@noy-db/cli 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/index.cjs

@@ -1,941 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  describeBundle: () => describeBundle,
-  formatSnapshot: () => formatSnapshot,
-  inspect: () => inspect,
-  loadOptionsFromFile: () => loadOptionsFromFile,
-  runConfigScaffold: () => runConfigScaffold,
-  runConfigValidate: () => runConfigValidate,
-  runDescribe: () => runDescribe,
-  runInspect: () => runInspect,
-  runMonitor: () => runMonitor,
-  runVerify: () => runVerify,
-  scaffold: () => scaffold,
-  validateOptions: () => validateOptions,
-  verify: () => verify
-});
-module.exports = __toCommonJS(src_exports);
-
-// src/commands/inspect.ts
-var import_hub = require("@noy-db/hub");
-var import_promises = require("fs/promises");
-async function inspect(filePath) {
-  const bytes = await (0, import_promises.readFile)(filePath);
-  const header = (0, import_hub.readNoydbBundleHeader)(new Uint8Array(bytes));
-  return {
-    formatVersion: header.formatVersion,
-    handle: header.handle,
-    bodyBytes: header.bodyBytes,
-    bodySha256: header.bodySha256
-  };
-}
-async function runInspect(argv) {
-  const file = argv[0];
-  if (!file) {
-    process.stderr.write("usage: noydb inspect <file.noydb>\n");
-    return 2;
-  }
-  try {
-    const info = await inspect(file);
-    process.stdout.write(JSON.stringify(info, null, 2) + "\n");
-    return 0;
-  } catch (err) {
-    process.stderr.write(`inspect failed: ${err.message}
-`);
-    return 1;
-  }
-}
-
-// src/commands/verify.ts
-var import_hub2 = require("@noy-db/hub");
-var import_promises2 = require("fs/promises");
-async function verify(filePath) {
-  const bytes = new Uint8Array(await (0, import_promises2.readFile)(filePath));
-  const checks = { magic: false, header: false, bodyHash: false };
-  let handle = "";
-  let bodyBytes = 0;
-  try {
-    const header = (0, import_hub2.readNoydbBundleHeader)(bytes);
-    checks.magic = true;
-    checks.header = true;
-    handle = header.handle;
-    bodyBytes = header.bodyBytes;
-    await (0, import_hub2.readNoydbBundle)(bytes);
-    checks.bodyHash = true;
-    return { ok: true, file: filePath, handle, bodyBytes, checks };
-  } catch (err) {
-    return {
-      ok: false,
-      file: filePath,
-      handle,
-      bodyBytes,
-      checks,
-      error: err.message
-    };
-  }
-}
-async function runVerify(argv) {
-  const file = argv[0];
-  if (!file) {
-    process.stderr.write("usage: noydb verify <file.noydb>\n");
-    return 2;
-  }
-  const report = await verify(file);
-  process.stdout.write(JSON.stringify(report, null, 2) + "\n");
-  return report.ok ? 0 : 1;
-}
-
-// src/commands/config.ts
-var import_node_url = require("url");
-var import_node_path = require("path");
-function safeStringify(v) {
-  if (typeof v === "string") return v;
-  if (typeof v === "number" || typeof v === "boolean" || v === null || v === void 0) {
-    return String(v);
-  }
-  try {
-    return JSON.stringify(v);
-  } catch {
-    return "<unserializable>";
-  }
-}
-function validateOptions(opts) {
-  const issues = [];
-  if (!isRecord(opts)) {
-    issues.push({
-      severity: "error",
-      code: "not-object",
-      path: "<root>",
-      message: "NoydbOptions must be an object"
-    });
-    return { ok: false, issues };
-  }
-  if (!opts.store) {
-    issues.push({
-      severity: "error",
-      code: "missing-store",
-      path: "store",
-      message: "`store` is required"
-    });
-  } else if (!isStoreShape(opts.store)) {
-    issues.push({
-      severity: "error",
-      code: "bad-store-shape",
-      path: "store",
-      message: "`store` does not expose the 6-method NoydbStore contract"
-    });
-  }
-  if (opts.sync !== void 0) {
-    const targets = normalizeSync(opts.sync);
