@noy-db/hub 0.7.0-pre.1 → 0.7.0-pre.10

package/CHANGELOG.md

@@ -1,5 +1,203 @@
 # Changelog — hub
 
+## 0.7.0-pre.10
+
+### Patch Changes
+
+- Export `assertRosterEpochCurrent` and `nextRosterEpoch` — they shipped in `0.7.0-pre.9` reachable from nothing (#1097 follow-up).
+
+  `0.7.0-pre.9` added the roster epoch and **listed `assertRosterEpochCurrent` in its release notes under "what is new"**. The function was present in `dist/**/*.d.ts` and exported from **no entry point** — all 53 were enumerated and imported; none had it.
+
+  That is the whole mechanism's caller half. Hub stamps and binds the epoch, but the expectation arrives by a second channel hub does not carry, so **only application code can perform the comparison**. A consumer following the release notes could not import the function they were told to call.
+
+  Both are now exported from the root barrel, beside `assertRosterAuthenticated`.
+
+  ## The class, and why it is worse than #1224
+
+  #1224 was a predicate reachable from the **wrong** seam — the root barrel rather than `/to`, which is all a store binds. This one was reachable from **none**. Both were found the same way: someone tried to follow the documentation.
+
+  Guarded by an invariant rather than by adding two names: a test asserts that **every** exported member of `roster-epoch.ts` reaches a published barrel, and that the query finds something in the first place. A helper added to that module later and exported from nothing fails the test rather than shipping unreachable.
+
+  Additive — the root barrel's golden baseline moves by two entries; nothing is removed or renamed.
+
+## 0.7.0-pre.9
+
+### Minor Changes
+
+- Add an authenticated, comparable roster epoch (#1097).
+
+  A roster tag authenticates the roster's **contents** and makes no claim about being **current**. That gap is reachable without forging anything: there is no role-change API, so narrowing a user's standing means calling `grant` again with a lower role, and that write overwrites in place. The previous, broader file was legitimately minted by the vault — so a store that kept a copy can re-serve it. The KEK unwraps, the canary checks out, the tag verifies, and the replayed file **restores the higher role**, usably.
+
+  The rotation half of #1097 already shipped and converts live access back into stale access. It cannot touch the role, because role gates capabilities rather than keys.
+
+  ## What is new
+
+  - `KeyringFile.roster_epoch?: number`, bumped on every roster write and bound into `rosterCanonical`, so a store can neither edit nor strip it.
+  - `assertRosterEpochCurrent(found, expected, userId)` — refuses a keyring older than a floor the caller obtained **out of band**.
+  - Two `KeyringTamperedReason` codes: `roster-epoch-rewound` and `roster-epoch-absent`.
+
+  ## Why an out-of-band anchor
+
+  An epoch stored beside the roster is not an anchor — a store rewinding the roster rewinds the epoch with it. It becomes one only when compared against a value that reached the reader by a channel the store does not carry. **Hub owns the epoch and the comparison; who carries the expectation is deliberately the consumer's problem**, because hub cannot know which channel a deployment trusts.
+
+  Considered and rejected, recorded so they are not re-derived: **time** (defeats long rewinds, useless against fresh ones — and a narrowing replay is entirely the fresh case) and **the vault head** (circular: head buckets are read with a keyring-issued DEK, and a rewound roster renders as the benign `no-expectations` verdict).
+
+  ## Not a format break
+
+  Binding the epoch **conditionally** is what makes this additive. `stable()` drops `undefined`, so a keyring written before the epoch existed canonicalises byte-identically and its existing tag still verifies. Binding it as `?? null` — the shape every other optional field uses — would have failed every pre-existing tag and rendered every existing vault unopenable.
+
+  ## Opt-in, and absence is never zero
+
+  With no expected epoch this changes nothing for a caller. When one is supplied, a file carrying **no** epoch is refused as `roster-epoch-absent` rather than treated as epoch 0 — treating absence as zero would accept every pre-epoch file, which is exactly the replay the mechanism exists to refuse. `found > expected` is accepted: the anchor is a floor, not an equality, since a roster may legitimately have moved on since an invite was minted.
+
