@noy-db/hub 0.7.0-pre.1 → 0.7.0-pre.10

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSeal,
   beginEchoUnlock,
   withTeam
-} from "../chunk-X62MEF2O.js";
+} from "../chunk-IRHIA3AL.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -31,8 +31,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-H4M7ADXY.js";
-import "../chunk-PQ6Z2TAP.js";
+} from "../chunk-7PC3DRG7.js";
+import "../chunk-5UKIZIO3.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -53,21 +53,21 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-5W7YXFV5.js";
-import "../chunk-DFAUMLD7.js";
-import "../chunk-HTGRQZFB.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-XJTGBHK6.js";
+import "../chunk-MV2OEK3K.js";
+import "../chunk-DZPMKY3J.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   TeamNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryDeviceSeal,

package/dist/tiers/index.js

@@ -11,20 +11,20 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-WK5FSW7T.js";
-import "../chunk-HTGRQZFB.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-2LPVI4PX.js";
-import "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-5NKHCJU5.js";
+import "../chunk-DZPMKY3J.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   TiersNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -1,11 +1,15 @@
+import {
+  NOYDB_ENVELOPE_GENERATION
+} from "../chunk-N4CHCXDL.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError,
-  UnknownStoreKindError
-} from "../chunk-JBIV4FLR.js";
+  UnknownStoreKindError,
+  isConflictError
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/to/locator.ts
@@ -39,11 +43,13 @@ function createStoreLocator() {
 export {
   ConflictError,
   DuplicateStoreKindError,
+  NOYDB_ENVELOPE_GENERATION,
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError,
   UnknownStoreKindError,
   createStoreLocator,
+  isConflictError,
   isPodStore
 };
 //# sourceMappingURL=index.js.map

