@noy-db/as-noydb 0.2.0-pre.9 → 0.3.0-pre.2

package/README.md

@@ -26,7 +26,7 @@ See the [main repository](https://github.com/vLannaAi/noy-db#readme) for setup,
 
 - Source — [`packages/as-noydb`](https://github.com/vLannaAi/noy-db/tree/main/packages/as-noydb)
 - Issues — [github.com/vLannaAi/noy-db/issues](https://github.com/vLannaAi/noy-db/issues)
-- Spec — [`SPEC.md`](https://github.com/vLannaAi/noy-db/blob/main/SPEC.md)
+- Spec — [`SPEC.md`](https://github.com/vLannaAi/noy-db-docs/blob/main/SPEC.md)
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/as-noydb",
-  "version": "0.2.0-pre.9",
+  "version": "0.3.0-pre.2",
   "description": "Encrypted .noydb bundle export for noy-db — wraps writeNoydbBundle() with the RFC #249 canExportBundle authorization gate and ergonomic browser/node helpers. Sole member of the @noy-db/as-* encrypted tier — ciphertext in, ciphertext out.",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -17,17 +17,10 @@
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "require": {
-        "types": "./dist/index.d.cts",
-        "default": "./dist/index.cjs"
-      }
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
-  "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -36,14 +29,14 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "peerDependencies": {
-    "@noy-db/hub": "0.2.0-pre.9"
+    "@noy-db/hub": "0.3.0-pre.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "@noy-db/hub": "0.2.0-pre.9"
+    "@noy-db/hub": "0.3.0-pre.2"
   },
   "keywords": [
     "noy-db",

