@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.6

package/dist/{chunk-JIHH26WQ.js → chunk-XG7OZDOS.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-MUPZ6IZX.js";
 import {
   openEnvelopeJson
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-MMVQ3SUO.js";
 import {
   encrypt
 } from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-DOZFU7OZ.js";
 import {
   NoydbError
 } from "./chunk-6SYOHUHM.js";
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-JIHH26WQ.js.map
+//# sourceMappingURL=chunk-XG7OZDOS.js.map

package/dist/{chunk-QBOQI6PG.js → chunk-XONZGK6J.js}

@@ -4,7 +4,7 @@ import {
   chainAnchor,
   loadPeriods,
   validatePeriodName
-} from "./chunk-7ICV4ASA.js";
+} from "./chunk-IUATR5UE.js";
 
 // src/with-audit/periods/active.ts
 function withPeriods() {
@@ -20,4 +20,4 @@ function withPeriods() {
 export {
   withPeriods
 };
-//# sourceMappingURL=chunk-QBOQI6PG.js.map
+//# sourceMappingURL=chunk-XONZGK6J.js.map

package/dist/{chunk-YQQPNXNO.js → chunk-XSOGLHGY.js}

@@ -201,7 +201,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-VWXRV2XU.js");
+      const { revealSealedField } = await import("./reveal-7OOT5XPD.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -244,4 +244,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-YQQPNXNO.js.map
+//# sourceMappingURL=chunk-XSOGLHGY.js.map

package/dist/{chunk-3OWYOECI.js → chunk-XY6MNSAF.js}

@@ -1,14 +1,14 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-K4BWPNJO.js";
+} from "./chunk-MLCTPWSO.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-OMSKGLYA.js";
+} from "./chunk-WWBC4KLB.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-DOZFU7OZ.js";
 import {
   NoydbError
 } from "./chunk-6SYOHUHM.js";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-3OWYOECI.js.map
+//# sourceMappingURL=chunk-XY6MNSAF.js.map

package/dist/chunk-XZHEOSQ2.js

@@ -0,0 +1,16 @@
+// src/with-lookup/reduce/canonical-key.ts
+function canonicalGroupKey(fields, row) {
+  const sorted = [...fields].sort();
+  const parts = [];
+  for (const name of sorted) {
+    const v = row[name];
+    const serialised = v === void 0 ? "undefined" : JSON.stringify(v);
+    parts.push(`${name}=${serialised}`);
+  }
+  return parts.join("|");
+}
+
+export {
+  canonicalGroupKey
+};
+//# sourceMappingURL=chunk-XZHEOSQ2.js.map

package/dist/chunk-XZHEOSQ2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/reduce/canonical-key.ts"],"sourcesContent":["/**\n * Canonicalise a group-key tuple to a stable string for dedup hashing.\n *\n * Sorts field names lexicographically before serialising, so that\n * `.groupBy('a', 'b')` and `.groupBy('b', 'a')` produce identical\n * keys for the same logical group. Values are JSON-stringified;\n * `undefined` and `null` are distinguished (matching the Map-key\n * semantics in `groupAndReduce`).\n *\n * NOT part of the public API. Used by:\n *   - `groupAndReduce` for the dedup Map's key\n *   - `materialized-views/query-hash` for UNION MV cross-arm row-key dedup (PR 2)\n *\n * Pure: same input → same output, no side effects.\n */\nexport function canonicalGroupKey(\n  fields: readonly string[],\n  row: Record<string, unknown>,\n): string {\n  const sorted = [...fields].sort()\n  const parts: string[] = []\n  for (const name of sorted) {\n    const v = row[name]\n    const serialised =\n      v === undefined ? 'undefined' : JSON.stringify(v)\n    parts.push(`${name}=${serialised}`)\n  }\n  return parts.join('|')\n}\n"],"mappings":";AAeO,SAAS,kBACd,QACA,KACQ;AACR,QAAM,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK;AAChC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,QAAQ;AACzB,UAAM,IAAI,IAAI,IAAI;AAClB,UAAM,aACJ,MAAM,SAAY,cAAc,KAAK,UAAU,CAAC;AAClD,UAAM,KAAK,GAAG,IAAI,IAAI,UAAU,EAAE;AAAA,EACpC;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;","names":[]}

