@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/sync/index.js

@@ -3,30 +3,30 @@ import {
   SyncEngine,
   SyncTransaction,
   bootstrapKeyrings
-} from "../chunk-JA25QG5M.js";
+} from "../chunk-N6EWQ5VB.js";
 import {
   NO_SYNC
-} from "../chunk-JBMMWYOH.js";
-import "../chunk-6WS35E6X.js";
-import "../chunk-45VHWE4C.js";
-import "../chunk-FZXRLNJO.js";
-import "../chunk-UHFGK6YA.js";
-import "../chunk-RIZTZJX6.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+} from "../chunk-7UHLO4ZN.js";
+import "../chunk-A52BK5AY.js";
+import "../chunk-QVUMKG3Z.js";
+import "../chunk-6BEBWHNL.js";
+import "../chunk-XQGKS4OW.js";
+import "../chunk-LJ744WXU.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
+import "../chunk-2RH5SEY7.js";
 
 // src/with-sync/active.ts
-function withSync() {
+function withSync(options) {
   return {
     bootstrapKeyrings,
     buildSyncEngine(opts) {
-      return new SyncEngine(opts);
+      return new SyncEngine({ ...opts, ...options?.arbiter === true && { arbiter: true } });
     },
     buildSyncTransaction(vault, engine) {
       return new SyncTransaction(vault, engine);

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\nimport { bootstrapKeyrings } from './reserved-mirror.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    bootstrapKeyrings,\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\nimport { bootstrapKeyrings } from './reserved-mirror.js'\n\n/**\n * core#107 — `arbiter: true` makes this device the vault's ARBITER: its\n * admission refusals are replicated so the writer finds out, instead of\n * staying local to the device that judged them.\n *\n * ⚠️ One arbiter, named by configuration on the device that is to be it\n * (the admin host, or the daemon) — ruled over a quorum because the failure\n * mode is legible: no arbiter configured means no replication, which is\n * exactly the pre-core#107 behaviour. It is NOT an authority proof: nothing\n * stops a member hand-writing `_sync_rejections`, and the reason that is\n * tolerable is the report-only ruling — a replicated refusal never deletes,\n * tombstones or retracts anything, so the worst a forged one does is show\n * somebody a notice about their own record.\n *\n * ⚠️ THE CONDITION THAT WOULD MAKE THAT NON-BOUNDARY A REAL ONE, named by\n * pilot-1 when they accepted it: every member is currently staff of the same\n * firm, and a forged refusal is sealed under the refused record's own\n * collection DEK — so a forger can only show a notice about a record they\n * could already read. ⛔ If EXTERNAL `client`-role users ever hold\n * collections of their own, \"who may write `_sync_rejections`\" stops being\n * cosmetic and this needs an authority design, not a flag. Do not read the\n * paragraph above as a general safety argument; it is an argument about one\n * topology, and this is the trigger to re-open it.\n */\nexport interface WithSyncOptions {\n  readonly arbiter?: boolean\n}\n\nexport function withSync(options?: WithSyncOptions): SyncStrategy {\n  return {\n    bootstrapKeyrings,\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine({ ...opts, ...(options?.arbiter === true && { arbiter: true }) })\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoEO,SAAS,SAAS,SAAyC;AAChE,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,EAAE,GAAG,MAAM,GAAI,SAAS,YAAY,QAAQ,EAAE,SAAS,KAAK,EAAG,CAAC;AAAA,IACxF;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.js

@@ -1,10 +1,10 @@
 import {
   MemoryDeviceSeal,
   withTeam
-} from "../chunk-BU2ABHFW.js";
+} from "../chunk-ZOFNZLAA.js";
 import {
   beginEchoUnlock
-} from "../chunk-G66YXUTY.js";
+} from "../chunk-35CNOVQE.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -34,8 +34,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-APFFJN5T.js";
-import "../chunk-DL6BZKP3.js";
+} from "../chunk-GLSCL74M.js";
+import "../chunk-B3B6HV5S.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -56,20 +56,20 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-45VHWE4C.js";
-import "../chunk-FZXRLNJO.js";
-import "../chunk-UHFGK6YA.js";
-import "../chunk-RIZTZJX6.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+} from "../chunk-QVUMKG3Z.js";
+import "../chunk-6BEBWHNL.js";
+import "../chunk-XQGKS4OW.js";
+import "../chunk-LJ744WXU.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
 import {
   TeamNotEnabledError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 export {
   MemoryDeviceSeal,
   NO_TEAM,

package/dist/tiers/index.js

@@ -12,19 +12,19 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-Z3ZXVB2Y.js";
-import "../chunk-UHFGK6YA.js";
-import "../chunk-RIZTZJX6.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+} from "../chunk-BSEPI3HD.js";
+import "../chunk-XQGKS4OW.js";
+import "../chunk-LJ744WXU.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
 import {
   TiersNotEnabledError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,

