@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.17

package/dist/{chunk-WMZQCXZ5.js → chunk-OAWVM5L6.js}

@@ -3,22 +3,22 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-4VRZDYRE.js";
+} from "./chunk-C52CJDFO.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-A3WHDOWI.js";
+} from "./chunk-6JRIYG2C.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-53PWELSC.js";
+} from "./chunk-N4GAJSRQ.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -88,4 +88,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-WMZQCXZ5.js.map
+//# sourceMappingURL=chunk-OAWVM5L6.js.map

package/dist/{chunk-IQGIPRSE.js → chunk-OXRPH6AR.js}

@@ -1,9 +1,9 @@
 import {
   envelopePayloadHash
-} from "./chunk-53PWELSC.js";
+} from "./chunk-N4GAJSRQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   DictKeyMissingError,
   PermissionDeniedError
@@ -389,4 +389,4 @@ export {
   dictCollectionName,
   LookupHandle
 };
-//# sourceMappingURL=chunk-IQGIPRSE.js.map
+//# sourceMappingURL=chunk-OXRPH6AR.js.map

package/dist/{chunk-TY6N3PAC.js → chunk-P5ARVLNW.js}

@@ -1,13 +1,13 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-TWPTRJEU.js";
+} from "./chunk-NWPR2V5W.js";
 import {
   sha256Hex
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   ReadOnlyError
 } from "./chunk-I64WQSN3.js";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-TY6N3PAC.js.map
+//# sourceMappingURL=chunk-P5ARVLNW.js.map

package/dist/{chunk-IGE6XWKK.js → chunk-QC2HGYFX.js}

@@ -1,7 +1,7 @@
 import {
   grant,
   revoke
-} from "./chunk-LJDW6LQJ.js";
+} from "./chunk-WBHQX6ME.js";
 import {
   CustodyNotEnabledError
 } from "./chunk-I64WQSN3.js";
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-UEYC4QLJ.js");
+      const { liberateVault } = await import("./liberate-2DNJ7AJ7.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-IGE6XWKK.js.map
+//# sourceMappingURL=chunk-QC2HGYFX.js.map

package/dist/{chunk-PZLIA5R3.js → chunk-QJBXB4WU.js}

@@ -1,12 +1,12 @@
 import {
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   ConflictError,
   USER_ENVELOPE_COLLECTION,
@@ -148,4 +148,4 @@ export {
   deleteUserEnvelope,
   listUserEnvelopeIds
 };
-//# sourceMappingURL=chunk-PZLIA5R3.js.map
+//# sourceMappingURL=chunk-QJBXB4WU.js.map

package/dist/{chunk-H5U4T6JK.js → chunk-QKRJUPAC.js}

@@ -1,18 +1,18 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-TY6N3PAC.js";
+} from "./chunk-P5ARVLNW.js";
 import {
   resolveManagedSecret
-} from "./chunk-55B3KHZW.js";
+} from "./chunk-JAHIL6WO.js";
 import {
   createOwnerKeyring
-} from "./chunk-LJDW6LQJ.js";
+} from "./chunk-WBHQX6ME.js";
 import {
   wrapKey
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   PermissionDeniedError
 } from "./chunk-I64WQSN3.js";
@@ -131,4 +131,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-H5U4T6JK.js.map
+//# sourceMappingURL=chunk-QKRJUPAC.js.map

package/dist/{chunk-6E2JZRBD.js → chunk-RGPB25DB.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 
 // src/kernel/enclave/record-envelope.ts
 function buildRecordEnvelope(identity, body) {
@@ -57,4 +57,4 @@ export {
   isDeleteMarker,
   buildDeleteMarker
 };
-//# sourceMappingURL=chunk-6E2JZRBD.js.map
+//# sourceMappingURL=chunk-RGPB25DB.js.map

package/dist/{chunk-THUITYH7.js → chunk-SDEHNGWW.js}

@@ -1,6 +1,6 @@
 import {
   pickLocale
-} from "./chunk-I5OLA3H6.js";
+} from "./chunk-N7HOHWKF.js";
 import {
   sha256Hex
 } from "./chunk-QTDAPDDV.js";
@@ -812,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-6HG5FP3I.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-MVFQCLXY.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -1058,4 +1058,4 @@ export {
   readPodRedirect,
   readPod
 };
-//# sourceMappingURL=chunk-THUITYH7.js.map
+//# sourceMappingURL=chunk-SDEHNGWW.js.map

