@noy-db/hub 0.7.0-pre.8 → 0.7.0

package/dist/{chunk-IF56DYJK.js → chunk-CPWQB3N5.js}

@@ -7,27 +7,27 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-Z7ZXZL6Y.js";
+} from "./chunk-FAHMLERK.js";
 import {
   envelopeBodySize
-} from "./chunk-BYBB4ABD.js";
+} from "./chunk-77K4PG6P.js";
 import {
   buildRecordEnvelope,
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-QU3YUP2X.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   decrypt,
   derivePresenceKey,
   encrypt
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-SL3JAAKN.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-GU3LQYW2.js";
+} from "./chunk-7MG7SJT7.js";
 import {
   ValidationError,
   isConflictError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-sync/presence.ts
 var subtle = globalThis.crypto.subtle;
@@ -1213,4 +1213,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-IF56DYJK.js.map
+//# sourceMappingURL=chunk-CPWQB3N5.js.map

package/dist/{chunk-SHILAQH5.js → chunk-DGOZ4UZD.js}

@@ -1,6 +1,6 @@
 import {
   DuplicateBehaviorNameError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-audit/guards/registry.ts
 var GuardRegistry = class {
@@ -141,4 +141,4 @@ var GuardRegistry = class {
 export {
   GuardRegistry
 };
-//# sourceMappingURL=chunk-SHILAQH5.js.map
+//# sourceMappingURL=chunk-DGOZ4UZD.js.map

package/dist/{chunk-BWWUXE3L.js → chunk-ELNXJMGB.js}

@@ -2,21 +2,21 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-LFDMKZIP.js";
+} from "./chunk-ANATMFIO.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-BYBB4ABD.js";
+} from "./chunk-77K4PG6P.js";
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   encrypt
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-SL3JAAKN.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-audit/attestation/revoke.ts
 import { signRevocationList } from "@noy-db/attestation";
@@ -81,4 +81,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-BWWUXE3L.js.map
+//# sourceMappingURL=chunk-ELNXJMGB.js.map

package/dist/{chunk-44C2URL7.js → chunk-EQEYOJBM.js}

@@ -1,9 +1,9 @@
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-party/directory/cover/custom.ts
 var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
@@ -230,4 +230,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-44C2URL7.js.map
+//# sourceMappingURL=chunk-EQEYOJBM.js.map

package/dist/{chunk-Y3XWRDAM.js → chunk-EYBQEIUY.js}

@@ -10,14 +10,14 @@ import {
   verifyPrompt,
   verifyRoster,
   verifyTypedEcho
-} from "./chunk-ZTYG36DH.js";
+} from "./chunk-G56KBWFY.js";
 import {
   NoAccessError,
   NoydbError,
   ValidationError,
   WrongEchoError,
   WrongPromptError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-party/team/echo-ceremony.ts
 async function beginEchoUnlock(store, vault, opts) {
@@ -122,4 +122,4 @@ export {
   MemoryDeviceSeal,
   withTeam
 };
-//# sourceMappingURL=chunk-Y3XWRDAM.js.map
+//# sourceMappingURL=chunk-EYBQEIUY.js.map

package/dist/{chunk-Z7ZXZL6Y.js → chunk-FAHMLERK.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -23,4 +23,4 @@ export {
   PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-Z7ZXZL6Y.js.map
+//# sourceMappingURL=chunk-FAHMLERK.js.map