package/dist/index.cjs

@@ -1,70 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  download: () => download,
-  peek: () => peek,
-  toBytes: () => toBytes,
-  write: () => write
-});
-module.exports = __toCommonJS(index_exports);
-var import_hub = require("@noy-db/hub");
-async function toBytes(vault, options = {}) {
-  vault.assertCanExport("bundle");
-  return (0, import_hub.writeNoydbBundle)(vault, options);
-}
-async function download(vault, options = {}) {
-  const bytes = await toBytes(vault, options);
-  const filename = options.filename ?? `vault-${await vault.getBundleHandle()}.noydb`;
-  const blob = new Blob([bytes], { type: "application/octet-stream" });
-  const url = URL.createObjectURL(blob);
-  const a = document.createElement("a");
-  a.href = url;
-  a.download = filename;
-  a.click();
-  URL.revokeObjectURL(url);
-}
-async function write(vault, path, options = {}) {
-  const bytes = await toBytes(vault, options);
-  const { writeFile } = await import("fs/promises");
-  await writeFile(path, bytes);
-}
-function peek(bytes) {
-  return (0, import_hub.readNoydbBundleHeader)(bytes);
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  download,
-  peek,
-  toBytes,
-  write
-});
-//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/as-noydb** — encrypted `.noydb` bundle export.\n *\n * The sole member of the Fork · As **encrypted tier**. Wraps the core\n * `writeNoydbBundle()` primitive with:\n *\n *   1. The `canExportBundle` authorization gate — default\n *      on for owner/admin, off for operator/viewer/client. The\n *      asymmetric default reflects asymmetric risk: a bundle is inert\n *      without the KEK, so owner backups don't need the per-format\n *      friction of the plaintext tier.\n *   2. The usual audit-ledger entry (`type: 'as-export'`,\n *      `encrypted: true`) so regulators see every bundle egress even\n *      though contents stay encrypted.\n *   3. Ergonomic browser-download / Node-file-write / in-memory-bytes\n *      helpers that parallel the plaintext-tier siblings.\n *\n * **Zero-knowledge preserved.** Unlike `as-csv` / `as-json` / …, this\n * package never reveals a single byte of plaintext to its caller or\n * any downstream handler. The vault's DEKs re-encrypt the body before\n * it leaves the gate; the bundle header is the minimal-disclosure\n * shape defined in `docs/reference/architecture.md`.\n *\n * **No `acknowledgeRisks: true` on `write()`.** Writing a `.noydb` to\n * disk is a legitimate encrypted-tier destination — the bytes are\n * ciphertext. The applicable risk is \"don't also store the\n * passphrase on the same disk\", not \"don't write the bytes\". The risk\n * is therefore documented rather than gated.\n *\n * @packageDocumentation\n */\n\nimport type { Vault, WriteNoydbBundleOptions, NoydbBundleHeader } from '@noy-db/hub'\nimport { writeNoydbBundle as coreWrite, readNoydbBundleHeader } from '@noy-db/hub'\n\nexport type AsNoydbOptions = WriteNoydbBundleOptions\n\nexport interface AsNoydbDownloadOptions extends AsNoydbOptions {\n  /** Filename offered to the browser. Default uses the vault's bundle handle. */\n  readonly filename?: string\n}\n\n/**\n * Produce the encrypted bundle as a `Uint8Array`. Caller decides the\n * sink — upload to S3, attach to email, store in IndexedDB, …\n */\nexport async function toBytes(vault: Vault, options: AsNoydbOptions = {}): Promise<Uint8Array> {\n  vault.assertCanExport('bundle')\n  return coreWrite(vault, options)\n}\n\n/**\n * Browser download — wraps `toBytes()` in a Blob + triggers the\n * browser save-as prompt. Default filename uses the vault's stable\n * bundle handle (so repeated backups sort lexically and dedupe by\n * prefix in file listings).\n */\nexport async function download(vault: Vault, options: AsNoydbDownloadOptions = {}): Promise<void> {\n  const bytes = await toBytes(vault, options)\n  const filename = options.filename ?? `vault-${await vault.getBundleHandle()}.noydb`\n  const blob = new Blob([bytes as BlobPart], { type: 'application/octet-stream' })\n  const url = URL.createObjectURL(blob)\n  const a = document.createElement('a')\n  a.href = url\n  a.download = filename\n  a.click()\n  URL.revokeObjectURL(url)\n}\n\n/**\n * Node file-write. No `acknowledgeRisks` gate — the bytes are\n * ciphertext; persisting them to disk is a legitimate encrypted-tier\n * destination. Store the passphrase separately.\n */\nexport async function write(\n  vault: Vault,\n  path: string,\n  options: AsNoydbOptions = {},\n): Promise<void> {\n  const bytes = await toBytes(vault, options)\n  const { writeFile } = await import('node:fs/promises')\n  await writeFile(path, bytes)\n}\n\n/**\n * Peek at the header of a received bundle without unpacking the body.\n * Useful for due diligence on bundles obtained from external parties\n * — confirm the handle, the compression algorithm, and the declared\n * body size before committing to decrypt.\n */\nexport function peek(bytes: Uint8Array): NoydbBundleHeader {\n  return readNoydbBundleHeader(bytes)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiCA,iBAAqE;AAarE,eAAsB,QAAQ,OAAc,UAA0B,CAAC,GAAwB;AAC7F,QAAM,gBAAgB,QAAQ;AAC9B,aAAO,WAAAA,kBAAU,OAAO,OAAO;AACjC;AAQA,eAAsB,SAAS,OAAc,UAAkC,CAAC,GAAkB;AAChG,QAAM,QAAQ,MAAM,QAAQ,OAAO,OAAO;AAC1C,QAAM,WAAW,QAAQ,YAAY,SAAS,MAAM,MAAM,gBAAgB,CAAC;AAC3E,QAAM,OAAO,IAAI,KAAK,CAAC,KAAiB,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAC/E,QAAM,MAAM,IAAI,gBAAgB,IAAI;AACpC,QAAM,IAAI,SAAS,cAAc,GAAG;AACpC,IAAE,OAAO;AACT,IAAE,WAAW;AACb,IAAE,MAAM;AACR,MAAI,gBAAgB,GAAG;AACzB;AAOA,eAAsB,MACpB,OACA,MACA,UAA0B,CAAC,GACZ;AACf,QAAM,QAAQ,MAAM,QAAQ,OAAO,OAAO;AAC1C,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,aAAkB;AACrD,QAAM,UAAU,MAAM,KAAK;AAC7B;AAQO,SAAS,KAAK,OAAsC;AACzD,aAAO,kCAAsB,KAAK;AACpC;","names":["coreWrite"]}

