@interocitor/core 0.0.0-beta.2

package/dist/core/types.d.ts

@@ -0,0 +1,478 @@
+/**
+ * interocitor — encrypted local-first CRDT sync over cloud storage
+ *
+ * Core type definitions
+ */
+/**
+ * Stable identity metadata for a client device participating in a mesh.
+ */
+export interface DeviceInfo {
+    deviceId: string;
+    userId?: string;
+    name?: string;
+}
+/**
+ * Hybrid logical clock state used to order CRDT writes across devices.
+ */
+export interface HLC {
+    ts: number;
+    counter: number;
+    nodeId: string;
+}
+export type ColumnValue = string | number | boolean | null | object;
+/**
+ * CRDT cell value paired with the HLC timestamp that last wrote it.
+ */
+export interface ColumnEntry {
+    value: ColumnValue;
+    hlc: string;
+}
+export interface UpsertOp {
+    type: 'upsert';
+    table: string;
+    rowId: string;
+    columns: Record<string, ColumnEntry>;
+}
+export interface DeleteOp {
+    type: 'delete';
+    table: string;
+    rowId: string;
+    hlc: string;
+}
+export type Op = UpsertOp | DeleteOp;
+/**
+ * Serialized batch of CRDT operations written to a device-specific change log.
+ */
+export interface ChangeEntry {
+    id: string;
+    ts: number;
+    device: string;
+    user?: string;
+    hlc: string;
+    ops: Op[];
+}
+/**
+ * Row representation as stored in the local CRDT cache.
+ *
+ * Public table APIs usually return plain objects rather than this internal
+ * metadata-rich shape.
+ */
+export interface Row {
+    _table: string;
+    _rowId: string;
+    _deleted: boolean;
+    _deletedHlc?: string;
+    _schemaVersion: number;
+    [column: string]: ColumnEntry | string | boolean | number | undefined;
+}
+export interface TableIndexDefinition {
+    /** Stable index id used for migration and diagnostics. */
+    name: string;
+    /** Top-level column name to index (plain row field, e.g. "status"). */
+    field: string;
+    unique?: boolean;
+}
+/**
+ * Built-in column merge strategies (git-style):
+ *
+ * - `'remote-wins'` — Like git `--theirs`. Remote always overwrites local. Default.
+ * - `'lww'`         — Last-Writer-Wins. Highest HLC wins.
+ * - `'local-wins'`  — Like git `--ours`. Keep local value on conflict.
+ */
+export type BuiltinMergeStrategy = 'lww' | 'local-wins' | 'remote-wins';
+/**
+ * Custom merge function. Receives the local and incoming column entries
+ * plus context, returns the winning entry.
+ *
+ * Called only when both local and remote have a value for the column.
+ * Return `local` to keep, `remote` to accept, or a new ColumnEntry to
+ * produce a merged result.
+ */
+export type MergeFunction = (local: ColumnEntry, remote: ColumnEntry, context: MergeContext) => ColumnEntry;
+export interface MergeContext {
+    table: string;
+    rowId: string;
+    field: string;
+}
+/** Per-column merge strategy — builtin name or custom function. */
+export type MergeStrategy = BuiltinMergeStrategy | MergeFunction;
+/**
+ * Table-level merge config.
+ *
+ * - Set `strategy` for a table-wide default.
+ * - Set `fields` to override per column (like `.gitattributes` per file).
+ *
+ * Unspecified = inherits from {@link DatabaseSchemaDefinition.mergeStrategy},
+ * which itself defaults to `'remote-wins'`.
+ */
+export interface TableMergeConfig {
+    /** Default strategy for all fields in this table. */
+    strategy?: MergeStrategy;
+    /** Per-field overrides. */
+    fields?: Record<string, MergeStrategy>;
+}
+export type SchemaFieldKind = 'string' | 'number' | 'boolean' | 'date' | 'json' | 'enum';
+export type IndexableSchemaFieldKind = Exclude<SchemaFieldKind, 'json'>;
+/** A field descriptor — carries kind, optional index flags, and a phantom TS type. */
+export interface SchemaField<T = unknown, K extends SchemaFieldKind = SchemaFieldKind> {
+    readonly kind: K;
+    readonly index?: boolean;
+    readonly unique?: boolean;
+    /** @internal phantom — never assigned at runtime */
+    readonly _type?: T;
+}
+/** Narrows kind to the set that IndexedDB can use as a key. */
+export type IndexableSchemaField<T = unknown> = SchemaField<T, IndexableSchemaFieldKind>;
+/**
+ * Schema metadata for a single table, including field kinds and local indexes.
