@noy-db/as-csv 0.1.0-pre.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vLannaAi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# @noy-db/as-csv
+
+CSV plaintext export for noy-db — decrypts records from a single collection and formats them as comma-separated values with RFC 4180 escaping. Part of the `@noy-db/as-*` portable-artefact family (plaintext tier).
+
+The **reference implementation** of the plaintext-tier shape — every other record formatter in the family (`as-json`, `as-xml`, `as-sql`, …) follows the same 3-entry-point + authorization-gate structure.
+
+## Install
+
+```bash
+pnpm add @noy-db/as-csv
+```
+
+## Authorization (RFC #249)
+
+Every call checks `vault.assertCanExport('plaintext', 'csv')` **before decrypting anything**. The caller's keyring must have been granted the `'csv'` format (or `'*'` wildcard) via `vault.grant({ exportCapability: { plaintext: ['csv'] } })`. Otherwise → `ExportCapabilityError`.
+
+**Default policy:** every role (including `owner`) requires explicit plaintext grant. Installing this package does not unlock anything; the owner's grant does. See [`docs/packages-exports.md#authorization-model`](../../docs/packages-exports.md#authorization-model) for the full policy.
+
+## Usage
+
+### `toString(vault, options)` — returns CSV string
+
+```ts
+import { toString } from '@noy-db/as-csv'
+
+const csv = await toString(vault, { collection: 'invoices' })
+// id,client,amount,status\n
+// inv-1,Globex,1500,paid\n
+// inv-2,"Acme, Inc.",2400,draft\n
+// inv-3,"Stark ""Industries""",999,overdue
+```
+
+### `download(vault, options)` — browser download (Tier 2)
+
+```ts
+import { download } from '@noy-db/as-csv'
+
+await download(vault, {
+  collection: 'invoices',
+  filename: 'invoices-2026-03.csv',  // optional; defaults to '<collection>.csv'
+})
+```
+
+Wraps the CSV in a `Blob`, creates an object URL, clicks a hidden anchor. Plaintext lives in RAM + the end-user's Downloads folder only. Does not write to your server.
+
+### `write(vault, path, options)` — Node file-write (Tier 3)
+
+```ts
+import { write } from '@noy-db/as-csv'
+
+await write(vault, '/tmp/invoices.csv', {
+  collection: 'invoices',
+  acknowledgeRisks: true,   // required — see below
+})
+```
+
+`acknowledgeRisks: true` is **required** at runtime (in addition to being a type requirement). This signals the consumer has considered that the CSV will persist on disk past the current process — consider retention, access control, and secondary-exposure risk before using.
+
+### Options
+
+```ts
+interface AsCSVOptions {
+  collection: string            // required
+  columns?: readonly string[]   // optional — default: infer from record keys
+  eol?: '\n' | '\r\n'          // optional — default: '\n' (LF)
+}
+```
+
+## RFC 4180 escaping
+
+- Strings containing `,` `"` `\r` or `\n` are wrapped in double quotes.
+- Embedded double quotes are doubled: `She said "hi"` → `"She said ""hi"""`.
+- `null` / `undefined` → empty field.
+- `number` / `boolean` → stringified.
+- `Date` → ISO 8601 string.
+- Objects / arrays → `JSON.stringify()` (then escaped if needed).
+
+Dates render as ISO strings rather than locale-formatted — spreadsheet consumers can re-parse if needed. For locale-formatted dates with Thai BE calendar, pipe through `@noy-db/locale-th` before exporting.
+
+## Audit
+
+This package does NOT write an audit-ledger entry yet — that lands with the full vault-level gated wrappers in a #249 follow-up. For now, applications using `@noy-db/as-csv` should write their own `type: 'as-export'` ledger entry after each call:
+
+```ts
+await vault.collection<AsExportEntry>('_ledger_custom').put(ulid(), {
+  type: 'as-export',
+  encrypted: false,
+  package: '@noy-db/as-csv',
+  collection: options.collection,
+  recordCount: records.length,
+  actor: currentUserId,
+  timestamp: new Date().toISOString(),
+})
+```
+
+## Related packages
+
+- `@noy-db/as-json` — structured JSON, schema-aware
+- `@noy-db/as-ndjson` — newline-delimited JSON, streaming-friendly
+- `@noy-db/as-xml` — XML for legacy systems
+- `@noy-db/as-xlsx` — multi-sheet Excel with dictionary-label expansion
+- `@noy-db/as-sql` — SQL dump for migration
+- `@noy-db/as-blob` — single-attachment extraction (binary, not structured data)
+- `@noy-db/as-zip` — composite records + attached blobs
+- `@noy-db/as-noydb` — encrypted-tier whole-vault bundle
+
+All share the same authorization model; see [`docs/packages-exports.md#authorization-model`](../../docs/packages-exports.md#authorization-model).
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,241 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  download: () => download,
+  fromString: () => fromString,
+  toString: () => toString,
+  write: () => write
+});
+module.exports = __toCommonJS(index_exports);
+var import_hub = require("@noy-db/hub");
+async function toString(vault, options) {
+  vault.assertCanExport("plaintext", "csv");
+  const eol = options.eol ?? "\n";
+  const collection = options.collection;
+  const records = [];
+  for await (const chunk of vault.exportStream({ granularity: "collection" })) {
+    if (chunk.collection === collection) {
+      records.push(...chunk.records);
+      break;
+    }
+  }
+  const columns = options.columns ?? inferColumns(records);
+  if (columns.length === 0) {
+    return "";
+  }
+  const lines = [columns.map(escapeField).join(",")];
+  for (const record of records) {
+    const row = columns.map((c) => escapeField(record[c]));
+    lines.push(row.join(","));
+  }
+  return lines.join(eol);
+}
+async function download(vault, options) {
+  const csv = await toString(vault, options);
+  const filename = options.filename ?? `${options.collection}.csv`;
+  const blob = new Blob([csv], { type: "text/csv;charset=utf-8" });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = filename;
+  a.click();
+  URL.revokeObjectURL(url);
+}
+async function write(vault, path, options) {
+  if (options.acknowledgeRisks !== true) {
+    throw new Error(
+      `as-csv.write: acknowledgeRisks: true is required for on-disk plaintext output. This call creates a persistent plaintext copy of your data outside noy-db's encrypted storage \u2014 see docs/patterns/as-exports.md \xA7"The three tiers of \\"plaintext out\\""`
+    );
+  }
+  const csv = await toString(vault, options);
+  const { writeFile } = await import("fs/promises");
+  await writeFile(path, csv, "utf-8");
+}
+function escapeField(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (value instanceof Date) return value.toISOString();
+  const s = typeof value === "string" ? value : JSON.stringify(value);
+  if (/[",\r\n]/.test(s)) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  return s;
+}
+function inferColumns(records) {
+  const columns = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    if (r && typeof r === "object") {
+      for (const key of Object.keys(r)) {
+        if (!seen.has(key)) {
+          seen.add(key);
+          columns.push(key);
+        }
+      }
+    }
+  }
+  return columns;
+}
+async function fromString(vault, csv, options) {
+  vault.assertCanImport("plaintext", "csv");
+  const policy = options.policy ?? "merge";
+  const idKey = options.idKey ?? "id";
+  const types = options.columnTypes ?? {};
+  const rows = parseCSV(csv);
+  if (rows.length === 0) {
+    return emptyPlan(vault, options.collection, policy, idKey);
+  }
