@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/{chunk-5HNW4ZTA.js → chunk-CSAN22QG.js}

@@ -4,7 +4,7 @@ import {
   embeddingSourceText,
   encodeVecId,
   isVecIdFor
-} from "./chunk-YKGJ44Z7.js";
+} from "./chunk-TU6ZJTYT.js";
 import {
   buildBlobFieldEntries,
   buildDictKeyFieldEntries,
@@ -13,20 +13,20 @@ import {
   extractSnippet,
   searchScan,
   segmentTokenizer
-} from "./chunk-TZYTMZZY.js";
+} from "./chunk-DL4GCSTS.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
 import {
   isStaticDictDescriptor,
   stripI18nFilled
-} from "./chunk-V55JASXO.js";
+} from "./chunk-UQRKAM2R.js";
 import {
   liveRecordIsElevated
-} from "./chunk-RIZTZJX6.js";
+} from "./chunk-LJ744WXU.js";
 import {
   EmbeddingDimMismatchError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-lookup/search/collection-facade.ts
 async function search(ctx, field, query, opts = {}) {
@@ -383,4 +383,4 @@ export {
   rebuildEmbeddings,
   syncTierSearch
 };
-//# sourceMappingURL=chunk-5HNW4ZTA.js.map
+//# sourceMappingURL=chunk-CSAN22QG.js.map

package/dist/{chunk-TZYTMZZY.js → chunk-DL4GCSTS.js}

@@ -1,9 +1,9 @@
 import {
   getAtPath
-} from "./chunk-V55JASXO.js";
+} from "./chunk-UQRKAM2R.js";
 import {
   SearchNotEnabledError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-lookup/search/tokenize.ts
 var WORD = /[\p{L}\p{N}]+/gu;
@@ -421,31 +421,31 @@ function buildBlobFieldEntries(filenamesByField) {
 function withSearch() {
   return {
     async search(ctx, field, query, opts) {
-      const { search } = await import("./collection-facade-LZIF7GWD.js");
+      const { search } = await import("./collection-facade-V63BEBGU.js");
       return search(ctx, field, query, opts);
     },
     async retrieve(ctx, query, opts) {
-      const { retrieve } = await import("./collection-facade-LZIF7GWD.js");
+      const { retrieve } = await import("./collection-facade-V63BEBGU.js");
       return retrieve(ctx, query, opts);
     },
     async similarTo(ctx, vector, opts) {
-      const { similarTo } = await import("./collection-facade-LZIF7GWD.js");
+      const { similarTo } = await import("./collection-facade-V63BEBGU.js");
       return similarTo(ctx, vector, opts);
     },
     async warmIndex(ctx) {
-      const { warmIndex } = await import("./collection-facade-LZIF7GWD.js");
+      const { warmIndex } = await import("./collection-facade-V63BEBGU.js");
       return warmIndex(ctx);
     },
     async flushIndex(ctx) {
-      const { flushIndex } = await import("./collection-facade-LZIF7GWD.js");
+      const { flushIndex } = await import("./collection-facade-V63BEBGU.js");
       return flushIndex(ctx);
     },
     async embedOnWrite(ctx, id, record, version) {
-      const { embedOnWrite } = await import("./collection-facade-LZIF7GWD.js");
+      const { embedOnWrite } = await import("./collection-facade-V63BEBGU.js");
       return embedOnWrite(ctx, id, record, version);
     },
     async rebuildEmbeddings(ctx) {
-      const { rebuildEmbeddings } = await import("./collection-facade-LZIF7GWD.js");
+      const { rebuildEmbeddings } = await import("./collection-facade-V63BEBGU.js");
       return rebuildEmbeddings(ctx);
     }
   };
@@ -492,4 +492,4 @@ export {
   buildBlobFieldEntries,
   withSearch
 };
-//# sourceMappingURL=chunk-TZYTMZZY.js.map
+//# sourceMappingURL=chunk-DL4GCSTS.js.map

package/dist/{chunk-EA4VDI5D.js → chunk-DYIR6RC3.js}

@@ -1,15 +1,15 @@
 import {
   MaintenanceMethods
-} from "./chunk-BNFNQNEP.js";
+} from "./chunk-F7X7MPK4.js";
 import {
   installMethods
 } from "./chunk-F6NCB7KT.js";
 import {
   Query
-} from "./chunk-ZVSKSUGI.js";
+} from "./chunk-7C7OF26T.js";
 import {
   gateTerminal
-} from "./chunk-DHU2AQ6T.js";
+} from "./chunk-O3NGOHXQ.js";
 