package/dist/chunk-FFWI7UH7.js

@@ -0,0 +1,53 @@
+// src/with-formula/derivations/trigger-match.ts
+function hopCollections(match) {
+  return [...new Set(match.flatMap((p) => p.via ? [p.via.collection] : []))];
+}
+function normalizeTriggerBy(triggerBy) {
+  if (triggerBy === void 0) return [];
+  return triggerBy.map((t) => ({
+    collection: t.collection,
+    match: t.match ?? [{ from: "id", to: t.on }],
+    ...t.maxFanout !== void 0 ? { maxFanout: t.maxFanout } : {}
+  }));
+}
+var scalar = (v) => typeof v === "string" || typeof v === "number" ? String(v) : null;
+async function resolveTuple(match, writtenId, record, lookup) {
+  const out = [];
+  for (const pair of match) {
+    const raw = pair.from === "id" ? writtenId : scalar(record?.[pair.from]);
+    if (raw === null) return null;
+    if (pair.via === void 0) {
+      out.push({ field: pair.to, value: raw });
+      continue;
+    }
+    const intermediate = await lookup(pair.via.collection, pair.via.take, raw);
+    if (intermediate === null) return null;
+    const hopped = scalar(intermediate[pair.via.on]);
+    if (hopped === null) return null;
+    out.push({ field: pair.to, value: hopped });
+  }
+  return out;
+}
+function tupleFromIntermediate(match, collection, record) {
+  const out = [];
+  for (const pair of match) {
+    if (pair.via?.collection !== collection) continue;
+    const v = scalar(record?.[pair.via.on]);
+    if (v === null) return null;
+    out.push({ field: pair.to, value: v });
+  }
+  return out.length > 0 ? out : null;
+}
+function sameTuple(a, b) {
+  if (a === null || b === null) return a === b;
+  return a.length === b.length && a.every((p, i) => p.field === b[i].field && p.value === b[i].value);
+}
+
+export {
+  hopCollections,
+  normalizeTriggerBy,
+  resolveTuple,
+  tupleFromIntermediate,
+  sameTuple
+};
+//# sourceMappingURL=chunk-FFWI7UH7.js.map