+  const header = rows[0] ?? [];
+  const records = [];
+  for (let r = 1; r < rows.length; r++) {
+    const row = rows[r];
+    if (row.length === 1 && row[0] === "") continue;
+    const record = {};
+    for (let c = 0; c < header.length; c++) {
+      const col = header[c] ?? "";
+      const cell = row[c] ?? "";
+      record[col] = coerceCell(cell, types[col]);
+    }
+    records.push(record);
+  }
+  const plan = await (0, import_hub.diffVault)(vault, { [options.collection]: records }, {
+    collections: [options.collection],
+    idKey
+  });
+  return {
+    plan,
+    policy,
+    async apply() {
+      await vault.noydb.transaction((tx) => {
+        const txVault = tx.vault(vault.name);
+        for (const entry of plan.added) {
+          txVault.collection(entry.collection).put(entry.id, entry.record);
+        }
+        if (policy !== "insert-only") {
+          for (const entry of plan.modified) {
+            txVault.collection(entry.collection).put(entry.id, entry.record);
+          }
+        }
+        if (policy === "replace") {
+          for (const entry of plan.deleted) {
+            txVault.collection(entry.collection).delete(entry.id);
+          }
+        }
+      });
+    }
+  };
+}
+async function emptyPlan(vault, collection, policy, idKey) {
+  const plan = await (0, import_hub.diffVault)(vault, { [collection]: [] }, { collections: [collection], idKey });
+  return { plan, policy, async apply() {
+  } };
+}
+function coerceCell(cell, type) {
+  if (type === "number") {
+    if (cell === "") return void 0;
+    const n = Number(cell);
+    return Number.isFinite(n) ? n : cell;
+  }
+  if (type === "boolean") {
+    if (cell === "true") return true;
+    if (cell === "false") return false;
+    return cell;
+  }
+  return cell;
+}
+function parseCSV(input) {
+  const rows = [];
+  let row = [];
+  let field = "";
+  let inQuotes = false;
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (input[i + 1] === '"') {
+          field += '"';
+          i += 2;
+          continue;
+        }
+        inQuotes = false;
+        i++;
+        continue;
+      }
+      field += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inQuotes = true;
+      i++;
+      continue;
+    }
+    if (ch === ",") {
+      row.push(field);
+      field = "";
+      i++;
+      continue;
+    }
+    if (ch === "\r" && input[i + 1] === "\n") {
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+      i += 2;
+      continue;
+    }
+    if (ch === "\n" || ch === "\r") {
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+      i++;
+      continue;
+    }
+    field += ch;
+    i++;
+  }
+  if (field !== "" || row.length > 0) {
+    row.push(field);
+    rows.push(row);
+  }
+  return rows;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  download,
+  fromString,
+  toString,
+  write
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/as-csv** — CSV plaintext export for noy-db.\n *\n * Decrypts records from a single collection and formats them as\n * comma-separated values suitable for spreadsheet import. RFC 4180\n * escaping (quote fields containing commas, quotes, or newlines;\n * escape embedded quotes by doubling them).\n *\n * **Authorization.** Every call is gated by the invoking keyring's\n * `canExportPlaintext` capability — plaintext crossings of the\n * library boundary require an explicit grant from the vault owner\n *. The package calls `vault.assertCanExport('plaintext',\n * 'csv')` before decrypting anything.\n *\n * **Scope.** One collection per call. Multi-collection + attachments\n * → use `@noy-db/as-zip`. Structured JSON → `@noy-db/as-json`.\n * Excel with dictionary-label expansion → `@noy-db/as-xlsx`.\n *\n * See [`docs/patterns/as-exports.md`](https://github.com/vLannaAi/noy-db/blob/main/docs/patterns/as-exports.md).\n *\n * @packageDocumentation\n */\n\nimport type { Vault } from '@noy-db/hub'\n\nexport interface AsCSVOptions {\n  /**\n   * Collection to export. Must be in the caller's read ACL; otherwise\n   * the resulting CSV will be empty (ACL-scoping applies at the\n   * `exportStream` layer).\n   */\n  readonly collection: string\n\n  /**\n   * Explicit column list. When omitted, columns are inferred from\n   * the union of keys across all records, in first-record-wins\n   * order. Specify explicitly for deterministic exports or when the\n   * source data has sparse fields.\n   */\n  readonly columns?: readonly string[]\n\n  /**\n   * Row separator. Default `'\\n'` (LF). Use `'\\r\\n'` for Windows-\n   * friendly output (Excel prefers CRLF but accepts LF).\n   */\n  readonly eol?: '\\n' | '\\r\\n'\n}\n\nexport interface AsCSVWriteOptions extends AsCSVOptions {\n  /**\n   * Required for Node file-write calls — consumer acknowledgement\n   * that plaintext bytes will persist on disk past the current\n   * process lifetime (Tier 3 risk per `docs/patterns/as-exports.md`).\n   */\n  readonly acknowledgeRisks: true\n}\n\nexport interface AsCSVDownloadOptions extends AsCSVOptions {\n  /** Filename offered to the browser. Default `'<collection>.csv'`. */\n  readonly filename?: string\n}\n\n/**\n * Serialise a collection as a CSV string. Pure operation — no side\n * effects beyond the authorization check + audit ledger write.\n */\nexport async function toString(vault: Vault, options: AsCSVOptions): Promise<string> {\n  vault.assertCanExport('plaintext', 'csv')\n\n  const eol = options.eol ?? '\\n'\n  const collection = options.collection\n\n  // Pull the one collection via exportStream in collection granularity.\n  const records: unknown[] = []\n  for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n    if (chunk.collection === collection) {\n      records.push(...chunk.records)\n      break\n    }\n  }\n\n  // Determine columns.\n  const columns = options.columns ?? inferColumns(records)\n  if (columns.length === 0) {\n    // Empty collection or no accessible records — emit header-only csv.\n    return ''\n  }\n\n  // Build header + rows\n  const lines: string[] = [columns.map(escapeField).join(',')]\n  for (const record of records) {\n    const row = columns.map(c => escapeField((record as Record<string, unknown>)[c]))\n    lines.push(row.join(','))\n  }\n  return lines.join(eol)\n}\n\n/**\n * Browser download — wraps `toString()` in a `Blob` + triggers the\n * browser's download prompt. Tier 2 egress per the pattern doc.\n *\n * Requires a browser-like environment with `URL.createObjectURL` and\n * `document.createElement`. No-op in headless environments; use\n * `toString()` there instead.\n */\nexport async function download(vault: Vault, options: AsCSVDownloadOptions): Promise<void> {\n  const csv = await toString(vault, options)\n  const filename = options.filename ?? `${options.collection}.csv`\n  const blob = new Blob([csv], { type: 'text/csv;charset=utf-8' })\n  const url = URL.createObjectURL(blob)\n  const a = document.createElement('a')\n  a.href = url\n  a.download = filename\n  a.click()\n  URL.revokeObjectURL(url)\n}\n\n/**\n * Node file-write — persists the CSV to the filesystem. Requires\n * explicit `acknowledgeRisks: true` because the plaintext file\n * outlives the current process (Tier 3 egress).\n */\nexport async function write(\n  vault: Vault,\n  path: string,\n  options: AsCSVWriteOptions,\n): Promise<void> {\n  if (options.acknowledgeRisks !