package/dist/{chunk-PJGMBELR.js → chunk-SJOK23XT.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-LFHRV6JH.js"));
+var loadMVExecutor = lazy(() => import("./executor-FNGVGDW3.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-PJGMBELR.js.map
+//# sourceMappingURL=chunk-SJOK23XT.js.map

package/dist/{chunk-WMUN7ZUD.js → chunk-UKKBKEUI.js}

@@ -1,7 +1,7 @@
 import {
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-JZVXGOJE.js";
+} from "./chunk-BMDF4TLU.js";
 import {
   PolicyDeniedError,
   ValidationError
@@ -364,4 +364,4 @@ export {
   describeGate,
   createNoydbPolicy
 };
-//# sourceMappingURL=chunk-WMUN7ZUD.js.map
+//# sourceMappingURL=chunk-UKKBKEUI.js.map

package/dist/{chunk-MKSTUVMJ.js → chunk-UNR6G3EJ.js}

@@ -5,14 +5,14 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-NY6RQBUN.js";
+} from "./chunk-ES36R3U2.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-A3WHDOWI.js";
+} from "./chunk-6JRIYG2C.js";
 import {
   assemblePodContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-THUITYH7.js";
+} from "./chunk-SDEHNGWW.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -23,14 +23,14 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-53PWELSC.js";
+} from "./chunk-N4GAJSRQ.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 import {
   buildRecordEnvelope
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-RGPB25DB.js";
 import {
   bufferToBase64,
   decrypt,
@@ -43,7 +43,7 @@ import {
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   PartitionExtractionError
 } from "./chunk-I64WQSN3.js";
@@ -490,4 +490,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-MKSTUVMJ.js.map
+//# sourceMappingURL=chunk-UNR6G3EJ.js.map

package/dist/{chunk-VUUUIKRG.js → chunk-URVL4EKU.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -75,4 +75,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-VUUUIKRG.js.map
+//# sourceMappingURL=chunk-URVL4EKU.js.map

package/dist/{chunk-4CSG6KBX.js → chunk-V3OLO4TK.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-S6CP5FWF.js";
 import {
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   NoydbError
 } from "./chunk-I64WQSN3.js";
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-4CSG6KBX.js.map
+//# sourceMappingURL=chunk-V3OLO4TK.js.map

package/dist/{chunk-76FBDG6M.js → chunk-VEA35MQP.js}

@@ -1,14 +1,14 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-TY6N3PAC.js";
+} from "./chunk-P5ARVLNW.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-TWPTRJEU.js";
+} from "./chunk-NWPR2V5W.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   NoydbError
 } from "./chunk-I64WQSN3.js";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-76FBDG6M.js.map
+//# sourceMappingURL=chunk-VEA35MQP.js.map

package/dist/{chunk-4DJQU3PH.js → chunk-VQQUOEON.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-3JQVA527.js";
 import {
   putDerivedOutput
-} from "./chunk-OPGKH5RD.js";
+} from "./chunk-DEP24EE3.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
 } from "./chunk-QI2KXQOM.js";
@@ -307,4 +307,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-4DJQU3PH.js.map
+//# sourceMappingURL=chunk-VQQUOEON.js.map

package/dist/{chunk-UVFO25FJ.js → chunk-VUQZYVYX.js}

@@ -5,11 +5,11 @@ import {
 import {
   applyRewrappedBody,
   rewrapBodyToDek
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-BKYQNNO3.js";
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-RGPB25DB.js";
 import {
   decrypt,
   encrypt,
@@ -17,7 +17,7 @@ import {
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   PersistedIndexCompensationError,
   TierDemoteDeniedError,
@@ -378,4 +378,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-UVFO25FJ.js.map
+//# sourceMappingURL=chunk-VUQZYVYX.js.map

