@noy-db/hub 0.7.0-pre.1 → 0.7.0-pre.10

package/dist/{chunk-57JTHWLQ.js → chunk-TQGT5BZE.js}

@@ -1,13 +1,13 @@
 import {
   envelopePayloadHash
-} from "./chunk-RC4BROYR.js";
+} from "./chunk-JRWLUWDM.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-RK7N4OQ5.js";
+} from "./chunk-N4CHCXDL.js";
 import {
   DictKeyMissingError,
   PermissionDeniedError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/via/lookup/handle.ts
 function isDeleteMarker(envelope) {
@@ -392,4 +392,4 @@ export {
   dictCollectionName,
   LookupHandle
 };
-//# sourceMappingURL=chunk-57JTHWLQ.js.map
+//# sourceMappingURL=chunk-TQGT5BZE.js.map

package/dist/{chunk-TOV6VMHF.js → chunk-U3RMWOXY.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-NSITFOCJ.js";
 import {
   installViaBinder
-} from "./chunk-XDVVBETV.js";
+} from "./chunk-YHIAWECL.js";
 import {
   NoydbError,
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/via/money/iso4217.ts
 var MINOR_UNITS = {
@@ -1044,4 +1044,4 @@ export {
   decodeMoneyFields,
   exactMath
 };
-//# sourceMappingURL=chunk-TOV6VMHF.js.map
+//# sourceMappingURL=chunk-U3RMWOXY.js.map

package/dist/{chunk-PUJTKLPL.js → chunk-UL7TLJ54.js}

@@ -1,10 +1,10 @@
 import {
   validateProjectionLegs
-} from "./chunk-4ZPE6SKS.js";
+} from "./chunk-75WNTBZL.js";
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -181,4 +181,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-PUJTKLPL.js.map
+//# sourceMappingURL=chunk-UL7TLJ54.js.map

package/dist/{chunk-W5LHQXZU.js → chunk-USKHHOIV.js}

@@ -3,7 +3,7 @@ import {
   InvalidKeyError,
   TamperedError,
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/kernel/enclave/crypto.ts
 var PBKDF2_ITERATIONS = 6e5;
@@ -448,4 +448,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-W5LHQXZU.js.map
+//# sourceMappingURL=chunk-USKHHOIV.js.map

package/dist/{chunk-J4MN6XIU.js → chunk-UTFY6W6X.js}

@@ -1,6 +1,6 @@
 import {
   PortabilityNotEnabledError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/portability/strategy.ts
 var NO_PORTABILITY = {
@@ -27,4 +27,4 @@ var NO_PORTABILITY = {
 export {
   NO_PORTABILITY
 };
-//# sourceMappingURL=chunk-J4MN6XIU.js.map
+//# sourceMappingURL=chunk-UTFY6W6X.js.map

package/dist/{chunk-P6ASQOZR.js → chunk-VT4DTCK5.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-P6ASQOZR.js.map
+//# sourceMappingURL=chunk-VT4DTCK5.js.map

package/dist/{chunk-A2YW5EMU.js → chunk-X6YRP5EC.js}

@@ -1,16 +1,16 @@
 import {
   getHistory,
   historyIdentity
-} from "./chunk-6EW2UCVF.js";
+} from "./chunk-TAJZ7GXO.js";
 import {
   liveRecordIsElevated
-} from "./chunk-POS53FG6.js";
+} from "./chunk-IZTU6RKH.js";
 import {
   openEnvelopeJson
-} from "./chunk-2LPVI4PX.js";
+} from "./chunk-DOPZWTMJ.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-commit/history/time-machine.ts
 var VaultInstant = class {
@@ -208,4 +208,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-A2YW5EMU.js.map
+//# sourceMappingURL=chunk-X6YRP5EC.js.map

package/dist/{chunk-FOG7YEJP.js → chunk-XGXVPCYW.js}

@@ -2,10 +2,10 @@ import {
   base64ToBuffer,
   decryptBytesWithAAD,
   encryptBytesWithAAD
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   TamperedError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/kernel/enclave/classify/compare.ts
 var subtle = globalThis.crypto.subtle;
@@ -92,4 +92,4 @@ export {
   openVdigPayload,
   evaluateKofN
 };
-//# sourceMappingURL=chunk-FOG7YEJP.js.map
+//# sourceMappingURL=chunk-XGXVPCYW.js.map

package/dist/{chunk-5263OEM3.js → chunk-XJP66QEN.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCycleError,
   MaterializedViewCycleError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/kernel/via/graph.ts
 var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
@@ -341,4 +341,4 @@ export {
   DEFAULT_POSTURE,
   ViaGraph
 };
-//# sourceMappingURL=chunk-5263OEM3.js.map
+//# sourceMappingURL=chunk-XJP66QEN.js.map

package/dist/{chunk-5W7YXFV5.js → chunk-XJTGBHK6.js}

@@ -5,18 +5,18 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-DFAUMLD7.js";
+} from "./chunk-MV2OEK3K.js";
 import {
   parseDekKey
-} from "./chunk-POS53FG6.js";
+} from "./chunk-IZTU6RKH.js";
 import {
   envelopeOpensUnderAny,
   rekeyBlobSet,
   rekeyEnvelopeIfNeeded
-} from "./chunk-2LPVI4PX.js";
+} from "./chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "./chunk-N4CNVSUF.js";
+} from "./chunk-4RUFYGWG.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -31,10 +31,10 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-RK7N4OQ5.js";
+} from "./chunk-N4CHCXDL.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
@@ -51,7 +51,21 @@ import {
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
+
+// src/with-party/team/roster-epoch.ts
+function assertRosterEpochCurrent(found, expected, userId) {
+  if (expected === void 0) return;
+  if (found === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "roster-epoch-absent" });
+  }
+  if (!Number.isFinite(found) || found < expected) {
+    throw new KeyringTamperedError({ userId, reason: "roster-epoch-rewound" });
+  }
+}
+function nextRosterEpoch(current) {
+  return Number.isFinite(current) ? current + 1 : 1;
+}
 
