@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/with-party/team/keyring.d.ts

@@ -99,8 +99,18 @@ export interface LoadKeyringOptions {
      * That user's secret — a single string for a standard keyring, or the
      * structured 3-part {@link EchoSecretParts} for an echo keyring (spec
      * #940, AG-1: a single string can never unlock an echo keyring).
+     * One of `secret` / `kek` is required.
      */
-    readonly secret: string | EchoSecretParts;
+    readonly secret?: string | EchoSecretParts;
+    /**
+     * core#96 — a KEK this session already HOLDS, instead of re-deriving one
+     * from a secret. The in-session roster reload (core#82) uses it: the secret
+     * the vault was opened with is stale after an in-session `rotateSecret`,
+     * and 600K PBKDF2 iterations are not needed to adopt a file this KEK
+     * already opens. A file re-keyed under this member by somebody else fails
+     * the canary and reports `InvalidKeyError` — a defined event, not a hang.
+     */
+    readonly kek?: EnclaveKey;
 }
 /**
  * KDF dispatch for tier-1 unlock (spec #940). An echo keyring accepts
@@ -186,8 +196,18 @@ export interface CreateOwnerKeyringOptions extends SecretPolicy {
 export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
 export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
+/**
+ * Reserved DEK-map slots that are KEYS, not collections, and can never be
+ * rotated — `rotateKeys` refuses each by name. Every caller that derives a
+ * rotation scope from a DEK map (`revoke`, `quarantineKeyring`) strips these
+ * first. ⛔ Kept as ONE set rather than a filter per caller: `quarantineKeyring`
+ * stripped only `_roster` and broke the moment the owner keyring gained an
+ * inbox key (core#65), which is the second time this list grew and a caller
+ * was missed.
+ */
+export declare const NON_ROTATABLE_SLOTS: ReadonlySet<string>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
-export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<RevokeResult>;
 /** What {@link verifyRoster} found. */
 export interface RosterVerifyResult {
     /**
@@ -306,7 +326,19 @@ export declare function quarantineKeyring(store: NoydbStore, vault: string, call
  * @throws `ValidationError` when the diff is empty (nothing to update).
  *
  */
-export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
+/** What `updateKeyringIdentity` hands back to the kernel (core#96). */
+export interface UpdateKeyringResult {
+    /** The role moved. The kernel re-registers the member with a broker host, if one is configured. */
+    readonly roleChanged: boolean;
+    /**
+     * A fresh `_broker_member` DEK, delivered through the inbox, when the member
+     * is (still) a sub-admin after a role change — the kernel seals the new seed
+     * under it and re-enrols. Absent otherwise (a promotion to owner/admin drops
+     * the slot: those roles use the shared `_broker` seed).
+     */
+    readonly brokerMemberDek?: EnclaveKey;
+}
+export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<UpdateKeyringResult>;
 /**
  * Rotate DEKs for specified collections:
  * 1. Generate new DEKs
@@ -351,11 +383,38 @@ export interface RotateResult {
         readonly userId: string;
         readonly reason: KeyringTamperedReason;
     }>;
+    /**
+     * core#100 — every record this rotation re-encrypted, with its version.
+     * Rotation writes through the raw store, invisible to the sync dirty log,
+     * so a replica kept the OLD ciphertext until each record was edited again —
+     * a revoked member with store access went on reading it, and a survivor
+     * handed the new DEK read `TamperedError` (measured by pilot-1). The kernel
+     * dirty-tracks these on every sync engine so the next push carries them.
+     */
+    readonly rewritten: ReadonlyArray<{
+        readonly collection: string;
+        readonly id: string;
+        readonly version: number;
+    }>;
+}
+/** core#100 — what `revoke` hands the kernel: the rotation's rewrites, for the dirty log. */
+export interface RevokeResult {
+    readonly rewritten: RotateResult['rewritten'];
 }
 /** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
 export interface RotateKeysOptions {
     /** Collections whose DEKs are re-minted. */
     readonly collections: readonly string[];
+    /**
+     * core#100 — members who must NOT be delivered the new keys: the member
+     * being revoked or quarantined (a store that suppresses the `_keyring`
+     * delete leaves their file in place — #1043 — and delivering to it would
+     * hand the revoked member the very key the rotation exists to take away),
+     * and a member being narrowed (the collection just left their file, but a
+     * pending inbox slot for it cannot be pulled out of its box). They get the
+     * drop, and appear in `needsRegrant` as before.
+     */
+    readonly exclude?: readonly string[];