package/dist/{chunk-X3MWEFPT.js → chunk-YGMREQAK.js}

@@ -1,12 +1,12 @@
 import {
   openEnvelopeJson
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-MMVQ3SUO.js";
 import {
   encrypt
 } from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-DOZFU7OZ.js";
 import {
   ConflictError,
   SequenceContentionError,
@@ -199,4 +199,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-X3MWEFPT.js.map
+//# sourceMappingURL=chunk-YGMREQAK.js.map

package/dist/chunk-YMUFFJCO.js

@@ -0,0 +1,23 @@
+// src/with-lookup/reduce/strategy.ts
+var NOT_ENABLED = new Error(
+  'Aggregate / groupBy is not enabled on this Noydb instance. Import `{ withReduce }` from "@noy-db/hub/reduce" and pass it to `createNoydb({ reduceStrategy: withReduce() })`.'
+);
+var NO_REDUCE = {
+  aggregate() {
+    throw NOT_ENABLED;
+  },
+  groupBy() {
+    throw NOT_ENABLED;
+  },
+  groupByN() {
+    throw NOT_ENABLED;
+  },
+  scanAggregate() {
+    throw NOT_ENABLED;
+  }
+};
+
+export {
+  NO_REDUCE
+};
+//# sourceMappingURL=chunk-YMUFFJCO.js.map

package/dist/chunk-YMUFFJCO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/reduce/strategy.ts"],"sourcesContent":["/**\n * Strategy seam between the core Query / ScanBuilder chain and the\n * optional aggregate / groupBy service. Core imports\n * `ReduceStrategy` as a TYPE-ONLY symbol and `NO_REDUCE` as a\n * tiny runtime stub.\n *\n * The heavy machinery — `Reduction`, `GroupedQuery`, the\n * reducer-step logic — is only reachable from `withReduce()` in\n * `./active.ts`, which is only exported through the\n * `@noy-db/hub/reduce` subpath. Consumers that don't import the\n * subpath ship none of the ~886 LOC.\n *\n * @internal\n */\n\nimport type {\n  Reduction,\n  ReduceSpec,\n  ReduceResult,\n  ReductionUpstream,\n} from './reduction.js'\nimport type { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { ViaPipeline } from '../../kernel/via/pipeline.js'\n\n/**\n * Seam interface. `@internal` — will promote to public only when the\n * aggregate service is extracted into its own package.\n *\n * @internal\n */\nexport interface ReduceStrategy {\n  /**\n   * Build an `Reduction<R>` for `Query.aggregate(spec)`. `executeRecords`\n   * is a closure that produces the matching record set when the\n   * reduction runs. NO_REDUCE throws; the active strategy\n   * constructs a real `Reduction`.\n   */\n  aggregate<Spec extends ReduceSpec>(\n    executeRecords: () => readonly unknown[],\n    spec: Spec,\n    upstreams: readonly ReductionUpstream[],\n  ): Reduction<ReduceResult<Spec>>\n\n  /**\n   * Build a `GroupedQuery<T, F, S>` for `Query.groupBy(field)`. Same\n   * closure / upstream inputs as `aggregate` plus the group key field.\n   */\n  groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(\n    executeRecords: () => readonly unknown[],\n    field: F,\n    upstreams: readonly ReductionUpstream[],\n    dictLabelResolver?: (\n      key: string,\n      locale: string,\n      fallback?: string | readonly string[],\n    ) => Promise<string | undefined>,\n    via?: ViaPipeline,\n  ): GroupedQuery<T, F, S, M>\n\n  /**\n   * Variadic-keyed sibling — builds a `GroupedQueryN<T, F, S>` for\n   * `Query.groupBy(...fields)`. No dictLabelResolver — `<field>Label`\n   * projection only applies to single-field groupings, which dispatch\n   * through `groupBy` above.\n   */\n  groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(\n    executeRecords: () => readonly unknown[],\n    fields: F,\n    upstreams: readonly ReductionUpstream[],\n    via?: ViaPipeline,\n  ): GroupedQueryN<T, F, S, M>\n\n  /**\n   * Terminal streaming aggregator for `ScanBuilder.aggregate(spec)`.\n   * Takes an async iterable of decrypted records + the spec and\n   * returns the reduced result.\n   */\n  scanAggregate<Spec extends ReduceSpec>(\n    iter: AsyncIterable<unknown>,\n    spec: Spec,\n  ): Promise<ReduceResult<Spec>>\n}\n\nconst NOT_ENABLED = new Error(\n  'Aggregate / groupBy is not enabled on this Noydb instance. ' +\n  'Import `{ withReduce }` from \"@noy-db/hub/reduce\" and pass it to ' +\n  '`createNoydb({ reduceStrategy: withReduce() })`.',\n)\n\n/**\n * No-aggregate stub. Every `.aggregate()` / `.groupBy()` / streaming\n * `scan().aggregate()` call throws with a pointer at the subpath. The\n * real `Reduction` / `GroupedQuery` classes are never referenced at\n * runtime, so the bundler drops the ~886 LOC.\n *\n * @internal\n */\nexport const NO_REDUCE: ReduceStrategy = {\n  aggregate() { throw NOT_ENABLED },\n  groupBy() { throw NOT_ENABLED },\n  groupByN() { throw NOT_ENABLED },\n  scanAggregate() { throw NOT_ENABLED },\n}\n"],"mappings":";AAmFA,IAAM,cAAc,IAAI;AAAA,EACtB;AAGF;AAUO,IAAM,YAA4B;AAAA,EACvC,YAAY;AAAE,UAAM;AAAA,EAAY;AAAA,EAChC,UAAU;AAAE,UAAM;AAAA,EAAY;AAAA,EAC9B,WAAW;AAAE,UAAM;AAAA,EAAY;AAAA,EAC/B,gBAAgB;AAAE,UAAM;AAAA,EAAY;AACtC;","names":[]}