 // src/kernel/query/live/live.ts
 function buildLiveQuery(recompute, upstreams, options) {
@@ -267,4 +267,4 @@ export {
   buildLiveQuery,
   installLive
 };
-//# sourceMappingURL=chunk-EA4VDI5D.js.map
+//# sourceMappingURL=chunk-DYIR6RC3.js.map

package/dist/{chunk-PUBI455O.js → chunk-EPPAEGH5.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/capsule/plumbing/normalize.ts
 function normalizeForVerify(mode, value) {
@@ -154,4 +154,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-PUBI455O.js.map
+//# sourceMappingURL=chunk-EPPAEGH5.js.map

package/dist/{chunk-2A56DSRI.js → chunk-EQ6C2ZPT.js}

@@ -4,7 +4,7 @@ import {
   isTombstone,
   isTombstoneShape,
   rewrapEnvelope
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-commit/history/history.ts
 var HISTORY_COLLECTION = "_history";
@@ -15,6 +15,19 @@ function historyId(collection, recordId, version) {
 function historyIdentity(collection, recordId, version) {
   return { collection: HISTORY_COLLECTION, id: historyId(collection, recordId, version), version };
 }
+function parseHistoryId(id) {
+  const lastColon = id.lastIndexOf(":");
+  if (lastColon < 0) return null;
+  const versionStr = id.slice(lastColon + 1);
+  const rest = id.slice(0, lastColon);
+  const firstColon = rest.indexOf(":");
+  if (firstColon < 0) return null;
+  return {
+    collection: rest.slice(0, firstColon),
+    recordId: rest.slice(firstColon + 1),
+    version: parseInt(versionStr, 10)
+  };
+}
 function matchesPrefix(id, collection, recordId) {
   if (recordId) {
     return id.startsWith(`${collection}:${recordId}:`);
@@ -127,62 +140,15 @@ async function rewrapHistory(adapter, vault, collection, recordId, fromDek, toDe
   }
 }
 
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  // Unreachable in practice — `saveHistory` above is a no-op, so nothing is
-  // ever sealed. Returns the real layout rather than a sentinel so a future
-  // caller that reads it without writing cannot be misled.
-  historyIdentity: (collection, recordId, version) => historyIdentity(collection, recordId, version),
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
 export {
   historyIdentity,
+  parseHistoryId,
   saveHistory,
   getHistory,
   getVersionEnvelope,
   pruneHistory,
   clearHistory,
   tombstoneHistory,
-  rewrapHistory,
-  NO_HISTORY
+  rewrapHistory
 };
-//# sourceMappingURL=chunk-2A56DSRI.js.map
+//# sourceMappingURL=chunk-EQ6C2ZPT.js.map