== true) {\n    throw new Error(\n      'as-csv.write: acknowledgeRisks: true is required for on-disk plaintext output. ' +\n      'This call creates a persistent plaintext copy of your data outside noy-db\\'s ' +\n      'encrypted storage — see docs/patterns/as-exports.md §\"The three tiers of \\\\\"plaintext out\\\\\"\"',\n    )\n  }\n  const csv = await toString(vault, options)\n  // Defer the node:fs import so this package remains browser-safe.\n  const { writeFile } = await import('node:fs/promises')\n  await writeFile(path, csv, 'utf-8')\n}\n\n// ── CSV formatting internals ───────────────────────────────────────────\n\n/**\n * RFC 4180 escaping: wrap a field in double quotes if it contains\n * comma, double quote, CR, or LF. Embedded double quotes become `\"\"`.\n * Other values stringify naturally.\n */\nfunction escapeField(value: unknown): string {\n  if (value === null || value === undefined) return ''\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (value instanceof Date) return value.toISOString()\n  const s =\n    typeof value === 'string' ? value : JSON.stringify(value)\n  if (/[\",\\r\\n]/.test(s)) {\n    return `\"${s.replace(/\"/g, '\"\"')}\"`\n  }\n  return s\n}\n\n/**\n * Derive column list from the records array, preserving first-\n * encountered-wins ordering. An explicit `options.columns` bypasses\n * this.\n */\nfunction inferColumns(records: readonly unknown[]): string[] {\n  const columns: string[] = []\n  const seen = new Set<string>()\n  for (const r of records) {\n    if (r && typeof r === 'object') {\n      for (const key of Object.keys(r)) {\n        if (!seen.has(key)) {\n          seen.add(key)\n          columns.push(key)\n        }\n      }\n    }\n  }\n  return columns\n}\n\n// ─── Reader ─────────────────────────────────────────────\n\nimport { diffVault, type VaultDiff } from '@noy-db/hub'\n\nexport type ImportPolicy = 'merge' | 'replace' | 'insert-only'\n\nexport interface AsCSVImportOptions {\n  /** Target collection. CSV has no native collection grouping. Required. */\n  readonly collection: string\n  /**\n   * Optional column type hints. When omitted, every cell is parsed as\n   * a string. Number / boolean cells are auto-detected when the hint\n   * matches: `'1'` → `1`, `'true'` → `true`, etc.\n   */\n  readonly columnTypes?: Record<string, 'string' | 'number' | 'boolean'>\n  /** Field on each record that carries its id. Default `'id'`. */\n  readonly idKey?: string\n  /** Reconciliation policy. Default `'merge'`. */\n  readonly policy?: ImportPolicy\n}\n\nexport interface AsCSVImportPlan {\n  readonly plan: VaultDiff\n  readonly policy: ImportPolicy\n  apply(): Promise<void>\n}\n\n/**\n * Parse RFC-4180 CSV into records and build an import plan for one\n * collection. The first row is the header; subsequent rows are\n * records. Quoted fields, embedded commas, embedded `\"\"`, and\n * CRLF line endings all round-trip with `as-csv.toString()`.\n *\n * Cells are returned as strings unless overridden via `columnTypes`.\n * For the common case of numeric ids (\"1001\" → 1001), pass\n * `columnTypes: { id: 'number' }`.\n */\nexport async function fromString(\n  vault: Vault,\n  csv: string,\n  options: AsCSVImportOptions,\n): Promise<AsCSVImportPlan> {\n  vault.assertCanImport('plaintext', 'csv')\n  const policy: ImportPolicy = options.policy ?? 'merge'\n  const idKey = options.idKey ?? 'id'\n  const types = options.columnTypes ?? {}\n\n  const rows = parseCSV(csv)\n  if (rows.length === 0) {\n    return emptyPlan(vault, options.collection, policy, idKey)\n  }\n  const header = rows[0] ?? []\n  const records: Record<string, unknown>[] = []\n  for (let r = 1; r < rows.length; r++) {\n    const row = rows[r]!\n    if (row.length === 1 && row[0] === '') continue   // ignore blank lines\n    const record: Record<string, unknown> = {}\n    for (let c = 0; c < header.length; c++) {\n      const col = header[c] ?? ''\n      const cell = row[c] ?? ''\n      record[col] = coerceCell(cell, types[col])\n    }\n    records.push(record)\n  }\n\n  const plan = await diffVault(vault, { [options.collection]: records }, {\n    collections: [options.collection],\n    idKey,\n  })\n\n  return {\n    plan,\n    policy,\n    async apply(): Promise<void> {\n      // Routes through the txStrategy seam — vault.noydb.transaction()\n      // throws a clear error pointing at withTransactions() when the\n      // strategy is not opted in. Atomicity ensures a partial failure\n      // rolls back every executed put.\n      await vault.noydb.transaction((tx) => {\n        const txVault = tx.vault(vault.name)\n        for (const entry of plan.added) {\n          txVault.collection(entry.collection).put(entry.id, entry.record)\n        }\n        if (policy !== 'insert-only') {\n          for (const entry of plan.modified) {\n            txVault.collection(entry.collection).put(entry.id, entry.record)\n          }\n        }\n        if (policy === 'replace') {\n          for (const entry of plan.deleted) {\n            txVault.collection(entry.collection).delete(entry.id)\n          }\n        }\n      })\n    },\n  }\n}\n\nasync function emptyPlan(\n  vault: Vault,\n  collection: string,\n  policy: ImportPolicy,\n  idKey: string,\n): Promise<AsCSVImportPlan> {\n  const plan = await diffVault(vault, { [collection]: [] }, { collections: [collection], idKey })\n  return { plan, policy, async apply() { /* nothing to do */ } }\n}\n\nfunction coerceCell(cell: string, type?: 'string' | 'number' | 'boolean'): unknown {\n  if (type === 'number') {\n    if (cell === '') return undefined\n    const n = Number(cell)\n    return Number.isFinite(n) ? n : cell\n  }\n  if (type === 'boolean') {\n    if (cell === 'true') return true\n    if (cell === 'false') return false\n    return cell\n  }\n  return cell\n}\n\n/**\n * Minimal RFC-4180 CSV parser. Recognises:\n *   - Comma-separated fields\n *   - Quoted fields with embedded commas, newlines, and `\"\"` escapes\n *   - Both CRLF and LF row endings\n *\n * Returns a 2D string array. The caller maps the first row to a\n * header and the rest to records.\n */\nfunction parseCSV(input: string): string[][] {\n  const rows: string[][] = []\n  let row: string[] = []\n  let field = ''\n  let inQuotes = false\n  let i = 0\n\n  while (i < input.length) {\n    const ch = input[i]!\n    if (inQuotes) {\n      if (ch === '\"') {\n        if (input[i + 1] === '\"') {\n          field += '\"'\n          i += 2\n          continue\n        }\n        inQuotes = false\n        i++\n        continue\n      }\n      field += ch\n      i++\n      continue\n    }\n    if (ch === '\"') {\n      inQuotes = true\n      i++\n      continue\n    }\n    if (ch === ',') {\n      row.push(field)\n      field = ''\n      i++\n      continue\n    }\n    if (ch === '\\r' && input[i + 1] === '\\n') {\n      row.push(field)\n      rows.push(row)\n      row = []\n      field = ''\n      i += 2\n      continue\n    }\n    if (ch === '\\n' || ch === '\\r') {\n      row.push(field)\n      rows.push(row)\n      row = []\n      field = ''\n      i++\n      continue\n    }\n    field += ch\n    i++\n  }\n\n  // Final field / row.\n  if (field !