package/dist/to/index.js

@@ -1,6 +1,6 @@
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-2ELOCEXE.js";
+} from "../chunk-URGHKZPL.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
@@ -9,7 +9,7 @@ import {
   StoreCapabilityError,
   UnknownStoreKindError,
   isConflictError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 
 // src/port/to/locator.ts
 function isPodStore(store) {

package/dist/transactions/index.js

@@ -3,15 +3,15 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-7CT6SX4M.js";
+} from "../chunk-PFHDQY5L.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-2RH5SEY7.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-WWM3DD4P.js"));
+var loadGuardExecutor = lazy(() => import("../executor-7SY3M6TZ.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 
 // src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";

package/dist/vault-head/index.js

@@ -8,14 +8,14 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+} from "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
+import "../chunk-2RH5SEY7.js";
 
 // src/with-commit/vault-head/head.ts
 function bucketIndex(collection, id, buckets) {

package/dist/{verify-KWQIWLGH.js → verify-QWO5UKD6.js}

@@ -2,25 +2,25 @@ import {
   blindedEqual,
   dualReadSealedSlot,
   openVdigPayload
-} from "./chunk-CB4467G3.js";
+} from "./chunk-5A3HOTP5.js";
 import {
   VDIG_ITERATIONS,
   pbkdf2VerifyDigest
-} from "./chunk-ABU6A4Z5.js";
+} from "./chunk-Q4DBU5RM.js";
 import {
   evaluateKofN
 } from "./chunk-NH2UOV3B.js";
-import "./chunk-OM3SEDI4.js";
+import "./chunk-HTRLQ4ZZ.js";
 import {
   base64ToBuffer,
   generateSalt,
   normalizeForVerify
-} from "./chunk-PUBI455O.js";
-import "./chunk-2ELOCEXE.js";
+} from "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/capsule/enclave-aes/classify/verify.ts
 async function padOnce(iter = VDIG_ITERATIONS) {
@@ -138,4 +138,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-KWQIWLGH.js.map
+//# sourceMappingURL=verify-QWO5UKD6.js.map

package/dist/walk-3KEOL7BY.js

@@ -0,0 +1,20 @@
+import {
+  dumpVaultSchema
+} from "./chunk-654RE5YC.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-UORWAG7K.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-IF2M43G4.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-3KEOL7BY.js.map

package/dist/with-audit/guards/types.d.ts

@@ -26,6 +26,8 @@ export interface GuardContext<T> {
     vault: ReadOnlyVaultFacade;
     userId: string;
     role: Role;
+    /** core#74 — `'sync-apply'` when the record is arriving by sync and this check runs as its admission gate; core#108 — `'push-recheck'` when it is this device's OWN dirty record being re-judged against current local state before it is pushed; absent on a local write. */
+    origin?: 'local-write' | 'sync-apply' | 'push-recheck';
 }
 /**
  * One {before, after} pair handed to an `invariant` function. `before`

package/dist/with-audit/tiers/index.d.ts

@@ -335,16 +335,16 @@ export declare function assertTierComposition(collectionName: string, cfg: {
  * structurally — no cast needed at the `tiersContext()` call site).
  */
 export interface DerivedOutputsHost<T> {
-    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+    _dispatchMaterializedViewsOnDelete(id: string): Promise<{
         deleted: number;
         residueUndecodable: string[];
         residueDeclined: string[];
     }>;
-    dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
-    dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>;
+    _dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
+    _dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>;
     /** Task 2 (#722) add-direction: the same local-write dispatchers an ordinary `put()` fires. */
-    dispatchMaterializedViews(id: string, record: T): Promise<void>;
-    dispatchDerivations(id: string, record: T, version: number): Promise<void>;
+    _dispatchMaterializedViews(id: string, record: T): Promise<void>;
+    _dispatchDerivations(id: string, record: T, version: number): Promise<void>;
 }
 /**
  * The {@link TiersContext.syncDerived} implementation collection.ts's

package/dist/with-commit/history/history.d.ts

@@ -26,6 +26,22 @@ import { type EnclaveKey } from '../../capsule/index.js';
  * both at once, by construction.
  */
 export declare function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
+/**
+ * core#76 — the inverse of `historyId`. Used by `restoreTo(T)` to discover
+ * collections that exist in history but not in the live store, which is
+ * exactly the case a point-in-time restore has to cover: a collection dropped
+ * since T would otherwise be invisible to a restore meant to bring T back.
+ *
+ * ⚠️ A collection name containing `:` would parse wrong here. That is not
+ * reachable today — `vault.collection()` rejects those names — and this
+ * function is deliberately not hardened against it, because the guard belongs
+ * at the naming boundary, not in every parser downstream of it.
+ */
+export declare function parseHistoryId(id: string): {
+    collection: string;
+    recordId: string;
+    version: number;
+} | null;
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */

package/dist/with-commit/history/restore-to.d.ts

@@ -0,0 +1,40 @@
+/**
+ * core#76 — point-in-time RESTORE, as forward writes.
+ *
+ * `vault.at(T)` reconstructs any record at T and is read-only by contract.
+ * `restoreTo(T)` takes that reconstruction and WRITES it: for every record
+ * whose state at T differs from its state now, put the T-state as a new
+ * version; for every record that exists now and did not exist at T, delete it.
+ *
+ * ## Why forward writes, and not a rewrite of history
+ *
+ * Every write goes through `Collection.put` / `.delete`, so guards, periods,
+ * history and the ledger all see it. The restore is therefore itself an
+ * audited, reversible event — `restoreTo(T)` can be undone by another
+ * `restoreTo`, the ledger's tamper-evidence is untouched, and the result
+ * replicates through ordinary sync because it IS ordinary versioned writes.
+ * ⭐ That is the whole argument for this over a pod: a pod restore is state
+ * REPLACEMENT and needs core#71/#72 to be safe under sync; this needs nothing,
+ * because the stack already knows how to gate, audit and replicate a write.
+ *
+ * ## What bounds it
+ *
+ * ⚠️ Accuracy is bounded by history retention. If `historyConfig.maxVersions`
+ * pruned the versions around T, the reconstruction at T is incomplete and so
+ * is the restore — `at(T)` returns null for a record whose earliest retained
+ * snapshot is after T, and this treats that as "did not exist at T". A vault
+ * that prunes history cannot honestly point-in-time restore past the prune
+ * horizon, and a pod is the answer there (core#77).
+ *
+ * ⛔ BLOBS ARE NOT RESTORED AND ARE NOT REPORTED. `_history` holds record
+ * envelopes, not chunks; a record's blob fields at T reference chunks that may
+ * since have been compacted away. The record comes back with its handles
+ * intact and the chunks may or may not still be there. Detecting that
+ * reliably means resolving every handle against `_blob_chunks`, which is a
+ * blob-subsystem concern this module deliberately does not reach into — a
+ * `blobsUnrecoverable: []` that is empty because nothing looked would be worse
+ * than the silence, because it would read as a guarantee.
+ */
+import type { RestoreToOptions, RestoreToResult } from '../../kernel/types.js';
+import type { RestoreToHost } from '../../port/with/restore-host.js';
+export declare function restoreTo(host: RestoreToHost, timestamp: string, options?: RestoreToOptions): Promise<RestoreToResult>;

package/dist/with-party/broker/seed.d.ts

@@ -36,6 +36,7 @@
  * @module
  */
 import type { StoreCredentials } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../capsule/index.js';
 import type { BrokerSeedCtx } from '../../port/with/broker-strategy.js';
 /**
  * Enrol (idempotent, two-phase commit — I9): create-if-absent the `_broker`
@@ -71,6 +72,9 @@ export declare function rotateSeed(ctx: BrokerSeedCtx): Promise<void>;
 export declare function enrolMemberSeed(ctx: BrokerSeedCtx, member: {
     readonly userId: string;
     readonly secret: string;
+} | {
+    readonly userId: string;
+    readonly dek: EnclaveKey;
 }): Promise<void>;
 /**
  * core#73 — de-register a member with the host and drop its record. Called

package/dist/with-party/custody/strategy.d.ts

@@ -20,7 +20,7 @@
  */
 import type { GrantOptions, RevokeOptions, FactorProofBundle, NoydbStore } from '../../kernel/types.js';
 import type { Vault } from '../../kernel/vault.js';
-import type { UnlockedKeyring } from '../team/keyring.js';
+import type { UnlockedKeyring, RevokeResult } from '../team/keyring.js';
 import type { GrantCustodianOptions } from './index.js';
 import type { LiberateOptions, LiberateResult } from './liberate.js';
 /**
@@ -33,7 +33,7 @@ import type { LiberateOptions, LiberateResult } from './liberate.js';
  */
 export interface CustodyHost {
     _grantCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
-    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
 }
 export interface CustodyStrategy {
     grantCustodian(host: CustodyHost, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;