package/dist/chunk-EQ6C2ZPT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/history.ts"],"sourcesContent":["import { buildRecordEnvelope } from '../../capsule/index.js'\nimport type { RecordIdentity } from '../../capsule/index.js'\nimport type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js'\nimport { isTombstone, isTombstoneShape, rewrapEnvelope, isRewrappedUnder, type EnclaveKey } from '../../capsule/index.js'\n\n/**\n * History storage convention:\n * Collection: `_history`\n * ID format: `{collection}:{recordId}:{paddedVersion}`\n * Version is zero-padded to 10 digits for lexicographic sorting.\n */\n\nconst HISTORY_COLLECTION = '_history'\nconst VERSION_PAD = 10\n\nfunction historyId(collection: string, recordId: string, version: number): string {\n  return `${collection}:${recordId}:${String(version).padStart(VERSION_PAD, '0')}`\n}\n\n/**\n * The identity a history snapshot is **sealed against** — its STORAGE location,\n * not the live record it is a copy of (#1041).\n *\n * ## Why storage, and why this is a decision rather than a detail\n *\n * A snapshot is a copy, so two identities are available: the live record\n * (`collection`/`recordId`) or where the bytes actually land\n * (`_history`/`historyId(...)`). They are not equivalent under attack.\n *\n * Binding the LIVE identity makes a snapshot's AAD **indistinguishable from the\n * live record's at the same version** — so an untrusted store could serve a\n * history entry *as the current record* and the client would accept it. It also\n * leaves entries relocatable within `_history`.\n *\n * Binding STORAGE identity closes both. The cost is that the id must be known\n * *before* the envelope is sealed, where `saveHistory` previously derived it\n * *after* (from `envelope._v`) — which is precisely the restructure this\n * function exists to make possible.\n *\n * `saveHistory` uses this too, so the sealed identity and the put location have\n * **one definition** and cannot drift apart. Changing the layout here changes\n * both at once, by construction.\n */\nexport function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity {\n  // The snapshot's own `_v` IS the version it preserves — the same number that\n  // appears in its id. One argument feeds both, so they cannot disagree (#1093).\n  return { collection: HISTORY_COLLECTION, id: historyId(collection, recordId, version), version }\n}\n\n/**\n * core#76 — the inverse of `historyId`. Used by `restoreTo(T)` to discover\n * collections that exist in history but not in the live store, which is\n * exactly the case a point-in-time restore has to cover: a collection dropped\n * since T would otherwise be invisible to a restore meant to bring T back.\n *\n * ⚠️ A collection name containing `:` would parse wrong here. That is not\n * reachable today — `vault.collection()` rejects those names — and this\n * function is deliberately not hardened against it, because the guard belongs\n * at the naming boundary, not in every parser downstream of it.\n */\nexport function parseHistoryId(id: string): { collection: string; recordId: string; version: number } | null {\n  const lastColon = id.lastIndexOf(':')\n  if (lastColon < 0) return null\n  const versionStr = id.slice(lastColon + 1)\n  const rest = id.slice(0, lastColon)\n  const firstColon = rest.indexOf(':')\n  if (firstColon < 0) return null\n  return {\n    collection: rest.slice(0, firstColon),\n    recordId: rest.slice(firstColon + 1),\n    version: parseInt(versionStr, 10),\n  }\n}\n\nfunction matchesPrefix(id: string, collection: string, recordId?: string): boolean {\n  if (recordId) {\n    return id.startsWith(`${collection}:${recordId}:`)\n  }\n  return id.startsWith(`${collection}:`)\n}\n\n/** Save a history entry (a complete encrypted envelope snapshot). */\nexport async function saveHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  envelope: EncryptedEnvelope,\n): Promise<void> {\n  // Same derivation the caller sealed against — one definition, so the sealed\n  // identity and the put location cannot drift (#1041).\n  const { id } = historyIdentity(collection, recordId, envelope._v)\n  await adapter.put(vault, HISTORY_COLLECTION, id, envelope)\n}\n\n/** Get history entries for a record, sorted newest-first. */\nexport async function getHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  options?: HistoryOptions,\n): Promise<EncryptedEnvelope[]> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds\n    .filter(id => matchesPrefix(id, collection, recordId))\n    .sort()\n    .reverse() // newest first\n\n  const entries: EncryptedEnvelope[] = []\n\n  for (const id of matchingIds) {\n    const envelope = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!envelope) continue\n\n    // Apply time filters\n    if (options?.from && envelope._ts < options.from) continue\n    if (options?.to && envelope._ts > options.to) continue\n\n    entries.push(envelope)\n\n    if (options?.limit && entries.length >= options.limit) break\n  }\n\n  return entries\n}\n\n/** Get a specific version's envelope from history. */\nexport async function getVersionEnvelope(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  version: number,\n): Promise<EncryptedEnvelope | null> {\n  const id = historyId(collection, recordId, version)\n  return adapter.get(vault, HISTORY_COLLECTION, id)\n}\n\n/** Prune history entries. Returns the number of entries deleted. */\nexport async function pruneHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string | undefined,\n  options: PruneOptions,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds\n    .filter(id => recordId ? matchesPrefix(id, collection, recordId) : matchesPrefix(id, collection))\n    .sort()\n\n  let toDelete: string[] = []\n\n  if (options.keepVersions !