recomputeRollup` for the sync/cutover/restore
      *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
-    dispatchDerivations(id: string, record: T, version: number, wave?: WaveContext, prior?: Record<string, unknown> | null): Promise<void>;
+    _dispatchDerivations(id: string, record: T, version: number, wave?: WaveContext, prior?: Record<string, unknown> | null): Promise<void>;
     /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
-    dispatchTriggerDerivationsOnDelete(id: string, deleted: T): Promise<void>;
+    _dispatchTriggerDerivationsOnDelete(id: string, deleted: T): Promise<void>;
     /**
      * Delete a record by ID. Runs inside the hub's write-queue tracker
      * so `hub.writeQueue.pending` reflects this write.
@@ -936,7 +968,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * erasure too — forget()'s fanout, GDPR residue. A delete-of-absent contributes 0 either way.
      * @internal
      */
-    dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
+    _dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
     /**
      * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
      * skip (record's gone); the `internal` gate at `_doDelete` is the recursion guard. Returns the
@@ -946,7 +978,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * manual serves empty until `refreshView()`. `residueUndecodable`/`residueDeclined` (#776/#785) carry `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest` could not decode, resp. decoded+stamp-matched but declined erasure — surfaced, not erased.
      * @internal
      */
-    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+    _dispatchMaterializedViewsOnDelete(id: string): Promise<{
         deleted: number;
         residueUndecodable: string[];
         residueDeclined: string[];
@@ -962,6 +994,35 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      *                each record is locale-resolved before being returned.
      */
     list(locale?: LocaleReadOptions): Promise<T[]>;
+    /**
+     * @internal core#122 — forget everything read from the store, so the next
+     * read re-hydrates.
+     *
+     * ⭐ Why this is needed even though the vault drops its collection cache on
+     * restore: `vault.collection(name)` hands back the instance FROM that cache,
+     * so a handle the caller is already holding IS one of the objects in it.
+     * Dropping the map makes the NEXT `vault.collection()` build a fresh
+     * instance and leaves the caller's handle answering from its own pre-restore
+     * cache — correct for the next caller, invisible to the current one, and the
+     * natural shape of restore code holds the handle across the load.
+     *
+     * ⛔ Not a general "refresh": it deliberately does NOT re-read here. The
+     * next read pays for it, so a restore that touches fifty collections does
+     * not hydrate fifty times for a caller who will look at one.
+     */
+    _invalidateAfterRestore(): void;
+    /**
+     * core#103 — `list()` with the hub-assigned id alongside each record.
+     *
+     * ⭐ The id is not derivable from a record, so a caller keyed on it
+     * previously had to `get()` per row after `list()`. Tuple order mirrors
+     * `putMany`: `[id, record]` reads the same going in and coming out.
+     *
+     * Same eager-mode requirement and the same locale/Via pipeline as `list()`
+     * — deliberately, so the two cannot drift into answering differently about
+     * the same collection. `list()` is unchanged.
+     */
+    listEntries(locale?: LocaleReadOptions): Promise<Array<readonly [id: string, record: T]>>;
     /**
      * Scan-mode full-text search over a plain-text `field`. Decrypts the
      * collection in memory and ranks records by BM25 against the tokenized query.
@@ -1200,6 +1261,24 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         items: T[];
         nextCursor: string | null;
     }>;
+    /**
+     * core#103 — `listPage()` with the hub-assigned id alongside each record.
+     *
+     * ⭐ The id is not derivable from the record. An app that stores its own key
+     * in a field is fine; one that relies on the id hub assigned had no bulk
+     * read that returned it and had to `get()` per row to find out — which is
+     * the shape pilot-1 hit writing a rule keyed on the record id.
+     *
+     * Tuple order mirrors `putMany`, so `[id, record]` reads the same way going
+     * in and coming out. `listPage()` is unchanged and delegates here.
+     */
+    listPageEntries(opts?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: Array<readonly [id: string, record: T]>;
+        nextCursor: string | null;
+    }>;
     /**
      * Stream every record in the collection page-by-page as an async
      * iterable, with chainable `.where()` / `.filter()` clauses and a

package/dist/kernel/constants.d.ts

@@ -52,3 +52,10 @@ export declare const ROSTER_KEY_ID = "_roster";
  * of rewriting every chunk and index row on every revocation.
  */
 export declare const BLOB_ADDRESS_KEY_ID = "_blob_addr";
+/**
+ * core#96 — the DEK-map slot holding a member's INBOX KEY: the AES key that
+ * seals the private half of their inbox key pair (`KeyringFile.inbox_key`).
+ * A reserved key, not a collection — never propagated to a grantee (it is
+ * per member), never rotated, stripped by `revoke` the way `_roster` is.
+ */
+export declare const INBOX_KEY_ID = "_inbox_key";