package/dist/to/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/to/locator.ts"],"sourcesContent":["/**\n * The Locator seam (#945 Task 1): a serializable, CREDENTIALLESS store\n * descriptor plus a factory registry that reconstructs a `NoydbStore` from\n * data.\n *\n * A `StoreDescriptor` is the pod-portable \"what store and where\" — kind,\n * broad topology class, and a kind-specific serializable address/options\n * bag. It is deliberately dumb data: no field on it is ever typed as a\n * function, a `StoreCredentialSource`, or a `StoreCredentials` value, so a\n * descriptor can be written into a pod / manifest / sync payload without an\n * audit for leaked secrets. Anything that must resolve device-side or\n * user-side — a short-lived credential, a device-local directory override,\n * a mounted drive handle — travels out-of-band via `resolve()`'s `opts`,\n * never through the descriptor itself.\n *\n * This module is pure TypeScript: no imports beyond the kernel's own types\n * and errors, no Node built-ins, no crypto. It adds zero runtime\n * dependencies to `@noy-db/hub/to`.\n */\nimport type { NoydbStore, NoydbPodStore, StoreCredentialSource } from '../../kernel/types.js'\nimport { DuplicateStoreKindError, UnknownStoreKindError } from '../../kernel/errors.js'\n\n/**\n * The broad topology bucket a store descriptor's kind falls into —\n * used by callers/UI to group or filter descriptors without knowing every\n * concrete `kind` string.\n */\nexport type StoreClass = 'local' | 'browser' | 'lan' | 'cloud'\n\n/**\n * A serializable, CREDENTIALLESS description of a store instance: enough\n * data to reconstruct a `NoydbStore` via a registered `StoreFactory`, and\n * safe to persist or transmit as-is.\n *\n * CREDENTIALLESS BY CONSTRUCTION: no field here may be typed as a function,\n * a `StoreCredentialSource`, or a `StoreCredentials` value. Credentials\n * NEVER ride the descriptor — they are supplied separately (as a\n * `StoreCredentialSource`) to `StoreLocator.resolve()` at resolve time.\n */\nexport interface StoreDescriptor {\n  /** The registered factory key (e.g. `'file'`, `'aws-s3'`, `'webdav'`). */\n  readonly kind: string\n  /** The broad topology bucket this kind falls into. */\n  readonly class: StoreClass\n  /** Kind-specific serializable location (e.g. `{ dir }`, `{ bucket, region }`). */\n  readonly address: unknown\n  /** Kind-specific serializable tuning options. */\n  readonly options?: unknown\n}\n\n/**\n * A kind-specific, device-local supplement to a `StoreDescriptor` — a\n * directory override, a mount point, a drive handle — that is resolved\n * device-side and never carried inside a pod alongside the descriptor.\n */\nexport type StoreBinding = unknown\n\n/**\n * Either store shape a factory may produce: the 6-method KV `NoydbStore`, or\n * the whole-vault `NoydbPodStore` implemented by `to-drive` / `to-icloud`.\n *\n * The two are DISJOINT, not sub/supertypes — a pod store has none of the six\n * KV methods — which is why moving between them needs a double cast and why\n * `isPodStore()` exists to narrow instead.\n */\nexport type AnyNoydbStore = NoydbStore | NoydbPodStore\n\n/**\n * Narrow an `AnyNoydbStore` to the pod shape. Discriminates on the\n * `kind: 'bundle'` tag `NoydbPodStore` carries for exactly this purpose; a\n * `NoydbStore` has no `kind` field at all.\n *\n * Use this at a `resolve()` boundary instead of casting — a store resolved\n * from a descriptor read out of a pod is only known to be one of the two\n * shapes at runtime.\n */\nexport function isPodStore(store: AnyNoydbStore): store is NoydbPodStore {\n  return (store as NoydbPodStore).kind === 'bundle'\n}\n\n/**\n * Reconstructs a live store from a `StoreDescriptor`. Registered against a\n * `StoreLocator` under the descriptor's `kind`.\n *\n * The type parameter says WHICH shape this factory builds. It defaults to\n * `NoydbStore`, so a bare `StoreFactory` means exactly what it always has;\n * a pod-store factory declares `StoreFactory<NoydbPodStore>` and registers\n * without a cast (#988).\n */\nexport type StoreFactory<S extends AnyNoydbStore = NoydbStore> = (\n  descriptor: StoreDescriptor,\n  opts: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n) => S | Promise<S>\n\n/** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */\nexport interface StoreLocator {\n  /**\n   * Register a factory for `kind`. Throws if `kind` is already registered.\n   *\n   * Accepts a factory building EITHER store shape — `S` is inferred from the\n   * factory's own return type, so a `NoydbPodStore` factory needs no cast.\n   */\n  register<S extends AnyNoydbStore>(kind: string, factory: StoreFactory<S>): void\n  /**\n   * Resolve `descriptor` to a live store via its kind's registered factory.\n   *\n   * Returns `NoydbStore`. If the `kind` was registered with a pod-store\n   * factory, the resolved value is really a `NoydbPodStore`: this signature\n   * is the seam's remaining unsoundness, kept because widening it to\n   * `AnyNoydbStore` would break every existing caller. Where the descriptor's\n   * kind is not statically known, prefer `resolveAny()` and `isPodStore()`.\n   */\n  resolve(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): NoydbStore | Promise<NoydbStore>\n  /**\n   * As `resolve()`, but typed honestly: the registry is keyed by a runtime\n   * `kind` string, so which of the two shapes comes back is not knowable\n   * statically. Narrow the result with `isPodStore()`.