-    targets.forEach((t, i) => validateTarget(t, `sync[${i}]`, issues));
-  }
-  if (opts.syncPolicy !== void 0 && opts.sync === void 0) {
-    issues.push({
-      severity: "warn",
-      code: "policy-without-sync",
-      path: "syncPolicy",
-      message: "`syncPolicy` has no effect without a `sync` target"
-    });
-  }
-  if (typeof opts.user !== "string" || !opts.user) {
-    issues.push({
-      severity: "warn",
-      code: "missing-user",
-      path: "user",
-      message: '`user` identifier is recommended \u2014 audit entries default to "anonymous" without it'
-    });
-  }
-  if (opts.secret === void 0 && opts.passphrase === void 0 && opts.encrypt !== false) {
-    issues.push({
-      severity: "warn",
-      code: "no-secret",
-      path: "secret",
-      message: "`secret` / `passphrase` missing and `encrypt` not explicitly false \u2014 vault open will fail"
-    });
-  }
-  const hasError = issues.some((i) => i.severity === "error");
-  return { ok: !hasError, issues };
-}
-async function loadOptionsFromFile(filePath) {
-  const abs = (0, import_node_path.resolve)(filePath);
-  if (abs.endsWith(".ts") || abs.endsWith(".mts") || abs.endsWith(".cts")) {
-    throw new Error(
-      `TypeScript config files are not directly loadable \u2014 Node has no native .ts loader.
-  Options:
-    (a) compile first:  tsc ${filePath} && noydb config validate ${filePath.replace(/\.[mc]?ts$/, ".js")}
-    (b) run via tsx:    npx tsx $(which noydb) config validate ${filePath}
-    (c) rename to .mjs/.js if your config has no TS-only syntax`
-    );
-  }
-  const mod = await import((0, import_node_url.pathToFileURL)(abs).href);
-  const value = mod.default ?? mod;
-  if (typeof value === "function") {
-    return await value();
-  }
-  return value;
-}
-async function runConfigValidate(argv) {
-  const file = argv[0];
-  if (!file) {
-    process.stderr.write("usage: noydb config validate <file.ts|js>\n");
-    return 2;
-  }
-  let opts;
-  try {
-    opts = await loadOptionsFromFile(file);
-  } catch (err) {
-    process.stderr.write(`failed to load ${file}: ${err.message}
-`);
-    return 1;
-  }
-  const report = validateOptions(opts);
-  process.stdout.write(JSON.stringify(report, null, 2) + "\n");
-  return report.ok ? 0 : 1;
-}
-function scaffold(profile) {
-  switch (profile) {
-    case "A":
-      return {
-        profile,
-        notes: "Local-only single-user. No cloud.",
-        code: [
-          `import { createNoydb } from '@noy-db/hub'`,
-          `import { jsonFile } from '@noy-db/to-file'`,
-          ``,
-          `export default {`,
-          `  store:  jsonFile({ dir: process.env.NOYDB_DATA_DIR ?? './data' }),`,
-          `  user:   process.env.NOYDB_USER ?? 'owner',`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=owner
-NOYDB_SECRET=
-NOYDB_DATA_DIR=./data
-`
-      };
-    case "B":
-      return {
-        profile,
-        notes: "Offline-first + cloud mirror. Local authoritative, sync opportunistically.",
-        code: [
-          `import { createNoydb, INDEXED_STORE_POLICY } from '@noy-db/hub'`,
-          `import { browserIdbStore } from '@noy-db/to-browser-idb'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          ``,
-          `export default {`,
-          `  store: browserIdbStore({ prefix: process.env.NOYDB_APP ?? 'myapp' }),`,
-          `  sync: [{`,
-          `    store: awsDynamoStore({`,
-          `      table:  process.env.NOYDB_DYNAMO_TABLE!,`,
-          `      region: process.env.AWS_REGION ?? 'us-east-1',`,
-          `    }),`,
-          `    role:  'sync-peer',`,
-          `    label: 'dynamo-live',`,
-          `  }],`,
-          `  syncPolicy: INDEXED_STORE_POLICY,`,
-          `  user:   process.env.NOYDB_USER ?? 'owner',`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=owner
-NOYDB_SECRET=