 }
 export declare function rotateKeys(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions): Promise<RotateResult>;
 /** Options for {@link changeSecret} (#846b). */
@@ -507,7 +566,38 @@ export declare function ensureCollectionDEK(store: NoydbStore, vault: string, ke
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */
 export declare function hasAccess(keyring: UnlockedKeyring, collectionName: string): boolean;
+export declare function mintInboxKey(kek: EnclaveKey): Promise<{
+    wrappedInboxKey: string;
+    inboxKeyAes: EnclaveKey;
+    inboxKey: NonNullable<KeyringFile['inbox_key']>;
+}>;
+/** core#96 — the collections a member has pending in their inbox, over every box. */
+export declare function inboxSlots(file: Pick<KeyringFile, 'inbox'>): string[];
+/**
+ * core#65 — this member's INBOX KEY PAIR, rebuilt from their keyring file: the
+ * private half is sealed under `deks[INBOX_KEY_ID]`, which only their own KEK
+ * unwraps. The inbox drain below opens boxes with it; `with-party/team/
+ * delegation.ts` opens a delegation's content key with the same pair, so a
+ * grantor can hand a member a key without knowing their secret.
+ */
+export declare function openInboxKeyPair(inboxKey: NonNullable<KeyringFile['inbox_key']>, inboxKeyAes: EnclaveKey): Promise<CryptoKeyPair>;
 /** Persist a keyring file to the store. */
+/**
+ * ⛔⛔ core#132 — DO NOT ADD A RETRY HERE. An earlier cut of this change did,
+ * and it was wrong in a way that looked like a fix.
+ *
+ * This function writes the caller's in-memory `keyring.deks` WHOLESALE. If a
+ * CAS fails, the write that lost was based on a stale version — retrying it
+ * re-persists that same map over the winner's, which is exactly the clobber
+ * the CAS just caught, laundered into a success. The suite went green and the
+ * data loss stayed.
+ *
+ * ⭐ The resolution belongs where the intent is, not where the write is. The
+ * only caller that races in practice is the lazy DEK mint in
+ * `ensureCollectionDEK`, and it can resolve correctly because it has not
+ * encrypted anything yet: on conflict it adopts the winner's key and returns
+ * that. See the comment there.
+ */
 export declare function persistKeyring(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
@@ -559,3 +649,43 @@ export declare function hasImportCapability(keyring: UnlockedKeyring, tier: 'bun
  */
 export declare function evaluateImportCapability(capability: ImportCapability | undefined, role: Role, tier: 'plaintext', format: ExportFormat): boolean;
 export declare function evaluateImportCapability(capability: ImportCapability | undefined, role: Role, tier: 'bundle'): boolean;
+/**
+ * core#132 — what this write is based on.
+ *
+ * `{ on }` is the envelope the edit was computed from; the write then CASes
+ * against its `_v` and lands at `_v + 1`. `'create'` is a keyring that did not
+ * exist.
+ *
+ * ⭐ REQUIRED, not optional, and that is the point: keyring writes were a bare
+ * `store.put` with no `expectedVersion`, so two concurrent edits to one member
+ * were last-writer-wins, silently. Making the basis a required parameter means
+ * the COMPILER enumerates every call site — `NON_ROTATABLE_SLOTS`' own comment
+ * records two defects caused by enumerating callers with grep instead.
+ *
+ * ⭐ `'create'` IS protected, since core#134: it writes with
+ * `expectedVersion: 0`. Every version hub writes starts at 1, so on a store
+ * that compares only when the record is present, 0 lets the first create
+ * through and conflicts every later one — an exact "write only if absent",
+ * with no sentinel in the signature and no seventh method on the six-method
+ * store contract. #134 costed both; neither was needed.
+ *
+ * ⚠️ What made it adoptable was an ASSERTION, not a mechanism. The behaviour
+ * was already universal when censused (2026-09-24 — `to-aws-s3` implements this
+ * sentinel by name), but `@noy-db/ports/to` asserted none of it, so a
+ * third-party adapter owed it nothing and this would have been a silent
+ * correctness dependency on behaviour no gate checked. The kit's absent case
+ * (core#138) holds it, and `noy-db/to` ran it green across 19 adapters before
+ * this line changed.
+ *
+ * ⛔ Still NOT protected, and do not read this as closing it: a MIXED FLEET. An
+ * older hub writes keyrings at `_v: 1` with no `expectedVersion` at all, so it
+ * clobbers a new hub's create as readily as its update.
+ */
+export type KeyringWriteBasis = {
+    readonly on: EncryptedEnvelope;
+} | 'create';
+/** The basis for a write computed from a `readKeyringFile` result. */
+export declare const basisOf: (found: {
+    readonly envelope: EncryptedEnvelope;
+} | undefined) => KeyringWriteBasis;
+export declare function writeKeyringFile(store: NoydbStore, vault: string, userId: string, keyringFile: KeyringFile, basis: KeyringWriteBasis): Promise<void>;