== undefined) {\n    // Keep only the N most recent, delete the rest\n    const keep = options.keepVersions\n    if (matchingIds.length > keep) {\n      toDelete = matchingIds.slice(0, matchingIds.length - keep)\n    }\n  }\n\n  if (options.beforeDate) {\n    // Delete entries older than the specified date\n    for (const id of matchingIds) {\n      if (toDelete.includes(id)) continue\n      const envelope = await adapter.get(vault, HISTORY_COLLECTION, id)\n      if (envelope && envelope._ts < options.beforeDate) {\n        toDelete.push(id)\n      }\n    }\n  }\n\n  // Deduplicate\n  const uniqueDeletes = [...new Set(toDelete)]\n\n  for (const id of uniqueDeletes) {\n    await adapter.delete(vault, HISTORY_COLLECTION, id)\n  }\n\n  return uniqueDeletes.length\n}\n\n/** Clear all history for a vault, optionally scoped to a collection or record. */\nexport async function clearHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection?: string,\n  recordId?: string,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  let toDelete: string[]\n\n  if (collection && recordId) {\n    toDelete = allIds.filter(id => matchesPrefix(id, collection, recordId))\n  } else if (collection) {\n    toDelete = allIds.filter(id => matchesPrefix(id, collection))\n  } else {\n    toDelete = allIds\n  }\n\n  for (const id of toDelete) {\n    await adapter.delete(vault, HISTORY_COLLECTION, id)\n  }\n\n  return toDelete.length\n}\n\n/**\n * Crypto-shred every `_history` version of a record. Each non-tombstone\n * history envelope is OVERWRITTEN in place with a tombstone\n * `{ _noydb, _v, _ts: now, _by: actor, _iv: '', _data: '' }` — dropping\n * `_iv`/`_data`/`_cek`/`_det`, so the prior ciphertext (and the wrapped CEK\n * that could decrypt it) is gone everywhere this store reaches. The version\n * counter (`_v`) is preserved so the audit trail still shows \"N versions\n * existed and were erased.\"\n *\n * Overwrite — NOT delete — so the history key itself survives as proof the\n * version existed. Already-tombstoned versions (re-run / idempotent forget)\n * are left untouched and not counted.\n *\n * Returns the number of history versions newly tombstoned.\n */\nexport async function tombstoneHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  actor: string,\n  encrypted: boolean,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds.filter(id => matchesPrefix(id, collection, recordId))\n\n  const now = new Date().toISOString()\n  let count = 0\n  for (const id of matchingIds) {\n    const env = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!env) continue\n    // Already a tombstone (no body and no wrapped CEK)? Skip — idempotent.\n    if (isTombstone(env, encrypted)) continue\n    // `by` rides on the IDENTITY — passing it in the body went through a\n    // conditional spread, which TypeScript does not excess-property-check, so\n    // it was silently dropped once `_by` moved to the identity (#1041).\n    const tombstone: EncryptedEnvelope = buildRecordEnvelope(\n      { collection: HISTORY_COLLECTION, id, ...(actor ? { by: actor } : {}), version: env._v },\n      { ts: now, iv: '', data: '' },\n    )\n    await adapter.put(vault, HISTORY_COLLECTION, id, tombstone)\n    count++\n  }\n  return count\n}\n\n/**\n * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`.\n * Mirrors what `rewrapBodyToDek` already does for a record's LIVE body on a\n * tier move (elevate/demote/putAtTier) — each `_history` envelope also\n * carries its own `_cek`, wrapped under the collection's tier-0 DEK at write\n * time (`record-codec.ts`), so a tier move that rewraps only the live\n * envelope leaves prior versions decryptable at rest under the tier the\n * record left. This is defense-in-depth *beneath* the read-gate\n * (`history()`/`getVersion()` already return empty for an elevated record;\n * this protects the ciphertext even if that gate is bypassed).\n *\n * Rewraps content in place — unlike `tombstoneHistory`, it does NOT blank\n * `_iv`/`_data`/`_cek` — so a subsequent `demote()` restores tier-0\n * readability. Tombstone-shaped entries (a forgotten/shredded version —\n * blanked `_data`, no `_cek`) are skipped: there is no key material left to\n * rewrap.\n *\n * **Legacy fallback.** A snapshot written before this fix stays wrapped\n * under the tier-0 DEK even after its live record has since moved tiers, so\n * a rewrap attempted with a tier-N `fromDek` fails to unwrap/decrypt. When\n * the caller supplies `tier0Dek`, a failed rewrap is retried once with\n * `tier0Dek` as `fromDek` (the only other key a pre-fix snapshot can be\n * wrapped under — history is written only by tier-0 `put()`). The output is\n * always wrapped under `toDek` regardless of which `fromDek` succeeded. A\n * rewrap that fails under BOTH keys re-throws — that is real corruption, not\n * a tier mismatch, and must not be swallowed.\n *\n * **Crash-atomicity / idempotency (#712 whole-branch-fix-3).** This loop has\n * no transaction around it: a crash after some entries have been rewritten\n * under `toDek` but before the loop finishes leaves the record's history\n * split across two keys. A retry of the SAME call must not re-fail on the\n * entries that already made it — so each entry is probed with\n * `isRewrappedUnder(env, toDek)` FIRST; a match means it's already at the\n * target key and is skipped (put nothing). This makes same-target retries\n * and demote-after-crash fully self-healing. It does NOT close every crash\n * window: a crash that lands SOME entries under `toDek` while the record's\n * NEXT move target differs from this call's `toDek` (an intermediate-tier\n * crash — e.g. elevate 0→1 crashes mid-loop, then the record is moved 1→2)\n * still finds those entries unreadable under either `fromDek` or the\n * tier-0 fallback, since `toDek` is a third key the next call never probes\n * for. That residual window is an accepted, fail-closed limitation (see\n * `.changeset/history-at-rest.md` and the design doc) — availability is\n * lost, never confidentiality.