package/dist/kernel/errors.d.ts

@@ -622,6 +622,15 @@ export declare class DuplicateStoreKindError extends NoydbError {
     readonly kind: string;
     constructor(kind: string);
 }
+/**
+ * core#96 — `updateUser` needs to deliver a DEK to a member whose keyring has
+ * no inbox key pair (written before inboxes existed), or the caller is not
+ * cleared to amend. The member can still be re-granted with a fresh secret.
+ */
+export declare class MemberInboxMissingError extends NoydbError {
+    readonly userId: string;
+    constructor(userId: string, message?: string);
+}
 export declare class PrivilegeEscalationError extends NoydbError {
     readonly offendingCollection: string;
     constructor(offendingCollection: string, message?: string);

package/dist/kernel/merge-authority.d.ts

@@ -15,11 +15,15 @@ import type { EnclaveKey } from '../capsule/index.js';
  */
 export declare function buildMergeAuthority(
 /**
+ * A GETTER for the DEK map (core#100): the vault reloads its keyring in
+ * place after a pull that replaced its file (core#82) — a delivered DEK, a
+ * rotation — and an authority that captured the object at wiring kept
+ * verifying with the map that no longer opened the records.
  * Just the DEK map, not the whole keyring. `port-layering` refused a type
  * import of `UnlockedKeyring` from `with-party` — correctly, and the narrower
  * shape is better anyway: this needs to look up keys, not to know what a
  * keyring is.
  */
-keyring: {
+keyring: () => {
     readonly deks: ReadonlyMap<string, EnclaveKey>;
 }): MergeAuthority;