package/dist/with-party/team/delegation.d.ts

@@ -19,11 +19,23 @@
  *   collection,     // collection name OR null for "every collection"
  *   record,         // optional specific record id
  *   until,          // ISO timestamp — token expires at this instant
- *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK
+ *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, under the token's content key
+ *   sealedCek,      // that content key, RSA-OAEP-sealed to the target's inbox public half
  *   createdAt,      // ISO timestamp
  * }
  * ```
  *
+ * ## Cross-user (core#65)
+ *
+ * The wrap key is a per-token CONTENT KEY, not anybody's KEK: the tier DEKs are
+ * AES-KW-wrapped under it exactly as they used to be under a KEK, and the key
+ * itself is RSA-OAEP-sealed to the target's INBOX PUBLIC HALF (core#96 mints
+ * that pair for every grantee, private half sealed under a DEK only that
+ * member's own KEK unwraps). So a grantor delegates to somebody whose secret it
+ * does not know — the thing this module could not do — while the slot NAMES
+ * stay readable to any member holding the `_delegations` DEK, which is what
+ * makes an audit enumeration possible without making the keys usable.
+ *
  * The ciphertext is stored as a normal noy-db envelope — the
  * `_delegations` collection has its own DEK shared across all vault
  * users, so an operator can enumerate active delegations for audit
@@ -91,6 +103,18 @@ export interface DelegationToken {
      * otherwise.
      */
     readonly wrappedDeks?: Readonly<Record<string, string>>;
+    /**
+     * core#65 — the token's CONTENT KEY, RSA-OAEP-sealed to the target's inbox
+     * public half. `wrappedDek` / `wrappedDeks` are AES-KW-wrapped under it, so
+     * only the target can unwrap them, and only they can: the matching private
+     * half is sealed in their keyring under a DEK their own KEK unwraps.
+     *
+     * Absent on a token written before core#65, whose wraps are under the
+     * grantor's own KEK — those still load for a target that shares that KEK
+     * (the only case that ever worked) and are skipped for anyone else, exactly
+     * as before.
+     */
+    readonly sealedCek?: string;
     readonly createdAt: string;
 }
 export interface IssueDelegationOptions {
@@ -101,11 +125,13 @@ export interface IssueDelegationOptions {
     readonly until: Date | string;
 }
 /**
- * Build and persist a delegation token. The caller must hold a tier-N
- * DEK and must have already located the target user's keyring file
- * (so the `wrappedDek` can be re-wrapped against their KEK).
+ * Build and persist a delegation token. The caller must hold a tier-N DEK; the
+ * target must have a keyring in this vault with an inbox key pair (core#96).
+ *
+ * core#65 — the wraps are keyed to a per-token content key sealed to that
+ * pair, so the grantor needs nothing of the target's but their PUBLIC half.
  */
-export declare function issueDelegation(store: NoydbStore, vault: string, grantor: UnlockedKeyring, targetKek: EnclaveKey | null, delegationsDek: EnclaveKey, opts: IssueDelegationOptions): Promise<DelegationToken>;
+export declare function issueDelegation(store: NoydbStore, vault: string, grantor: UnlockedKeyring, delegationsDek: EnclaveKey, opts: IssueDelegationOptions): Promise<DelegationToken>;
 /**
  * ## Why the vault calls this EXPLICITLY, and never from `openVault` (core#56)
  *
@@ -121,13 +147,17 @@ export declare function issueDelegation(store: NoydbStore, vault: string, granto
  * cheap to honour, and its "periodic intervals (tracked by the caller)" is what
  * an explicit method is.
  *
- * ## ⚠️ Cross-user delegation does not work yet
+ * ## Cross-user delegation (core#65) — and the one thing it still needs
+ *
+ * A token's wraps are keyed to a per-token content key sealed to the target's
+ * INBOX PUBLIC HALF, so any member can be a target. Opening one therefore needs
+ * that member's inbox PRIVATE half, which is sealed in their keyring file under
+ * `deks[INBOX_KEY_ID]` — so this function reads the caller's own keyring file,
+ * once, and only when a sealed token is actually addressed to them.
  *
- * `Vault.delegate()` wraps against the GRANTOR's own KEK — its own comment calls
- * that "a simpler first cut" pending a per-target KEK exchange. A token issued
- * to somebody else cannot be unwrapped by them, and this function skips it. What
- * works today is a token whose target shares the issuing KEK. That limit belongs
- * to `delegate()`; do not "fix" it here.
+ * ⚠️ A pre-core#65 token (no `sealedCek`) is wrapped under the GRANTOR's KEK and
+ * still requires `user.kek`; it is skipped for anyone who does not share it,
+ * which is the behaviour those tokens were written under.
  */
 /**
  * Enumerate every live (non-expired) delegation addressed to `toUser`

package/dist/with-party/team/index.d.ts

@@ -18,6 +18,8 @@ export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { PodRecipient, ListUsersOptions } from './keyring.js';
+export type { RotateResult, QuarantineResult, RosterVerifyResult } from './keyring.js';
+export type { DelegationToken, IssueDelegationOptions } from './delegation.js';
 export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, revokeAuthenticator, // #1445 — the three-step revocation; removeAuthenticator alone only hides
 updateAuthenticator, findAuthenticator, } from './authenticators.js';