@noy-db/hub 0.6.0-pre.19 → 0.6.0-pre.20

package/dist/broker/index.js

@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-2KZDTFS4.js");
+      const { enrollSeed } = await import("../seed-SGIF3EN4.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-2KZDTFS4.js");
+      const { rotateSeed } = await import("../seed-SGIF3EN4.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-2KZDTFS4.js");
+          const { mintStoreCredentials } = await import("../seed-SGIF3EN4.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/cargo/index.js

@@ -6,7 +6,7 @@ import {
   diffVault,
   unsealDeks,
   withCargo
-} from "../chunk-YEZW6UJA.js";
+} from "../chunk-RQY5UWEL.js";
 import {
   extractPartition,
   walkClosure
@@ -16,7 +16,7 @@ import {
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-37P5VB4N.js";
+} from "../chunk-PNAIDIP7.js";
 import "../chunk-TC6MBEGH.js";
 import "../chunk-ZPMXYPBR.js";
 import {
@@ -28,7 +28,7 @@ import "../chunk-NRNTXBHT.js";
 import "../chunk-YVTADFTC.js";
 import {
   CustodyApi
-} from "../chunk-HUYNPLTT.js";
+} from "../chunk-XGQGWZ6D.js";
 import "../chunk-2IK6AC6A.js";
 import "../chunk-DYASJSKI.js";
 import {
@@ -46,7 +46,7 @@ import {
 } from "../chunk-IGJCYUT5.js";
 import "../chunk-437FDIHO.js";
 import "../chunk-KDX6VEYV.js";
-import "../chunk-E6WANBD6.js";
+import "../chunk-RKDH6L53.js";
 import "../chunk-JHO6FGZX.js";
 import "../chunk-HTMQBBF3.js";
 import {

package/dist/{chunk-HGAR7H5M.js → chunk-6TXUVKPG.js}

@@ -74,7 +74,7 @@ import {
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-HUYNPLTT.js";
+} from "./chunk-XGQGWZ6D.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
@@ -223,7 +223,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-LAFP5H5U.js";
+} from "./chunk-F5AJZC3U.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -238,7 +238,7 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
@@ -14616,4 +14616,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-HGAR7H5M.js.map
+//# sourceMappingURL=chunk-6TXUVKPG.js.map

package/dist/{chunk-LAFP5H5U.js → chunk-F5AJZC3U.js}

@@ -9,7 +9,7 @@ import {
   mintKeyringCanary,
   persistKeyring,
   readKeyringFile
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   dekKey
 } from "./chunk-47ZFULEZ.js";
@@ -924,4 +924,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-LAFP5H5U.js.map
+//# sourceMappingURL=chunk-F5AJZC3U.js.map

package/dist/{chunk-37P5VB4N.js → chunk-PNAIDIP7.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-NRNTXBHT.js";
 import {
   createOwnerKeyring
-} from "./chunk-E6WANBD6.js";
+} from "./chunk-RKDH6L53.js";
 import {
   buildRecordEnvelope
 } from "./chunk-ZVAFJQZB.js";
@@ -128,4 +128,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-37P5VB4N.js.map
+//# sourceMappingURL=chunk-PNAIDIP7.js.map

package/dist/{chunk-E6WANBD6.js → chunk-RKDH6L53.js}

@@ -643,6 +643,30 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
   };
   await writeKeyringFile(store, vault, options.userId, next);
 }
+var HISTORY_COLLECTION = "_history";
+var LEDGER_COLLECTION = "_ledger";
+var LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
+async function listOrEmpty(store, vault, collection) {
+  try {
+    return await store.list(vault, collection);
+  } catch {
+    return [];
+  }
+}
+async function derivedRefsFor(store, vault, rotated) {
+  const out = [];
+  if (!rotated.startsWith("_")) {
+    for (const id of await listOrEmpty(store, vault, HISTORY_COLLECTION)) {
+      if (id.startsWith(`${rotated}:`)) out.push({ collection: HISTORY_COLLECTION, id });
+    }
+  }
+  if (rotated === LEDGER_COLLECTION) {
+    for (const id of await listOrEmpty(store, vault, LEDGER_DELTAS_COLLECTION)) {
+      out.push({ collection: LEDGER_DELTAS_COLLECTION, id });
+    }
+  }
+  return out;
+}
 async function rotateKeys(store, vault, callerKeyring, opts) {
   const { collections } = opts;
   if (callerKeyring.role === "custodian") {
@@ -664,12 +688,16 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
     const oldDek = callerKeyring.deks.get(collName);
     const newDek = newDeks.get(collName);
     if (!oldDek) continue;
-    const ids = await store.list(vault, collName);
-    for (const id of ids) {
-      const envelope = await store.get(vault, collName, id);
+    const refs = [
+      ...(await store.list(vault, collName)).map((id) => ({ collection: collName, id })),
+      ...await derivedRefsFor(store, vault, collName)
+    ];
+    for (const ref of refs) {
+      const { collection: refColl, id } = ref;
+      const envelope = await store.get(vault, refColl, id);
       if (!envelope || !envelope._iv) continue;
-      const newEnvelope = await rekeyEnvelopeIfNeeded({ collection: collName, id }, envelope, oldDek, newDek);
-      if (newEnvelope !== null) await store.put(vault, collName, id, newEnvelope);
+      const newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
+      if (newEnvelope !== null) await store.put(vault, refColl, id, newEnvelope);
     }
   }
   for (const [collName, newDek] of newDeks) {
@@ -1041,4 +1069,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-E6WANBD6.js.map
+//# sourceMappingURL=chunk-RKDH6L53.js.map