package/dist/with-party/team/managed-secret.d.ts

@@ -111,7 +111,7 @@ export declare class MemorySealer implements NoydbSealer {
      * says `unseal` MUST throw on tamper, and a double that silently returns
      * corrupted bytes is not modelling the contract it stands in for. Without
      * it, every managed-mode test ran against a provider that could not fail
-     * the way a real one must (found by @noy-db/test-sealer-conformance).
+     * the way a real one must (found by @noy-db/ports/at).
      */
     private tag;
     seal(secret: Uint8Array): Promise<Uint8Array>;

package/dist/with-party/team/noydb-facade.d.ts

@@ -24,7 +24,7 @@ import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResu
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
 import type { Vault } from '../../kernel/vault.js';
-import type { UnlockedKeyring } from './keyring.js';
+import type { UnlockedKeyring, RevokeResult } from './keyring.js';
 import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from './authenticators.js';
 import type { QuickUnlockStore, QuickUnlockState } from '../session/unlock-state.js';
 import type { SecretPolicy } from '../../kernel/validation.js';
@@ -58,6 +58,8 @@ export interface TeamFacadeDeps {
         readonly userId: string;
         readonly secret: string;
     }): Promise<void>;
+    /** core#96 — pull a member's keyring file from every sync target before an authority edit. */
+    refreshRoster(vault: string, userId: string): Promise<void>;
     /** Managed-recovery enrolment check (kernel-resident). */
     assertRecoveryEnrolled(vault: string, policy: VaultPolicy, opts?: {
         skipManagedCheck?: boolean;
@@ -76,7 +78,7 @@ export declare class TeamFacade {
     /** Gate + run a `grant` engine. See `Noydb.grant` for the public contract. */
     runGrant(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
-    runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<RevokeResult>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
     runRotate(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
     /** Gate + run the `verifyRoster` engine (#1121). See `Noydb.verifyRoster`. */
@@ -171,6 +173,7 @@ export declare class TeamFacade {
      *     meta: {
      *       credentialId: e.credentialId,
      *       wrapIv: e.wrapIv,
+     *       rpId: e.rpId,
      *       prfUsed: e.prfUsed,
      *       beFlag: e.beFlag,
      *       requireSingleDevice: e.requireSingleDevice,
@@ -179,6 +182,15 @@ export declare class TeamFacade {
      * })
      * ```
      *
+     * `meta` is a free-form blob — hub validates `credentialId` and nothing
+     * else, so this example IS the contract for what a slot carries. Record
+     * `rpId` (core#140): the slot rewrap / rotation ceremony falls back to
+     * `meta.rpId` when the caller passes no `options.rpId` and the enrollment
+     * record predates `WebAuthnEnrollment.rpId`. Omitting it does not break
+     * single-hostname deployments — absence correctly reads as "send no RP ID"
+     * — but on a shared registrable domain rotation then works only if every
+     * caller remembers to pass the RP ID by hand.
+     *
      * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
      * for the caller's lookup index (a bootstrap vault, a Cover,
      * a server-side allowlist).