package/dist/kernel/noydb.d.ts

@@ -1,5 +1,5 @@
-import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
-import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, RealignResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
+import type { RotateResult, RevokeResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
+import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, RealignResult, PushOptions, PullOptions, SyncStatus, SyncTarget, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy, SyncRejectedApi, ReplaceRemoteResult } from './types.js';
 import type { SecretPolicy } from './validation.js';
 import { type NoydbMesh } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
@@ -51,6 +51,8 @@ export declare class Noydb {
     private readonly vaultOpening;
     private readonly keyringCache;
     private readonly syncEngines;
+    /** core#90 — conflict resolvers registered per vault, replayed onto a target attached after open. */
+    private readonly conflictResolvers;
     /**
      * Per-vault active session tier — defaults to `1` after a secret
      * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
@@ -90,10 +92,10 @@ export declare class Noydb {
     /**
      * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
      * `withCustody()` was passed. Kept as a public accessor because `Vault`
-     * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+     * routes `vault.custody.liberate` through `this.noydb._custodyStrategy`.
      * @internal
      */
-    get custodyStrategy(): CustodyStrategy;
+    get _custodyStrategy(): CustodyStrategy;
     private readonly snapshots;
     private readonly policyManager;
     /** Pre-resolved policy-gate engine function (mirrors `meshPort`/`userApiFactory` above). */
@@ -176,6 +178,13 @@ export declare class Noydb {
     /**
      * Grant access to a user for a vault.
      *
+     * ⚠️ On an EXISTING user this RE-KEYS them: a new KEK from `secret`,
+     * authenticator slots dropped, the file overwritten. So it needs the
+     * member's CURRENT secret — after `acceptInvite` or `rotateSecret` an
+     * owner never holds it, and a re-grant with a stale one locks the member
+     * out. To change what an existing member may do, use `updateUser`
+     * (core#96); re-grant only to re-key, with a fresh temporary secret.
+     *
      * Gated by `enroll-user`. `STRICT_POLICY` requires a TOTP / email-OTP
      * factor proof so the operator affirmatively re-asserts identity at
      * the moment of grant; `PERSONAL_POLICY` accepts a tier-1 unlock alone.
@@ -220,23 +229,37 @@ export declare class Noydb {
     revokeCustodian(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** @internal — revoke-custodian engine, reached only via withCustody().
      * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
-    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
-    /**
-     * Mutate post-grant identity fields on an existing keyring — `role`,
-     * `displayName`, and/or `permissions`. Pure plaintext-header rewrite:
-     * no DEK rewrap, no KEK required, no authenticator slots touched.
-     * Tier-2 enrollments and recovery codes survive.
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Change what an EXISTING member may do — `role`, `displayName`, and/or
+     * `permissions` — without holding their secret. The member's KEK, salt
+     * and authenticator slots are untouched; tier-2 enrollments and recovery
+     * codes survive.
+     *
+     * core#96 — the keys follow the header. A change that widens access
+     * delivers the DEKs the member lacks through their keyring INBOX
+     * (sealed to a per-member key pair only their KEK opens; drained at
+     * their next tier-1 unlock, or at the next pull of an open session). A
+     * change that narrows access drops the DEKs and rotates those
+     * collections, as a narrowing `grant` does (#1097). A role change
+     * re-registers the member with a configured broker host under a fresh
+     * `_broker_member` key. This is the widening path: `db.grant` on an
+     * existing user RE-KEYS them from `secret`, so it needs their CURRENT
+     * secret — after `acceptInvite` or `rotateSecret` an owner never holds it.
      *
      * Different from `db.revoke + db.grant`:
      *
-     *   - Same `userId`, same DEK wrappings, same `granted_by`, same
-     *     `_users/<keyringId>` envelope. Only the specified header
-     *     fields move. Last-write-wins via the standard keyring put.
+     *   - Same `userId`, same KEK, same `granted_by`, same
+     *     `_users/<keyringId>` envelope. Last-write-wins via the standard
+     *     keyring put.
      *   - No cascade on role demotion (admins demoted to operator keep
      *     the keyrings they previously granted; the cascade rules are
      *     a `db.revoke` concern, not `db.updateUser`).
      *   - Tier-2 slots NOT dropped — the wrapping is unaffected.
      *
+     * @throws `MemberInboxMissingError` when a DEK must be delivered to a
+     *   member whose keyring predates inboxes — re-grant them once.
+     *
      * Role-elevation guard: BOTH the old and new role must satisfy
      * `db.grant`'s hierarchy. Owner can do anything; admin manages
      * admin/operator/viewer/client laterally; admin cannot promote to
@@ -257,6 +280,46 @@ export declare class Noydb {
      * }, { factors: [{ kind: 'totp' }] })
      * ```
      *
+     * ## ⚠️ A NARROWING DOES NOT REACH A SESSION THAT IS ALREADY OPEN
+     *
+     * This writes the target's keyring. It cannot reach into a `Noydb` the
+     * target already has open: an eager collection holds the records it
+     * hydrated, and nothing polls the keyring, so that session keeps serving
+     * rows it read while it still had the key. A FRESH open throws
+     * `NoAccessError` correctly (core#101), and so does that session for any
+     * collection it had not already hydrated.
+     *
+     * ⭐ A long-lived admin console — one holding a vault open while changing
+     * somebody's permissions — must RE-OPEN the affected session rather than
+     * expect its next read to start failing.
+     *
+     * ## What the window is, MEASURED — it is narrower than it sounds
+     *
+     * The consumer building that console asked the two questions a security
+     * reviewer asks, and reasoning would have got both wrong in the cautious
+     * direction. Measured on a synced vault, after `updateUser` narrowed the
+     * member away and `rotate()` re-keyed:
+     *
+     * 1. **Records arriving AFTER the narrowing are not readable.** A `pull()`
+     *    into the open session brings the new roster, the session reloads its
+     *    keyring, and reads then throw `NoAccessError` — including for rows it