+ *
+ * @typeParam T — plain record type for rows in this table, e.g.
+ *   `{ title: string; status: 'open' | 'done' }`.
+ *   When omitted, defaults to `Record<string, unknown>` (untyped).
+ */
+export interface TableSchemaDefinition<T extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * Production style: define field kind + index intent in one place.
+     * Keys must match keys of T; values carry the phantom TS type via SchemaField<T[K]>.
+     */
+    fields?: {
+        [K in keyof T]?: SchemaField<T[K]>;
+    } & Record<string, SchemaField>;
+    /** Legacy style: kept for compatibility. */
+    indexes?: TableIndexDefinition[];
+    /** Merge strategy for this table. Overrides the database-level default. */
+    merge?: MergeStrategy | TableMergeConfig;
+}
+/**
+ * Versioned schema definition used for local index planning and migrations.
+ *
+ * @typeParam S — database shape: `{ tableName: { fieldName: FieldType } }`.
+ *   Inferred automatically when you pass a schema literal to `SyncConfig`.
+ *   Omit for untyped usage.
+ *
+ * @example
+ * const schema = {
+ *   version: 1,
+ *   tables: {
+ *     tasks: { fields: { title: types.string, status: types.enum('open', 'done') } },
+ *   },
+ * } satisfies DatabaseSchemaDefinition;
+ * // → DatabaseSchemaDefinition<{ tasks: { title: string; status: 'open' | 'done' } }>
+ */
+export interface DatabaseSchemaDefinition<S extends Record<string, Record<string, unknown>> = Record<string, Record<string, unknown>>> {
+    /** Increment when index/table metadata changes. */
+    version: number;
+    tables: {
+        [K in keyof S]: TableSchemaDefinition<S[K]>;
+    } & Record<string, TableSchemaDefinition>;
+    /** Default merge strategy for all tables. Default: `'remote-wins'`. */
+    mergeStrategy?: MergeStrategy;
+}
+/**
+ * Extracts the database shape `S` from a `DatabaseSchemaDefinition<S>`.
+ *
+ * @example
+ * const schema = { version: 1, tables: { tasks: { fields: { title: types.string } } } }
+ *   satisfies DatabaseSchemaDefinition;
+ * type DB = InferSchemaType<typeof schema>;
+ * // → { tasks: { title: string } }  (via field phantom types)
+ *
+ * // Simpler — use InferTableType per table:
+ * type TaskRow = InferTableType<typeof schema, 'tasks'>;
+ * // → { title: string }
+ */
+export type InferSchemaType<D extends DatabaseSchemaDefinition> = D extends DatabaseSchemaDefinition<infer S> ? S : Record<string, Record<string, unknown>>;
+/**
+ * Extracts the row type for a single table `K` from a `DatabaseSchemaDefinition`.
+ */
+export type InferTableType<D extends DatabaseSchemaDefinition, K extends keyof InferSchemaType<D> & string> = InferSchemaType<D>[K];
+export type WherePrimitive = string | number | boolean | Date;
+export type WhereOperator = 'equals' | 'above' | 'aboveOrEqual' | 'below' | 'belowOrEqual' | 'between' | 'startsWith' | 'anyOf';
+/**
+ * Dexie-style predicate description used by {@link Table.where} and
+ * {@link SyncEngine.queryWhere}.
+ */
+export interface WhereClause {
+    field: string;
+    op: WhereOperator;
+    value?: WherePrimitive;
+    values?: WherePrimitive[];
+    lower?: WherePrimitive;
+    upper?: WherePrimitive;
+    lowerOpen?: boolean;
+    upperOpen?: boolean;
+}
+/**
+ * Compacted mesh snapshot containing the full row set at a given epoch.
+ */
+export interface Snapshot {
+    snapshotId: string;
+    timestamp: string;
+    hlc: string;
+    epoch: number;
+    schemaVersion: number;
+    tables: Record<string, Record<string, Row>>;
+}
+export interface MeshChangePayload {
+    meshId: string;
+    kind: 'change';
+    entry: ChangeEntry;
+}
+export interface MeshSnapshotPayload {
+    meshId: string;
+    kind: 'snapshot';
+    snapshot: Snapshot;
+}
+export interface ServerConfig {
+    managed: boolean;
+    relayUrl: string | null;
+    serverId: string;
+}
+export interface ManifestPointer {
+    currentGeneration: number;
+    file: string;
+}
+/**
+ * Authoritative mesh manifest describing the latest generation and snapshot state.