package/dist/chunk-FFWI7UH7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/trigger-match.ts"],"sourcesContent":["/**\n * Pure helpers behind composite `triggerBy` (#1249).\n *\n * A trigger entry is a CONJUNCTION of equality pairs: a source record\n * matches when EVERY pair satisfies String(source[to]) === String(written[from]).\n * `from: 'id'` reads the written record's id (winning over any stored field\n * named `id`, matching dispatch's `{ ...incoming, id }` convention). The\n * legacy `on` form normalizes to `[{ from: 'id', to: on }]` so everything\n * downstream has ONE shape.\n *\n * Scalar coercion is verbatim from `_findMatchingIds`: both sides must be\n * string | number; anything else fails the pair (never throws).\n * Spec: docs/superpowers/specs/2026-08-29-composite-triggerby-design.md §4-§5.\n * @module\n */\n\n/** One declared hop through an intermediate collection (#1277). */\nexport interface MatchVia {\n  /** The intermediate collection to resolve through. */\n  readonly collection: string\n  /** Field on the intermediate whose value equals `written[from]`. */\n  readonly take: string\n  /** Field on the intermediate whose value is compared against `source[to]`. */\n  readonly on: string\n}\n\nexport interface MatchPair {\n  readonly from: string\n  readonly to: string\n  readonly via?: MatchVia\n}\n\n/** True when any pair in this trigger resolves through an intermediate. */\nexport function hasHop(match: ReadonlyArray<MatchPair>): boolean {\n  return match.some((p) => p.via !== undefined)\n}\n\n/** Every intermediate collection named by a trigger's pairs, deduplicated. */\nexport function hopCollections(match: ReadonlyArray<MatchPair>): string[] {\n  return [...new Set(match.flatMap((p) => (p.via ? [p.via.collection] : [])))]\n}\n\nexport interface NormalizedTrigger {\n  readonly collection: string\n  readonly match: ReadonlyArray<MatchPair>\n  readonly maxFanout?: number\n}\n\ninterface RawTrigger {\n  readonly collection: string\n  readonly on?: string\n  readonly match?: ReadonlyArray<MatchPair>\n  readonly maxFanout?: number\n}\n\nexport function normalizeTriggerBy(triggerBy: ReadonlyArray<RawTrigger> | undefined): NormalizedTrigger[] {\n  if (triggerBy === undefined) return []\n  return triggerBy.map((t) => ({\n    collection: t.collection,\n    match: t.match ?? [{ from: 'id', to: t.on! }],\n    ...(t.maxFanout !== undefined ? { maxFanout: t.maxFanout } : {}),\n  }))\n}\n\nconst scalar = (v: unknown): string | null =>\n  (typeof v === 'string' || typeof v === 'number') ? String(v) : null\n\n/**\n * Resolve one trigger's pairs into the value tuple a written record presents,\n * following any declared hop (#1277).\n *\n * Non-hop pairs behave exactly as {@link tupleFromWritten}. A hop pair reads\n * `written[from]`, finds the intermediate record whose `via.take` equals it,\n * and substitutes that record's `via.on` value — so everything downstream\n * still compares a flat `{ field, value }` tuple against source records and\n * the existing index-backed matcher is unchanged.\n *\n * Returns `null` when ANY pair cannot produce a value — a missing field, a\n * non-scalar, or an intermediate that does not resolve. That is a legitimate\n * no-match, not an error: a dangling reference addresses nothing, and refusing\n * here would turn a data condition into a thrown exception on every write.\n *\n * Supersedes the sync `tupleFromWritten`, which was DELETED rather than kept\n * (#1294): having two tuple builders that had to agree is precisely how the\n * delete path drifted — it called the unhopped one, so a mapped pair compared\n * the wrong side of the relationship and matched nothing, silently. One path\n * cannot disagree with itself.\n *\n * ONE lookup per hop per written record. `take: 'id'` is a direct `get`; any\n * other `take` is a field match on the intermediate, which uses its index when\n * one is declared.\n */\nexport async function resolveTuple(\n  match: ReadonlyArray<MatchPair>,\n  writtenId: string,\n  record: Record<string, unknown> | null,\n  lookup: (collection: string, field: string, value: string) => Promise<Record<string, unknown> | null>,\n): Promise<Array<{ field: string; value: string }> | null> {\n  const out: Array<{ field: string; value: string }> = []\n  for (const pair of match) {\n    const raw = pair.from === 'id' ? writtenId : scalar(record?.