+     *    had already cached. ⭐ So with sync on, the window CLOSES at the next
+     *    pull; it is not open until re-open.
+     * 2. **Writes are refused locally.** `put()` throws `ReadOnlyError` on the
+     *    narrowed collection — the record is never encrypted, never queued, and
+     *    `push()` carries nothing. Nothing reaches the remote to be judged, so
+     *    this does not even rest on the admission gate (core#74).
+     *
+     * ⛔ So it is not a confidentiality hole and not a write hole: no access is
+     * gained, nothing new becomes readable, and nothing can be written. What
+     * survives is a read of rows the session ALREADY HELD, on a device with no
+     * sync or one that has not pulled since.
+     *
+     * ⚠️ Which is still the window that matters when a narrowing is
+     * security-motivated rather than administrative — a departing member, a
+     * suspected device. `rotate()` is the answer there and a console should
+     * REQUIRE it for that case rather than offer it.
+     *
      * @throws `NoAccessError` when no keyring exists for the target.
      * @throws `PermissionDeniedError` when the role hierarchy rejects.
      * @throws `ValidationError` when no field is provided.
@@ -291,6 +354,14 @@ export declare class Noydb {
      * reaching into internals. See `noy-db rotate` for the CLI wrapper.
      * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
+    /**
+     * core#74 — the records this device's admission gate refused on pull
+     * (`PullResult.rejected`, `sync:rejected`), parked under `_sync_rejected`
+     * with the envelope intact. `list()` them; `readmit()` applies one after all
+     * (bypassing the gate); `discard()` drops the parking record. Per device:
+     * a refusal is local to the device that judged it.
+     */
+    rejected(vault: string): SyncRejectedApi;
     rotate(vault: string, collections: string[]): Promise<RotateResult>;
     /**
      * Verify every `_keyring` file in the vault. Read-only (#1121).
@@ -423,9 +494,13 @@ export declare class Noydb {
      */
     queryAcross<T>(vaultIds: string[], fn: (vault: Vault) => Promise<T>, options?: QueryAcrossOptions): Promise<QueryAcrossResult<T>[]>;
     /**
-     * @internal True once `close()` has been called. Read by outward
-     * orchestration frameworks whose entry points can't see the private
-     * `closed` field.
+     * True once `close()` has been called.
+     *
+     * ⭐ NOT `@internal`, and core#128 removed that tag rather than `_`-prefixing
+     * this: the doc's own reason — "read by outward orchestration frameworks
+     * whose entry points can't see the private `closed` field" — IS a public
+     * contract. Prefixing it would have broken the readers it exists for. The
+     * tag was the defect, not the name.
      */
     get isClosed(): boolean;
     /**
@@ -460,6 +535,18 @@ export declare class Noydb {
     pull(vault: string, options?: PullOptions): Promise<PullResult>;
     /** core#82 — replace every local envelope that fails to authenticate with the primary target's healthy copy; see `SyncEngine.realign`. */
     realign(vault: string): Promise<RealignResult>;
+    /**
+     * core#72 — make THIS device's vault authoritative on its primary target:
+     * every local record is written unconditionally (re-versioned above the
+     * target's copy where the target moved on), every id the target holds that
+     * the local vault does not gets a delete marker, the reserved collections
+     * are mirrored, and a new restore EPOCH is written on the target. Every
+     * other device's next pull crosses that epoch: its unpushed edits are parked
+     * (`db.rejected(vault)`, reason `restore-epoch`), its dirty log dropped, the
+     * target adopted wholesale. The act of a restore (`vault.load` then this), or
+     * of declaring one replica the truth. Owner/admin, ledgered by the pushes.
+     */
+    replaceRemote(vault: string): Promise<ReplaceRemoteResult>;
     /**
      * Bidirectional sync: pull then push for all targets.
      * `sync-peer` targets do pull+push; `backup`/`archive` targets do push-only.
@@ -525,7 +612,7 @@ export declare class Noydb {
     get store(): NoydbStore;
     /**
      * Currently-running multi-record transaction, or `null` outside
-     * Phase 2. `Collection.dispatchDerivations` consults this so a
+     * Phase 2. `Collection._dispatchDerivations` consults this so a
      * recursive derived-output write inside `Collection.put` can register
      * its envelope onto `ctx._executed` and roll back with the main
      * staged ops on mid-batch failure.
@@ -582,6 +669,8 @@ export declare class Noydb {
      */
     listSyncTargets(vault: string): SyncTargetInfo[];
     private getSyncEngine;
+    /** core#90 — attach a sync target to an OPEN vault (primary when it had none, else keyed by position); records written before it are sent by `push({ full: true })`. Rationale in `kernel/sync-wiring.ts`. */
+    attachSyncTarget(vault: string, target: NoydbStore | SyncTarget): Promise<void>;
     _forEachSyncEngine(vault: string, fn: (engine: SyncEngine) => void): void;
     on<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
     off<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
@@ -641,9 +730,15 @@ export declare class Noydb {
     /** @internal Session that owns this instance's writers. */
     get _sessionId(): string;
     /**
-     * @internal Drain-barrier coordination transport for the schema fence.
-     * The default store-backed provider reproduces today's fence behavior; a
-     * `by-*` real-time transport is injected via `mesh`.
+     * Drain-barrier coordination transport for the schema fence. The default
+     * store-backed provider reproduces today's fence behavior; a `by-*`
+     * real-time transport is injected via the `mesh` option.
+     *
+     * ⭐ NOT `@internal`, and core#128 removed that tag rather than
+     * `_`-prefixing this. `db.mesh` is documented as a public handle in
+     * `port/by/index.ts` — "a `Noydb` handle (`db.mesh`) without ever naming a
+     * `by-*` pack" — and `createNoydb({ mesh })` is a public option. The tag
+     * contradicted both; prefixing would have broken the documented handle.
      */
     get mesh(): NoydbMesh;
     /**
@@ -689,7 +784,7 @@ export declare class Noydb {
      *
      * @internal — not part of the public API surface
      */
-    invokeTranslator(text: string, from: string, to: string, field: string, collection: string): Promise<string>;
+    _invokeTranslator(text: string, from: string, to: string, field: string, collection: string): Promise<string>;
     /**
      * Read the active policy for a vault. Loads from `_meta/policy` on
      * first call; subsequent calls hit the in-memory cache. Throws