+  All thirteen roster-mint sites stamp the epoch before the tag is minted, and `writeKeyringFile` now refuses to write a keyring without one — an output-domain guard, so a future mint site cannot ship the field empty.
+
+### Patch Changes
+
+- Satellite hub peers now publish as a caret **range** instead of an exact version (#1228).
+
+  Every `@noy-db/*` satellite declared `peerDependencies['@noy-db/hub'] = "workspace:*"`, which **publishes as an exact version**:
+
+  ```
+  workspace:*   ->   "@noy-db/hub": "0.7.0-pre.8"     exact
+  workspace:^   ->   "@noy-db/hub": "^0.7.0-pre.8"    a range
+  ```
+
+  Exact peers make the satellite set co-installable **only when every member came from the same cut**. Measured against published packages:
+
+  ```
+  npm i @noy-db/as-csv@0.7.0-pre.6 @noy-db/in-vue@0.7.0-pre.5   ->  exit 1, ERESOLVE
+  npm i @noy-db/as-csv@0.7.0-pre.6 @noy-db/in-vue@0.7.0-pre.6   ->  exit 0
+  ```
+
+  No hub version satisfies two different exact peers, so any lag — a satellite not republished in a given release, or a consumer upgrading one package — made a pair uninstallable by name. Caret ranges are jointly satisfiable (`hub@pre.8` satisfies both `^pre.7` and `^pre.8`) and still stop at the next minor, so a satellite never claims to work against a hub line it has not seen.
+
+  ## The reason for the old form did not hold
+
+  The architecture rule mandated `workspace:*` because `workspace:^` "trips the changeset-cli pre-1.0 dep-propagation heuristic and forces unintended major bumps on every dependent". `release.mjs`'s own header contradicted that all along: the heuristic fires **"even with loose `workspace:*` constraints"**. The peer form never prevented the bumps — the normalizer does.
+
+  Verified rather than reasoned: a full `release:version` was run with all 50 satellites on `workspace:^`. The line advanced normally, the normalizer corrected the heuristic as usual, and every package landed on one version.
+
+  **Nothing breaks for existing consumers.** A range is strictly more permissive than the exact version it replaces, so anything that resolved before still resolves. The `peer-deps` architecture rule now requires `workspace:^` and is mutation-checked.
+
+## 0.7.0-pre.8
+
+### Patch Changes
+
+- Say what is actually true about runtime dependencies (#1227).
+
+  Four places claimed zero runtime dependencies. Measured across all 57 packages, **51 have none** — but six do, and four of those are third-party:
+
+  | package                             | runtime dependency                                         |
+  | ----------------------------------- | ---------------------------------------------------------- |
+  | `@noy-db/as-xml`, `@noy-db/as-xlsx` | `fast-xml-parser`                                          |
+  | `@noy-db/in-devtools-tui`           | `ink`, `react`                                             |
+  | `create-noy-db`                     | its scaffolder toolchain                                   |
+  | `@noy-db/hub`                       | `@noy-db/attestation` — a sibling on the same version line |
+  | `@noy-db/in-nuxt`                   | `@noy-db/in-devtools` — likewise                           |
+
+  Corrected:
+
+  - **`@noy-db/hub`** — "Zero runtime dependencies" → _no third-party runtime dependencies to install_, naming `@noy-db/attestation` as the one runtime dependency. Also states plainly that `zod` is **vendored into the bundle** for the optional persisted-schema converter, loaded lazily, never executing unless you use that path — and that it will not appear in your lockfile. That last clause is the one an SBOM or audit process needs, and no manifest field carries it.
+  - **`@noy-db/as-xlsx`** — "Zero runtime dependencies" was **flatly false**; it depends on `fast-xml-parser`. The intent was "no heavyweight spreadsheet library", which is true and is now what it says.
+
+  Two other claims were checked and left alone because they are correct: `@noy-db/as-zip` and `@noy-db/on-totp` genuinely have no dependencies.
+
+  Documentation only. No code, dependency, or behaviour change — the manifests already said this; only the prose disagreed with them.
+
+## 0.7.0-pre.6
+
+### Patch Changes
+
+- Correct a factual claim in the `0.7.0-pre.5` changelog entry: the cached read path returned `undefined`, not `null`.
+
+  That entry described the #1220 failure as _"the cached path returned `null`, indistinguishable from no such record."_ The value is wrong. Measured on published `0.7.0-pre.4` with `to-memory@0.7.0-pre.4`, correct arity throughout:
+
+  | read                              | value                                       |
+  | --------------------------------- | ------------------------------------------- |
+  | genuinely absent id               | `null`                                      |
+  | empty-sealed record, cached path  | **`undefined`**                             |
+  | empty-sealed record, hydrate path | `SyntaxError: Unexpected end of JSON input` |
+
+  **The argument the entry made is unaffected — it gets stronger.** `undefined` is off `get()`'s declared `T | null` contract, so a caller writing `if (!rec)` or `?? fallback` folds it into _"no such record"_ exactly as it would fold `null`, **and** a caller writing `rec === null` fails to catch it as well. The collapse of distinguishable states is wider than the original sentence claimed, not narrower.
+
+  `0.7.0-pre.5`'s entry is left standing as the record of what that release said — its tarball is immutable, so amending it would only make later tarballs disagree with the shipped one. This is the correction published alongside, the same move `0.7.0-pre.4` made for `0.7.0-pre.3`.
+
+  Scope: the incorrect sentence appeared only in `CHANGELOG.md` on the published surface — it was not in any shipped `.d.ts`. No code, type, or behaviour change. The guards added in `0.7.0-pre.5` are unaffected, and note they prevent such a record being **created**, not **read**: a record sealed by an earlier build still throws on the hydrate path today.
+
+- Export `isConflictError` from `@noy-db/hub/to` (#1224).
+
+  The predicate was reachable only from the root barrel, while `/to` exported the `ConflictError` **class**. That is the wrong way round for the one seam that needs it: `isConflictError` exists precisely because a store may bind a different copy of `@noy-db/hub/to` than its caller, making `instanceof` against that class silently miss (#935) — CAS retry loops rethrow instead of retrying, and the sync engine misfiles the conflict with no resolution run.
+
+  A store binds `/to` and nothing else, so store authors were told by the predicate's own documentation to use something they could not import, and the obvious fallback — `instanceof ConflictError` off `/to` — is exactly the defect the predicate prevents.
+
+  Additive: an existing function on an existing subpath. Nothing is removed or renamed, and the root barrel export is unchanged.
+
+  Guarded by an invariant rather than an enumeration: a test parses `kernel/errors.ts` for any `is*` predicate whose contract mentions the store seam and asserts each is reachable from `/to`, so a future sibling cannot repeat this. `/to`'s golden surface baseline moves by one entry.
+
+## 0.7.0-pre.5
+
+### Patch Changes
+
+- Refuse to seal a record against a coerced address or over an empty plaintext (#1220).
+
+  Two boundary values were accepted silently and produced envelopes that are **valid and undecodable** — sealed correctly, addressed or filled with nothing. Both are now `TypeError`s at the seal, stated as output-domain invariants so they hold for every caller rather than for the two calls that surfaced them:
+
+  - **`buildRecordAad` refuses a non-string `collection` or `id`.** `String({})` is `"[object Object]"` and `String(undefined)` is `"undefined"`; both make perfectly good AAD, so a record sealed against one is stored at an address nothing queries. Sibling of the `version` assertion already in that function, and there for the same reason: it can only fire for a caller TypeScript never saw.
+  - **`RecordCodec.encryptJsonString` refuses a non-string plaintext.** `JSON.stringify(undefined)` is `undefined`, so an undefined record sealed over _nothing_ — `_data` a bare GCM tag over zero ciphertext.
+
+  Why this was worth a guard rather than a documentation note: the two read paths disagreed about the same bytes and neither named the cause. The cached path returned `null`, indistinguishable from _no such record_; the hydrate path threw `SyntaxError` out of `decryptRecord`, indistinguishable from _your store returned corrupt bytes_. A `to-*` author or daemon operator meeting that would reasonably suspect their store, indefinitely, over a caller mistake made days earlier.
+
+  No format, encryption, or integrity change: envelopes that seal continue to seal identically, and `NOYDB_ENVELOPE_GENERATION` is unaffected. This only refuses inputs that previously produced unreadable records.