\n   */\n  resolveAny(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): AnyNoydbStore | Promise<AnyNoydbStore>\n}\n\n/**\n * Creates a fresh, empty `StoreLocator`.\n *\n * DUPLICATE REGISTRATION: `register()` throws if `kind` is already\n * registered, rather than silently overwriting it (last-wins). A\n * composition root that registers the same kind twice is almost always a\n * mistake — a copy-pasted setup block, two satellite packages fighting\n * over the same kind string — and last-wins would hide it behind whichever\n * registration happened to run last. This mirrors the\n * `DuplicateBehaviorNameError` philosophy (#947): fail loudly at the\n * mistake's source instead of silently at some unrelated `resolve()` call\n * later.\n */\nexport function createStoreLocator(): StoreLocator {\n  const factories = new Map<string, StoreFactory<AnyNoydbStore>>()\n\n  function lookup(kind: string): StoreFactory<AnyNoydbStore> {\n    const factory = factories.get(kind)\n    if (!factory) {\n      throw new UnknownStoreKindError(kind, [...factories.keys()].sort())\n    }\n    return factory\n  }\n\n  return {\n    register(kind, factory) {\n      if (factories.has(kind)) {\n        throw new DuplicateStoreKindError(kind)\n      }\n      factories.set(kind, factory)\n    },\n    resolve(descriptor, opts = {}) {\n      // The one place the seam's `resolve(): NoydbStore` signature is paid\n      // for. A pod-store `kind` really returns a `NoydbPodStore`; the registry\n      // is keyed by a runtime string so nothing here can prove otherwise.\n      // Concentrated in the module that owns the invariant rather than\n      // duplicated as `as unknown as StoreFactory` in every pod-store package\n      // (#988). `resolveAny()` is the honest signature over the same call.\n      return lookup(descriptor.kind)(descriptor, opts) as NoydbStore | Promise<NoydbStore>\n    },\n    resolveAny(descriptor, opts = {}) {\n      return lookup(descriptor.kind)(descriptor, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AA4EO,SAAS,WAAW,OAA8C;AACvE,SAAQ,MAAwB,SAAS;AAC3C;AA8DO,SAAS,qBAAmC;AACjD,QAAM,YAAY,oBAAI,IAAyC;AAE/D,WAAS,OAAO,MAA2C;AACzD,UAAM,UAAU,UAAU,IAAI,IAAI;AAClC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS;AACtB,UAAI,UAAU,IAAI,IAAI,GAAG;AACvB,cAAM,IAAI,wBAAwB,IAAI;AAAA,MACxC;AACA,gBAAU,IAAI,MAAM,OAAO;AAAA,IAC7B;AAAA,IACA,QAAQ,YAAY,OAAO,CAAC,GAAG;AAO7B,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,IACA,WAAW,YAAY,OAAO,CAAC,GAAG;AAChC,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/to/locator.ts"],"sourcesContent":["/**\n * The Locator seam (#945 Task 1): a serializable, CREDENTIALLESS store\n * descriptor plus a factory registry that reconstructs a `NoydbStore` from\n * data.\n *\n * A `StoreDescriptor` is the pod-portable \"what store and where\" — kind,\n * broad topology class, and a kind-specific serializable address/options\n * bag. It is deliberately dumb data: no field on it is ever typed as a\n * function, a `StoreCredentialSource`, or a `StoreCredentials` value, so a\n * descriptor can be written into a pod / manifest / sync payload without an\n * audit for leaked secrets. Anything that must resolve device-side or\n * user-side — a short-lived credential, a device-local directory override,\n * a mounted drive handle — travels out-of-band via `resolve()`'s `opts`,\n * never through the descriptor itself.\n *\n * This module is pure TypeScript: no imports beyond the kernel's own types\n * and errors, no Node built-ins, no crypto. It adds zero runtime\n * dependencies to `@noy-db/hub/to`.\n */\nimport type { NoydbStore, NoydbPodStore, StoreCredentialSource } from '../../kernel/types.js'\nimport { DuplicateStoreKindError, UnknownStoreKindError } from '../../kernel/errors.js'\n\n/**\n * The broad topology bucket a store descriptor's kind falls into —\n * used by callers/UI to group or filter descriptors without knowing every\n * concrete `kind` string.\n */\nexport type StoreClass = 'local' | 'browser' | 'lan' | 'cloud'\n\n/**\n * A serializable, CREDENTIALLESS description of a store instance: enough\n * data to reconstruct a `NoydbStore` via a registered `StoreFactory`, and\n * safe to persist or transmit as-is.\n *\n * CREDENTIALLESS BY CONSTRUCTION: no field here may be typed as a function,\n * a `StoreCredentialSource`, or a `StoreCredentials` value. Credentials\n * NEVER ride the descriptor — they are supplied separately (as a\n * `StoreCredentialSource`) to `StoreLocator.resolve()` at resolve time.\n */\nexport interface StoreDescriptor {\n  /** The registered factory key (e.g. `'file'`, `'aws-s3'`, `'webdav'`). */\n  readonly kind: string\n  /** The broad topology bucket this kind falls into. */\n  readonly class: StoreClass\n  /** Kind-specific serializable location (e.g. `{ dir }`, `{ bucket, region }`). */\n  readonly address: unknown\n  /** Kind-specific serializable tuning options. */\n  readonly options?: unknown\n}\n\n/**\n * A kind-specific, device-local supplement to a `StoreDescriptor` — a\n * directory override, a mount point, a drive handle — that is resolved\n * device-side and never carried inside a pod alongside the descriptor.