+ */
+export interface Manifest {
+    generation: number;
+    parentGeneration: number;
+    writtenBy: string;
+    writtenAt: string;
+    contentHash: string;
+    version: number;
+    meshId: string;
+    schema: number;
+    encrypted: boolean;
+    server: ServerConfig;
+    createdAt: string;
+    /** Compaction epoch — incremented on each snapshot. */
+    epoch: number;
+    /** HLC watermark — all data ≤ this HLC is captured in the snapshot. */
+    watermarkHlc: string;
+    /** Cloud path to the latest snapshot file, or null before first compaction. */
+    snapshotPath: string | null;
+    /** Reserved for future delta-based catch-up. */
+    deltaPath: string | null;
+}
+export interface DeviceMetadata extends DeviceInfo {
+    registeredAt: string;
+    lastSeenAt: string;
+    retired?: boolean;
+}
+export interface DeviceHead {
+    device: string;
+    latestHlc: string;
+    latestDate: string;
+    fileCount: number;
+}
+/** Global change-folder head — monotonic HLC hint for fast poll skipping. */
+export interface ChangesHead {
+    latestHlc: string;
+}
+/**
+ * Normalized remote file metadata returned by a storage adapter.
+ */
+export interface FileEntry {
+    name: string;
+    path: string;
+    size: number;
+    modifiedTime: string;
+    etag?: string;
+    revision?: string;
+}
+/**
+ * Contract implemented by remote backends such as WebDAV, Google Drive,
+ * Cloudflare, or in-memory test adapters.
+ */
+export interface StorageAdapter {
+    readonly name: string;
+    authenticate(): Promise<void>;
+    isAuthenticated(): boolean;
+    ensureFolder(path: string): Promise<void>;
+    listFiles(path: string): Promise<FileEntry[]>;
+    listFolders(path: string): Promise<string[]>;
+    readFile(path: string): Promise<Uint8Array>;
+    writeFile(path: string, data: Uint8Array | string): Promise<void>;
+    deleteFile(path: string): Promise<void>;
+    getFileMetadata(path: string): Promise<FileEntry | null>;
+    /**
+     * Return an opaque config string describing how to reach this backend,
+     * suitable for embedding in a handshake QR code payload.
+     *
+     * Must NOT include credentials (passwords, tokens, OAuth secrets).
+     * The scanner uses this to configure their own adapter instance before
+     * starting the ECDH relay exchange.
+     *
+     * Returns undefined for adapters where the backend address is already
+     * baked into the app (e.g. a fixed Cloudflare Worker URL known to all
+     * app users). In that case the scanner configures their adapter independently.
+     *
+     * The returned string should be treated as opaque by the handshake layer;
+     * only the same adapter class knows how to parse it.
+     */
+    getHandshakeConfig?(): string;
+}
+/**
+ * Contract every local store implementation must satisfy.
+ * Implement this interface to plug in a custom local backend
+ * (e.g. in-memory for tests, SQLite via OPFS, etc.).
+ */
+export interface LocalStoreAdapter {
+    open(): Promise<void>;
+    close(): void;
+    getRow(table: string, rowId: string): Promise<Row | undefined>;
+    putRow(row: Row): Promise<void>;
+    putRows(rows: Row[]): Promise<void>;
+    getTable(table: string): Promise<Row[]>;
+    queryWhere(table: string, clause: WhereClause): Promise<Row[]>;
+    getAllRows(): Promise<Row[]>;
+    clearRows(): Promise<void>;
+    getTableNames(): Promise<string[]>;
+    pushOutbox(entry: ChangeEntry): Promise<void>;
+    drainOutbox(): Promise<ChangeEntry[]>;
+    outboxSize(): Promise<number>;
+    getCursor(deviceId: string): Promise<number>;
+    setCursor(deviceId: string, offset: number): Promise<void>;
+    getAllCursors(): Promise<Record<string, number>>;
+    getMeta(key: string): Promise<unknown>;
+    setMeta(key: string, value: unknown): Promise<void>;
+    clearAll(): Promise<void>;
+}
+/** Factory that creates a local store instance for this engine. */
+export type LocalStoreFactory = () => LocalStoreAdapter;
+/** Write-only replica adapter for backup. */
+export interface ReplicaConfig {
+    adapter: StorageAdapter;
+    /** Override remotePath for this replica. Defaults to the primary remotePath. */
+    remotePath?: string;
+}
+/**
+ * Configuration for a {@link SyncEngine} instance.
+ *
+ * Supports both fully local startup and immediate sync with a remote adapter.