[pair.from])\n    if (raw === null) return null\n    if (pair.via === undefined) {\n      out.push({ field: pair.to, value: raw })\n      continue\n    }\n    const intermediate = await lookup(pair.via.collection, pair.via.take, raw)\n    if (intermediate === null) return null\n    const hopped = scalar(intermediate[pair.via.on])\n    if (hopped === null) return null\n    out.push({ field: pair.to, value: hopped })\n  }\n  return out\n}\n\n/**\n * The tuple a written INTERMEDIATE record presents (#1277 option 2).\n *\n * When a record of `via.collection` is written, the sources it addresses are\n * those whose `to` equals the intermediate's own `via.on` value — no lookup is\n * needed, because the intermediate IS the written record. Pairs that do not\n * hop through this collection cannot be constrained by such a write and are\n * skipped, which makes the fan-out deliberately WIDER than a trigger write:\n * refreshing too much is recoverable, refreshing too little is the silent\n * staleness this feature exists to remove.\n *\n * Returns `null` when no pair hops through `collection`, or when the\n * intermediate carries no scalar at `via.on`.\n */\nexport function tupleFromIntermediate(\n  match: ReadonlyArray<MatchPair>,\n  collection: string,\n  record: Record<string, unknown> | null,\n): Array<{ field: string; value: string }> | null {\n  const out: Array<{ field: string; value: string }> = []\n  for (const pair of match) {\n    if (pair.via?.collection !== collection) continue\n    const v = scalar(record?.[pair.via.on])\n    if (v === null) return null\n    out.push({ field: pair.to, value: v })\n  }\n  return out.length > 0 ? out : null\n}\n\n/** Any single component differing means NOT the same tuple (spec §7). */\nexport function sameTuple(\n  a: Array<{ field: string; value: string }> | null,\n  b: Array<{ field: string; value: string }> | null,\n): boolean {\n  if (a === null || b === null) return a === b\n  return a.length === b.length && a.every((p, i) => p.field === b[i]!.field && p.value === b[i]!.value)\n}\n\n/** Moved to the kernel (#1249) so `collection.ts` can import statically without\n *  dragging derivations code into the floor bundle; re-exported here for\n *  compatibility with existing consumers of this module. */\nexport { recordMatchesPairs, findMatchingIdsByPairs } from '../../kernel/match-pairs.js'\n"],"mappings":";AAsCO,SAAS,eAAe,OAA2C;AACxE,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,MAAO,EAAE,MAAM,CAAC,EAAE,IAAI,UAAU,IAAI,CAAC,CAAE,CAAC,CAAC;AAC7E;AAeO,SAAS,mBAAmB,WAAuE;AACxG,MAAI,cAAc,OAAW,QAAO,CAAC;AACrC,SAAO,UAAU,IAAI,CAAC,OAAO;AAAA,IAC3B,YAAY,EAAE;AAAA,IACd,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,MAAM,IAAI,EAAE,GAAI,CAAC;AAAA,IAC5C,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,EAChE,EAAE;AACJ;AAEA,IAAM,SAAS,CAAC,MACb,OAAO,MAAM,YAAY,OAAO,MAAM,WAAY,OAAO,CAAC,IAAI;AA2BjE,eAAsB,aACpB,OACA,WACA,QACA,QACyD;AACzD,QAAM,MAA+C,CAAC;AACtD,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,KAAK,SAAS,OAAO,YAAY,OAAO,SAAS,KAAK,IAAI,CAAC;AACvE,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI,KAAK,QAAQ,QAAW;AAC1B,UAAI,KAAK,EAAE,OAAO,KAAK,IAAI,OAAO,IAAI,CAAC;AACvC;AAAA,IACF;AACA,UAAM,eAAe,MAAM,OAAO,KAAK,IAAI,YAAY,KAAK,IAAI,MAAM,GAAG;AACzE,QAAI,iBAAiB,KAAM,QAAO;AAClC,UAAM,SAAS,OAAO,aAAa,KAAK,IAAI,EAAE,CAAC;AAC/C,QAAI,WAAW,KAAM,QAAO;AAC5B,QAAI,KAAK,EAAE,OAAO,KAAK,IAAI,OAAO,OAAO,CAAC;AAAA,EAC5C;AACA,SAAO;AACT;AAgBO,SAAS,sBACd,OACA,YACA,QACgD;AAChD,QAAM,MAA+C,CAAC;AACtD,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,KAAK,eAAe,WAAY;AACzC,UAAM,IAAI,OAAO,SAAS,KAAK,IAAI,EAAE,CAAC;AACtC,QAAI,MAAM,KAAM,QAAO;AACvB,QAAI,KAAK,EAAE,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;AAAA,EACvC;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAGO,SAAS,UACd,GACA,GACS;AACT,MAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,SAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAG,SAAS,EAAE,UAAU,EAAE,CAAC,EAAG,KAAK;AACtG;","names":[]}