\n */\nexport async function rewrapHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  fromDek: EnclaveKey,\n  toDek: EnclaveKey,\n  tier0Dek?: EnclaveKey,\n): Promise<void> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds.filter(id => matchesPrefix(id, collection, recordId))\n\n  for (const id of matchingIds) {\n    const env = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!env) continue\n    // Already a tombstone (forgotten/shredded version)? Nothing to rewrap.\n    if (isTombstoneShape(env)) continue\n    // #712/whole-branch-fix-3: toDek-first idempotency skip — already at the\n    // target key (a same-target retry, or demote-after-crash landing back on\n    // a key it already reached)? Nothing to do; put nothing.\n    // In-place re-key of a `_history` entry: the address does not move, so the\n    // same identity opens and re-seals it (#1041). Built from the entry itself,\n    // exactly as a reader would via `recordAadFor`.\n    const identity = {\n      collection: HISTORY_COLLECTION, id, version: env._v,\n      ...(env._tier !== undefined ? { tier: env._tier } : {}),\n      ...(env._by !== undefined ? { by: env._by } : {}),\n    }\n    if (await isRewrappedUnder(identity, env, toDek)) continue\n\n    let next: EncryptedEnvelope\n    try {\n      next = await rewrapEnvelope(identity, env, fromDek, toDek)\n    } catch (err) {\n      if (!tier0Dek) throw err\n      // Legacy fallback: retry once under the tier-0 DEK. A failure here is\n      // real corruption, not a tier mismatch — let it propagate.\n      next = await rewrapEnvelope(identity, env, tier0Dek, toDek)\n    }\n\n    await adapter.put(vault, HISTORY_COLLECTION, id, next)\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AAEpB,SAAS,UAAU,YAAoB,UAAkB,SAAyB;AAChF,SAAO,GAAG,UAAU,IAAI,QAAQ,IAAI,OAAO,OAAO,EAAE,SAAS,aAAa,GAAG,CAAC;AAChF;AA0BO,SAAS,gBAAgB,YAAoB,UAAkB,SAAiC;AAGrG,SAAO,EAAE,YAAY,oBAAoB,IAAI,UAAU,YAAY,UAAU,OAAO,GAAG,QAAQ;AACjG;AAaO,SAAS,eAAe,IAA8E;AAC3G,QAAM,YAAY,GAAG,YAAY,GAAG;AACpC,MAAI,YAAY,EAAG,QAAO;AAC1B,QAAM,aAAa,GAAG,MAAM,YAAY,CAAC;AACzC,QAAM,OAAO,GAAG,MAAM,GAAG,SAAS;AAClC,QAAM,aAAa,KAAK,QAAQ,GAAG;AACnC,MAAI,aAAa,EAAG,QAAO;AAC3B,SAAO;AAAA,IACL,YAAY,KAAK,MAAM,GAAG,UAAU;AAAA,IACpC,UAAU,KAAK,MAAM,aAAa,CAAC;AAAA,IACnC,SAAS,SAAS,YAAY,EAAE;AAAA,EAClC;AACF;AAEA,SAAS,cAAc,IAAY,YAAoB,UAA4B;AACjF,MAAI,UAAU;AACZ,WAAO,GAAG,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG;AAAA,EACnD;AACA,SAAO,GAAG,WAAW,GAAG,UAAU,GAAG;AACvC;AAGA,eAAsB,YACpB,SACA,OACA,YACA,UACA,UACe;AAGf,QAAM,EAAE,GAAG,IAAI,gBAAgB,YAAY,UAAU,SAAS,EAAE;AAChE,QAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,QAAQ;AAC3D;AAGA,eAAsB,WACpB,SACA,OACA,YACA,UACA,SAC8B;AAC9B,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OACjB,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC,EACpD,KAAK,EACL,QAAQ;AAEX,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,aAAa;AAC5B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAChE,QAAI,CAAC,SAAU;AAGf,QAAI,SAAS,QAAQ,SAAS,MAAM,QAAQ,KAAM;AAClD,QAAI,SAAS,MAAM,SAAS,MAAM,QAAQ,GAAI;AAE9C,YAAQ,KAAK,QAAQ;AAErB,QAAI,SAAS,SAAS,QAAQ,UAAU,QAAQ,MAAO;AAAA,EACzD;AAEA,SAAO;AACT;AAGA,eAAsB,mBACpB,SACA,OACA,YACA,UACA,SACmC;AACnC,QAAM,KAAK,UAAU,YAAY,UAAU,OAAO;AAClD,SAAO,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAClD;AAGA,eAAsB,aACpB,SACA,OACA,YACA,UACA,SACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OACjB,OAAO,QAAM,WAAW,cAAc,IAAI,YAAY,QAAQ,IAAI,cAAc,IAAI,UAAU,CAAC,EAC/F,KAAK;AAER,MAAI,WAAqB,CAAC;AAE1B,MAAI,QAAQ,iBAAiB,QAAW;AAEtC,UAAM,OAAO,QAAQ;AACrB,QAAI,YAAY,SAAS,MAAM;AAC7B,iBAAW,YAAY,MAAM,GAAG,YAAY,SAAS,IAAI;AAAA,IAC3D;AAAA,EACF;AAEA,MAAI,QAAQ,YAAY;AAEtB,eAAW,MAAM,aAAa;AAC5B,UAAI,SAAS,SAAS,EAAE,EAAG;AAC3B,YAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAChE,UAAI,YAAY,SAAS,MAAM,QAAQ,YAAY;AACjD,iBAAS,KAAK,EAAE;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAE3C,aAAW,MAAM,eAAe;AAC9B,UAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE;AAAA,EACpD;AAEA,SAAO,cAAc;AACvB;AAGA,eAAsB,aACpB,SACA,OACA,YACA,UACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,MAAI;AAEJ,MAAI,cAAc,UAAU;AAC1B,eAAW,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAAA,EACxE,WAAW,YAAY;AACrB,eAAW,OAAO,OAAO,QAAM,cAAc,IAAI,UAAU,CAAC;AAAA,EAC9D,OAAO;AACL,eAAW;AAAA,EACb;AAEA,aAAW,MAAM,UAAU;AACzB,UAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE;AAAA,EACpD;AAEA,SAAO,SAAS;AAClB;AAiBA,eAAsB,iBACpB,SACA,OACA,YACA,UACA,OACA,WACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAE/E,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,MAAI,QAAQ;AACZ,aAAW,MAAM,aAAa;AAC5B,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,CAAC,IAAK;AAEV,QAAI,YAAY,KAAK,SAAS,EAAG;AAIjC,UAAM,YAA+B;AAAA,MACnC,EAAE,YAAY,oBAAoB,IAAI,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC,GAAI,SAAS,IAAI,GAAG;AAAA,MACvF,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG;AAAA,IAC9B;AACA,UAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,SAAS;AAC1D;AAAA,EACF;AACA,SAAO;AACT;AA8CA,eAAsB,cACpB,SACA,OACA,YACA,UACA,SACA,OACA,UACe;AACf,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAE/E,aAAW,MAAM,aAAa;AAC5B,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,CAAC,IAAK;AAEV,QAAI,iBAAiB,GAAG,EAAG;AAO3B,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MAAoB;AAAA,MAAI,SAAS,IAAI;AAAA,MACjD,GAAI,IAAI,UAAU,SAAY,EAAE,MAAM,IAAI,MAAM,IAAI,CAAC;AAAA,MACrD,GAAI,IAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC;AAAA,IACjD;AACA,QAAI,MAAM,iBAAiB,UAAU,KAAK,KAAK,EAAG;AAElD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,eAAe,UAAU,KAAK,SAAS,KAAK;AAAA,IAC3D,SAAS,KAAK;AACZ,UAAI,CAAC,SAAU,OAAM;AAGrB,aAAO,MAAM,eAAe,UAAU,KAAK,UAAU,KAAK;AAAA,IAC5D;AAEA,UAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,IAAI;AAAA,EACvD;AACF;","names":[]}