\n */\nexport type StoreBinding = unknown\n\n/**\n * Either store shape a factory may produce: the 6-method KV `NoydbStore`, or\n * the whole-vault `NoydbPodStore` implemented by `to-drive` / `to-icloud`.\n *\n * The two are DISJOINT, not sub/supertypes — a pod store has none of the six\n * KV methods — which is why moving between them needs a double cast and why\n * `isPodStore()` exists to narrow instead.\n */\nexport type AnyNoydbStore = NoydbStore | NoydbPodStore\n\n/**\n * Narrow an `AnyNoydbStore` to the pod shape. Discriminates on the\n * `kind: 'bundle'` tag `NoydbPodStore` carries for exactly this purpose; a\n * `NoydbStore` has no `kind` field at all.\n *\n * Use this at a `resolve()` boundary instead of casting — a store resolved\n * from a descriptor read out of a pod is only known to be one of the two\n * shapes at runtime.\n */\nexport function isPodStore(store: AnyNoydbStore): store is NoydbPodStore {\n  return (store as NoydbPodStore).kind === 'bundle'\n}\n\n/**\n * Reconstructs a live store from a `StoreDescriptor`. Registered against a\n * `StoreLocator` under the descriptor's `kind`.\n *\n * The type parameter says WHICH shape this factory builds. It defaults to\n * `NoydbStore`, so a bare `StoreFactory` means exactly what it always has;\n * a pod-store factory declares `StoreFactory<NoydbPodStore>` and registers\n * without a cast (#988).\n */\nexport type StoreFactory<S extends AnyNoydbStore = NoydbStore> = (\n  descriptor: StoreDescriptor,\n  opts: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n) => S | Promise<S>\n\n/** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */\nexport interface StoreLocator {\n  /**\n   * Register a factory for `kind`. Throws if `kind` is already registered.\n   *\n   * Accepts a factory building EITHER store shape — `S` is inferred from the\n   * factory's own return type, so a `NoydbPodStore` factory needs no cast.\n   */\n  register<S extends AnyNoydbStore>(kind: string, factory: StoreFactory<S>): void\n  /**\n   * Resolve `descriptor` to a live store via its kind's registered factory.\n   *\n   * Returns `NoydbStore`. If the `kind` was registered with a pod-store\n   * factory, the resolved value is really a `NoydbPodStore`: this signature\n   * is the seam's remaining unsoundness, kept because widening it to\n   * `AnyNoydbStore` would break every existing caller. Where the descriptor's\n   * kind is not statically known, prefer `resolveAny()` and `isPodStore()`.\n   */\n  resolve(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): NoydbStore | Promise<NoydbStore>\n  /**\n   * As `resolve()`, but typed honestly: the registry is keyed by a runtime\n   * `kind` string, so which of the two shapes comes back is not knowable\n   * statically. Narrow the result with `isPodStore()`.\n   */\n  resolveAny(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): AnyNoydbStore | Promise<AnyNoydbStore>\n}\n\n/**\n * Creates a fresh, empty `StoreLocator`.\n *\n * DUPLICATE REGISTRATION: `register()` throws if `kind` is already\n * registered, rather than silently overwriting it (last-wins). A\n * composition root that registers the same kind twice is almost always a\n * mistake — a copy-pasted setup block, two satellite packages fighting\n * over the same kind string — and last-wins would hide it behind whichever\n * registration happened to run last. This mirrors the\n * `DuplicateBehaviorNameError` philosophy (#947): fail loudly at the\n * mistake's source instead of silently at some unrelated `resolve()` call\n * later.\n */\nexport function createStoreLocator(): StoreLocator {\n  const factories = new Map<string, StoreFactory<AnyNoydbStore>>()\n\n  function lookup(kind: string): StoreFactory<AnyNoydbStore> {\n    const factory = factories.get(kind)\n    if (!factory) {\n      throw new UnknownStoreKindError(kind, [...factories.keys()].sort())\n    }\n    return factory\n  }\n\n  return {\n    register(kind, factory) {\n      if (factories.has(kind)) {\n        throw new DuplicateStoreKindError(kind)\n      }\n      factories.set(kind, factory)\n    },\n    resolve(descriptor, opts = {}) {\n      // The one place the seam's `resolve(): NoydbStore` signature is paid\n      // for. A pod-store `kind` really returns a `NoydbPodStore`; the registry\n      // is keyed by a runtime string so nothing here can prove otherwise.\n      // Concentrated in the module that owns the invariant rather than\n      // duplicated as `as unknown as StoreFactory` in every pod-store package\n      // (#988). `resolveAny()` is the honest signature over the same call.\n      return lookup(descriptor.kind)(descriptor, opts) as NoydbStore | Promise<NoydbStore>\n    },\n    resolveAny(descriptor, opts = {}) {\n      return lookup(descriptor.kind)(descriptor, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA4EO,SAAS,WAAW,OAA8C;AACvE,SAAQ,MAAwB,SAAS;AAC3C;AA8DO,SAAS,qBAAmC;AACjD,QAAM,YAAY,oBAAI,IAAyC;AAE/D,WAAS,OAAO,MAA2C;AACzD,UAAM,UAAU,UAAU,IAAI,IAAI;AAClC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS;AACtB,UAAI,UAAU,IAAI,IAAI,GAAG;AACvB,cAAM,IAAI,wBAAwB,IAAI;AAAA,MACxC;AACA,gBAAU,IAAI,MAAM,OAAO;AAAA,IAC7B;AAAA,IACA,QAAQ,YAAY,OAAO,CAAC,GAAG;AAO7B,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,IACA,WAAW,YAAY,OAAO,CAAC,GAAG;AAChC,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}