package/dist/kernel/rejection-seal.d.ts

@@ -0,0 +1,13 @@
+import type { EnclaveKey } from '../capsule/index.js';
+import type { EncryptedEnvelope, SyncRejection } from './types.js';
+/** core#107 — where replicated refusals live. Reserved, declared in `reserved-mirror.ts`. */
+export declare const REJECTIONS_COLLECTION = "_sync_rejections";
+/** `<collection>::<id>` — one live refusal per record, newer `_v` supersedes. */
+export declare const rejectionKey: (collection: string, id: string) => string;
+export declare function sealRejection(collection: string, id: string, rejection: SyncRejection, dek: EnclaveKey, version: number): Promise<EncryptedEnvelope>;
+/**
+ * `null` when this device cannot open it. Never throws: a member who does not
+ * hold the collection's DEK receives the envelope like everybody else (the
+ * mirror is DEK-free and copies it unconditionally) and must skip it quietly.
+ */
+export declare function openRejection(collection: string, id: string, envelope: EncryptedEnvelope, dek: EnclaveKey): Promise<SyncRejection | null>;

package/dist/kernel/sync-wiring.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The vault-side seams every sync engine of a vault is wired with — at
+ * `openVault()` and again on `attachSyncTarget()` (core#90). One function so
+ * the two paths cannot drift: `sync` used to be construction-only, which forced
+ * pilot-1's direct cloud shape (a target whose credentials come from
+ * `vault.broker()`, reachable only once the vault is open) into a two-phase
+ * open with a reconstruct in between. Attaching after open needs exactly the
+ * wiring open does, plus a replay of the conflict resolvers collections
+ * registered before the target existed — hence `conflictResolvers` on the host.
+ *
+ * @internal
+ */
+import type { Vault } from './vault.js';
+import type { CollectionConflictResolver, EncryptedEnvelope, SyncRejection } from './types.js';
+type WiredEngine = {
+    setCacheInvalidator(fn: (collection: string, id: string, action: 'put' | 'delete') => Promise<void>): void;
+    setGraphBatchController(c: {
+        begin(): void;
+        flush(): Promise<void>;
+    }): void;
+    setReservedLookupSource(s: {
+        collections(): readonly string[];
+    }): void;
+    setReservedDictExpander(fn: (names: readonly string[]) => readonly string[]): void;
+    setPeriodPullSource(s: {
+        periods(): Promise<readonly unknown[]>;
+    }): void;
+    setRosterReload(seam: {
+        userId: string;
+        reload: () => Promise<void>;
+    }): void;
+    setAdmission(a: {
+        admit(collection: string, id: string, envelope: EncryptedEnvelope, origin?: 'sync-apply' | 'push-recheck'): Promise<{
+            admitted: true;
+        } | {
+            admitted: false;
+            reason: string;
+        }>;
+    }): void;
+    setRejectionCourier(c: {
+        seal(collection: string, id: string, rejection: SyncRejection, version: number): Promise<EncryptedEnvelope | null>;
+        open(collection: string, id: string, envelope: EncryptedEnvelope): Promise<SyncRejection | null>;
+    }): void;
+    setCollectionNames(fn: () => readonly string[]): void;
+    registerConflictResolver(name: string, resolver: CollectionConflictResolver): void;
+};
+export interface EngineWiringHost {
+    readonly user: string;
+    readonly keyringCache: ReadonlyMap<string, {
+        readonly deks: ReadonlyMap<string, unknown>;
+    }>;
+    readonly conflictResolvers: ReadonlyMap<string, ReadonlyMap<string, CollectionConflictResolver>>;
+}
+export declare function wireEngine(host: EngineWiringHost, name: string, comp: Vault, engine: WiredEngine): void;
+export {};