-NOYDB_APP=myapp
-NOYDB_DYNAMO_TABLE=myapp-live
-AWS_REGION=us-east-1
-`
-      };
-    case "C":
-      return {
-        profile,
-        notes: "Records + blobs split (routeStore). Dynamo for records, S3 for blobs.",
-        code: [
-          `import { createNoydb, routeStore } from '@noy-db/hub'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          `import { awsS3Store } from '@noy-db/to-aws-s3'`,
-          ``,
-          `export default {`,
-          `  store: routeStore({`,
-          `    default: awsDynamoStore({`,
-          `      table:  process.env.NOYDB_DYNAMO_TABLE!,`,
-          `      region: process.env.AWS_REGION ?? 'us-east-1',`,
-          `    }),`,
-          `    blobs:   awsS3Store({`,
-          `      bucket: process.env.NOYDB_S3_BUCKET!,`,
-          `      region: process.env.AWS_REGION ?? 'us-east-1',`,
-          `    }),`,
-          `  }),`,
-          `  user:   process.env.NOYDB_USER ?? 'owner',`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=owner
-NOYDB_SECRET=
-NOYDB_DYNAMO_TABLE=myapp-records
-NOYDB_S3_BUCKET=myapp-blobs
-AWS_REGION=us-east-1
-`
-      };
-    case "G":
-      return {
-        profile,
-        notes: "Middleware-hardened production: retry + breaker + cache + metrics.",
-        code: [
-          `import { createNoydb, wrapStore, withRetry, withCircuitBreaker, withCache, withHealthCheck, withMetrics } from '@noy-db/hub'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          ``,
-          `export default {`,
-          `  store: wrapStore(`,
-          `    awsDynamoStore({ table: process.env.NOYDB_DYNAMO_TABLE! }),`,
-          `    withRetry({ maxRetries: 3 }),`,
-          `    withCircuitBreaker({ failureThreshold: 5, resetTimeoutMs: 30_000 }),`,
-          `    withCache({ ttlMs: 60_000 }),`,
-          `    withHealthCheck(),`,
-          `    withMetrics({ onOperation: op => console.log(op) }),`,
-          `  ),`,
-          `  user:   process.env.NOYDB_USER ?? 'owner',`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=owner
-NOYDB_SECRET=
-NOYDB_DYNAMO_TABLE=myapp-prod
-`
-      };
-    case "D":
-      return {
-        profile,
-        notes: "Hot + cold tiered. Records age out to archive after N days.",
-        code: [
-          `import { createNoydb, routeStore } from '@noy-db/hub'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          `import { awsS3Store } from '@noy-db/to-aws-s3'`,
-          ``,
-          `export default {`,
-          `  store: routeStore({`,
-          `    default: awsDynamoStore({ table: process.env.NOYDB_DYNAMO_TABLE! }),`,
-          `    age: {`,
-          `      cold:          awsS3Store({ bucket: process.env.NOYDB_S3_COLD! }),`,
-          `      coldAfterDays: Number(process.env.NOYDB_COLD_AFTER_DAYS ?? '90'),`,
-          `    },`,
-          `  }),`,
-          `  user:   process.env.NOYDB_USER ?? 'owner',`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=owner
-NOYDB_SECRET=
-NOYDB_DYNAMO_TABLE=myapp-hot
-NOYDB_S3_COLD=myapp-archive
-NOYDB_COLD_AFTER_DAYS=90
-`
-      };
-    case "E":
-      return {
-        profile,
-        notes: "Multi-peer team sync. Primary + peer + backup + archive.",
-        code: [
-          `import { createNoydb } from '@noy-db/hub'`,
-          `import { browserIdbStore } from '@noy-db/to-browser-idb'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          `import { awsS3Store } from '@noy-db/to-aws-s3'`,
-          ``,
-          `export default {`,
-          `  store: browserIdbStore({ prefix: process.env.NOYDB_APP ?? 'team' }),`,
-          `  sync: [`,
-          `    { store: awsDynamoStore({ table: process.env.NOYDB_DYNAMO_TABLE! }), role: 'sync-peer', label: 'team-hot' },`,
-          `    { store: awsS3Store({ bucket: process.env.NOYDB_S3_BACKUP! }),       role: 'backup',    label: 'team-backup' },`,