package/dist/transactions/index.js

@@ -3,16 +3,16 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-VFIWDPXZ.js";
+} from "../chunk-RPX2H2OL.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-JBIV4FLR.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-AFHQYRAU.js"));
+var loadGuardExecutor = lazy(() => import("../executor-CRH5OB4V.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/vault-head/index.js

@@ -6,19 +6,19 @@ import {
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "../chunk-2LPVI4PX.js";
+} from "../chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "../chunk-N4CNVSUF.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "../chunk-W5LHQXZU.js";
-import "../chunk-RK7N4OQ5.js";
-import "../chunk-JBIV4FLR.js";
+} from "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/vault-head/head.ts

package/dist/{verify-WYOFLSNA.js → verify-R6CCBUA3.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-FOG7YEJP.js";
+} from "./chunk-XGXVPCYW.js";
 import {
   dualReadSealedSlot
-} from "./chunk-KDJGJR7F.js";
+} from "./chunk-CWFH36SI.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-WYOFLSNA.js.map
+//# sourceMappingURL=verify-R6CCBUA3.js.map

package/dist/walk-3PA4ZOKS.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-PCIBCL26.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-VT4DTCK5.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-I5LSKXT6.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-3PA4ZOKS.js.map

package/dist/with-cargo/index.d.ts

@@ -22,6 +22,7 @@ export type { DeedMarker } from '../with-party/team/deed.js';
 export type { NoydbSealer } from '../with-party/team/managed-secret.js';
 export { diffVault } from './vault-diff.js';
 export { STATE_VAULT_NAME } from '../kernel/constants.js';
+export { NOYDB_ENVELOPE_GENERATION } from '../kernel/types.js';
 export { withCargo } from './active.js';
 export { NO_CARGO } from './strategy.js';
 export type { CargoStrategy } from './strategy.js';

