@noy-db/hub 0.7.0-pre.0 → 0.7.0-pre.10

package/dist/cargo/index.js

@@ -5,11 +5,11 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-YKPGQJFU.js";
+} from "../chunk-NUXTUGAD.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-OWLVBOWO.js";
+} from "../chunk-7XT7KZTN.js";
 import {
   diffVault
 } from "../chunk-LFUID7OW.js";
@@ -18,59 +18,61 @@ import {
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-KN4W2OQ4.js";
-import "../chunk-H7HP56F6.js";
-import "../chunk-DKWPJOYH.js";
+} from "../chunk-OXZSMX2H.js";
+import "../chunk-5EC7X5QA.js";
+import "../chunk-P22XPNFW.js";
 import {
   NO_CARGO
-} from "../chunk-XJ3FEKEY.js";
-import "../chunk-Z2WK53N6.js";
+} from "../chunk-FKQCC4C5.js";
+import "../chunk-JUBWUJY5.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-CBRS2NEK.js";
-import "../chunk-YXA2TCTZ.js";
+} from "../chunk-GHADG5QZ.js";
+import "../chunk-I5LSKXT6.js";
 import {
   CustodyApi
-} from "../chunk-J4UJ5FRV.js";
-import "../chunk-6FOGTKBY.js";
-import "../chunk-LF6DMX4C.js";
+} from "../chunk-Z277MC2O.js";
+import "../chunk-RCONOOVF.js";
+import "../chunk-NMDMSHBF.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-ALB64CZM.js";
+import "../chunk-HS3LEVT4.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-4G25SDQL.js";
+} from "../chunk-4U52PMEL.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import {
   readPath
 } from "../chunk-NSITFOCJ.js";
-import "../chunk-X67FCULK.js";
-import "../chunk-XDVVBETV.js";
-import "../chunk-5W7YXFV5.js";
-import "../chunk-DFAUMLD7.js";
-import "../chunk-HTGRQZFB.js";
+import "../chunk-DIVY2CJZ.js";
+import "../chunk-YHIAWECL.js";
+import "../chunk-XJTGBHK6.js";
+import "../chunk-MV2OEK3K.js";
+import "../chunk-DZPMKY3J.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-IESNYJXZ.js";
+import "../chunk-OKCQNMO6.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-RC4BROYR.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-JRWLUWDM.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+} from "../chunk-USKHHOIV.js";
+import {
+  NOYDB_ENVELOPE_GENERATION
+} from "../chunk-N4CHCXDL.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -85,7 +87,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AdoptionStateError,
@@ -93,6 +95,7 @@ export {
   CrossShardJoinError,
   CustodyApi,
   DataResidencyError,
+  NOYDB_ENVELOPE_GENERATION,
   NO_CARGO,
   NoAccessError,
   PartitionExtractionError,

package/dist/{chunk-AB5P32RE.js → chunk-2DGBRE4K.js}

@@ -1,7 +1,7 @@
 import {
   FieldFrozenError,
   InvariantError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/guards/executor.ts
 var GuardExecutor = {
@@ -77,4 +77,4 @@ function deepEqual(a, b) {
 export {
   GuardExecutor
 };
-//# sourceMappingURL=chunk-AB5P32RE.js.map
+//# sourceMappingURL=chunk-2DGBRE4K.js.map

package/dist/{chunk-XVU7J43V.js → chunk-2E2LT37H.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-XVU7J43V.js.map
+//# sourceMappingURL=chunk-2E2LT37H.js.map

package/dist/{chunk-4LPF226H.js → chunk-2MQ2D5OZ.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-H7HP56F6.js";
+} from "./chunk-5EC7X5QA.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-DKWPJOYH.js";
+} from "./chunk-P22XPNFW.js";
 import {
   buildRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 import {
   NoydbError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -158,4 +158,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-4LPF226H.js.map
+//# sourceMappingURL=chunk-2MQ2D5OZ.js.map

package/dist/{chunk-DBNYPLWY.js → chunk-357ECVLE.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-DFAUMLD7.js";
+} from "./chunk-MV2OEK3K.js";
 import {
   PolicyDeniedError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-DBNYPLWY.js.map
+//# sourceMappingURL=chunk-357ECVLE.js.map

package/dist/{chunk-SHILAQH5.js → chunk-3GIA3HJ2.js}

@@ -1,6 +1,6 @@
 import {
   DuplicateBehaviorNameError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/guards/registry.ts
 var GuardRegistry = class {
@@ -141,4 +141,4 @@ var GuardRegistry = class {
 export {
   GuardRegistry
 };
-//# sourceMappingURL=chunk-SHILAQH5.js.map
+//# sourceMappingURL=chunk-3GIA3HJ2.js.map