package/dist/with-party/team/roster-tag.d.ts

@@ -44,7 +44,7 @@ export interface RosterTag {
     readonly iv: string;
     readonly data: string;
 }
-export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch' | 'clearance'>;
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch' | 'clearance' | 'inbox_key' | 'inbox'>;
 export declare function rosterCanonical(file: RosterAuthorityFields): string;
 export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
 /**

package/dist/with-pod/backup.d.ts

@@ -1,4 +1,4 @@
-import type { NoydbStore, EncryptedEnvelope, ExportStreamOptions, ExportChunk } from '../kernel/types.js';
+import type { NoydbStore, EncryptedEnvelope, LoadPodOptions, LoadPodResult, ExportStreamOptions, ExportChunk } from '../kernel/types.js';
 import type { LedgerStore } from '../with-commit/history/ledger/store.js';
 /** Everything the moving backup methods touched on the vault's `this.*`. */
 export interface BackupContext {
@@ -18,6 +18,13 @@ export interface BackupContext {
      * callback (plaintext vaults / test constructions).
      */
     reloadKeyringAndRebuildDEK(): Promise<void>;
+    /**
+     * core#71 — reset every sync engine attached to the vault after a restore:
+     * the dirty log, the watermarks, the adopted epoch. A restore is a new base;
+     * the pre-restore dirty entries refer to records the load just replaced.
+     * Absent on test constructions without sync.
+     */
+    resetSync?(): Promise<void>;
     /** Clear the vault's collection cache (post-load). */
     clearCollectionCache(): void;
     /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */
@@ -42,23 +49,8 @@ export type VerifyBackupResult = {
     readonly id: string;
     readonly message: string;
 };
-/**
- * Dump vault as a verifiable encrypted JSON backup string.
- *
- * backups embed the current ledger head and the full `_ledger` +
- * `_ledger_deltas` internal collections so the receiver can run
- * `verifyBackupIntegrity()` after `load()` and detect any tampering between
- * dump and restore. Backups produced without a ledger skip the integrity check
- * with a warning — both modes round-trip cleanly.
- */
 export declare function dumpVault(ctx: BackupContext): Promise<string>;
-/**
- * Restore a vault from a verifiable backup. After loading, runs
- * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and
- * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load
- * with a console warning and skip the integrity check.
- */
-export declare function loadVault(ctx: BackupContext, backupJson: string): Promise<void>;
+export declare function loadVault(ctx: BackupContext, backupJson: string, options?: LoadPodOptions): Promise<LoadPodResult>;
 /**
  * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data
  * envelope cross-check (every current record's `_data` hash must match the

package/dist/with-sync/active.d.ts

@@ -30,4 +30,31 @@
  * @public
  */
 import type { SyncStrategy } from './strategy.js';
-export declare function withSync(): SyncStrategy;
+/**
+ * core#107 — `arbiter: true` makes this device the vault's ARBITER: its
+ * admission refusals are replicated so the writer finds out, instead of
+ * staying local to the device that judged them.
+ *
+ * ⚠️ One arbiter, named by configuration on the device that is to be it
+ * (the admin host, or the daemon) — ruled over a quorum because the failure
+ * mode is legible: no arbiter configured means no replication, which is
+ * exactly the pre-core#107 behaviour. It is NOT an authority proof: nothing
+ * stops a member hand-writing `_sync_rejections`, and the reason that is
+ * tolerable is the report-only ruling — a replicated refusal never deletes,
+ * tombstones or retracts anything, so the worst a forged one does is show
+ * somebody a notice about their own record.
+ *
+ * ⚠️ THE CONDITION THAT WOULD MAKE THAT NON-BOUNDARY A REAL ONE, named by
+ * pilot-1 when they accepted it: every member is currently staff of the same
+ * firm, and a forged refusal is sealed under the refused record's own
+ * collection DEK — so a forger can only show a notice about a record they
+ * could already read. ⛔ If EXTERNAL `client`-role users ever hold
+ * collections of their own, "who may write `_sync_rejections`" stops being
+ * cosmetic and this needs an authority design, not a flag. Do not read the
+ * paragraph above as a general safety argument; it is an argument about one
+ * topology, and this is the trigger to re-open it.
+ */
+export interface WithSyncOptions {
+    readonly arbiter?: boolean;
+}
+export declare function withSync(options?: WithSyncOptions): SyncStrategy;