+ */
+export interface SyncConfig<S extends Record<string, Record<string, unknown>> = Record<string, Record<string, unknown>>> {
+    /** Cloud folder path prefix, e.g. "/Interocitor" */
+    remotePath: string;
+    /**
+     * Base58 passphrase for mesh encryption.
+     * When set, the engine derives the AES-256 key internally and persists
+     * it via the credential store. Implies encrypted = true.
+     */
+    passphrase?: string;
+    /**
+     * Encryption is on by default. Set to false to opt out.
+     * When enabled without a passphrase, the engine generates a fresh key
+     * on first init (retrieve via getPassphrase()).
+     */
+    encrypted?: boolean;
+    /**
+     * Override the auto-generated device ID.
+     * Primarily for tests. In production, omit — the engine generates
+     * and persists a unique ID per origin automatically.
+     */
+    deviceId?: string;
+    /** If true, only serverId may publish manifests/compaction */
+    serverManaged?: boolean;
+    /** Authorized writer identity when serverManaged=true */
+    serverId?: string;
+    /** Polling interval in ms (default 30000) */
+    pollInterval?: number;
+    /** Flush debounce in ms (default 2000) */
+    flushDebounce?: number;
+    /** Max pending ops before forced flush (default 50) */
+    flushThreshold?: number;
+    /**
+     * Local database name for this engine's local cache.
+     * Use distinct names to isolate multiple engine instances on the same origin.
+     * Default: "interocitor"
+     */
+    dbName?: string;
+    /**
+     * Factory that produces the local store for this engine.
+     * When provided, dbName is ignored — the factory is fully responsible
+     * for constructing the store.
+     */
+    localStoreFactory?: LocalStoreFactory;
+    /** Optional table/index metadata for local query planning and migrations. */
+    schema?: DatabaseSchemaDefinition<S>;
+    /**
+     * Write-only replica adapters for backup.
+     * Flush writes to primary + all replicas. Pull reads primary only.
+     * Replica failures are emitted as 'replica:error' events but do not
+     * fail the primary flush.
+     */
+    replicas?: ReplicaConfig[];
+    /**
+     * Credential store for persisting key material (passphrase + device ID).
+     *
+     * Default: auto-detecting store that tries WebAuthn largeBlob (OS keychain,
+     * survives Safari ITP) and falls back to localStorage.
+     *
+     * Pass a custom `CredentialStore` implementation or `null` to disable
+     * credential persistence entirely.
+     */
+    credentialStore?: import('../storage/credential-store.ts').CredentialStore | null;
+    /**
+     * Human-readable app name shown in biometric prompts (Touch ID / Face ID)
+     * and OS keychain entries. Used by the default credential store.
+     */
+    appName: string;
+}
+/**
+ * Union of lifecycle, sync, auth, and replication events emitted by the engine.
+ */
+export type SyncEvent = {
+    type: 'sync:start';
+} | {
+    type: 'sync:complete';
+    entriesMerged: number;
+} | {
+    type: 'sync:error';
+    error: Error;
+} | {
+    type: 'remote:poisoned';
+    error: Error;
+    path?: string;
+} | {
+    type: 'flush:start';
+    entryCount: number;
+} | {
+    type: 'flush:complete';
+} | {
+    type: 'flush:error';
+    error: Error;
+} | {
+    type: 'change';
+    table: string;
+    rowId: string;
+    row: Row;
+} | {
+    type: 'delete';
+    table: string;
+    rowId: string;
+} | {
+    type: 'rehydrate:start';
+} | {
+    type: 'rehydrate:complete';
+    rowCount: number;
+} | {
+    type: 'auth:required';
+} | {
+    type: 'auth:complete';
+} | {
+    type: 'schema:mismatch';
+    local: number;
+    remote: number;
+} | {
+    type: 'replica:error';
+    adapter: string;
+    error: Error;
+};
+/**
+ * Listener callback registered with {@link SyncEngine.on}.