package/dist/{chunk-EXDIHWFO.js → chunk-FMZY5Q6L.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-BYBB4ABD.js";
+} from "./chunk-77K4PG6P.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-CDIMJVE2.js"));
+var loadMVExecutor = lazy(() => import("./executor-PUAO6AKJ.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-EXDIHWFO.js.map
+//# sourceMappingURL=chunk-FMZY5Q6L.js.map

package/dist/{chunk-H6WXKZL7.js → chunk-FXBIP2WD.js}

@@ -201,7 +201,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-X2QMWOVX.js");
+      const { revealSealedField } = await import("./reveal-67RDQRIN.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -213,26 +213,26 @@ function withClassified() {
       return value;
     },
     async verify(ctx, id, field, candidate) {
-      const { verifyDigestField } = await import("./verify-WYOFLSNA.js");
+      const { verifyDigestField } = await import("./verify-KOV2G5D6.js");
       const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async verifyText(ctx, id, field, candidate) {
-      const { verifyTextField } = await import("./verify-WYOFLSNA.js");
+      const { verifyTextField } = await import("./verify-KOV2G5D6.js");
       const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async matchGroup(ctx, id, answers, opts) {
-      const { matchGroupFields } = await import("./verify-WYOFLSNA.js");
+      const { matchGroupFields } = await import("./verify-KOV2G5D6.js");
       const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
       const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
       await ctx.onAccess?.("verify", id);
       return result;
     },
     async computeTarget(ctx, field, candidate, costByte) {
-      const { computeBidxTarget } = await import("./find-SZBL2HPB.js");
+      const { computeBidxTarget } = await import("./find-2ABFCZX4.js");
       const dek = await ctx.getDEK();
       return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
     }
@@ -244,4 +244,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-H6WXKZL7.js.map
+//# sourceMappingURL=chunk-FXBIP2WD.js.map

package/dist/{chunk-ZTYG36DH.js → chunk-G56KBWFY.js}

@@ -5,18 +5,18 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-26W5VETY.js";
+} from "./chunk-KG7TZKZG.js";
 import {
   parseDekKey
-} from "./chunk-POS53FG6.js";
+} from "./chunk-JMGDHKQF.js";
 import {
   envelopeOpensUnderAny,
   rekeyBlobSet,
   rekeyEnvelopeIfNeeded
-} from "./chunk-BYBB4ABD.js";
+} from "./chunk-77K4PG6P.js";
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -31,10 +31,10 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-SL3JAAKN.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-GU3LQYW2.js";
+} from "./chunk-7MG7SJT7.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
@@ -51,7 +51,21 @@ import {
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-7O3Y4PPD.js";
+
+// src/with-party/team/roster-epoch.ts
+function assertRosterEpochCurrent(found, expected, userId) {
+  if (expected === void 0) return;
+  if (found === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "roster-epoch-absent" });
+  }
+  if (!Number.isFinite(found) || found < expected) {
+    throw new KeyringTamperedError({ userId, reason: "roster-epoch-rewound" });
+  }
+}
+function nextRosterEpoch(current) {
+  return Number.isFinite(current) ? current + 1 : 1;
+}
 