package/dist/index.d.cts

@@ -1,66 +0,0 @@
-import { WriteNoydbBundleOptions, Vault, NoydbBundleHeader } from '@noy-db/hub';
-
-/**
- * **@noy-db/as-noydb** — encrypted `.noydb` bundle export.
- *
- * The sole member of the Fork · As **encrypted tier**. Wraps the core
- * `writeNoydbBundle()` primitive with:
- *
- *   1. The `canExportBundle` authorization gate — default
- *      on for owner/admin, off for operator/viewer/client. The
- *      asymmetric default reflects asymmetric risk: a bundle is inert
- *      without the KEK, so owner backups don't need the per-format
- *      friction of the plaintext tier.
- *   2. The usual audit-ledger entry (`type: 'as-export'`,
- *      `encrypted: true`) so regulators see every bundle egress even
- *      though contents stay encrypted.
- *   3. Ergonomic browser-download / Node-file-write / in-memory-bytes
- *      helpers that parallel the plaintext-tier siblings.
- *
- * **Zero-knowledge preserved.** Unlike `as-csv` / `as-json` / …, this
- * package never reveals a single byte of plaintext to its caller or
- * any downstream handler. The vault's DEKs re-encrypt the body before
- * it leaves the gate; the bundle header is the minimal-disclosure
- * shape defined in `docs/reference/architecture.md`.
- *
- * **No `acknowledgeRisks: true` on `write()`.** Writing a `.noydb` to
- * disk is a legitimate encrypted-tier destination — the bytes are
- * ciphertext. The applicable risk is "don't also store the
- * passphrase on the same disk", not "don't write the bytes". The risk
- * is therefore documented rather than gated.
- *
- * @packageDocumentation
- */
-
-type AsNoydbOptions = WriteNoydbBundleOptions;
-interface AsNoydbDownloadOptions extends AsNoydbOptions {
-    /** Filename offered to the browser. Default uses the vault's bundle handle. */
-    readonly filename?: string;
-}
-/**
- * Produce the encrypted bundle as a `Uint8Array`. Caller decides the
- * sink — upload to S3, attach to email, store in IndexedDB, …
- */
-declare function toBytes(vault: Vault, options?: AsNoydbOptions): Promise<Uint8Array>;
-/**
- * Browser download — wraps `toBytes()` in a Blob + triggers the
- * browser save-as prompt. Default filename uses the vault's stable
- * bundle handle (so repeated backups sort lexically and dedupe by
- * prefix in file listings).
- */
-declare function download(vault: Vault, options?: AsNoydbDownloadOptions): Promise<void>;
-/**
- * Node file-write. No `acknowledgeRisks` gate — the bytes are
- * ciphertext; persisting them to disk is a legitimate encrypted-tier
- * destination. Store the passphrase separately.
- */
-declare function write(vault: Vault, path: string, options?: AsNoydbOptions): Promise<void>;
-/**
- * Peek at the header of a received bundle without unpacking the body.
- * Useful for due diligence on bundles obtained from external parties
- * — confirm the handle, the compression algorithm, and the declared
- * body size before committing to decrypt.
- */
-declare function peek(bytes: Uint8Array): NoydbBundleHeader;
-
-export { type AsNoydbDownloadOptions, type AsNoydbOptions, download, peek, toBytes, write };