 // src/with-party/team/roster-tag.ts
 function stable(value) {
@@ -89,7 +103,24 @@ function rosterCanonical(file) {
     pending_dek_slots: Object.keys(file.pending_deks ?? {}).sort(),
     expires_at: file.expires_at ?? null,
     export_capability: file.export_capability ?? null,
-    import_capability: file.import_capability ?? null
+    import_capability: file.import_capability ?? null,
+    // #1097 — the roster epoch, bound ONLY WHEN PRESENT.
+    //
+    // The conditional spread is the entire backward-compatibility story, not a
+    // style choice. `stable()` drops `undefined`, so a file written before the
+    // epoch existed produces the byte-identical canonical string it always did
+    // and its roster tag still verifies. Writing `file.roster_epoch ?? null` —
+    // the shape every other optional field above uses — would have changed that
+    // string for every existing keyring, failed every existing tag, and
+    // rendered every existing vault unopenable. #1115 took exactly that cost
+    // deliberately; there is no reason to take it again for a field that can be
+    // additive.
+    //
+    // A PRESENT epoch is authenticated: stripping it changes the canonical and
+    // the tag stops verifying, so a store cannot downgrade a file to the
+    // no-epoch shape. It can only replay a file that genuinely never had one,
+    // which is why absence must read as UNKNOWN rather than as zero.
+    ...file.roster_epoch !== void 0 ? { roster_epoch: file.roster_epoch } : {}
   });
 }
 async function mintRosterTag(file, rosterKey) {
@@ -531,13 +562,14 @@ async function createOwnerKeyring(store, vault, opts) {
       [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey
     }
   };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
+    roster_tag: await mintRosterTag(withEpoch, rosterKey),
     // The presence of this block is what makes the keyring an echo keyring —
     // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
     ...typeof secret !== "string" ? {
@@ -637,15 +669,16 @@ async function grant(store, vault, callerKeyring, options) {
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(previousGrantFound?.file.roster_epoch) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
     // The grantee's own copy of the roster key rode in via the `_`-prefix
     // propagation loop above, so they can verify this tag on first unlock.
-    roster_tag: await mintRosterTag(authorityWithDeks, callerRosterKey)
+    roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
   };
   await writeKeyringFile(store, vault, options.userId, keyringFile);
   if (previousDekNames !== null && options.userId !== callerKeyring.userId) {
@@ -873,7 +906,8 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
-  const next = { ...edited, roster_tag: await mintRosterTag(edited, rosterKey) };
+  const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(target.roster_epoch) };
+  const next = { ...withEpoch, roster_tag: await mintRosterTag(withEpoch, rosterKey) };
   await writeKeyringFile(store, vault, options.userId, next);
 }
 var HISTORY_COLLECTION = "_history";
@@ -1011,9 +1045,10 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       deks: updatedDeks,
       permissions: updatedPermissions
     };
+    const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(userKeyringFile.roster_epoch) };
     const updatedKeyring = {
-      ...edited,
-      roster_tag: await mintRosterTag(edited, callerRosterKey)
+      ...withEpoch,
+      roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
     };
     await writeKeyringFile(store, vault, userId, updatedKeyring);
   }
@@ -1050,13 +1085,14 @@ async function changeSecret(store, vault, keyring, opts) {
     ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingAuthority?.roster_epoch) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey)
+    roster_tag: await mintRosterTag(withEpoch, rosterKey)
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
@@ -1124,15 +1160,16 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
   return {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
     // The recipient's copy of the roster key rode in via the `_`-prefix
     // propagation loop above, so the slot verifies on first unlock.
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
+    roster_tag: await mintRosterTag(withEpoch, rosterKey),
     // The presence of this block is what makes the recipient's slot an
     // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
     // ceremony (prompt → echo → key) travels with the pod, not just a
@@ -1291,13 +1328,14 @@ async function persistKeyring(store, vault, keyring) {
     deks: wrappedDeks,
     ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {}
   };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingFound?.file.roster_epoch) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(keyring.salt),
     created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
+    roster_tag: await mintRosterTag(withEpoch, rosterKey),
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
@@ -1342,6 +1380,11 @@ function resolvePermissions(role, explicit) {
   return explicit ?? {};
 }
 async function writeKeyringFile(store, vault, userId, keyringFile) {
+  if (keyringFile.roster_epoch === void 0) {
+    throw new Error(
+      `writeKeyringFile: refusing to write a keyring for "${userId}" with no roster_epoch (#1097). Stamp it with nextRosterEpoch(previous) onto the authority object BEFORE minting the roster tag, so it is covered by rosterCanonical.`
+    );
+  }
   const envelope = buildRecordEnvelope(
     { collection: "_keyring", id: userId, version: 1 },
     { iv: "", data: JSON.stringify(keyringFile) }
@@ -1350,6 +1393,8 @@ async function writeKeyringFile(store, vault, userId, keyringFile) {
 }
 
 export {
+  assertRosterEpochCurrent,
+  nextRosterEpoch,
   mintRosterTag,
   assertRosterAuthenticated,
   assertRosterTagValid,
@@ -1395,4 +1440,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-5W7YXFV5.js.map
+//# sourceMappingURL=chunk-XJTGBHK6.js.map