== '' || row.length > 0) {\n    row.push(field)\n    rows.push(row)\n  }\n\n  return rows\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsLA,iBAA0C;AApH1C,eAAsB,SAAS,OAAc,SAAwC;AACnF,QAAM,gBAAgB,aAAa,KAAK;AAExC,QAAM,MAAM,QAAQ,OAAO;AAC3B,QAAM,aAAa,QAAQ;AAG3B,QAAM,UAAqB,CAAC;AAC5B,mBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,QAAI,MAAM,eAAe,YAAY;AACnC,cAAQ,KAAK,GAAG,MAAM,OAAO;AAC7B;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,QAAQ,WAAW,aAAa,OAAO;AACvD,MAAI,QAAQ,WAAW,GAAG;AAExB,WAAO;AAAA,EACT;AAGA,QAAM,QAAkB,CAAC,QAAQ,IAAI,WAAW,EAAE,KAAK,GAAG,CAAC;AAC3D,aAAW,UAAU,SAAS;AAC5B,UAAM,MAAM,QAAQ,IAAI,OAAK,YAAa,OAAmC,CAAC,CAAC,CAAC;AAChF,UAAM,KAAK,IAAI,KAAK,GAAG,CAAC;AAAA,EAC1B;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAUA,eAAsB,SAAS,OAAc,SAA8C;AACzF,QAAM,MAAM,MAAM,SAAS,OAAO,OAAO;AACzC,QAAM,WAAW,QAAQ,YAAY,GAAG,QAAQ,UAAU;AAC1D,QAAM,OAAO,IAAI,KAAK,CAAC,GAAG,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC/D,QAAM,MAAM,IAAI,gBAAgB,IAAI;AACpC,QAAM,IAAI,SAAS,cAAc,GAAG;AACpC,IAAE,OAAO;AACT,IAAE,WAAW;AACb,IAAE,MAAM;AACR,MAAI,gBAAgB,GAAG;AACzB;AAOA,eAAsB,MACpB,OACA,MACA,SACe;AACf,MAAI,QAAQ,qBAAqB,MAAM;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,SAAS,OAAO,OAAO;AAEzC,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,aAAkB;AACrD,QAAM,UAAU,MAAM,KAAK,OAAO;AACpC;AASA,SAAS,YAAY,OAAwB;AAC3C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAM,IACJ,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC1D,MAAI,WAAW,KAAK,CAAC,GAAG;AACtB,WAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAOA,SAAS,aAAa,SAAuC;AAC3D,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,SAAS;AACvB,QAAI,KAAK,OAAO,MAAM,UAAU;AAC9B,iBAAW,OAAO,OAAO,KAAK,CAAC,GAAG;AAChC,YAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,eAAK,IAAI,GAAG;AACZ,kBAAQ,KAAK,GAAG;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAuCA,eAAsB,WACpB,OACA,KACA,SAC0B;AAC1B,QAAM,gBAAgB,aAAa,KAAK;AACxC,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,QAAQ,QAAQ,eAAe,CAAC;AAEtC,QAAM,OAAO,SAAS,GAAG;AACzB,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO,UAAU,OAAO,QAAQ,YAAY,QAAQ,KAAK;AAAA,EAC3D;AACA,QAAM,SAAS,KAAK,CAAC,KAAK,CAAC;AAC3B,QAAM,UAAqC,CAAC;AAC5C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,GAAI;AACvC,UAAM,SAAkC,CAAC;AACzC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,MAAM,OAAO,CAAC,KAAK;AACzB,YAAM,OAAO,IAAI,CAAC,KAAK;AACvB,aAAO,GAAG,IAAI,WAAW,MAAM,MAAM,GAAG,CAAC;AAAA,IAC3C;AACA,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,QAAM,OAAO,UAAM,sBAAU,OAAO,EAAE,CAAC,QAAQ,UAAU,GAAG,QAAQ,GAAG;AAAA,IACrE,aAAa,CAAC,QAAQ,UAAU;AAAA,IAChC;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,QAAuB;AAK3B,YAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,cAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,mBAAW,SAAS,KAAK,OAAO;AAC9B,kBAAQ,WAAW,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM;AAAA,QACjE;AACA,YAAI,WAAW,eAAe;AAC5B,qBAAW,SAAS,KAAK,UAAU;AACjC,oBAAQ,WAAW,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM;AAAA,UACjE;AAAA,QACF;AACA,YAAI,WAAW,WAAW;AACxB,qBAAW,SAAS,KAAK,SAAS;AAChC,oBAAQ,WAAW,MAAM,UAAU,EAAE,OAAO,MAAM,EAAE;AAAA,UACtD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,UACb,OACA,YACA,QACA,OAC0B;AAC1B,QAAM,OAAO,UAAM,sBAAU,OAAO,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC;AAC9F,SAAO,EAAE,MAAM,QAAQ,MAAM,QAAQ;AAAA,EAAsB,EAAE;AAC/D;AAEA,SAAS,WAAW,MAAc,MAAiD;AACjF,MAAI,SAAS,UAAU;AACrB,QAAI,SAAS,GAAI,QAAO;AACxB,UAAM,IAAI,OAAO,IAAI;AACrB,WAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,EAClC;AACA,MAAI,SAAS,WAAW;AACtB,QAAI,SAAS,OAAQ,QAAO;AAC5B,QAAI,SAAS,QAAS,QAAO;AAC7B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,SAAS,OAA2B;AAC3C,QAAM,OAAmB,CAAC;AAC1B,MAAI,MAAgB,CAAC;AACrB,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,IAAI;AAER,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAM,KAAK,MAAM,CAAC;AAClB,QAAI,UAAU;AACZ,UAAI,OAAO,KAAK;AACd,YAAI,MAAM,IAAI,CAAC,MAAM,KAAK;AACxB,mBAAS;AACT,eAAK;AACL;AAAA,QACF;AACA,mBAAW;AACX;AACA;AAAA,MACF;AACA,eAAS;AACT;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,iBAAW;AACX;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,UAAI,KAAK,KAAK;AACd,cAAQ;AACR;AACA;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,MAAM,IAAI,CAAC,MAAM,MAAM;AACxC,UAAI,KAAK,KAAK;AACd,WAAK,KAAK,GAAG;AACb,YAAM,CAAC;AACP,cAAQ;AACR,WAAK;AACL;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,OAAO,MAAM;AAC9B,UAAI,KAAK,KAAK;AACd,WAAK,KAAK,GAAG;AACb,YAAM,CAAC;AACP,cAAQ;AACR;AACA;AAAA,IACF;AACA,aAAS;AACT;AAAA,EACF;AAGA,MAAI,UAAU,MAAM,IAAI,SAAS,GAAG;AAClC,QAAI,KAAK,KAAK;AACd,SAAK,KAAK,GAAG;AAAA,EACf;AAEA,SAAO;AACT;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,111 @@
+import { VaultDiff, Vault } from '@noy-db/hub';
+
+/**
+ * **@noy-db/as-csv** — CSV plaintext export for noy-db.
+ *
+ * Decrypts records from a single collection and formats them as
+ * comma-separated values suitable for spreadsheet import. RFC 4180
+ * escaping (quote fields containing commas, quotes, or newlines;
+ * escape embedded quotes by doubling them).
+ *
+ * **Authorization.** Every call is gated by the invoking keyring's
+ * `canExportPlaintext` capability — plaintext crossings of the
+ * library boundary require an explicit grant from the vault owner
+ *. The package calls `vault.assertCanExport('plaintext',
+ * 'csv')` before decrypting anything.
+ *
+ * **Scope.** One collection per call. Multi-collection + attachments
+ * → use `@noy-db/as-zip`. Structured JSON → `@noy-db/as-json`.
+ * Excel with dictionary-label expansion → `@noy-db/as-xlsx`.
+ *
+ * See [`docs/patterns/as-exports.md`](https://github.com/vLannaAi/noy-db/blob/main/docs/patterns/as-exports.md).
+ *
+ * @packageDocumentation
+ */
+
+interface AsCSVOptions {
+    /**
+     * Collection to export. Must be in the caller's read ACL; otherwise
+     * the resulting CSV will be empty (ACL-scoping applies at the
+     * `exportStream` layer).
+     */
+    readonly collection: string;
+    /**
+     * Explicit column list. When omitted, columns are inferred from
+     * the union of keys across all records, in first-record-wins
+     * order. Specify explicitly for deterministic exports or when the
+     * source data has sparse fields.
+     */
+    readonly columns?: readonly string[];
+    /**
+     * Row separator. Default `'\n'` (LF). Use `'\r\n'` for Windows-
+     * friendly output (Excel prefers CRLF but accepts LF).
+     */
+    readonly eol?: '\n' | '\r\n';
+}
+interface AsCSVWriteOptions extends AsCSVOptions {
+    /**
+     * Required for Node file-write calls — consumer acknowledgement
+     * that plaintext bytes will persist on disk past the current
+     * process lifetime (Tier 3 risk per `docs/patterns/as-exports.md`).
+     */
+    readonly acknowledgeRisks: true;
+}
+interface AsCSVDownloadOptions extends AsCSVOptions {
+    /** Filename offered to the browser. Default `'<collection>.csv'`. */
+    readonly filename?: string;
+}
+/**
+ * Serialise a collection as a CSV string. Pure operation — no side
+ * effects beyond the authorization check + audit ledger write.
+ */
+declare function toString(vault: Vault, options: AsCSVOptions): Promise<string>;
+/**
+ * Browser download — wraps `toString()` in a `Blob` + triggers the
+ * browser's download prompt. Tier 2 egress per the pattern doc.
+ *
+ * Requires a browser-like environment with `URL.createObjectURL` and
+ * `document.createElement`. No-op in headless environments; use
+ * `toString()` there instead.
+ */
+declare function download(vault: Vault, options: AsCSVDownloadOptions): Promise<void>;
+/**
+ * Node file-write — persists the CSV to the filesystem. Requires
+ * explicit `acknowledgeRisks: true` because the plaintext file
+ * outlives the current process (Tier 3 egress).