-          `    { store: awsS3Store({ bucket: process.env.NOYDB_S3_ARCHIVE! }),      role: 'archive',   label: 'team-archive' },`,
-          `  ],`,
-          `  user:   process.env.NOYDB_USER ?? 'member',`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=member
-NOYDB_SECRET=
-NOYDB_APP=team
-NOYDB_DYNAMO_TABLE=team-hot
-NOYDB_S3_BACKUP=team-backup
-NOYDB_S3_ARCHIVE=team-archive
-`
-      };
-    case "F":
-      return {
-        profile,
-        notes: "CRDT collaboration \u2014 Yjs-backed shared records over the encrypted envelope.",
-        code: [
-          `import { createNoydb } from '@noy-db/hub'`,
-          `import { browserIdbStore } from '@noy-db/to-browser-idb'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          `// import { yjsCollection } from '@noy-db/in-yjs'   // use inside your app`,
-          ``,
-          `export default {`,
-          `  store: browserIdbStore({ prefix: 'collab' }),`,
-          `  sync: [{ store: awsDynamoStore({ table: process.env.NOYDB_DYNAMO_TABLE! }), role: 'sync-peer' }],`,
-          `  user:   process.env.NOYDB_USER!,`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`,
-          ``,
-          `// After createNoydb(), replace normal collections with yjsCollection() for CRDT fields.`
-        ].join("\n"),
-        env: `NOYDB_USER=
-NOYDB_SECRET=
-NOYDB_DYNAMO_TABLE=collab-live
-`
-      };
-    case "H":
-      return {
-        profile,
-        notes: "USB-portable \u2014 everything on a single file store, no cloud.",
-        code: [
-          `import { createNoydb } from '@noy-db/hub'`,
-          `import { jsonFile } from '@noy-db/to-file'`,
-          ``,
-          `export default {`,
-          `  store:  jsonFile({ dir: process.env.NOYDB_DATA_DIR ?? '/Volumes/MY_USB/data' }),`,
-          `  user:   process.env.NOYDB_USER!,`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=
-NOYDB_SECRET=
-NOYDB_DATA_DIR=/Volumes/MY_USB/data
-`
-      };
-    case "I":
-      return {
-        profile,
-        notes: "Multi-tenant geographic sharding \u2014 per-vault primary per region.",
-        code: [
-          `import { createNoydb } from '@noy-db/hub'`,
-          `import { awsDynamoStore } from '@noy-db/to-aws-dynamo'`,
-          ``,
-          `// Pick the nearest region at init time based on tenant config.`,
-          `const region = process.env.NOYDB_REGION ?? 'ap-southeast-1'`,
-          `const table  = \`myapp-\${region}\``,
-          ``,
-          `export default {`,
-          `  store:  awsDynamoStore({ table, region }),`,
-          `  user:   process.env.NOYDB_USER!,`,
-          `  secret: process.env.NOYDB_SECRET,`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=
-NOYDB_SECRET=
-NOYDB_REGION=ap-southeast-1
-`
-      };
-    case "J":
-      return {
-        profile,
-        notes: "Authentication bridge (passphrase-less unlock via OIDC or WebAuthn).",
-        code: [
-          `import { createNoydb } from '@noy-db/hub'`,
-          `import { browserIdbStore } from '@noy-db/to-browser-idb'`,
-          `// import { unlockWebAuthn } from '@noy-db/on-webauthn'   // in the browser`,
-          `// import { keyConnector } from '@noy-db/on-oidc'         // in a server app`,
-          ``,
-          `export default {`,
-          `  store: browserIdbStore({ prefix: process.env.NOYDB_APP ?? 'app' }),`,
-          `  user:  process.env.NOYDB_USER!,`,
-          `  // secret supplied by the unlock method at openVault() time, not here.`,
-          `}`
-        ].join("\n"),
-        env: `NOYDB_USER=
-NOYDB_APP=app
-`
-      };
-  }
-}
-async function runConfigScaffold(argv) {
-  const profileArg = argv.find((a) => a.startsWith("--profile="));
-  const profile = profileArg?.split("=")[1] ?? "A";
-  if (!/^[A-J]$/.test(profile)) {
