@noy-db/hub 0.9.0 → 0.10.0-pre.1

package/dist/sealed-record/index.js

@@ -1,6 +1,6 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-UMV5GBTJ.js";
+} from "../chunk-PZZWAHEJ.js";
 import {
   base64ToBuffer,
   decrypt,
@@ -8,31 +8,31 @@ import {
   recordAadFor,
   sealedBodyArgs
 } from "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../capsule-YQKQZPH7.js");
+      const { sealRecordToHost } = await import("../capsule-QJJFUUSH.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../capsule-YQKQZPH7.js");
+      const { revokeSealedRecord } = await import("../capsule-QJJFUUSH.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../capsule-YQKQZPH7.js");
+      const { rotateRecordCek } = await import("../capsule-QJJFUUSH.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/search/index.js

@@ -9,7 +9,7 @@ import {
   segmentTokens,
   tokenize,
   withSearch
-} from "../chunk-DL4GCSTS.js";
+} from "../chunk-VX72USUQ.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
@@ -17,11 +17,11 @@ import {
   DEFAULT_INDEX_MIN_VECTORS,
   withVectorIndex
 } from "../chunk-NYMLINRP.js";
-import "../chunk-UQRKAM2R.js";
-import "../chunk-PIO6NW7O.js";
+import "../chunk-ZZZVNHN2.js";
+import "../chunk-ZZLIFVZG.js";
 import {
   SearchNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 export {
   DEFAULT_INDEX_MIN_VECTORS,
   InvertedIndex,

package/dist/{seed-BVYDPVIW.js → seed-XHQQF6LJ.js}

@@ -6,10 +6,10 @@ import {
   loadKeyring,
   readKeyringFile,
   requireRosterKey
-} from "./chunk-QVUMKG3Z.js";
-import "./chunk-6BEBWHNL.js";
-import "./chunk-XQGKS4OW.js";
-import "./chunk-LJ744WXU.js";
+} from "./chunk-WVML7HUZ.js";
+import "./chunk-PQGCWTTI.js";
+import "./chunk-OCSKQUNE.js";
+import "./chunk-KFYUQMF5.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -19,12 +19,12 @@ import {
   openEnvelopeJson,
   writeEnvelopeBody
 } from "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
+import "./chunk-OJAFKGI7.js";
+import "./chunk-6B4X447I.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
+import "./chunk-YIVAKBCW.js";
+import "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -33,7 +33,7 @@ import {
   TamperedError,
   ValidationError,
   isConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/with-party/broker/seed.ts
 function isAdminRole(keyring) {
@@ -331,4 +331,4 @@ export {
   revokeMemberSeed,
   rotateSeed
 };
-//# sourceMappingURL=seed-BVYDPVIW.js.map
+//# sourceMappingURL=seed-XHQQF6LJ.js.map

package/dist/sequence/index.js

@@ -5,17 +5,17 @@ import {
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "../chunk-CLOSXHR4.js";
+} from "../chunk-VPG2UJYR.js";
 import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
 import {
   SequenceNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 export {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,

package/dist/session/index.js

@@ -12,23 +12,23 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-QQLXKDGC.js";
+} from "../chunk-JWLVBYP4.js";
 import {
   NO_SESSION
 } from "../chunk-VKQCVU2Z.js";
 import "../chunk-4AOERLTV.js";
 import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 
 // src/with-party/session/active.ts
 function withSession() {

package/dist/shadow/index.js

@@ -1,11 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-RF5WDM25.js";
+} from "../chunk-G2KLVCKO.js";
 import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-JGYCKX56.js";
 
 // src/with-fork/shadow/active.ts
 function withShadow() {

package/dist/{signer-TW5MAQJP.js → signer-CP6XZLE3.js}

@@ -4,15 +4,15 @@ import {
   SIGNER_RECORD_ID,
   loadOrCreateSigner,
   loadSigner
-} from "./chunk-IPF5ORDI.js";
+} from "./chunk-RRI3JBD6.js";
 import "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
+import "./chunk-OJAFKGI7.js";
+import "./chunk-6B4X447I.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+import "./chunk-YIVAKBCW.js";
+import "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
+import "./chunk-JGYCKX56.js";
 export {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
@@ -20,4 +20,4 @@ export {
   loadOrCreateSigner,
   loadSigner
 };
-//# sourceMappingURL=signer-TW5MAQJP.js.map
+//# sourceMappingURL=signer-CP6XZLE3.js.map

package/dist/snapshots/index.js

@@ -4,19 +4,19 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-4N4OIVK3.js";
-import "../chunk-WQUIJPN4.js";
+} from "../chunk-BCJAUHSG.js";
+import "../chunk-HOK5KGBO.js";
 import "../chunk-GMKGGY7V.js";
 import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 
 // src/with-fork/snapshots/engine.ts
 var SnapshotEngine = class {