package/dist/{chunk-BNFNQNEP.js → chunk-F7X7MPK4.js}

@@ -11,7 +11,7 @@ import {
   filterRecords,
   fnViewDecoder,
   orderKeyOf
-} from "./chunk-ZVSKSUGI.js";
+} from "./chunk-7C7OF26T.js";
 
 // src/kernel/query/internal/maintenance.ts
 var MaintenanceMethods = class {
@@ -97,4 +97,4 @@ var MaintenanceMethods = class {
 export {
   MaintenanceMethods
 };
-//# sourceMappingURL=chunk-BNFNQNEP.js.map
+//# sourceMappingURL=chunk-F7X7MPK4.js.map

package/dist/{chunk-SNM7LSYG.js → chunk-FUHUGKDN.js}

@@ -1,14 +1,14 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-55P6OBB7.js";
+} from "./chunk-U43RSPPX.js";
 import {
   buildRecordEnvelope,
   sha256Hex
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   ReadOnlyError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-SNM7LSYG.js.map
+//# sourceMappingURL=chunk-FUHUGKDN.js.map

package/dist/{chunk-72XBVN4J.js → chunk-FVKQ5QUC.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -33,4 +33,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-72XBVN4J.js.map
+//# sourceMappingURL=chunk-FVKQ5QUC.js.map