-    process.stderr.write(`unknown profile: ${profile}. Valid: A-J (see docs/guides/topology-matrix.md)
-`);
-    return 2;
-  }
-  const out = scaffold(profile);
-  process.stdout.write(`// \u2500\u2500 noydb config (profile ${out.profile}) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`);
-  process.stdout.write(`// ${out.notes}
-
-`);
-  process.stdout.write(out.code + "\n\n");
-  if (out.env) {
-    process.stdout.write(`// \u2500\u2500 .env template \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`);
-    process.stdout.write(out.env);
-  }
-  return 0;
-}
-function isRecord(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isStoreShape(v) {
-  if (!isRecord(v)) return false;
-  return ["get", "put", "delete", "list", "loadAll", "saveAll"].every((m) => typeof v[m] === "function");
-}
-function normalizeSync(v) {
-  if (Array.isArray(v)) return v;
-  return [v];
-}
-function validateTarget(t, path, issues) {
-  if (!isRecord(t)) {
-    issues.push({
-      severity: "error",
-      code: "bad-target",
-      path,
-      message: "sync target must be an object with { store, role }"
-    });
-    return;
-  }
-  if (t["role"] === void 0) {
-    if (!isStoreShape(t)) {
-      issues.push({
-        severity: "error",
-        code: "bad-store-shape",
-        path,
-        message: "sync target store does not expose the 6-method contract"
-      });
-    }
-    return;
-  }
-  const validRoles = ["sync-peer", "backup", "archive"];
-  if (!validRoles.includes(safeStringify(t["role"]))) {
-    issues.push({
-      severity: "error",
-      code: "bad-role",
-      path: `${path}.role`,
-      message: `role must be one of ${validRoles.join(", ")}; got ${safeStringify(t["role"])}`
-    });
-  }
-  if (!t["store"] || !isStoreShape(t["store"])) {
-    issues.push({
-      severity: "error",
-      code: "bad-store-shape",
-      path: `${path}.store`,
-      message: "sync target store does not expose the 6-method contract"
-    });
-  }
-  if (t["role"] === "archive" && isRecord(t["policy"]) && isRecord(t["policy"]["pull"])) {
-    issues.push({
-      severity: "error",
-      code: "archive-pull-configured",
-      path: `${path}.policy.pull`,
-      message: "archive targets are push-only \u2014 pull policy is invalid"
-    });
-  }
-}
-
-// src/commands/monitor.ts
-var import_to_meter = require("@noy-db/to-meter");
-async function runMonitor(argv) {
-  const file = argv[0];
-  if (!file) {
-    process.stderr.write("usage: noydb monitor <config.ts> [--interval=ms]\n");
-    return 2;
-  }
-  const intervalArg = argv.find((a) => a.startsWith("--interval="));
-  const intervalMs = intervalArg ? parseInt(intervalArg.split("=")[1] ?? "5000", 10) : 5e3;
-  let opts;
-  try {
-    const loaded = await loadOptionsFromFile(file);
-    if (typeof loaded !== "object" || loaded === null) {
-      process.stderr.write(`config file must export a NoydbOptions-shaped object
-`);
-      return 1;
-    }
-    opts = loaded;
-  } catch (err) {
-    process.stderr.write(`failed to load ${file}: ${err.message}
-`);
-    return 1;
-  }
-  const innerStore = opts["store"];
-  if (!innerStore || typeof innerStore !== "object") {
-    process.stderr.write("config has no `store` \u2014 nothing to monitor\n");
-    return 1;
-  }
-  const { store: metered, meter } = (0, import_to_meter.toMeter)(innerStore, {
-    degradedMs: 500,
-    onDegraded: (e) => process.stderr.write(`DEGRADED: ${e.reason}
-`),
-    onRestored: (e) => process.stderr.write(`RESTORED: ${e.reason}
-`)
-  });
-  const liveOpts = { ...opts, store: metered };
-  const hub = await import("@noy-db/hub");
-  await hub.createNoydb(liveOpts);
-  process.stdout.write(`monitoring ${file} \u2014 interval ${intervalMs}ms \u2014 Ctrl-C to stop
-
-`);
-  const stop = installSigintHandler(meter);