package/dist/{chunk-LJDW6LQJ.js → chunk-WBHQX6ME.js}

@@ -5,16 +5,17 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-PZLIA5R3.js";
+} from "./chunk-QJBXB4WU.js";
+import {
+  rekeyEnvelopeIfNeeded
+} from "./chunk-BKYQNNO3.js";
 import {
   base64ToBuffer,
   bufferToBase64,
-  decrypt,
   deriveEchoKey,
   deriveKey,
   deriveSecretKey,
   encodeEchoParts,
-  encrypt,
   generateDEK,
   generateIV,
   generateSalt,
@@ -24,7 +25,7 @@ import {
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-5UGEGEIJ.js";
 import {
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
@@ -343,6 +344,13 @@ async function loadKeyring(store, vault, opts) {
       if (firstUnwrapError === null) firstUnwrapError = err;
     }
   }
+  const pendingDeks = /* @__PURE__ */ new Map();
+  for (const [collName, wrapped] of Object.entries(keyringFile.pending_deks ?? {})) {
+    try {
+      pendingDeks.set(collName, await unwrapKey(wrapped, kek));
+    } catch {
+    }
+  }
   if (canaryOk === true) {
     if (failedCollections.length > 0) {
       throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
@@ -369,6 +377,7 @@ async function loadKeyring(store, vault, opts) {
     role: keyringFile.role,
     permissions: keyringFile.permissions,
     deks,
+    pendingDeks,
     kek,
     salt,
     authenticators: keyringFile.authenticators ?? [],
@@ -556,6 +565,11 @@ async function findAdminDescendants(store, vault, rootUserId) {
 async function revoke(store, vault, callerKeyring, options) {
   const targetFound = await readKeyringFile(store, vault, options.userId);
   if (!targetFound) {
+    const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
+    if (pending.length > 0) {
+      await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return;
+    }
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
   const targetKeyring = targetFound.file;
@@ -636,8 +650,14 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
   }
   const newDeks = /* @__PURE__ */ new Map();
   for (const collName of collections) {
-    newDeks.set(collName, await generateDEK());
+    newDeks.set(collName, callerKeyring.pendingDeks?.get(collName) ?? await generateDEK());
+  }
+  const pending = callerKeyring.pendingDeks ?? /* @__PURE__ */ new Map();
+  callerKeyring.pendingDeks = pending;
+  for (const [collName, newDek] of newDeks) {
+    pending.set(collName, newDek);
   }
+  await persistKeyring(store, vault, callerKeyring);
   for (const collName of collections) {
     const oldDek = callerKeyring.deks.get(collName);
     const newDek = newDeks.get(collName);
@@ -646,20 +666,13 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
     for (const id of ids) {
       const envelope = await store.get(vault, collName, id);
       if (!envelope || !envelope._iv) continue;
-      const plaintext = await decrypt(envelope._iv, envelope._data, oldDek);
-      const { iv, data } = await encrypt(plaintext, newDek);
-      const newEnvelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: envelope._v,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data
-      };
-      await store.put(vault, collName, id, newEnvelope);
+      const newEnvelope = await rekeyEnvelopeIfNeeded(envelope, oldDek, newDek);
+      if (newEnvelope !== null) await store.put(vault, collName, id, newEnvelope);
     }
   }
   for (const [collName, newDek] of newDeks) {
     callerKeyring.deks.set(collName, newDek);
+    callerKeyring.pendingDeks?.delete(collName);
   }
   await persistKeyring(store, vault, callerKeyring);
   const needsRegrant = [];
@@ -916,6 +929,10 @@ async function persistKeyring(store, vault, keyring) {
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
   }
+  const wrappedPending = {};
+  for (const [collName, dek] of keyring.pendingDeks ?? []) {
+    wrappedPending[collName] = await wrapKey(dek, keyring.kek);
+  }
   const canary = await mintKeyringCanary(keyring.kek);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
@@ -924,6 +941,7 @@ async function persistKeyring(store, vault, keyring) {
     role: keyring.role,
     permissions: keyring.permissions,
     deks: wrappedDeks,
+    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {},
     salt: bufferToBase64(keyring.salt),
     created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     granted_by: existingGrantedBy ?? keyring.userId,
@@ -1024,4 +1042,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-LJDW6LQJ.js.map
+//# sourceMappingURL=chunk-WBHQX6ME.js.map