+
+## 0.7.0-pre.4
+
+### Patch Changes
+
+- Correct the scoping of `NOYDB_ENVELOPE_GENERATION`'s documentation, and record that adopting it is not free (#1207 follow-up).
+
+  `0.7.0-pre.3` documented generation 1 as "no AAD (absence of the export also means 1)". That parenthetical is wrong as written, in the published `.d.ts` and in that release's changelog entry, and it is wrong in the direction that produces a false stamp rather than a missing one. "Absence of the **export**" is a statement about a hub _build_, and hub `0.6.0-pre.18` … `0.7.0-pre.2` seal at generation 2 while exporting no constant — verified against the published `0.7.0-pre.2` tarball. A writer using absence as a fallback would stamp a gen-2 artefact as gen 1.
+
+  The corrected form, now stated outright rather than left to inference: absence of a **stamp on an artefact** classifies that artefact as _unknown — possibly older than the constant_, never as generation 1; and a build's own absence of the export says nothing about the generation it seals at. A writer that cannot determine its generation omits the stamp.
+
+  Also documented: **adoption is not free.** "Diagnostic only" describes how the value may be used, not what it costs to import. It is a _value_ export, so a named import moves a consumer's real hub floor to `0.7.0-pre.3` regardless of the range its `peerDependencies` declares — measured as `TS2305` at a declared `^0.7.0-pre.0` floor while build, typecheck, lint and the full suite were green at the exact dev pin. Both correct postures are named: a defensive read at an unchanged floor, or a floor narrowing where the consumer publishes nothing and so gates no downstream range.
+
+  Documentation only — no value, signature, or export changed. The `0.7.0-pre.3` changelog entry is left standing as the record of what that release said; this entry is the correction published alongside it.
+
+## 0.7.0-pre.3
+
+### Minor Changes
+
+- Export `NOYDB_ENVELOPE_GENERATION` — a monotonic generation of the envelope _sealing_ format, distinct from `NOYDB_FORMAT_VERSION` (#1207).
+
+  `NOYDB_FORMAT_VERSION` records what is written; the generation records what a reader must **compute** to open an envelope. The two move independently: 0.6.0-pre.18 bound record identity into the AEAD (#1041) without changing a stored byte, so nothing published could express that envelopes sealed before it are unopenable after it. The generation closes that gap: 1 = no AAD (hub ≤ 0.6.0-pre.17; absence of the export also means 1), 2 = identity + `_v` bound via `noydb-aad/2` (hub ≥ 0.6.0-pre.18).
+
+  Exported from the root barrel and re-exported from the `/cargo` and `/to` seams (additive), so an orchestrator can stamp it into a manifest and a store host can report "sealed under generation N, this build reads generation M" instead of a bare `TamperedError` from code that is correct. **Diagnostic only**: a reader must never branch on a generation read from an untrusted source (ADR 0003) — classification only, refusal unchanged, the same contract as `TamperedError.reason`. A test pins the generation to the AAD bytes actually emitted, so a sealing-format change cannot ship without a generation decision in the same diff.
+
+## 0.7.0-pre.2
+
+### Patch Changes
+
+- **The conformance kit covers both entry-point shapes and both gates (#1209).**
+
+  `0.7.0-pre.0`'s `/as` inversion silently blinded `@noy-db/test-format-conformance`:
+  it denied by proxying the vault, which the inverted method-on-vault shape
+  (`vault.export(asCsv())`) bypasses — `this` inside `Vault.export` is the real,
+  unproxied object. The four inverted formats' fixtures had been deleted rather
+  than migrated, so coverage dropped from nine formats to five with nothing
+  turning red.
+
+  The kit now **patches the instance** instead: own-property assignment shadows
+  the prototype method at call time, intercepting the argument shape, the
+  inverted shape, and hub's internal delegation. Denials are matched on the
+  kit's own error class rather than "it threw", every entry point gets an
+  ungated-success guard, and the **import gate (`assertCanImport`) is covered
+  for the first time** — a format shipping a `decode` with no declared import
+  entries gets a loud `SKIPPED` line.
+
+  All four fixtures are restored, and a new architecture rule
+  (`as-conformance-fixture`) makes a silent fixture deletion impossible.
+
 ## 0.7.0-pre.1
 
