@noy-db/hub 0.7.0-pre.7 → 0.7.0-pre.9

package/dist/{seed-IX5NFSH5.js → seed-CG7JMJNY.js}

@@ -1,27 +1,27 @@
 import {
   BROKER_COLLECTION,
   ensureCollectionDEK
-} from "./chunk-ZTYG36DH.js";
-import "./chunk-26W5VETY.js";
-import "./chunk-POS53FG6.js";
+} from "./chunk-OHGCRKWA.js";
+import "./chunk-MV2OEK3K.js";
+import "./chunk-IZTU6RKH.js";
 import {
   computeBrokerProof,
   deriveBrokerProofBits,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-BYBB4ABD.js";
+} from "./chunk-DOPZWTMJ.js";
 import {
   buildSealedRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
+} from "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
 import "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-W5LHQXZU.js";
-import "./chunk-GU3LQYW2.js";
+} from "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -29,7 +29,7 @@ import {
   PermissionDeniedError,
   ValidationError,
   isConflictError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-party/broker/seed.ts
@@ -226,4 +226,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-IX5NFSH5.js.map
+//# sourceMappingURL=seed-CG7JMJNY.js.map

package/dist/sequence/index.js

@@ -5,18 +5,18 @@ import {
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "../chunk-S3I7VKID.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-H5GVPOB4.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   SequenceNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_SEQUENCE,

package/dist/session/index.js

@@ -12,24 +12,24 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-T3PHCEN4.js";
+} from "../chunk-MU74BYOD.js";
 import {
   NO_SESSION
 } from "../chunk-VKQCVU2Z.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/session/active.ts

package/dist/shadow/index.js

@@ -1,11 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-XVU7J43V.js";
+} from "../chunk-2E2LT37H.js";
 import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
-import "../chunk-JBIV4FLR.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/shadow/active.ts

package/dist/signer-5TA7FUC3.js

@@ -0,0 +1,25 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-GKOJR53Y.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-5TA7FUC3.js.map

package/dist/snapshots/index.js

@@ -4,19 +4,19 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-6AQIFBSP.js";
-import "../chunk-44C2URL7.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-RCONOOVF.js";
+import "../chunk-NMDMSHBF.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts

package/dist/{stale-5I36LPVK.js → stale-HZR7745Y.js}

@@ -6,17 +6,17 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-EXDIHWFO.js";
+} from "./chunk-MENI33ZV.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-BYBB4ABD.js";
-import "./chunk-QU3YUP2X.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-W5LHQXZU.js";
-import "./chunk-GU3LQYW2.js";
-import "./chunk-JBIV4FLR.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MV_STALE_COLLECTION,
@@ -27,4 +27,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-5I36LPVK.js.map
+//# sourceMappingURL=stale-HZR7745Y.js.map

package/dist/storage-J2QHNJCB.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-I5LSKXT6.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-J2QHNJCB.js.map

package/dist/{store-coordination-provider-OLPNRMFO.js → store-coordination-provider-MYIHSZXT.js}

@@ -1,18 +1,18 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-M7UC2QPT.js";
-import "./chunk-BYBB4ABD.js";
+} from "./chunk-GM4IM7TC.js";
+import "./chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
+} from "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-W5LHQXZU.js";
-import "./chunk-GU3LQYW2.js";
-import "./chunk-JBIV4FLR.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -146,4 +146,4 @@ function unref(timer) {
 export {
   StoreMesh
 };
-//# sourceMappingURL=store-coordination-provider-OLPNRMFO.js.map
+//# sourceMappingURL=store-coordination-provider-MYIHSZXT.js.map

package/dist/sync/index.js

@@ -2,20 +2,20 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-IF56DYJK.js";
+} from "../chunk-OLUTCM23.js";
 import {
   NO_SYNC
 } from "../chunk-T7IR4N2S.js";
-import "../chunk-Z7ZXZL6Y.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-Q2ZN5DWZ.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
-import "../chunk-JBIV4FLR.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-sync/active.ts

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSeal,
   beginEchoUnlock,
   withTeam
-} from "../chunk-Y3XWRDAM.js";
+} from "../chunk-RHTPGS56.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -31,8 +31,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-4FPEWQKF.js";
-import "../chunk-X6TBQKHW.js";
+} from "../chunk-VTTDPGEK.js";
+import "../chunk-5UKIZIO3.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -53,21 +53,21 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-ZTYG36DH.js";
-import "../chunk-26W5VETY.js";
-import "../chunk-HTGRQZFB.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-OHGCRKWA.js";
+import "../chunk-MV2OEK3K.js";
+import "../chunk-DZPMKY3J.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   TeamNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryDeviceSeal,

package/dist/tiers/index.js

@@ -11,20 +11,20 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-RJ7RIIX6.js";
-import "../chunk-HTGRQZFB.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-5NKHCJU5.js";
+import "../chunk-DZPMKY3J.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   TiersNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -1,6 +1,6 @@
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-GU3LQYW2.js";
+} from "../chunk-N4CHCXDL.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
@@ -9,7 +9,7 @@ import {
   StoreCapabilityError,
   UnknownStoreKindError,
   isConflictError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/to/locator.ts

package/dist/transactions/index.js

@@ -3,16 +3,16 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-VFIWDPXZ.js";
+} from "../chunk-RPX2H2OL.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-JBIV4FLR.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-AFHQYRAU.js"));
+var loadGuardExecutor = lazy(() => import("../executor-CRH5OB4V.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/vault-head/index.js