package/dist/with-sync/engine.d.ts

@@ -1,5 +1,9 @@
-import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole, RealignResult } from '../kernel/types.js';
+import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole, RealignResult, SyncRejectedApi, ReplaceRemoteResult } from '../kernel/types.js';
+/** core#74 — where a device parks the records its admission gate refused. Local-only: never mirrored, never full-pushed. */
+export declare const REJECTED_COLLECTION = "_sync_rejected";
 import type { MergeAuthority } from '../port/with/merge-authority.js';
+import type { AdmissionAuthority } from '../port/with/admission-authority.js';
+import type { RejectionCourier } from '../port/with/rejection-courier.js';
 import { type PeriodPullSource } from './period-scope.js';
 import type { NoydbEventEmitter } from '../kernel/events.js';
 import type { SyncPolicy } from '../kernel/sync-policy.js';
@@ -13,7 +17,14 @@ export interface ReservedLookupSource {
 }
 /** Sync engine: dirty tracking, push, pull, conflict resolution, scheduling. */
 export declare class SyncEngine {
+    #private;
     private readonly mergeAuthority;
+    /** core#74 — the vault's admission gate for incoming records; wired at open like the other vault seams. */
+    private admission;
+    /** core#107 — the vault's sealing capability for replicated refusals; wired at open like `admission`. */
+    private courier;
+    /** core#107 — this device's refusals replicate. Configuration, not an authority proof — see `withSync`. */
+    private readonly arbiter;
     private readonly local;
     private readonly remote;
     private readonly strategy;
@@ -29,6 +40,8 @@ export declare class SyncEngine {
     /** #1036 — last SUCCESSFUL push/pull. Never advanced by a failed attempt. */
     private lastPush;
     private lastPull;
+    /** core#72 — the target's restore epoch this device adopted; null before any. */
+    private epoch;
     /**
      * #1036 — the failure that ended the most recent attempt, cleared by the next
      * success. Live state only: deliberately NOT persisted in `_sync/meta`, since a
@@ -89,9 +102,37 @@ export declare class SyncEngine {
     private periodPullSource?;
     /** Wire the period-window source (#807). Same injection pattern as `setReservedLookupSource`. */
     setPeriodPullSource(source: PeriodPullSource): void;
+    /** core#81 — the collections this keyring names; the walk set for a paged pull. Wired by the vault at open. */
+    private collectionNames?;
+    /** Wire the paged-pull walk set (core#81). Same injection pattern as `setCacheInvalidator`. */
+    setCollectionNames(fn: () => readonly string[]): void;
+    /**
+     * core#81 — one chunk per page of one collection, for `pull({ paged: true })`.
+     * `listPage` when the store offers it (200 per page), else `list` + `get` in
+     * batches of the same size. Never more than one page in memory.
+     */
+    private pagedChunks;
     /** core#82 — when a pull replaces the caller's OWN keyring file, the vault reloads it in place. */
     private rosterReload?;
     /** Wire the roster-reload seam (core#82). Same injection pattern as `setCacheInvalidator`. */
+    /** core#107 — wire the vault's rejection sealing capability. */
+    setRejectionCourier(c: RejectionCourier): void;