package/dist/chunk-FVKQ5QUC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n  /**\n   * core#73 — called by the kernel right after `grant()`: register the\n   * grantee with the broker host under its own per-member key. Needs the\n   * grantee's `secret` because the member's `_broker_member` DEK can only be\n   * opened with it, and only at this moment does the grantor hold it. A\n   * no-op for owner/admin grantees (they use the shared seed) and for the\n   * floor stub (no broker ⇒ nothing to register).\n   */\n  /**\n   * core#73 — register a sub-admin member with the host. With `secret` (a\n   * grant) the member's `_broker_member` DEK is read from their keyring; with\n   * `dek` (core#96, a role change through `updateUser`) it is the fresh key\n   * just delivered through the member's inbox.\n   */\n  enrolMember(ctx: BrokerCtx, member: { readonly userId: string; readonly secret: string } | { readonly userId: string; readonly dek: EnclaveKey }): Promise<void>\n  /** core#73 — called by the kernel right after `revoke()`: de-register the member with the host and drop its record. */\n  revokeMember(ctx: BrokerCtx, userId: string): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n  // grant()/revoke() must keep working without a broker — these two are the\n  // only members of this stub that do NOT throw.\n  async enrolMember() { /* no broker configured */ },\n  async revokeMember() { /* no broker configured */ },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAoGO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA;AAAA;AAAA,EAGvD,MAAM,cAAc;AAAA,EAA6B;AAAA,EACjD,MAAM,eAAe;AAAA,EAA6B;AACpD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/{chunk-D4V5JJAK.js → chunk-GHMINSER.js}

@@ -3,15 +3,15 @@ import {
 } from "./chunk-XBKH4FOC.js";
 import {
   normalizeJoinOn
-} from "./chunk-5UUJE4FP.js";
+} from "./chunk-OK44MD3C.js";
 import {
   sha256Hex
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewSourceUnknownError,
   RefNotDeclaredError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -574,4 +574,4 @@ export {
   ungatedMvContext,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-D4V5JJAK.js.map
+//# sourceMappingURL=chunk-GHMINSER.js.map