-  return new Promise((resolveP) => {
-    const timer = setInterval(() => {
-      if (stop.signalled) {
-        clearInterval(timer);
-        meter.close();
-        resolveP(0);
-        return;
-      }
-      const snap = meter.snapshot();
-      process.stdout.write(formatSnapshot(snap) + "\n");
-    }, intervalMs);
-  });
-}
-function installSigintHandler(meter) {
-  const state = { signalled: false };
-  const handler = () => {
-    state.signalled = true;
-    meter.close();
-  };
-  process.on("SIGINT", handler);
-  process.on("SIGTERM", handler);
-  return state;
-}
-function formatSnapshot(snap) {
-  const lines = [];
-  const ts = new Date(snap.collectedAt).toISOString().slice(11, 19);
-  lines.push(`[${ts}] status=${snap.status} calls=${snap.totalCalls} casConflicts=${snap.casConflicts} windowMs=${snap.windowMs}`);
-  for (const m of ["get", "put", "delete", "list", "loadAll", "saveAll"]) {
-    const s = snap.byMethod[m];
-    if (s.count === 0) continue;
-    lines.push(`  ${m.padEnd(7)} count=${s.count} errors=${s.errors} p50=${s.p50}ms p99=${s.p99}ms max=${s.max}ms avg=${s.avg}ms`);
-  }
-  return lines.join("\n");
-}
-
-// src/commands/describe.ts
-var import_promises3 = require("fs/promises");
-var import_node_path2 = require("path");
-var import_node_crypto = require("crypto");
-var import_yaml = require("yaml");
-var import_hub3 = require("@noy-db/hub");
-var VERSION = "0.1.0";
-function memoryStore() {
-  const data = /* @__PURE__ */ new Map();
-  const getColl = (v, c) => {
-    let vm = data.get(v);
-    if (!vm) {
-      vm = /* @__PURE__ */ new Map();
-      data.set(v, vm);
-    }
-    let cm = vm.get(c);
-    if (!cm) {
-      cm = /* @__PURE__ */ new Map();
-      vm.set(c, cm);
-    }
-    return cm;
-  };
-  return {
-    async get(v, c, id) {
-      return data.get(v)?.get(c)?.get(id) ?? null;
-    },
-    async put(v, c, id, env, ev) {
-      const coll = getColl(v, c);
-      const ex = coll.get(id);
-      if (ev !== void 0 && ex && ex._v !== ev) throw new import_hub3.ConflictError(ex._v);
-      coll.set(id, env);
-    },
-    async delete(v, c, id) {
-      data.get(v)?.get(c)?.delete(id);
-    },
-    async list(v, c) {
-      return [...data.get(v)?.get(c)?.keys() ?? []];
-    },
-    async loadAll(v) {
-      const vm = data.get(v);
-      const snap = {};
-      if (vm) for (const [cn, cm] of vm) {
-        if (cn.startsWith("_")) continue;
-        const r = {};
-        for (const [id, e] of cm) r[id] = e;
-        snap[cn] = r;
-      }
-      return snap;
-    },
-    async saveAll(v, snap) {
-      for (const [cn, recs] of Object.entries(snap)) {
-        const coll = getColl(v, cn);
-        for (const [id, env] of Object.entries(recs)) coll.set(id, env);
-      }
-    }
-  };
-}
-async function describeBundle(opts) {
-  const bytes = await (0, import_promises3.readFile)(opts.bundlePath);
-  const sourceSha256 = (0, import_node_crypto.createHash)("sha256").update(bytes).digest("hex");
-  const { dumpJson } = await (0, import_hub3.readNoydbBundle)(new Uint8Array(bytes));
-  const backup = JSON.parse(dumpJson);
-  const compartmentName = backup._compartment ?? "vault";
-  const db = await (0, import_hub3.createNoydb)({
-    store: memoryStore(),
-    user: opts.user,
-    secret: opts.passphrase
-  });
-  const vault = await db.openVault(compartmentName);
-  await vault.load(dumpJson);
-  const collectionNames = await vault.collections();
-  for (const name of collectionNames) {
-    if (!name.startsWith("_")) vault.collection(name);
-  }
-  const snapshot = await vault.dumpSchema({
-    withStats: opts.withStats,
-    sampleSize: opts.sampleSize
-  });
-  const enriched = opts.schemas === "full" ? await enrichWithFullSchemas(snapshot, vault, collectionNames) : snapshot;
-  const { _noydb_snapshot: _ignore, ...rest } = enriched;