+ */
+declare function write(vault: Vault, path: string, options: AsCSVWriteOptions): Promise<void>;
+
+type ImportPolicy = 'merge' | 'replace' | 'insert-only';
+interface AsCSVImportOptions {
+    /** Target collection. CSV has no native collection grouping. Required. */
+    readonly collection: string;
+    /**
+     * Optional column type hints. When omitted, every cell is parsed as
+     * a string. Number / boolean cells are auto-detected when the hint
+     * matches: `'1'` → `1`, `'true'` → `true`, etc.
+     */
+    readonly columnTypes?: Record<string, 'string' | 'number' | 'boolean'>;
+    /** Field on each record that carries its id. Default `'id'`. */
+    readonly idKey?: string;
+    /** Reconciliation policy. Default `'merge'`. */
+    readonly policy?: ImportPolicy;
+}
+interface AsCSVImportPlan {
+    readonly plan: VaultDiff;
+    readonly policy: ImportPolicy;
+    apply(): Promise<void>;
+}
+/**
+ * Parse RFC-4180 CSV into records and build an import plan for one
+ * collection. The first row is the header; subsequent rows are
+ * records. Quoted fields, embedded commas, embedded `""`, and
+ * CRLF line endings all round-trip with `as-csv.toString()`.
+ *
+ * Cells are returned as strings unless overridden via `columnTypes`.
+ * For the common case of numeric ids ("1001" → 1001), pass
+ * `columnTypes: { id: 'number' }`.
+ */
+declare function fromString(vault: Vault, csv: string, options: AsCSVImportOptions): Promise<AsCSVImportPlan>;
+
+export { type AsCSVDownloadOptions, type AsCSVImportOptions, type AsCSVImportPlan, type AsCSVOptions, type AsCSVWriteOptions, type ImportPolicy, download, fromString, toString, write };

package/dist/index.d.ts

@@ -0,0 +1,111 @@
+import { VaultDiff, Vault } from '@noy-db/hub';
+
+/**
+ * **@noy-db/as-csv** — CSV plaintext export for noy-db.
+ *
+ * Decrypts records from a single collection and formats them as
+ * comma-separated values suitable for spreadsheet import. RFC 4180
+ * escaping (quote fields containing commas, quotes, or newlines;
+ * escape embedded quotes by doubling them).
+ *
+ * **Authorization.** Every call is gated by the invoking keyring's
+ * `canExportPlaintext` capability — plaintext crossings of the
+ * library boundary require an explicit grant from the vault owner
+ *. The package calls `vault.assertCanExport('plaintext',
+ * 'csv')` before decrypting anything.
+ *
+ * **Scope.** One collection per call. Multi-collection + attachments
+ * → use `@noy-db/as-zip`. Structured JSON → `@noy-db/as-json`.
+ * Excel with dictionary-label expansion → `@noy-db/as-xlsx`.
+ *
+ * See [`docs/patterns/as-exports.md`](https://github.com/vLannaAi/noy-db/blob/main/docs/patterns/as-exports.md).
+ *
+ * @packageDocumentation
+ */
+
+interface AsCSVOptions {
+    /**
+     * Collection to export. Must be in the caller's read ACL; otherwise
+     * the resulting CSV will be empty (ACL-scoping applies at the
+     * `exportStream` layer).
+     */
+    readonly collection: string;
+    /**
+     * Explicit column list. When omitted, columns are inferred from
+     * the union of keys across all records, in first-record-wins
+     * order. Specify explicitly for deterministic exports or when the
+     * source data has sparse fields.
+     */
+    readonly columns?: readonly string[];
+    /**
+     * Row separator. Default `'\n'` (LF). Use `'\r\n'` for Windows-
+     * friendly output (Excel prefers CRLF but accepts LF).
+     */
+    readonly eol?: '\n' | '\r\n';
+}
+interface AsCSVWriteOptions extends AsCSVOptions {
+    /**
+     * Required for Node file-write calls — consumer acknowledgement
+     * that plaintext bytes will persist on disk past the current
+     * process lifetime (Tier 3 risk per `docs/patterns/as-exports.md`).
+     */
+    readonly acknowledgeRisks: true;
+}
+interface AsCSVDownloadOptions extends AsCSVOptions {
+    /** Filename offered to the browser. Default `'<collection>.csv'`. */
+    readonly filename?: string;
+}
+/**
+ * Serialise a collection as a CSV string. Pure operation — no side
+ * effects beyond the authorization check + audit ledger write.
+ */
+declare function toString(vault: Vault, options: AsCSVOptions): Promise<string>;
+/**
+ * Browser download — wraps `toString()` in a `Blob` + triggers the
+ * browser's download prompt. Tier 2 egress per the pattern doc.
+ *
+ * Requires a browser-like environment with `URL.createObjectURL` and
+ * `document.createElement`. No-op in headless environments; use
+ * `toString()` there instead.
+ */
+declare function download(vault: Vault, options: AsCSVDownloadOptions): Promise<void>;
+/**
+ * Node file-write — persists the CSV to the filesystem. Requires
+ * explicit `acknowledgeRisks: true` because the plaintext file
+ * outlives the current process (Tier 3 egress).
+ */
+declare function write(vault: Vault, path: string, options: AsCSVWriteOptions): Promise<void>;
+
+type ImportPolicy = 'merge' | 'replace' | 'insert-only';
+interface AsCSVImportOptions {
+    /** Target collection. CSV has no native collection grouping. Required. */
+    readonly collection: string;
+    /**
+     * Optional column type hints. When omitted, every cell is parsed as
+     * a string. Number / boolean cells are auto-detected when the hint
+     * matches: `'1'` → `1`, `'true'` → `true`, etc.
+     */
+    readonly columnTypes?: Record<string, 'string' | 'number' | 'boolean'>;
+    /** Field on each record that carries its id. Default `'id'`. */
+    readonly idKey?: string;
+    /** Reconciliation policy. Default `'merge'`. */
+    readonly policy?: ImportPolicy;
+}
+interface AsCSVImportPlan {
+    readonly plan: VaultDiff;
+    readonly policy: ImportPolicy;
+    apply(): Promise<void>;
+}
+/**
+ * Parse RFC-4180 CSV into records and build an import plan for one
+ * collection. The first row is the header; subsequent rows are
+ * records. Quoted fields, embedded commas, embedded `""`, and
+ * CRLF line endings all round-trip with `as-csv.toString()`.
+ *
+ * Cells are returned as strings unless overridden via `columnTypes`.
+ * For the common case of numeric ids ("1001" → 1001), pass
+ * `columnTypes: { id: 'number' }`.