+ */
+export type SyncEventListener = (event: SyncEvent) => void;
+//# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,EAAE,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,EAAE,EAAE,CAAC;CACX;AAID;;;;;GAKG;AACH,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACvE;AAID,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,YAAY,GAAG,aAAa,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,KAClB,WAAW,CAAC;AAEjB,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,aAAa,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACxC;AAID,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAExE,sFAAsF;AACtF,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,SAAS,eAAe,GAAG,eAAe;IACnF,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CACpB;AAED,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,CAAC,CAAC,GAAG,OAAO,IAAI,WAAW,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAGzF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAChG;;;OAGG;IACH,MAAM,CAAC,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9E,4CAA4C;IAC5C,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,GAAG,gBAAgB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,wBAAwB,CACvC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3F,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAChG,uEAAuE;IACvE,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,wBAAwB,IAC5D,CAAC,SAAS,wBAAwB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5F;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,CAAC,SAAS,wBAAwB,EAClC,CAAC,SAAS,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IACzC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1B,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAE9D,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,OAAO,GACP,cAAc,GACd,OAAO,GACP,cAAc,GACd,SAAS,GACT,YAAY,GACZ,OAAO,CAAC;AAEZ;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,aAAa,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAElB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,eAAe,IAAI,OAAO,CAAC;IAG3B,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAG7C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAAC,IAAI,MAAM,CAAC;CAC/B;AAID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,IAAI,CAAC;IAEd,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnC,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEjD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG,MAAM,iBAAiB,CAAC;AAIxD,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,cAAc,CAAC;IACxB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;GAIG;AACH,MAAM,WAAW,UAAU,CACzB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3F,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,gCAAgC,EAAE,eAAe,GAAG,IAAI,CAAC;IAElF;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC"}

package/dist/core/types.js

@@ -0,0 +1,7 @@
+/**
+ * interocitor — encrypted local-first CRDT sync over cloud storage
+ *
+ * Core type definitions
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/crypto/encryption.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Encryption layer — AES-256-GCM via Web Crypto API
+ *
+ * The key is a 256-bit symmetric key. It never leaves the device.
+ * Each entry is independently encrypted with a random 96-bit IV.
+ *
+ * The key can be transferred as:
+ *  - base58 string (~43 chars, copy-pasteable)
+ *  - URL fragment (#key=base64url)
+ *  - QR code containing either of the above
+ */
+/** Generate a new 256-bit AES-GCM key. */
+export declare function generateKey(): Promise<CryptoKey>;
+/** Export key to raw bytes. */
+export declare function exportKeyRaw(key: CryptoKey): Promise<Uint8Array>;
+/** Import key from raw bytes. */
+export declare function importKeyRaw(raw: Uint8Array): Promise<CryptoKey>;
+/** Export key as a base58 string (~43 chars, human-transferable). */
+export declare function keyToPassphrase(key: CryptoKey): Promise<string>;
+/** Import key from a base58 passphrase. */
+export declare function passphraseToKey(passphrase: string): Promise<CryptoKey>;
+/**
+ * Export key as a URL fragment (never hits server).
+ * @param baseUrl - e.g. "https://yourapp.com/join"
+ */
+export declare function keyToShareUrl(raw: Uint8Array, baseUrl: string): string;
+/** Extract key bytes from a URL fragment. */
+export declare function keyFromFragment(hash: string): Uint8Array | null;
+export interface EncryptedEnvelope {
+    v: number;
+    iv: string;
+    ct: string;
+}
+/** Encrypt a single plaintext string. */
+export declare function encryptEntry(key: CryptoKey, plaintext: string): Promise<string>;
+/** Decrypt a single encrypted envelope back to plaintext. */
+export declare function decryptEntry(key: CryptoKey, envelopeStr: string): Promise<string>;
+/**
+ * Encrypt multiple plaintext lines independently and join them as NDJSON.
+ *
+ * Each line gets its own IV and auth tag, so corruption is isolated to the
+ * affected entry.
+ */
+export declare function encryptNdjson(key: CryptoKey, lines: string[]): Promise<string>;
+/**
+ * Decrypt newline-delimited encrypted entries.
+ *
+ * Invalid or corrupted lines are returned as `null` instead of throwing so the
+ * caller can recover as much of the stream as possible.
+ */
+export declare function decryptNdjson(key: CryptoKey, content: string): Promise<Array<string | null>>;
+/** Quick verification: try decrypting a single line to confirm key is correct. */
+export declare function verifyKey(key: CryptoKey, sampleEncrypted: string): Promise<boolean>;
+export declare function storeKeyLocally(key: CryptoKey): Promise<void>;
+export declare function loadKeyLocally(): Promise<CryptoKey | null>;
+export declare function clearKeyLocally(): void;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/crypto/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/crypto/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuEH,0CAA0C;AAC1C,wBAAsB,WAAW,IAAI,OAAO,CAAC,SAAS,CAAC,CAMtD;AAED,+BAA+B;AAC/B,wBAAsB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtE;AAED,iCAAiC;AACjC,wBAAsB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAQtE;AAED,qEAAqE;AACrE,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE;AAED,2CAA2C;AAC3C,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG5E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAMtE;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAO/D;AAID,MAAM,WAAW,iBAAiB;IAChC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,yCAAyC;AACzC,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpF;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAalG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzF;AAMD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAKhE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}