 // src/with-party/team/roster-tag.ts
 function stable(value) {
@@ -89,7 +103,24 @@ function rosterCanonical(file) {
     pending_dek_slots: Object.keys(file.pending_deks ?? {}).sort(),
     expires_at: file.expires_at ?? null,
     export_capability: file.export_capability ?? null,
-    import_capability: file.import_capability ?? null
+    import_capability: file.import_capability ?? null,
+    // #1097 — the roster epoch, bound ONLY WHEN PRESENT.
+    //
+    // The conditional spread is the entire backward-compatibility story, not a
+    // style choice. `stable()` drops `undefined`, so a file written before the
+    // epoch existed produces the byte-identical canonical string it always did
+    // and its roster tag still verifies. Writing `file.roster_epoch ?? null` —
+    // the shape every other optional field above uses — would have changed that
+    // string for every existing keyring, failed every existing tag, and
+    // rendered every existing vault unopenable. #1115 took exactly that cost
+    // deliberately; there is no reason to take it again for a field that can be
+    // additive.
+    //
+    // A PRESENT epoch is authenticated: stripping it changes the canonical and
+    // the tag stops verifying, so a store cannot downgrade a file to the
+    // no-epoch shape. It can only replay a file that genuinely never had one,
+    // which is why absence must read as UNKNOWN rather than as zero.
+    ...file.roster_epoch !== void 0 ? { roster_epoch: file.roster_epoch } : {}
   });
 }
 async function mintRosterTag(file, rosterKey) {
@@ -531,13 +562,14 @@ async function createOwnerKeyring(store, vault, opts) {
       [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey
     }
   };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
+    roster_tag: await mintRosterTag(withEpoch, rosterKey),
     // The presence of this block is what makes the keyring an echo keyring —
     // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
     ...typeof secret !== "string" ? {
@@ -637,15 +669,16 @@ async function grant(store, vault, callerKeyring, options) {
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(previousGrantFound?.file.roster_epoch) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
     // The grantee's own copy of the roster key rode in via the `_`-prefix
     // propagation loop above, so they can verify this tag on first unlock.
-    roster_tag: await mintRosterTag(authorityWithDeks, callerRosterKey)
+    roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
   };
   await writeKeyringFile(store, vault, options.userId, keyringFile);
   if (previousDekNames !== null && options.userId !== callerKeyring.userId) {
@@ -873,7 +906,8 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
-  const next = { ...edited, roster_tag: await mintRosterTag(edited, rosterKey) };
+  const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(target.roster_epoch) };
+  const next = { ...withEpoch, roster_tag: await mintRosterTag(withEpoch, rosterKey) };
   await writeKeyringFile(store, vault, options.userId, next);
 }
 var HISTORY_COLLECTION = "_history";
@@ -1011,9 +1045,10 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       deks: updatedDeks,
       permissions: updatedPermissions
     };
+    const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(userKeyringFile.roster_epoch) };
     const updatedKeyring = {
-      ...edited,
-      roster_tag: await mintRosterTag(edited, callerRosterKey)
+      ...withEpoch,
+      roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
     };
     await writeKeyringFile(store, vault, userId, updatedKeyring);
   }
@@ -1050,13 +1085,14 @@ async function changeSecret(store, vault, keyring, opts) {
     ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingAuthority?.roster_epoch) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey)
+    roster_tag: await mintRosterTag(withEpoch, rosterKey)
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
@@ -1124,15 +1160,16 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
   return {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
     // The recipient's copy of the roster key rode in via the `_`-prefix
     // propagation loop above, so the slot verifies on first unlock.
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
+    roster_tag: await mintRosterTag(withEpoch, rosterKey),
     // The presence of this block is what makes the recipient's slot an
     // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
     // ceremony (prompt → echo → key) travels with the pod, not just a
@@ -1291,13 +1328,14 @@ async function persistKeyring(store, vault, keyring) {
     deks: wrappedDeks,
     ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {}
   };
+  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingFound?.file.roster_epoch) };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authorityWithDeks,
+    ...withEpoch,
     salt: bufferToBase64(keyring.salt),
     created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
+    roster_tag: await mintRosterTag(withEpoch, rosterKey),
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
@@ -1342,6 +1380,11 @@ function resolvePermissions(role, explicit) {
   return explicit ?? {};
 }
 async function writeKeyringFile(store, vault, userId, keyringFile) {
+  if (keyringFile.roster_epoch === void 0) {
+    throw new Error(
+      `writeKeyringFile: refusing to write a keyring for "${userId}" with no roster_epoch (#1097). Stamp it with nextRosterEpoch(previous) onto the authority object BEFORE minting the roster tag, so it is covered by rosterCanonical.`
+    );
+  }
   const envelope = buildRecordEnvelope(
     { collection: "_keyring", id: userId, version: 1 },
     { iv: "", data: JSON.stringify(keyringFile) }
@@ -1350,6 +1393,8 @@ async function writeKeyringFile(store, vault, userId, keyringFile) {
 }
 
 export {
+  assertRosterEpochCurrent,
+  nextRosterEpoch,
   mintRosterTag,
   assertRosterAuthenticated,
   assertRosterTagValid,
@@ -1395,4 +1440,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-ZTYG36DH.js.map
+//# sourceMappingURL=chunk-G56KBWFY.js.map