-  void _ignore;
-  const withProvenance = {
-    _noydb_snapshot: 1,
-    _provenance: {
-      generatedBy: `noydb describe v${VERSION}`,
-      source: (0, import_node_path2.basename)(opts.bundlePath),
-      sourceSha256,
-      emittedAt: enriched.emittedAt
-    },
-    vault: rest.vault,
-    emittedAt: rest.emittedAt,
-    subsystems: rest.subsystems,
-    collections: rest.collections,
-    materializedViews: rest.materializedViews,
-    overlayViews: rest.overlayViews,
-    derivations: rest.derivations,
-    ...rest.internal !== void 0 ? { internal: rest.internal } : {},
-    ...rest.aclRoles !== void 0 ? { aclRoles: rest.aclRoles } : {}
-  };
-  if (opts.schemas === "sidecar" && opts.outPath) {
-    await writeSidecarSchemas(opts.outPath, vault, collectionNames);
-  }
-  const emitted = emit(withProvenance, opts.format);
-  if (opts.outPath) {
-    await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(opts.outPath), { recursive: true });
-    await (0, import_promises3.writeFile)(opts.outPath, emitted);
-  }
-  return emitted;
-}
-async function enrichWithFullSchemas(snapshot, vault, collectionNames) {
-  const state = vault._introspectState();
-  const collections = {};
-  for (const name of Object.keys(snapshot.collections)) {
-    const base = snapshot.collections[name];
-    if (!base) continue;
-    if (!collectionNames.includes(name)) {
-      collections[name] = base;
-      continue;
-    }
-    try {
-      const dek = await state.getDEK(name);
-      const persisted = await (0, import_hub3.loadPersistedSchema)(state.adapter, state.name, name, dek);
-      if (persisted?.jsonSchema) {
-        collections[name] = { ...base, jsonSchema: persisted.jsonSchema };
-      } else {
-        collections[name] = base;
-      }
-    } catch {
-      collections[name] = base;
-    }
-  }
-  return { ...snapshot, collections };
-}
-async function writeSidecarSchemas(outPath, vault, collectionNames) {
-  const state = vault._introspectState();
-  const sidecarDir = `${outPath}.schemas`;
-  await (0, import_promises3.mkdir)(sidecarDir, { recursive: true });
-  for (const name of collectionNames) {
-    if (name.startsWith("_")) continue;
-    try {
-      const dek = await state.getDEK(name);
-      const persisted = await (0, import_hub3.loadPersistedSchema)(state.adapter, state.name, name, dek);
-      if (persisted?.jsonSchema) {
-        await (0, import_promises3.writeFile)(
-          (0, import_node_path2.join)(sidecarDir, `${name}.schema.json`),
-          JSON.stringify(persisted.jsonSchema, null, 2)
-        );
-      }
-    } catch {
-    }
-  }
-}
-function emit(snapshot, format) {
-  if (format === "json") {
-    return JSON.stringify(snapshot, null, 2) + "\n";
-  }
-  return (0, import_yaml.stringify)(snapshot, {
-    aliasDuplicateObjects: false,
-    indent: 2,
-    lineWidth: 0
-    // never wrap; preserves long strings
-  });
-}
-function parseArgs(argv) {
-  const out = {
-    bundlePath: "",
-    format: "yaml",
-    withStats: false,
-    schemas: "none",
-    sampleSize: 50
-  };
-  let i = 0;
-  while (i < argv.length) {
-    const arg = argv[i];
-    if (arg === "--format") {
-      const v = argv[++i];
-      if (v !== "yaml" && v !== "json") return { error: `--format must be yaml or json (got: ${v ?? "<none>"})` };
-      out.format = v;
-    } else if (arg === "--with-stats") {
-      out.withStats = true;
-    } else if (arg === "--schemas") {
-      const v = argv[++i];
-      if (v !== "none" && v !== "full" && v !== "sidecar") {
-        return { error: `--schemas must be none|full|sidecar (got: ${v ?? "<none>"})` };
-      }
-      out.schemas = v;
-    } else if (arg === "-o" || arg === "--out") {
-      const v = argv[++i];
-      if (v === void 0) return { error: "-o requires a value" };
-      out.outPath = v;