 ### Patch Changes

package/README.md

@@ -76,7 +76,10 @@ const all = await invoices.list()
 - **Multi-user access control** — owner, admin, operator, viewer, client roles
 - **Offline-first sync** — push/pull with optimistic concurrency on encrypted envelopes
 - **Audit history** — full-copy snapshots with `history()`, `diff()`, `revert()`, `pruneHistory()`
-- **Zero runtime dependencies**
+- **No third-party runtime dependencies to install** — the only runtime dependency is
+  `@noy-db/attestation`, on the same version line. (`zod` is vendored into the bundle for the
+  optional persisted-schema converter and loaded lazily; it never executes unless you use that
+  path, and it does not appear in your lockfile.)
 
 ## Cross-vault queries
 

package/dist/api-GJQF7OAJ.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-357ECVLE.js";
+import "./chunk-MV2OEK3K.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-GJQF7OAJ.js.map

package/dist/as/index.js

@@ -1,23 +1,23 @@
 import "../chunk-UBSFPGVJ.js";
-import "../chunk-HM4JSXX2.js";
+import "../chunk-PCIBCL26.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-KHKKD62N.js";
-import "../chunk-P6ASQOZR.js";
+import "../chunk-VT4DTCK5.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-YXA2TCTZ.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-I5LSKXT6.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   ValidationError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/as/active.ts

package/dist/at/index.js

@@ -3,16 +3,16 @@ import {
   MemorySealer,
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
-} from "../chunk-Z2WK53N6.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-JUBWUJY5.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
-import "../chunk-JBIV4FLR.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryRecipientSealer,

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-ZO252Q5S.js";
+} from "../chunk-LUVGSKXE.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-TVIFAHZR.js";
+} from "../chunk-FPN5D4JX.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-3L2MVE36.js";
+} from "../chunk-GKOJR53Y.js";
 import {
   NO_ATTESTATION
-} from "../chunk-E6YA6UAP.js";
+} from "../chunk-FLRLZ4XZ.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-G53NB6EW.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-64N6OG7U.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-6XVS2AU3.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-5TA7FUC3.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-MJNYWO72.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-PUJKRYJF.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-MJNYWO72.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-PUJKRYJF.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-MJNYWO72.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-PUJKRYJF.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-MJNYWO72.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-PUJKRYJF.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-Z7ZBTAQ6.js → backup-QZQEP5RO.js}

@@ -3,37 +3,37 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-YXA2TCTZ.js";
+} from "./chunk-I5LSKXT6.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-CN6B5PEN.js";
+} from "./chunk-H5GVPOB4.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-Z7ZXZL6Y.js";
+} from "./chunk-Q2ZN5DWZ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-2LPVI4PX.js";
+import "./chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
+} from "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-W5LHQXZU.js";
+import "./chunk-USKHHOIV.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-RK7N4OQ5.js";
+} from "./chunk-N4CHCXDL.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-Z7ZBTAQ6.js.map
+//# sourceMappingURL=backup-QZQEP5RO.js.map

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-F23WQK3G.js";
+} from "../chunk-IS5LFHV2.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,21 +25,21 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-ALB64CZM.js";
-import "../chunk-XDVVBETV.js";
-import "../chunk-HTGRQZFB.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-HS3LEVT4.js";
+import "../chunk-YHIAWECL.js";
+import "../chunk-DZPMKY3J.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   BlobOfflineError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-4A4TYISP.js";
+} from "../chunk-PV7XXAXK.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-NSNIGYXE.js");
+      const { enrollSeed } = await import("../seed-MCCGVPRI.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-NSNIGYXE.js");
+      const { rotateSeed } = await import("../seed-MCCGVPRI.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-NSNIGYXE.js");
+          const { mintStoreCredentials } = await import("../seed-MCCGVPRI.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-CBRS2NEK.js";
-import "../chunk-JBIV4FLR.js";
+} from "../chunk-GHADG5QZ.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   isQuorum,