+ */
+declare function fromString(vault: Vault, csv: string, options: AsCSVImportOptions): Promise<AsCSVImportPlan>;
+
+export { type AsCSVDownloadOptions, type AsCSVImportOptions, type AsCSVImportPlan, type AsCSVOptions, type AsCSVWriteOptions, type ImportPolicy, download, fromString, toString, write };

package/dist/index.js

@@ -0,0 +1,203 @@
+// src/index.ts
+import { diffVault } from "@noy-db/hub";
+async function toString(vault, options) {
+  vault.assertCanExport("plaintext", "csv");
+  const eol = options.eol ?? "\n";
+  const collection = options.collection;
+  const records = [];
+  for await (const chunk of vault.exportStream({ granularity: "collection" })) {
+    if (chunk.collection === collection) {
+      records.push(...chunk.records);
+      break;
+    }
+  }
+  const columns = options.columns ?? inferColumns(records);
+  if (columns.length === 0) {
+    return "";
+  }
+  const lines = [columns.map(escapeField).join(",")];
+  for (const record of records) {
+    const row = columns.map((c) => escapeField(record[c]));
+    lines.push(row.join(","));
+  }
+  return lines.join(eol);
+}
+async function download(vault, options) {
+  const csv = await toString(vault, options);
+  const filename = options.filename ?? `${options.collection}.csv`;
+  const blob = new Blob([csv], { type: "text/csv;charset=utf-8" });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = filename;
+  a.click();
+  URL.revokeObjectURL(url);
+}
+async function write(vault, path, options) {
+  if (options.acknowledgeRisks !== true) {
+    throw new Error(
+      `as-csv.write: acknowledgeRisks: true is required for on-disk plaintext output. This call creates a persistent plaintext copy of your data outside noy-db's encrypted storage \u2014 see docs/patterns/as-exports.md \xA7"The three tiers of \\"plaintext out\\""`
+    );
+  }
+  const csv = await toString(vault, options);
+  const { writeFile } = await import("fs/promises");
+  await writeFile(path, csv, "utf-8");
+}
+function escapeField(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (value instanceof Date) return value.toISOString();
+  const s = typeof value === "string" ? value : JSON.stringify(value);
+  if (/[",\r\n]/.test(s)) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  return s;
+}
+function inferColumns(records) {
+  const columns = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    if (r && typeof r === "object") {
+      for (const key of Object.keys(r)) {
+        if (!seen.has(key)) {
+          seen.add(key);
+          columns.push(key);
+        }
+      }
+    }
+  }
+  return columns;
+}
+async function fromString(vault, csv, options) {
+  vault.assertCanImport("plaintext", "csv");
+  const policy = options.policy ?? "merge";
+  const idKey = options.idKey ?? "id";
+  const types = options.columnTypes ?? {};
+  const rows = parseCSV(csv);
+  if (rows.length === 0) {
+    return emptyPlan(vault, options.collection, policy, idKey);
+  }
+  const header = rows[0] ?? [];
+  const records = [];
+  for (let r = 1; r < rows.length; r++) {
+    const row = rows[r];
+    if (row.length === 1 && row[0] === "") continue;
+    const record = {};
+    for (let c = 0; c < header.length; c++) {
+      const col = header[c] ?? "";
+      const cell = row[c] ?? "";
+      record[col] = coerceCell(cell, types[col]);
+    }
+    records.push(record);
+  }
+  const plan = await diffVault(vault, { [options.collection]: records }, {
+    collections: [options.collection],
+    idKey
+  });
+  return {
+    plan,
+    policy,
+    async apply() {
+      await vault.noydb.transaction((tx) => {
+        const txVault = tx.vault(vault.name);
+        for (const entry of plan.added) {
+          txVault.collection(entry.collection).put(entry.id, entry.record);
+        }
+        if (policy !== "insert-only") {
+          for (const entry of plan.modified) {
+            txVault.collection(entry.collection).put(entry.id, entry.record);
+          }
+        }
+        if (policy === "replace") {
+          for (const entry of plan.deleted) {
+            txVault.collection(entry.collection).delete(entry.id);
+          }
+        }
+      });
+    }
+  };
+}
+async function emptyPlan(vault, collection, policy, idKey) {
+  const plan = await diffVault(vault, { [collection]: [] }, { collections: [collection], idKey });
+  return { plan, policy, async apply() {
+  } };
+}
+function coerceCell(cell, type) {
+  if (type === "number") {
+    if (cell === "") return void 0;
+    const n = Number(cell);
+    return Number.isFinite(n) ? n : cell;
+  }
+  if (type === "boolean") {
+    if (cell === "true") return true;
+    if (cell === "false") return false;
+    return cell;
+  }
+  return cell;
+}
+function parseCSV(input) {
+  const rows = [];
+  let row = [];
+  let field = "";
+  let inQuotes = false;
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (input[i + 1] === '"') {
+          field += '"';
+          i += 2;
+          continue;
+        }
+        inQuotes = false;
+        i++;
+        continue;
+      }
+      field += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inQuotes = true;
+      i++;
+      continue;
+    }
+    if (ch === ",") {
+      row.push(field);
+      field = "";
+      i++;
+      continue;
+    }
+    if (ch === "\r" && input[i + 1] === "\n") {
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+      i += 2;
+      continue;
+    }
+    if (ch === "\n" || ch === "\r") {
+      row.push(field);
+      rows.push(row);
+      row = [];
+      field = "";
+      i++;
+      continue;
+    }
+    field += ch;
+    i++;
+  }
+  if (field !== "" || row.length > 0) {
+    row.push(field);
+    rows.push(row);
+  }
+  return rows;
+}
+export {
+  download,
+  fromString,
+  toString,
+  write
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/as-csv** — CSV plaintext export for noy-db.\n *\n * Decrypts records from a single collection and formats them as\n * comma-separated values suitable for spreadsheet import. RFC 4180\n * escaping (quote fields containing commas, quotes, or newlines;\n * escape embedded quotes by doubling them).\n *\n * **Authorization.** Every call is gated by the invoking keyring's\n * `canExportPlaintext` capability — plaintext crossings of the\n * library boundary require an explicit grant from the vault owner\n *. The package calls `vault.assertCanExport('plaintext',\n * 'csv')` before decrypting anything.\n *\n * **Scope.** One collection per call. Multi-collection + attachments\n * → use `@noy-db/as-zip`. Structured JSON → `@noy-db/as-json`.\n * Excel with dictionary-label expansion → `@noy-db/as-xlsx`.\n *\n * See [`docs/patterns/as-exports.md`](https://github.com/vLannaAi/noy-db/blob/main/docs/patterns/as-exports.md).\n *\n * @packageDocumentation\n */\n\nimport type { Vault } from '@noy-db/hub'\n\nexport interface AsCSVOptions {\n  /**\n   * Collection to export. Must be in the caller's read ACL; otherwise\n   * the resulting CSV will be empty (ACL-scoping applies at the\n   * `exportStream` layer).\n   */\n  readonly collection: string\n\n  /**\n   * Explicit column list. When omitted, columns are inferred from\n   * the union of keys across all records, in first-record-wins\n   * order. Specify explicitly for deterministic exports or when the\n   * source data has sparse fields.\n   */\n  readonly columns?: readonly string[]\n\n  /**\n   * Row separator. Default `'\\n'` (LF). Use `'\\r\\n'` for Windows-\n   * friendly output (Excel prefers CRLF but accepts LF).