package/dist/with-party/team/roster-epoch.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The roster epoch: minting and comparison (#1097).
+ *
+ * ## What this closes, and what it does not
+ *
+ * A roster tag authenticates the roster's CONTENTS. It makes no claim about
+ * being CURRENT, and that gap is reachable without forging anything: there is
+ * no role-change API, so narrowing a user's standing means calling `grant`
+ * again with a lower role, and the keyring write overwrites in place. The
+ * previous, broader file was legitimately minted by this vault. A store that
+ * kept a copy re-serves it; the KEK unwraps, the canary checks out, the tag
+ * verifies, and the replayed file restores the higher role — usably, not
+ * cosmetically.
+ *
+ * The ROTATION half of #1097 already shipped: rotating the collections a
+ * narrowing drops restores the bound ADR 0003 assumed, so the old file's DEKs
+ * no longer open anything written since. That converts live access back into
+ * stale access. It cannot touch the role, because role gates capabilities
+ * rather than keys.
+ *
+ * ## Why the epoch needs a second channel
+ *
+ * An epoch stored beside the roster is not an anchor: a store rewinding the
+ * roster rewinds the epoch with it. It becomes an anchor only when the reader
+ * holds an expected value that arrived by a channel the store does not carry.
+ * Hub owns the epoch and the comparison; **who carries the expectation is
+ * deliberately not hub's business**, because hub cannot know which channel a
+ * deployment trusts.
+ *
+ * Candidates considered and REJECTED for that anchor, recorded so they are not
+ * re-derived:
+ *
+ *   - **Time.** Defeats long rewinds and is useless against fresh ones — and a
+ *     narrowing replay is entirely the fresh case.
+ *   - **The vault head.** Circular: head buckets are read with a
+ *     keyring-issued DEK, and a rewound roster renders as the benign
+ *     `no-expectations` verdict.
+ *
+ * @module
+ */
+/**
+ * Refuse a keyring whose roster epoch is older than the caller expects.
+ *
+ * OPT-IN: with no `expected` this is a no-op, and the caller is exactly as
+ * exposed as before. Deliberate — a deployment with no second channel has
+ * nothing to compare against, and inventing a comparison would be worse than
+ * declining to make one.
+ *
+ * ⚠️ **An absent epoch is UNKNOWN, never zero.** Every keyring written before
+ * the epoch existed has none, and those are precisely the files a replay would
+ * serve. Treating absence as `0` would accept all of them and defeat the
+ * mechanism while appearing to work. Same rule as `NOYDB_ENVELOPE_GENERATION`,
+ * and the same reason: absence is a statement about the WRITER, not the value.
+ *
+ * `found > expected` is ACCEPTED. The expectation is a FLOOR, not an equality:
+ * an out-of-band anchor is minted at a moment in time and the roster may
+ * legitimately have moved on. Requiring equality would refuse healthy vaults
+ * after any grant or revoke, which is the fastest way to get a security check
+ * switched off.
+ */
+export declare function assertRosterEpochCurrent(found: number | undefined, expected: number | undefined, userId: string): void;
+/**
+ * The next epoch for a roster write — monotonic, never silently restarting.
+ *
+ * A write that reused or lowered an epoch would mint a file the comparison
+ * above cannot distinguish from a replay, so this is the only sanctioned way
+ * to produce one. `undefined` in — a file that predates the mechanism, or a
+ * brand-new keyring — starts the line at 1 rather than 0, so that "has an
+ * epoch" is never confusable with falsy.
+ */
+export declare function nextRosterEpoch(current: number | undefined): number;

package/dist/with-party/team/roster-tag.d.ts

@@ -44,7 +44,7 @@ export interface RosterTag {
     readonly iv: string;
     readonly data: string;
 }
-export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks'>;
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch'>;
 export declare function rosterCanonical(file: RosterAuthorityFields): string;
 export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
 /**

package/dist/withdraw-accessible-62VI4W7D.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-5EC7X5QA.js";
+import "./chunk-P22XPNFW.js";
+import "./chunk-RCONOOVF.js";
+import "./chunk-NMDMSHBF.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-62VI4W7D.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.7.0-pre.1",
+  "version": "0.7.0-pre.10",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -233,14 +233,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.7.0-pre.1"
+    "@noy-db/attestation": "0.7.0-pre.10"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.7.0-pre.1"
+    "@noy-db/on-shamir": "0.7.0-pre.10"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"

package/dist/api-EQYRTZO2.js

@@ -1,20 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-DBNYPLWY.js";
-import "./chunk-DFAUMLD7.js";
-import "./chunk-2LPVI4PX.js";
-import "./chunk-N4CNVSUF.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-W5LHQXZU.js";
-import "./chunk-RK7N4OQ5.js";
-import "./chunk-JBIV4FLR.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-EQYRTZO2.js.map