@@ -6,19 +6,19 @@ import {
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "../chunk-BYBB4ABD.js";
+} from "../chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
-import "../chunk-JBIV4FLR.js";
+} from "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/vault-head/head.ts

package/dist/{verify-WYOFLSNA.js → verify-R6CCBUA3.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-FOG7YEJP.js";
+} from "./chunk-XGXVPCYW.js";
 import {
   dualReadSealedSlot
-} from "./chunk-KDJGJR7F.js";
+} from "./chunk-CWFH36SI.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-USKHHOIV.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-WYOFLSNA.js.map
+//# sourceMappingURL=verify-R6CCBUA3.js.map

package/dist/walk-3PA4ZOKS.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-PCIBCL26.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-VT4DTCK5.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-I5LSKXT6.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-3PA4ZOKS.js.map

package/dist/with-party/team/roster-epoch.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The roster epoch: minting and comparison (#1097).
+ *
+ * ## What this closes, and what it does not
+ *
+ * A roster tag authenticates the roster's CONTENTS. It makes no claim about
+ * being CURRENT, and that gap is reachable without forging anything: there is
+ * no role-change API, so narrowing a user's standing means calling `grant`
+ * again with a lower role, and the keyring write overwrites in place. The
+ * previous, broader file was legitimately minted by this vault. A store that
+ * kept a copy re-serves it; the KEK unwraps, the canary checks out, the tag
+ * verifies, and the replayed file restores the higher role — usably, not
+ * cosmetically.
+ *
+ * The ROTATION half of #1097 already shipped: rotating the collections a
+ * narrowing drops restores the bound ADR 0003 assumed, so the old file's DEKs
+ * no longer open anything written since. That converts live access back into
+ * stale access. It cannot touch the role, because role gates capabilities
+ * rather than keys.
+ *
+ * ## Why the epoch needs a second channel
+ *
+ * An epoch stored beside the roster is not an anchor: a store rewinding the
+ * roster rewinds the epoch with it. It becomes an anchor only when the reader
+ * holds an expected value that arrived by a channel the store does not carry.
+ * Hub owns the epoch and the comparison; **who carries the expectation is
+ * deliberately not hub's business**, because hub cannot know which channel a
+ * deployment trusts.
+ *
+ * Candidates considered and REJECTED for that anchor, recorded so they are not
+ * re-derived:
+ *
+ *   - **Time.** Defeats long rewinds and is useless against fresh ones — and a
+ *     narrowing replay is entirely the fresh case.
+ *   - **The vault head.** Circular: head buckets are read with a
+ *     keyring-issued DEK, and a rewound roster renders as the benign
+ *     `no-expectations` verdict.
+ *
+ * @module
+ */
+/**
+ * Refuse a keyring whose roster epoch is older than the caller expects.
+ *
+ * OPT-IN: with no `expected` this is a no-op, and the caller is exactly as
+ * exposed as before. Deliberate — a deployment with no second channel has
+ * nothing to compare against, and inventing a comparison would be worse than
+ * declining to make one.
+ *
+ * ⚠️ **An absent epoch is UNKNOWN, never zero.** Every keyring written before
+ * the epoch existed has none, and those are precisely the files a replay would
+ * serve. Treating absence as `0` would accept all of them and defeat the
+ * mechanism while appearing to work. Same rule as `NOYDB_ENVELOPE_GENERATION`,
+ * and the same reason: absence is a statement about the WRITER, not the value.
+ *
+ * `found > expected` is ACCEPTED. The expectation is a FLOOR, not an equality:
+ * an out-of-band anchor is minted at a moment in time and the roster may
+ * legitimately have moved on. Requiring equality would refuse healthy vaults
+ * after any grant or revoke, which is the fastest way to get a security check
+ * switched off.
+ */
+export declare function assertRosterEpochCurrent(found: number | undefined, expected: number | undefined, userId: string): void;
+/**
+ * The next epoch for a roster write — monotonic, never silently restarting.
+ *
+ * A write that reused or lowered an epoch would mint a file the comparison
+ * above cannot distinguish from a replay, so this is the only sanctioned way
+ * to produce one. `undefined` in — a file that predates the mechanism, or a
+ * brand-new keyring — starts the line at 1 rather than 0, so that "has an
+ * epoch" is never confusable with falsy.
+ */
+export declare function nextRosterEpoch(current: number | undefined): number;

package/dist/with-party/team/roster-tag.d.ts

@@ -44,7 +44,7 @@ export interface RosterTag {
     readonly iv: string;
     readonly data: string;
 }
-export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks'>;
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks' | 'roster_epoch'>;
 export declare function rosterCanonical(file: RosterAuthorityFields): string;
 export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
 /**

package/dist/withdraw-accessible-62VI4W7D.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-5EC7X5QA.js";
+import "./chunk-P22XPNFW.js";
+import "./chunk-RCONOOVF.js";
+import "./chunk-NMDMSHBF.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-62VI4W7D.js.map