\n   */\n  readonly eol?: '\\n' | '\\r\\n'\n}\n\nexport interface AsCSVWriteOptions extends AsCSVOptions {\n  /**\n   * Required for Node file-write calls — consumer acknowledgement\n   * that plaintext bytes will persist on disk past the current\n   * process lifetime (Tier 3 risk per `docs/patterns/as-exports.md`).\n   */\n  readonly acknowledgeRisks: true\n}\n\nexport interface AsCSVDownloadOptions extends AsCSVOptions {\n  /** Filename offered to the browser. Default `'<collection>.csv'`. */\n  readonly filename?: string\n}\n\n/**\n * Serialise a collection as a CSV string. Pure operation — no side\n * effects beyond the authorization check + audit ledger write.\n */\nexport async function toString(vault: Vault, options: AsCSVOptions): Promise<string> {\n  vault.assertCanExport('plaintext', 'csv')\n\n  const eol = options.eol ?? '\\n'\n  const collection = options.collection\n\n  // Pull the one collection via exportStream in collection granularity.\n  const records: unknown[] = []\n  for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n    if (chunk.collection === collection) {\n      records.push(...chunk.records)\n      break\n    }\n  }\n\n  // Determine columns.\n  const columns = options.columns ?? inferColumns(records)\n  if (columns.length === 0) {\n    // Empty collection or no accessible records — emit header-only csv.\n    return ''\n  }\n\n  // Build header + rows\n  const lines: string[] = [columns.map(escapeField).join(',')]\n  for (const record of records) {\n    const row = columns.map(c => escapeField((record as Record<string, unknown>)[c]))\n    lines.push(row.join(','))\n  }\n  return lines.join(eol)\n}\n\n/**\n * Browser download — wraps `toString()` in a `Blob` + triggers the\n * browser's download prompt. Tier 2 egress per the pattern doc.\n *\n * Requires a browser-like environment with `URL.createObjectURL` and\n * `document.createElement`. No-op in headless environments; use\n * `toString()` there instead.\n */\nexport async function download(vault: Vault, options: AsCSVDownloadOptions): Promise<void> {\n  const csv = await toString(vault, options)\n  const filename = options.filename ?? `${options.collection}.csv`\n  const blob = new Blob([csv], { type: 'text/csv;charset=utf-8' })\n  const url = URL.createObjectURL(blob)\n  const a = document.createElement('a')\n  a.href = url\n  a.download = filename\n  a.click()\n  URL.revokeObjectURL(url)\n}\n\n/**\n * Node file-write — persists the CSV to the filesystem. Requires\n * explicit `acknowledgeRisks: true` because the plaintext file\n * outlives the current process (Tier 3 egress).\n */\nexport async function write(\n  vault: Vault,\n  path: string,\n  options: AsCSVWriteOptions,\n): Promise<void> {\n  if (options.acknowledgeRisks !== true) {\n    throw new Error(\n      'as-csv.write: acknowledgeRisks: true is required for on-disk plaintext output. ' +\n      'This call creates a persistent plaintext copy of your data outside noy-db\\'s ' +\n      'encrypted storage — see docs/patterns/as-exports.md §\"The three tiers of \\\\\"plaintext out\\\\\"\"',\n    )\n  }\n  const csv = await toString(vault, options)\n  // Defer the node:fs import so this package remains browser-safe.\n  const { writeFile } = await import('node:fs/promises')\n  await writeFile(path, csv, 'utf-8')\n}\n\n// ── CSV formatting internals ───────────────────────────────────────────\n\n/**\n * RFC 4180 escaping: wrap a field in double quotes if it contains\n * comma, double quote, CR, or LF. Embedded double quotes become `\"\"`.\n * Other values stringify naturally.\n */\nfunction escapeField(value: unknown): string {\n  if (value === null || value === undefined) return ''\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (value instanceof Date) return value.toISOString()\n  const s =\n    typeof value === 'string' ? value : JSON.stringify(value)\n  if (/[\",\\r\\n]/.test(s)) {\n    return `\"${s.replace(/\"/g, '\"\"')}\"`\n  }\n  return s\n}\n\n/**\n * Derive column list from the records array, preserving first-\n * encountered-wins ordering. An explicit `options.columns` bypasses\n * this.\n */\nfunction inferColumns(records: readonly unknown[]): string[] {\n  const columns: string[] = []\n  const seen = new Set<string>()\n  for (const r of records) {\n    if (r && typeof r === 'object') {\n      for (const key of Object.keys(r)) {\n        if (!seen.has(key)) {\n          seen.add(key)\n          columns.push(key)\n        }\n      }\n    }\n  }\n  return columns\n}\n\n// ─── Reader ─────────────────────────────────────────────\n\nimport { diffVault, type VaultDiff } from '@noy-db/hub'\n\nexport type ImportPolicy = 'merge' | 'replace' | 'insert-only'\n\nexport interface AsCSVImportOptions {\n  /** Target collection. CSV has no native collection grouping. Required. */\n  readonly collection: string\n  /**\n   * Optional column type hints. When omitted, every cell is parsed as\n   * a string. Number / boolean cells are auto-detected when the hint\n   * matches: `'1'` → `1`, `'true'` → `true`, etc.\n   */\n  readonly columnTypes?: Record<string, 'string' | 'number' | 'boolean'>\n  /** Field on each record that carries its id. Default `'id'`. */\n  readonly idKey?: string\n  /** Reconciliation policy. Default `'merge'`. */\n  readonly policy?: ImportPolicy\n}\n\nexport interface AsCSVImportPlan {\n  readonly plan: VaultDiff\n  readonly policy: ImportPolicy\n  apply(): Promise<void>\n}\n\n/**\n * Parse RFC-4180 CSV into records and build an import plan for one\n * collection. The first row is the header; subsequent rows are\n * records. Quoted fields, embedded commas, embedded `\"\"`, and\n * CRLF line endings all round-trip with `as-csv.toString()`.\n *\n * Cells are returned as strings unless overridden via `columnTypes`.\n * For the common case of numeric ids (\"1001\" → 1001), pass\n * `columnTypes: { id: 'number' }`.\n */\nexport async function fromString(\n  vault: Vault,\n  csv: string,\n  options: AsCSVImportOptions,\n): Promise<AsCSVImportPlan> {\n  vault.assertCanImport('plaintext', 'csv')\n  const policy: ImportPolicy = options.policy ?? 'merge'\n  const idKey = options.idKey ?? 'id'\n  const types = options.columnTypes ?? {}\n\n  const rows = parseCSV(csv)\n  if (rows.length === 0) {\n    return emptyPlan(vault, options.collection, policy, idKey)\n  }\n  const header = rows[0] ?? []\n  const records: Record<string, unknown>[] = []\n  for (let r = 1; r < rows.length; r++) {\n    const row = rows[r]!\n    if (row.length === 1 && row[0] === '') continue   // ignore blank lines\n    const record: Record<string, unknown> = {}\n    for (let c = 0; c < header.length; c++) {\n      const col = header[c] ?? ''\n      const cell = row[c] ?? ''\n      record[col] = coerceCell(cell, types[col])\n    }\n    records.push(record)\n  }\n\n  const plan = await diffVault(vault, { [options.collection]: records }, {\n    collections: [options.collection],\n    idKey,\n  })\n\n  return {\n    plan,\n    policy,\n    async apply(): Promise<void> {\n      // Routes through the txStrategy seam — vault.noydb.transaction()\n      // throws a clear error pointing at withTransactions() when the\n      // strategy is not opted in. Atomicity ensures a partial failure\n      // rolls back every executed put.\n      await vault.noydb.transaction((tx) => {\n        const txVault = tx.vault(vault.name)\n        for (const entry of plan.added) {\n          txVault.collection(entry.collection).put(entry.id, entry.record)\n        }\n        if (policy !