package/dist/{chunk-QGJ4XIA7.js → chunk-3SWP2FYA.js}

@@ -2,33 +2,33 @@ import {
   isCollectLeg,
   resolveLegOwner,
   wrapDbWithPredicates
-} from "./chunk-4ZPE6SKS.js";
+} from "./chunk-75WNTBZL.js";
 import {
   canonicalizeMoneyFieldsAsDecimal,
   decodeMoneyFields,
   exactMath
-} from "./chunk-TOV6VMHF.js";
+} from "./chunk-U3RMWOXY.js";
 import {
   putDerivedOutput
-} from "./chunk-VTG7327U.js";
+} from "./chunk-FRIVOR5N.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
-} from "./chunk-XSN63FUS.js";
+} from "./chunk-AW4KTQA4.js";
 import {
   groupAndReduce
-} from "./chunk-4G25SDQL.js";
+} from "./chunk-4U52PMEL.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
 import {
   applyI18nLocale
-} from "./chunk-X67FCULK.js";
+} from "./chunk-DIVY2CJZ.js";
 import {
   JoinTooLargeError,
   LocaleNotSpecifiedError,
   MaterializedViewConfigError,
   MaterializedViewTooLargeError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-formula/materialized-views/executor.ts
 var DEFAULT_MAX_ROWS = 1e5;
@@ -342,4 +342,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-QGJ4XIA7.js.map
+//# sourceMappingURL=chunk-3SWP2FYA.js.map

package/dist/{chunk-N4CNVSUF.js → chunk-4RUFYGWG.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-RK7N4OQ5.js";
+} from "./chunk-N4CHCXDL.js";
 
 // src/kernel/enclave/record-envelope.ts
 function buildRecordEnvelope(identity, body) {
@@ -63,4 +63,4 @@ export {
   isDeleteMarker,
   buildDeleteMarker
 };
-//# sourceMappingURL=chunk-N4CNVSUF.js.map
+//# sourceMappingURL=chunk-4RUFYGWG.js.map

package/dist/{chunk-4G25SDQL.js → chunk-4U52PMEL.js}

@@ -9,13 +9,13 @@ import {
 } from "./chunk-NSITFOCJ.js";
 import {
   applyI18nLocale
-} from "./chunk-X67FCULK.js";
+} from "./chunk-DIVY2CJZ.js";
 import {
   viaBinder
-} from "./chunk-XDVVBETV.js";
+} from "./chunk-YHIAWECL.js";
 import {
   GroupCardinalityError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-lookup/reduce/reduction.ts
 function reduceRecords(records, spec) {
@@ -361,4 +361,4 @@ export {
   groupAndReduce,
   GroupedReduction
 };
-//# sourceMappingURL=chunk-4G25SDQL.js.map
+//# sourceMappingURL=chunk-4U52PMEL.js.map

package/dist/{chunk-H7HP56F6.js → chunk-5EC7X5QA.js}

@@ -1,16 +1,16 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-DKWPJOYH.js";
+} from "./chunk-P22XPNFW.js";
 import {
   buildRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 import {
   sha256Hex
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   ReadOnlyError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -117,4 +117,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-H7HP56F6.js.map
+//# sourceMappingURL=chunk-5EC7X5QA.js.map

package/dist/{chunk-WK5FSW7T.js → chunk-5NKHCJU5.js}

@@ -1,34 +1,34 @@
 import {
   assertTierAccess
-} from "./chunk-HTGRQZFB.js";
+} from "./chunk-DZPMKY3J.js";
 import {
   dekKey
-} from "./chunk-POS53FG6.js";
+} from "./chunk-IZTU6RKH.js";
 import {
   applyRewrappedBody,
   buildRecordAad,
   recordAadFor,
   rewrapBodyToDek
-} from "./chunk-2LPVI4PX.js";
+} from "./chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope,
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 import {
   decrypt,
   encrypt,
   unwrapCek
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-RK7N4OQ5.js";
+} from "./chunk-N4CHCXDL.js";
 import {
   PersistedIndexCompensationError,
   TierDemoteDeniedError,
   TiersNotEnabledError,
   UnsupportedTierCompositionError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -435,4 +435,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-WK5FSW7T.js.map
+//# sourceMappingURL=chunk-5NKHCJU5.js.map

package/dist/{chunk-PQ6Z2TAP.js → chunk-5UKIZIO3.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 
 // src/with-party/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -36,4 +36,4 @@ export {
   loadVaultPolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=chunk-PQ6Z2TAP.js.map
+//# sourceMappingURL=chunk-5UKIZIO3.js.map

package/dist/{chunk-QHJKK77B.js → chunk-5W5CEHLA.js}

@@ -3,22 +3,22 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-Y6GZ2P4M.js";
+} from "./chunk-GM4IM7TC.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-YXA2TCTZ.js";
+} from "./chunk-I5LSKXT6.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-RC4BROYR.js";
+} from "./chunk-JRWLUWDM.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-2LPVI4PX.js";
+} from "./chunk-DOPZWTMJ.js";
 import {
   buildSealedRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -86,4 +86,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-QHJKK77B.js.map
+//# sourceMappingURL=chunk-5W5CEHLA.js.map