+    /** core#74 — wire the vault's admission gate. */
+    setAdmission(a: AdmissionAuthority): void;
+    /** core#71 — after `vault.load()`: a new base. Drops the dirty log, the watermarks and the adopted epoch. */
+    resetAfterRestore(): Promise<void>;
+    /**
+     * core#72 — make the LOCAL vault authoritative on this target. Every local
+     * record goes up unconditionally, re-sealed above the target's version where
+     * the target moved on (so every peer's copy is superseded); every id the
+     * target holds that the local vault lacks gets a delete marker at
+     * `remote._v + 1` (so every peer removes it); the reserved collections are
+     * mirrored; then a new epoch is written at `_sync/epoch`. The dirty log is
+     * cleared: the target IS the local state now.
+     */
+    replaceRemote(): Promise<ReplaceRemoteResult>;
+    /** core#74 — the parked refusals on this device, and their two fates. */
+    rejected(): SyncRejectedApi;
     setRosterReload(seam: {
         userId: string;
         reload: () => Promise<void>;
@@ -128,6 +169,8 @@ export declare class SyncEngine {
          * bound to the keys rather than the engine reaching for them.
          */
         mergeAuthority?: MergeAuthority;
+        /** core#107 — this device is the vault's arbiter: its refusals replicate. */
+        arbiter?: boolean;
     });
     /** Start the sync scheduler. Called after vault is fully opened. */
     startScheduler(): void;
@@ -163,9 +206,16 @@ export declare class SyncEngine {
      */
     remirrorPairResolvers(names: readonly string[]): void;
     /** Record a local change for later push. */
-    trackChange(collection: string, id: string, action: 'put' | 'delete', version: number): Promise<void>;
+    trackChange(collection: string, id: string, action: DirtyEntry['action'], version: number): Promise<void>;
     /** Remove a dirty entry (satellite fan-out revert cleanup — spec #591). */
     removeDirty(collection: string, id: string): Promise<void>;
+    /**
+     * core#92 — mark every user-collection record in the local store dirty at its
+     * current version, so the next push sends it (CAS against `_v - 1`, so a
+     * remote that already holds a newer copy resolves through the conflict path
+     * instead of being overwritten). Records already dirty keep their entry.
+     */
+    markAllDirty(): Promise<void>;
     /** Push dirty records to remote adapter. Accepts optional `PushOptions` for partial sync. */
     push(options?: PushOptions): Promise<PushResult>;
     /** Pull remote records to local adapter. Accepts optional `PullOptions` for partial sync. */
@@ -209,6 +259,13 @@ export declare class SyncEngine {
      * what the caller can read. Requires a `MergeAuthority` (a vault-attached
      * engine on an encrypted vault).
      */
+    /**
+     * core#96 (pilot-1, finding B) — bring one member's keyring file down from
+     * this target if the target's copy supersedes ours. Called by the kernel
+     * before an authority edit; reloads the caller's own keyring in place when
+     * it is the one refreshed (core#82).
+     */
+    refreshKeyring(userId: string): Promise<boolean>;
     realign(): Promise<RealignResult>;
     status(): SyncStatus;
     /** Start auto-sync: listen for online/offline events, optional periodic sync. */