package/dist/{stale-CROGJBIJ.js → stale-XY2QUSGU.js}

@@ -6,16 +6,16 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-27NCEPKM.js";
+} from "./chunk-AYUMAPOS.js";
 import "./chunk-5D2ALSM5.js";
 import "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
+import "./chunk-OJAFKGI7.js";
+import "./chunk-6B4X447I.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+import "./chunk-YIVAKBCW.js";
+import "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
+import "./chunk-JGYCKX56.js";
 export {
   MV_STALE_COLLECTION,
   clearMVStale,
@@ -25,4 +25,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-CROGJBIJ.js.map
+//# sourceMappingURL=stale-XY2QUSGU.js.map

package/dist/{storage-SO2L2Z5J.js → storage-QTM6JYQF.js}

@@ -5,17 +5,17 @@ import {
   savePersistedSchema
 } from "./chunk-IF2M43G4.js";
 import "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
+import "./chunk-OJAFKGI7.js";
+import "./chunk-6B4X447I.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+import "./chunk-YIVAKBCW.js";
+import "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
+import "./chunk-JGYCKX56.js";
 export {
   SCHEMAS_COLLECTION,
   loadPersistedSchema,
   loadPersistedSchemaEntry,
   savePersistedSchema
 };
-//# sourceMappingURL=storage-SO2L2Z5J.js.map
+//# sourceMappingURL=storage-QTM6JYQF.js.map

package/dist/{store-coordination-provider-2YD2PTTP.js → store-coordination-provider-F7YG22D3.js}

@@ -5,13 +5,13 @@ import {
 import {
   buildRecordEnvelope
 } from "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
+import "./chunk-OJAFKGI7.js";
+import "./chunk-6B4X447I.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+import "./chunk-YIVAKBCW.js";
+import "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
+import "./chunk-JGYCKX56.js";
 
 // src/with-shape/schema-update/client-registry.ts
 var META_COLLECTION = "_meta";
@@ -144,4 +144,4 @@ function unref(timer) {
 export {
   StoreMesh
 };
-//# sourceMappingURL=store-coordination-provider-2YD2PTTP.js.map
+//# sourceMappingURL=store-coordination-provider-F7YG22D3.js.map

package/dist/sync/index.js

@@ -3,23 +3,23 @@ import {
   SyncEngine,
   SyncTransaction,
   bootstrapKeyrings
-} from "../chunk-N6EWQ5VB.js";
+} from "../chunk-CE443VXM.js";
 import {
   NO_SYNC
 } from "../chunk-7UHLO4ZN.js";
-import "../chunk-A52BK5AY.js";
-import "../chunk-QVUMKG3Z.js";
-import "../chunk-6BEBWHNL.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
+import "../chunk-B24ODIKE.js";
+import "../chunk-WVML7HUZ.js";
+import "../chunk-PQGCWTTI.js";
+import "../chunk-OCSKQUNE.js";
+import "../chunk-KFYUQMF5.js";
 import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
+import "../chunk-JGYCKX56.js";
 
 // src/with-sync/active.ts
 function withSync(options) {

package/dist/team/index.js

@@ -1,10 +1,10 @@
 import {
   MemoryDeviceSeal,
   withTeam
-} from "../chunk-ZOFNZLAA.js";
+} from "../chunk-ESDYDGPH.js";
 import {
   beginEchoUnlock
-} from "../chunk-35CNOVQE.js";
+} from "../chunk-YWEPWJRG.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -34,7 +34,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-GLSCL74M.js";
+} from "../chunk-XBG6YJPK.js";
 import "../chunk-B3B6HV5S.js";
 import {
   buildEchoBlock,
@@ -56,20 +56,20 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-QVUMKG3Z.js";
-import "../chunk-6BEBWHNL.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
+} from "../chunk-WVML7HUZ.js";
+import "../chunk-PQGCWTTI.js";
+import "../chunk-OCSKQUNE.js";
+import "../chunk-KFYUQMF5.js";
 import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
 import {
   TeamNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 export {
   MemoryDeviceSeal,
   NO_TEAM,

package/dist/tiers/index.js

@@ -12,19 +12,19 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-BSEPI3HD.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
+} from "../chunk-PR2R57YF.js";
+import "../chunk-OCSKQUNE.js";
+import "../chunk-KFYUQMF5.js";
 import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
 import {
   TiersNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,

package/dist/to/index.js

@@ -1,6 +1,6 @@
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-URGHKZPL.js";
+} from "../chunk-VUBRHJ4H.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
@@ -9,7 +9,7 @@ import {
   StoreCapabilityError,
   UnknownStoreKindError,
   isConflictError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 
 // src/port/to/locator.ts
 function isPodStore(store) {

package/dist/transactions/index.js

@@ -3,15 +3,15 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-PFHDQY5L.js";
+} from "../chunk-PVQIME6P.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-JGYCKX56.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-7SY3M6TZ.js"));
+var loadGuardExecutor = lazy(() => import("../executor-BVVZ5UHG.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-JGYCKX56.js";
 