== 'insert-only') {\n          for (const entry of plan.modified) {\n            txVault.collection(entry.collection).put(entry.id, entry.record)\n          }\n        }\n        if (policy === 'replace') {\n          for (const entry of plan.deleted) {\n            txVault.collection(entry.collection).delete(entry.id)\n          }\n        }\n      })\n    },\n  }\n}\n\nasync function emptyPlan(\n  vault: Vault,\n  collection: string,\n  policy: ImportPolicy,\n  idKey: string,\n): Promise<AsCSVImportPlan> {\n  const plan = await diffVault(vault, { [collection]: [] }, { collections: [collection], idKey })\n  return { plan, policy, async apply() { /* nothing to do */ } }\n}\n\nfunction coerceCell(cell: string, type?: 'string' | 'number' | 'boolean'): unknown {\n  if (type === 'number') {\n    if (cell === '') return undefined\n    const n = Number(cell)\n    return Number.isFinite(n) ? n : cell\n  }\n  if (type === 'boolean') {\n    if (cell === 'true') return true\n    if (cell === 'false') return false\n    return cell\n  }\n  return cell\n}\n\n/**\n * Minimal RFC-4180 CSV parser. Recognises:\n *   - Comma-separated fields\n *   - Quoted fields with embedded commas, newlines, and `\"\"` escapes\n *   - Both CRLF and LF row endings\n *\n * Returns a 2D string array. The caller maps the first row to a\n * header and the rest to records.\n */\nfunction parseCSV(input: string): string[][] {\n  const rows: string[][] = []\n  let row: string[] = []\n  let field = ''\n  let inQuotes = false\n  let i = 0\n\n  while (i < input.length) {\n    const ch = input[i]!\n    if (inQuotes) {\n      if (ch === '\"') {\n        if (input[i + 1] === '\"') {\n          field += '\"'\n          i += 2\n          continue\n        }\n        inQuotes = false\n        i++\n        continue\n      }\n      field += ch\n      i++\n      continue\n    }\n    if (ch === '\"') {\n      inQuotes = true\n      i++\n      continue\n    }\n    if (ch === ',') {\n      row.push(field)\n      field = ''\n      i++\n      continue\n    }\n    if (ch === '\\r' && input[i + 1] === '\\n') {\n      row.push(field)\n      rows.push(row)\n      row = []\n      field = ''\n      i += 2\n      continue\n    }\n    if (ch === '\\n' || ch === '\\r') {\n      row.push(field)\n      rows.push(row)\n      row = []\n      field = ''\n      i++\n      continue\n    }\n    field += ch\n    i++\n  }\n\n  // Final field / row.\n  if (field !== '' || row.length > 0) {\n    row.push(field)\n    rows.push(row)\n  }\n\n  return rows\n}\n"],"mappings":";AAsLA,SAAS,iBAAiC;AApH1C,eAAsB,SAAS,OAAc,SAAwC;AACnF,QAAM,gBAAgB,aAAa,KAAK;AAExC,QAAM,MAAM,QAAQ,OAAO;AAC3B,QAAM,aAAa,QAAQ;AAG3B,QAAM,UAAqB,CAAC;AAC5B,mBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,QAAI,MAAM,eAAe,YAAY;AACnC,cAAQ,KAAK,GAAG,MAAM,OAAO;AAC7B;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,QAAQ,WAAW,aAAa,OAAO;AACvD,MAAI,QAAQ,WAAW,GAAG;AAExB,WAAO;AAAA,EACT;AAGA,QAAM,QAAkB,CAAC,QAAQ,IAAI,WAAW,EAAE,KAAK,GAAG,CAAC;AAC3D,aAAW,UAAU,SAAS;AAC5B,UAAM,MAAM,QAAQ,IAAI,OAAK,YAAa,OAAmC,CAAC,CAAC,CAAC;AAChF,UAAM,KAAK,IAAI,KAAK,GAAG,CAAC;AAAA,EAC1B;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAUA,eAAsB,SAAS,OAAc,SAA8C;AACzF,QAAM,MAAM,MAAM,SAAS,OAAO,OAAO;AACzC,QAAM,WAAW,QAAQ,YAAY,GAAG,QAAQ,UAAU;AAC1D,QAAM,OAAO,IAAI,KAAK,CAAC,GAAG,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC/D,QAAM,MAAM,IAAI,gBAAgB,IAAI;AACpC,QAAM,IAAI,SAAS,cAAc,GAAG;AACpC,IAAE,OAAO;AACT,IAAE,WAAW;AACb,IAAE,MAAM;AACR,MAAI,gBAAgB,GAAG;AACzB;AAOA,eAAsB,MACpB,OACA,MACA,SACe;AACf,MAAI,QAAQ,qBAAqB,MAAM;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,SAAS,OAAO,OAAO;AAEzC,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,aAAkB;AACrD,QAAM,UAAU,MAAM,KAAK,OAAO;AACpC;AASA,SAAS,YAAY,OAAwB;AAC3C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAM,IACJ,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC1D,MAAI,WAAW,KAAK,CAAC,GAAG;AACtB,WAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAOA,SAAS,aAAa,SAAuC;AAC3D,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,SAAS;AACvB,QAAI,KAAK,OAAO,MAAM,UAAU;AAC9B,iBAAW,OAAO,OAAO,KAAK,CAAC,GAAG;AAChC,YAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,eAAK,IAAI,GAAG;AACZ,kBAAQ,KAAK,GAAG;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAuCA,eAAsB,WACpB,OACA,KACA,SAC0B;AAC1B,QAAM,gBAAgB,aAAa,KAAK;AACxC,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,QAAQ,QAAQ,eAAe,CAAC;AAEtC,QAAM,OAAO,SAAS,GAAG;AACzB,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO,UAAU,OAAO,QAAQ,YAAY,QAAQ,KAAK;AAAA,EAC3D;AACA,QAAM,SAAS,KAAK,CAAC,KAAK,CAAC;AAC3B,QAAM,UAAqC,CAAC;AAC5C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,GAAI;AACvC,UAAM,SAAkC,CAAC;AACzC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,MAAM,OAAO,CAAC,KAAK;AACzB,YAAM,OAAO,IAAI,CAAC,KAAK;AACvB,aAAO,GAAG,IAAI,WAAW,MAAM,MAAM,GAAG,CAAC;AAAA,IAC3C;AACA,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,QAAM,OAAO,MAAM,UAAU,OAAO,EAAE,CAAC,QAAQ,UAAU,GAAG,QAAQ,GAAG;AAAA,IACrE,aAAa,CAAC,QAAQ,UAAU;AAAA,IAChC;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,QAAuB;AAK3B,YAAM,MAAM,MAAM,YAAY,CAAC,OAAO;AACpC,cAAM,UAAU,GAAG,MAAM,MAAM,IAAI;AACnC,mBAAW,SAAS,KAAK,OAAO;AAC9B,kBAAQ,WAAW,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM;AAAA,QACjE;AACA,YAAI,WAAW,eAAe;AAC5B,qBAAW,SAAS,KAAK,UAAU;AACjC,oBAAQ,WAAW,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM;AAAA,UACjE;AAAA,QACF;AACA,YAAI,WAAW,WAAW;AACxB,qBAAW,SAAS,KAAK,SAAS;AAChC,oBAAQ,WAAW,MAAM,UAAU,EAAE,OAAO,MAAM,EAAE;AAAA,UACtD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,UACb,OACA,YACA,QACA,OAC0B;AAC1B,QAAM,OAAO,MAAM,UAAU,OAAO,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC;AAC9F,SAAO,EAAE,MAAM,QAAQ,MAAM,QAAQ;AAAA,EAAsB,EAAE;AAC/D;AAEA,SAAS,WAAW,MAAc,MAAiD;AACjF,MAAI,SAAS,UAAU;AACrB,QAAI,SAAS,GAAI,QAAO;AACxB,UAAM,IAAI,OAAO,IAAI;AACrB,WAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,EAClC;AACA,MAAI,SAAS,WAAW;AACtB,QAAI,SAAS,OAAQ,QAAO;AAC5B,QAAI,SAAS,QAAS,QAAO;AAC7B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,SAAS,OAA2B;AAC3C,QAAM,OAAmB,CAAC;AAC1B,MAAI,MAAgB,CAAC;AACrB,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,IAAI;AAER,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAM,KAAK,MAAM,CAAC;AAClB,QAAI,UAAU;AACZ,UAAI,OAAO,KAAK;AACd,YAAI,MAAM,IAAI,CAAC,MAAM,KAAK;AACxB,mBAAS;AACT,eAAK;AACL;AAAA,QACF;AACA,mBAAW;AACX;AACA;AAAA,MACF;AACA,eAAS;AACT;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,iBAAW;AACX;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,UAAI,KAAK,KAAK;AACd,cAAQ;AACR;AACA;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,MAAM,IAAI,CAAC,MAAM,MAAM;AACxC,UAAI,KAAK,KAAK;AACd,WAAK,KAAK,GAAG;AACb,YAAM,CAAC;AACP,cAAQ;AACR,WAAK;AACL;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,OAAO,MAAM;AAC9B,UAAI,KAAK,KAAK;AACd,WAAK,KAAK,GAAG;AACb,YAAM,CAAC;AACP,cAAQ;AACR;AACA;AAAA,IACF;AACA,aAAS;AACT;AAAA,EACF;AAGA,MAAI,UAAU,MAAM,IAAI,SAAS,GAAG;AAClC,QAAI,KAAK,KAAK;AACd,SAAK,KAAK,GAAG;AAAA,EACf;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@noy-db/as-csv",
+  "version": "0.1.0-pre.3",
+  "description": "CSV plaintext export for noy-db — decrypts records and formats as comma-separated values. Gated by the RFC #249 `canExportPlaintext` capability bit; writes an audit-ledger entry on every call. Part of the @noy-db/as-* portable-artefact family (plaintext tier).",
+  "license": "MIT",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/as-csv#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "directory": "packages/as-csv"
+  },
+  "bugs": {
+    "url": "https://github.com/vLannaAi/noy-db/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "peerDependencies": {
+    "@noy-db/hub": "0.1.0-pre.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@noy-db/hub": "0.1.0-pre.3"
+  },
+  "keywords": [
+    "noy-db",
+    "as-csv",
+    "csv",
+    "export",
+    "plaintext",
+    "spreadsheet",
+    "zero-knowledge"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}