package/dist/{chunk-3LJYHE7S.js → chunk-ZDFU34XY.js}

@@ -5,7 +5,7 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-6RPWILRH.js";
+} from "./chunk-7IQWHYL2.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -20,7 +20,7 @@ import {
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-DOZFU7OZ.js";
 import {
   DirectoryDisabledError,
   InvalidKeyError,
@@ -477,6 +477,7 @@ async function rotateKeys(adapter, vault, callerKeyring, collections) {
     callerKeyring.deks.set(collName, newDek);
   }
   await persistKeyring(adapter, vault, callerKeyring);
+  const needsRegrant = [];
   const userIds = await adapter.list(vault, "_keyring");
   for (const userId of userIds) {
     if (userId === callerKeyring.userId) continue;
@@ -484,11 +485,12 @@ async function rotateKeys(adapter, vault, callerKeyring, collections) {
     if (!userEnvelope) continue;
     const userKeyringFile = JSON.parse(userEnvelope._data);
     const updatedDeks = { ...userKeyringFile.deks };
-    for (const collName of collections) {
-      delete updatedDeks[collName];
-    }
     const updatedPermissions = { ...userKeyringFile.permissions };
     for (const collName of collections) {
+      if (collName in updatedDeks || collName in updatedPermissions) {
+        needsRegrant.push({ userId, collection: collName });
+      }
+      delete updatedDeks[collName];
       delete updatedPermissions[collName];
     }
     const updatedKeyring = {
@@ -498,6 +500,7 @@ async function rotateKeys(adapter, vault, callerKeyring, collections) {
     };
     await writeKeyringFile(adapter, vault, userId, updatedKeyring);
   }
+  return { needsRegrant };
 }
 async function changeSecret(adapter, vault, keyring, newSecret, secretOpts) {
   if (!secretOpts?.allowWeakSecret) {
@@ -775,4 +778,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-3LJYHE7S.js.map
+//# sourceMappingURL=chunk-ZDFU34XY.js.map