package/dist/{chunk-YPSOHDNC.js → chunk-65ZYRK7O.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-YPSOHDNC.js.map
+//# sourceMappingURL=chunk-65ZYRK7O.js.map

package/dist/{chunk-4ZPE6SKS.js → chunk-75WNTBZL.js}

@@ -1,11 +1,11 @@
 import {
   sha256Hex
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewSourceUnknownError,
   RefNotDeclaredError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -483,4 +483,4 @@ export {
   MaterializedViewRegistry,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-4ZPE6SKS.js.map
+//# sourceMappingURL=chunk-75WNTBZL.js.map

package/dist/{chunk-H4M7ADXY.js → chunk-7PC3DRG7.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-PQ6Z2TAP.js";
+} from "./chunk-5UKIZIO3.js";
 import {
   assertRosterAuthenticated,
   assertRosterTagValid,
@@ -10,20 +10,21 @@ import {
   deriveKekForKeyring,
   mintKeyringCanary,
   mintRosterTag,
+  nextRosterEpoch,
   persistKeyring,
   readKeyringFile,
   requireRosterKey
-} from "./chunk-5W7YXFV5.js";
+} from "./chunk-XJTGBHK6.js";
 import {
   dekKey
-} from "./chunk-POS53FG6.js";
+} from "./chunk-IZTU6RKH.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-2LPVI4PX.js";
+} from "./chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -34,10 +35,10 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-RK7N4OQ5.js";
+} from "./chunk-N4CHCXDL.js";
 import {
   DelegationTargetMissingError,
   InvalidKeyError,
@@ -48,7 +49,7 @@ import {
   RecoveryProfileNotImplementedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/port/with/team-strategy.ts
 var NO_TEAM = {
@@ -438,9 +439,10 @@ async function rotateSecret(store, vault, userId, input) {
     canary,
     ...await echoFieldForNewSecret(input.newSecret, input.echoOptions)
   };
+  const withEpoch = { ...rebuilt, roster_epoch: nextRosterEpoch(found?.file.roster_epoch) };
   const next = {
-    ...rebuilt,
-    roster_tag: await mintRosterTag(rebuilt, requireRecoveredRosterKey(deks))
+    ...withEpoch,
+    roster_tag: await mintRosterTag(withEpoch, requireRecoveredRosterKey(deks))
   };
   await writeKeyringFile(store, vault, userId, next);
   return {
@@ -521,9 +523,10 @@ async function recoverViaPaperCode(store, vault, userId, input) {
     canary,
     ...await echoFieldForNewSecret(input.newSecret)
   };
+  const withEpoch = { ...rebuilt, roster_epoch: nextRosterEpoch(found?.file.roster_epoch) };
   const next = {
-    ...rebuilt,
-    roster_tag: await mintRosterTag(rebuilt, requireRecoveredRosterKey(deks))
+    ...withEpoch,
+    roster_tag: await mintRosterTag(withEpoch, requireRecoveredRosterKey(deks))
   };
   await burnPaperRecoveryEntry(store, vault, recovered.entry.codeId);
   await writeKeyringFile(store, vault, userId, next);
@@ -620,9 +623,10 @@ async function recoverViaShamir(provider, store, vault, userId, input) {
     canary,
     ...await echoFieldForNewSecret(input.newSecret)
   };
+  const withEpoch = { ...rebuilt, roster_epoch: nextRosterEpoch(file.roster_epoch) };
   const next = {
-    ...rebuilt,
-    roster_tag: await mintRosterTag(rebuilt, requireRecoveredRosterKey(recoveredDeks))
+    ...withEpoch,
+    roster_tag: await mintRosterTag(withEpoch, requireRecoveredRosterKey(recoveredDeks))
   };
   await writeKeyringFile(store, vault, userId, next);
   return {
@@ -639,6 +643,11 @@ async function recoverViaShamir(provider, store, vault, userId, input) {
   };
 }
 async function writeKeyringFile(store, vault, userId, file) {
+  if (file.roster_epoch === void 0) {
+    throw new Error(
+      `writeKeyringFile: refusing to write a keyring for "${userId}" with no roster_epoch (#1097). Stamp it with nextRosterEpoch(previous) onto the authority object BEFORE minting the roster tag, so it is covered by rosterCanonical.`
+    );
+  }
   const envelope = buildRecordEnvelope(
     { collection: "_keyring", id: userId, version: 1 },
     { iv: "", data: JSON.stringify(file) }
@@ -714,9 +723,10 @@ async function recoverUser(store, vault, callerKeyring, options) {
     authenticators: [],
     canary
   };
+  const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(target.roster_epoch) };
   const next = {
-    ...edited,
-    roster_tag: await mintRosterTag(edited, rosterKey)
+    ...withEpoch,
+    roster_tag: await mintRosterTag(withEpoch, rosterKey)
   };
   const envelope = buildRecordEnvelope(
     { collection: "_keyring", id: options.userId, version: 1 },
@@ -965,4 +975,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-H4M7ADXY.js.map
+//# sourceMappingURL=chunk-7PC3DRG7.js.map