-    } else if (arg === "--passphrase") {
-      const v = argv[++i];
-      if (v === void 0) return { error: "--passphrase requires a value" };
-      out.passphrase = v;
-    } else if (arg === "--user") {
-      const v = argv[++i];
-      if (v === void 0) return { error: "--user requires a value" };
-      out.user = v;
-    } else if (arg === "--sample") {
-      const n = parseInt(argv[++i] ?? "", 10);
-      if (Number.isNaN(n) || n < 0) return { error: `--sample must be a non-negative integer` };
-      out.sampleSize = n;
-    } else if (arg === "-h" || arg === "--help") {
-      return { error: "help" };
-    } else if (arg?.startsWith("-")) {
-      return { error: `unknown option: ${arg}` };
-    } else if (!out.bundlePath) {
-      out.bundlePath = arg ?? "";
-    } else {
-      return { error: `unexpected positional arg: ${arg}` };
-    }
-    i++;
-  }
-  if (!out.bundlePath) return { error: "missing bundle path" };
-  return out;
-}
-function usage() {
-  return [
-    "usage: noydb describe <bundle-path> [options]",
-    "",
-    "  --format <yaml|json>     output format (default: yaml)",
-    "  --with-stats             include records / bytes / oldest / newest per collection",
-    "  --schemas <mode>         JSON Schema body inclusion (default: none)",
-    "                           - none:    summary only",
-    "                           - full:    inline complete JSON Schema per collection",
-    "                           - sidecar: write `<out>.schemas/<col>.schema.json` siblings",
-    "  -o, --out <file>         write to file instead of stdout",
-    "  --user <userId>          keyring user identifier (required)",
-    "  --passphrase <p>         decryption passphrase (or via NOYDB_PASSPHRASE env)",
-    "  --sample <n>             max records sampled when no persisted/live schema (default: 50)",
-    "",
-    "Exit codes: 0 ok, 1 internal error, 2 usage error, 3 auth failure"
-  ].join("\n");
-}
-async function runDescribe(argv) {
-  const parsed = parseArgs(argv);
-  if ("error" in parsed) {
-    if (parsed.error === "help") {
-      process.stdout.write(usage() + "\n");
-      return 0;
-    }
-    process.stderr.write(`describe: ${parsed.error}
-
-${usage()}
-`);
-    return 2;
-  }
-  const passphrase = parsed.passphrase ?? process.env.NOYDB_PASSPHRASE;
-  if (!passphrase) {
-    process.stderr.write("describe: passphrase required \u2014 pass --passphrase or set NOYDB_PASSPHRASE env\n");
-    return 3;
-  }
-  if (parsed.passphrase) {
-    process.stderr.write(
-      "[noy-db] warning: --passphrase appears in shell history; consider NOYDB_PASSPHRASE env instead\n"
-    );
-  }
-  if (!parsed.user) {
-    process.stderr.write("describe: --user <userId> is required to unlock the bundle\n");
-    return 2;
-  }
-  try {
-    const out = await describeBundle({
-      bundlePath: parsed.bundlePath,
-      user: parsed.user,
-      passphrase,
-      format: parsed.format,
-      withStats: parsed.withStats,
-      schemas: parsed.schemas,
-      ...parsed.outPath !== void 0 ? { outPath: parsed.outPath } : {},
-      sampleSize: parsed.sampleSize
-    });
-    if (!parsed.outPath) process.stdout.write(out);
-    return 0;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/decrypt|tamper|wrong key|invalid/i.test(msg)) {
-      process.stderr.write(`describe: decryption failed \u2014 check --user and --passphrase
-  ${msg}
-`);
-      return 3;
-    }
-    process.stderr.write(`describe: ${msg}
-`);
-    return 1;
-  }
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  describeBundle,
-  formatSnapshot,
-  inspect,
-  loadOptionsFromFile,
-  runConfigScaffold,
-  runConfigValidate,
-  runDescribe,
-  runInspect,
-  runMonitor,
-  runVerify,
-  scaffold,
-  validateOptions,
-  verify
-});
-//# sourceMappingURL=index.cjs.map