package/dist/with-sync/index.d.ts

@@ -28,6 +28,7 @@
  * directly. This subpath is the clean LTS factory entry point.
  */
 export { withSync } from './active.js';
+export type { WithSyncOptions } from './active.js';
 export type { SyncStrategy } from './strategy.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_SYNC } from './strategy.js';

package/dist/with-sync/reserved-mirror.d.ts

@@ -26,7 +26,9 @@
  * | `_meta/invite-audit-*` | higher `_v` wins | single-use evidence for magic links (core#83) |
  * | `_users` | higher `_v` wins | the directory's user envelopes; a member app renders these |
  * | `_delegations` | higher `_v` wins | delegation tokens; revocation is a delete |
+ * | `_broker`, `_broker_member` | higher `_v` wins | broker seeds (core#91) — sealed under DEKs only their holder has; a fresh device mints from them |
  * | `_history`, `_ledger` | NOT replicated | per-device evidence: the ledger is a hash chain per writer, two devices appending would fork it; `vault.at(T)` runs where history lives |
+ * | `_sync_rejections` | higher `_v` wins | core#107 — the arbiter's refusals, sealed under the refused record's own collection DEK |
  * | `_sync` | NOT replicated | this device's dirty log and watermarks |
  * | `_meta/schema-fence`, `_meta/handle`, other `_meta` | NOT replicated | session and instance state; the rest of `_meta` is decided one id at a time |
  *
@@ -49,12 +51,13 @@
  * the acting device and is pushed through the dirty log as
  * `(collection, id, 'delete')`. On PULL, a record the remote lacks and the
  * local holds is deleted locally only when (a) the remote carries at least
- * one record of that collection — a target never pushed to is not evidence
- * of revocation — and (b) no dirty entry protects it (a grant made offline,
- * not yet pushed). Invite audit docs are never deleted; revocation is a
+ * one KEYRING file — a target never pushed to is not evidence of revocation,
+ * but a collection that emptied by revocation is exactly what must propagate
+ * (core#91) — and (b) no dirty entry protects it (a grant made offline, not
+ * yet pushed). Invite audit docs are never deleted; revocation is a
  * field update, which the `_v` rule carries.
  */
-import type { NoydbStore } from '../kernel/types.js';
+import type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js';
 export interface ReservedMirrorResult {
     /** Records written to `to`. */
     readonly copied: number;
@@ -62,9 +65,29 @@ export interface ReservedMirrorResult {
     readonly deleted: number;
     /** Ids of `_keyring` files copied — the roster reload seam reads this for the caller's own file. */
     readonly keyringsCopied: readonly string[];
+    /**
+     * core#96 (pilot-1, finding B) — push only: local `_keyring` files the epoch
+     * rule did not write and whose content differs from the remote's (the remote
+     * is ahead, or the two diverged at one epoch). The local edit LOST; the
+     * engine reports each as a `Conflict` so an authority edit made on a stale
+     * copy is never silently dropped.
+     */
+    readonly staleKeyrings?: readonly {
+        readonly id: string;
+        readonly local: EncryptedEnvelope;
+        readonly remote: EncryptedEnvelope;
+    }[];
 }
 /** The push half: mirror every declared rule from `local` to `remote`. Never deletes. */
 export declare function pushReserved(local: NoydbStore, remote: NoydbStore, vault: string): Promise<ReservedMirrorResult>;
+/**
+ * core#96 (pilot-1, finding B) — bring ONE member's keyring file down from the
+ * target if the target's copy supersedes the local one. The kernel calls it
+ * before every authority edit (`grant` on an existing user, `updateUser`,
+ * `revoke`, `recoverUser`), so the edit is made on the current file and its
+ * push wins instead of being discarded by the epoch rule. One GET.
+ */
+export declare function pullKeyringFile(remote: NoydbStore, local: NoydbStore, vault: string, userId: string): Promise<boolean>;
 /**
  * The pull half: mirror every declared rule from `remote` into `local`, then
  * propagate revocations under the two guards in the module doc.

package/dist/with-sync/strategy.d.ts

@@ -50,6 +50,8 @@ export interface BuildSyncEngineOptions {
     label?: string;
     /** #1042 — the merge's verify/re-stamp capability, bound to the keys by the caller. */
     mergeAuthority?: MergeAuthority;
+    /** core#107 — this device is the vault's arbiter: its admission refusals replicate. */
+    arbiter?: boolean;
 }
 /**
  * @internal

package/dist/withdraw-accessible-OZU525ND.js

@@ -0,0 +1,25 @@
+import {
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-FUHUGKDN.js";
+import "./chunk-U43RSPPX.js";
+import "./chunk-4N4OIVK3.js";
+import "./chunk-WQUIJPN4.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-OZU525ND.js.map

package/dist/withdraw-accessible-OZU525ND.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.9.0-pre.0",
+  "version": "0.9.0-pre.2",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "Apache-2.0",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -276,8 +276,8 @@
     "happy-dom": "^18.0.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/attestation": "0.9.0-pre.0",
-    "@noy-db/shamir": "0.9.0-pre.0"
+    "@noy-db/attestation": "0.9.0-pre.2",
+    "@noy-db/shamir": "0.9.0-pre.2"
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0",

package/dist/api-MSJXVYQG.js

@@ -1,18 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-GCUMOKTN.js";
-import "./chunk-FZXRLNJO.js";
-import "./chunk-4J3MNVVX.js";
-import "./chunk-ZBUAX4EF.js";
-import "./chunk-SPPOUJLN.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-OM3SEDI4.js";
-import "./chunk-PUBI455O.js";
-import "./chunk-2ELOCEXE.js";
-import "./chunk-VSUQI5Q6.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-MSJXVYQG.js.map