 // src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";

package/dist/vault-head/index.js

@@ -9,13 +9,13 @@ import {
   encrypt,
   openEnvelopeJson
 } from "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
+import "../chunk-OJAFKGI7.js";
+import "../chunk-6B4X447I.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-YIVAKBCW.js";
+import "../chunk-6Y3UJT5H.js";
+import "../chunk-VUBRHJ4H.js";
+import "../chunk-JGYCKX56.js";
 
 // src/with-commit/vault-head/head.ts
 function bucketIndex(collection, id, buckets) {

package/dist/{verify-QWO5UKD6.js → verify-FT5COLP2.js}

@@ -2,25 +2,25 @@ import {
   blindedEqual,
   dualReadSealedSlot,
   openVdigPayload
-} from "./chunk-5A3HOTP5.js";
+} from "./chunk-GLSRKIU3.js";
 import {
   VDIG_ITERATIONS,
   pbkdf2VerifyDigest
-} from "./chunk-Q4DBU5RM.js";
+} from "./chunk-RQLCOSEJ.js";
 import {
   evaluateKofN
 } from "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-YIVAKBCW.js";
 import {
   base64ToBuffer,
   generateSalt,
   normalizeForVerify
-} from "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
+} from "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-JGYCKX56.js";
 
 // src/capsule/enclave-aes/classify/verify.ts
 async function padOnce(iter = VDIG_ITERATIONS) {
@@ -138,4 +138,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-QWO5UKD6.js.map
+//# sourceMappingURL=verify-FT5COLP2.js.map

package/dist/{walk-3KEOL7BY.js → walk-52FW6EKP.js}

@@ -7,14 +7,14 @@ import "./chunk-UORWAG7K.js";
 import "./chunk-Y2NBBT6K.js";
 import "./chunk-IF2M43G4.js";
 import "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
+import "./chunk-OJAFKGI7.js";
+import "./chunk-6B4X447I.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+import "./chunk-YIVAKBCW.js";
+import "./chunk-6Y3UJT5H.js";
+import "./chunk-VUBRHJ4H.js";
+import "./chunk-JGYCKX56.js";
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-3KEOL7BY.js.map
+//# sourceMappingURL=walk-52FW6EKP.js.map

package/dist/with-party/team/delegation.d.ts

@@ -4,9 +4,10 @@
  * A higher-tier user can issue a delegation that grants another user
  * temporary access to records at a specified tier. The delegation is
  * persisted as an encrypted envelope in the reserved `_delegations`
- * collection. The target user's runtime scans this collection on every
- * open and, while `until` is still in the future, merges the
- * unwrapped tier DEKs into their in-memory DEK map.
+ * collection. While `until` is still in the future, the target merges the
+ * unwrapped tier DEKs into their in-memory DEK map by calling
+ * `Vault.refreshDelegations()` — EXPLICIT, never automatic; the core#56
+ * section below says why a read path must not scan on open.
  *
  * ## Token shape
  *
@@ -39,14 +40,14 @@
  * The ciphertext is stored as a normal noy-db envelope — the
  * `_delegations` collection has its own DEK shared across all vault
  * users, so an operator can enumerate active delegations for audit
- * without being able to *use* them (the `wrappedDek` inside is still
- * keyed to the target user's KEK).
+ * without being able to *use* them (the `wrappedDek` inside is keyed to
+ * the token's own content key — see the core#65 section above).
  *
  * ## Revocation
  *
- * Delete the `_delegations/<id>` envelope. The target user's runtime
- * reloads the delegation list at each open and at periodic intervals
- * (tracked by the caller — this module is pure logic).
+ * Delete the `_delegations/<id>` envelope. The target picks the change up
+ * at its next `Vault.refreshDelegations()` call — this module is pure
+ * logic and schedules nothing.
  *
  * @module
  */
@@ -56,8 +57,9 @@ import { type EnclaveKey } from '../../capsule/index.js';
 export declare const DELEGATIONS_COLLECTION = "_delegations";
 /**
  * Durable payload of a delegation token. Encrypted under the vault's
- * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped
- * under the target user's KEK.
+ * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped under
+ * the token's per-token CONTENT KEY — see {@link DelegationToken.sealedCek},
+ * which carries the pre-core#65 exception.
  */
 export interface DelegationToken {
     readonly id: string;
@@ -75,8 +77,10 @@ export interface DelegationToken {
     readonly until: string;
     /**
      * The delegated tier DEK for {@link DelegationToken.collection}, wrapped
-     * under the target's KEK. Present on a per-collection token; absent on a
-     * collection-wide one, which carries {@link DelegationToken.wrappedDeks}.
+     * under the token's content key — see {@link DelegationToken.sealedCek},
+     * which carries the pre-core#65 exception. Present on a per-collection
+     * token; absent on a collection-wide one, which carries
+     * {@link DelegationToken.wrappedDeks}.
      */
     readonly wrappedDek?: string;
     /**