package/dist/{chunk-APFFJN5T.js → chunk-GLSCL74M.js}

@@ -1,25 +1,30 @@
 import {
   loadVaultPolicy
-} from "./chunk-DL6BZKP3.js";
+} from "./chunk-B3B6HV5S.js";
 import {
   BROKER_MEMBER_COLLECTION,
+  NON_ROTATABLE_SLOTS,
   assertRosterAuthenticated,
   assertRosterTagValid,
   assertStrongEchoSecret,
   assertStrongSecret,
+  basisOf,
   buildEchoBlock,
   deriveKekForKeyring,
+  inboxSlots,
+  mintInboxKey,
   mintKeyringCanary,
   mintRosterTag,
   persistKeyring,
   readKeyringFile,
   requireRosterKey,
   rotateKeys,
-  stampAuthority
-} from "./chunk-45VHWE4C.js";
+  stampAuthority,
+  writeKeyringFile
+} from "./chunk-QVUMKG3Z.js";
 import {
   dekKey
-} from "./chunk-RIZTZJX6.js";
+} from "./chunk-LJ744WXU.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -41,13 +46,13 @@ import {
   sha256Bytes,
   unwrapKey,
   wrapKey
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-2ELOCEXE.js";
+} from "./chunk-URGHKZPL.js";
 import {
-  BLOB_ADDRESS_KEY_ID,
   DelegationTargetMissingError,
+  INBOX_KEY_ID,
   InvalidKeyError,
   NoAccessError,
   PermissionDeniedError,
@@ -57,7 +62,7 @@ import {
   TamperedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/port/with/team-strategy.ts
 var NO_TEAM = {
@@ -408,7 +413,7 @@ async function rotateSecret(store, vault, userId, input) {
     ...withEpoch,
     roster_tag: await mintRosterTag(withEpoch, requireRecoveredRosterKey(deks))
   };
-  await writeKeyringFile(store, vault, userId, next);
+  await writeKeyringFile(store, vault, userId, next, basisOf(found));
   return {
     userId: file.user_id,
     displayName: file.display_name,
@@ -493,7 +498,7 @@ async function recoverViaPaperCode(store, vault, userId, input) {
     roster_tag: await mintRosterTag(withEpoch, requireRecoveredRosterKey(deks))
   };
   await burnPaperRecoveryEntry(store, vault, recovered.entry.codeId);
-  await writeKeyringFile(store, vault, userId, next);
+  await writeKeyringFile(store, vault, userId, next, basisOf(found));
   return {
     userId: file.user_id,
     displayName: file.display_name,
@@ -592,7 +597,7 @@ async function recoverViaShamir(provider, store, vault, userId, input) {
     ...withEpoch,
     roster_tag: await mintRosterTag(withEpoch, requireRecoveredRosterKey(recoveredDeks))
   };
-  await writeKeyringFile(store, vault, userId, next);
+  await writeKeyringFile(store, vault, userId, next, basisOf(found));
   return {
     userId: file.user_id,
     displayName: file.display_name,
@@ -606,18 +611,6 @@ async function recoverViaShamir(provider, store, vault, userId, input) {
     ...file.import_capability !== void 0 && { importCapability: file.import_capability }
   };
 }
-async function writeKeyringFile(store, vault, userId, file) {
-  if (file.roster_epoch === void 0) {
-    throw new Error(
-      `writeKeyringFile: refusing to write a keyring for "${userId}" with no roster_epoch (#1097). Stamp it with nextRosterEpoch(previous) onto the authority object BEFORE minting the roster tag, so it is covered by rosterCanonical.`
-    );
-  }
-  const envelope = buildRecordEnvelope(
-    { collection: "_keyring", id: userId, version: 1 },
-    { iv: "", data: JSON.stringify(file) }
-  );
-  await store.put(vault, "_keyring", userId, envelope);
-}
 function requireRecoveredRosterKey(deks) {
   const key = deks.get(ROSTER_KEY_ID);
   if (!key) {
@@ -656,8 +649,9 @@ async function recoverUser(store, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot recover role "${target.role}"`
     );
   }
-  for (const coll of Object.keys(target.deks)) {
-    if (coll === BROKER_MEMBER_COLLECTION) continue;
+  const carriedSlots = [...Object.keys(target.deks), ...inboxSlots(target)];
+  for (const coll of carriedSlots) {
+    if (coll === BROKER_MEMBER_COLLECTION || coll === INBOX_KEY_ID) continue;
     if (!callerKeyring.deks.has(coll)) {
       throw new PrivilegeEscalationError(coll);
     }
@@ -671,8 +665,10 @@ async function recoverUser(store, vault, callerKeyring, options) {
   if (targetRole !== "owner" && targetRole !== "admin") {
     wrappedDeks[BROKER_MEMBER_COLLECTION] = await wrapKey(await generateDEK(), newKek);
   }
-  for (const coll of Object.keys(target.deks)) {
-    if (coll === BROKER_MEMBER_COLLECTION) continue;
+  const inbox = await mintInboxKey(newKek);
+  wrappedDeks[INBOX_KEY_ID] = inbox.wrappedInboxKey;
+  for (const coll of carriedSlots) {
+    if (coll === BROKER_MEMBER_COLLECTION || coll === INBOX_KEY_ID) continue;
     const callerDek = callerKeyring.deks.get(coll);
     if (!callerDek) {
       throw new PrivilegeEscalationError(coll);
@@ -680,7 +676,7 @@ async function recoverUser(store, vault, callerKeyring, options) {
     wrappedDeks[coll] = await wrapKey(callerDek, newKek);
   }
   const canary = await mintKeyringCanary(newKek);
-  const { echo: _staleEcho, ...carried } = target;
+  const { echo: _staleEcho, inbox: _drainedInbox, ...carried } = target;
   const edited = {
     ...carried,
     _noydb_keyring: NOYDB_KEYRING_VERSION,
@@ -690,18 +686,20 @@ async function recoverUser(store, vault, callerKeyring, options) {
     salt: bufferToBase64(newSalt),
     granted_by: callerKeyring.userId,
     authenticators: [],
-    canary
+    canary,
+    inbox_key: inbox.inboxKey
   };
   const withEpoch = stampAuthority(edited, target.roster_epoch);
   const next = {
     ...withEpoch,
     roster_tag: await mintRosterTag(withEpoch, rosterKey)
   };
+  const base = found?.envelope._v ?? 0;
   const envelope = buildRecordEnvelope(
-    { collection: "_keyring", id: options.userId, version: 1 },
+    { collection: "_keyring", id: options.userId, version: base + 1 },
     { iv: "", data: JSON.stringify(next) }
   );
-  await store.put(vault, "_keyring", options.userId, envelope);
+  await store.put(vault, "_keyring", options.userId, envelope, found ? base : void 0);
 }
 
 // src/with-party/auth-introspection/index.ts
@@ -920,8 +918,7 @@ function appendSlot(keyring, slot) {
 async function revokeAuthenticator(store, vault, keyring, options) {
   const next = await removeAuthenticator(store, vault, keyring, options.slotId);
   const collections = new Set(next.deks.keys());
-  collections.delete(ROSTER_KEY_ID);
-  collections.delete(BLOB_ADDRESS_KEY_ID);
+  for (const slot of NON_ROTATABLE_SLOTS) collections.delete(slot);
   if (collections.size > 0) {
     await rotateKeys(store, vault, next, { collections: [...collections] });
   }
@@ -968,4 +965,4 @@ export {
   findAuthenticator,
   revokeAuthenticator
 };
-//# sourceMappingURL=chunk-APFFJN5T.js.map
+//# sourceMappingURL=chunk-GLSCL74M.js.map