@noy-db/hub 0.1.0-pre.14 → 0.1.0-pre.16

package/dist/blobs/index.d.cts

@@ -1,11 +1,12 @@
-import { B as BlobStrategy } from '../types-2JGVRzO2.cjs';
-export { p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, s as BLOB_EVICTION_AUDIT_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, x as BlobEvictionEntry, y as BlobFieldPolicy, z as BlobFieldsConfig, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, G as BlobStrategyOpenArgs, H as CompactRunOptions, J as CompactionContext, K as CompactionResult, L as DEFAULT_CHUNK_SIZE, M as EXPORT_AUDIT_COLLECTION, N as ExportBlobsAbortedError, O as ExportBlobsAuditEntry, Q as ExportBlobsHandle, R as ExportBlobsOptions, T as ExportedBlob, U as SlotInfo, V as SlotRecord, W as VersionRecord, X as createExportBlobsHandle, Y as runCompaction } from '../types-2JGVRzO2.cjs';
+import { B as BlobStrategy } from '../types-DDy02bWN.cjs';
+export { p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, s as BLOB_EVICTION_AUDIT_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, x as BlobEvictionEntry, y as BlobFieldPolicy, z as BlobFieldsConfig, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, G as BlobStrategyOpenArgs, H as CompactRunOptions, J as CompactionContext, K as CompactionResult, L as DEFAULT_CHUNK_SIZE, M as EXPORT_AUDIT_COLLECTION, N as ExportBlobsAbortedError, O as ExportBlobsAuditEntry, Q as ExportBlobsHandle, R as ExportBlobsOptions, T as ExportedBlob, U as SlotInfo, V as SlotRecord, W as VersionRecord, X as createExportBlobsHandle, Y as runCompaction } from '../types-DDy02bWN.cjs';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from '../mime-magic-CBBSOkjm.cjs';
 import '../lazy-builder-C-rPfWG0.cjs';
 import '../predicate-Dnu81tsS.cjs';
-import '../strategy-D-SrOLCl.cjs';
+import '../strategy-DSTrsZ8t.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-CFJKJXWa.cjs';
+import '../index-CmVgTkqk.cjs';
+import '@noy-db/on-shamir';
 
 /**
  * Active blob strategy factory. Calling `blobs()` returns a

package/dist/blobs/index.d.ts

@@ -1,11 +1,12 @@
-import { B as BlobStrategy } from '../types-DIOLYPUq.js';
-export { p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, s as BLOB_EVICTION_AUDIT_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, x as BlobEvictionEntry, y as BlobFieldPolicy, z as BlobFieldsConfig, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, G as BlobStrategyOpenArgs, H as CompactRunOptions, J as CompactionContext, K as CompactionResult, L as DEFAULT_CHUNK_SIZE, M as EXPORT_AUDIT_COLLECTION, N as ExportBlobsAbortedError, O as ExportBlobsAuditEntry, Q as ExportBlobsHandle, R as ExportBlobsOptions, T as ExportedBlob, U as SlotInfo, V as SlotRecord, W as VersionRecord, X as createExportBlobsHandle, Y as runCompaction } from '../types-DIOLYPUq.js';
+import { B as BlobStrategy } from '../types-DImsOlJe.js';
+export { p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, s as BLOB_EVICTION_AUDIT_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, x as BlobEvictionEntry, y as BlobFieldPolicy, z as BlobFieldsConfig, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, G as BlobStrategyOpenArgs, H as CompactRunOptions, J as CompactionContext, K as CompactionResult, L as DEFAULT_CHUNK_SIZE, M as EXPORT_AUDIT_COLLECTION, N as ExportBlobsAbortedError, O as ExportBlobsAuditEntry, Q as ExportBlobsHandle, R as ExportBlobsOptions, T as ExportedBlob, U as SlotInfo, V as SlotRecord, W as VersionRecord, X as createExportBlobsHandle, Y as runCompaction } from '../types-DImsOlJe.js';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from '../mime-magic-CBBSOkjm.js';
 import '../lazy-builder-Rpd-V3jP.js';
 import '../predicate-Dnu81tsS.js';
-import '../strategy-D-SrOLCl.js';
+import '../strategy-DSTrsZ8t.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-7nd15fgy.js';
+import '../index-CNwA-B6-.js';
+import '@noy-db/on-shamir';
 
 /**
  * Active blob strategy factory. Calling `blobs()` returns a

package/dist/blobs/index.js

@@ -14,10 +14,10 @@ import {
   detectMimeType,
   isPreCompressed,
   runCompaction
-} from "../chunk-562AT3V6.js";
-import "../chunk-PMMNH7VZ.js";
-import "../chunk-7AQKLLI5.js";
-import "../chunk-W7M3E5M5.js";
+} from "../chunk-5NGHX6ME.js";
+import "../chunk-H7XROQJM.js";
+import "../chunk-WCA2NROQ.js";
+import "../chunk-ADQ5MQ54.js";
 
 // src/blobs/active.ts
 function withBlobs() {

package/dist/bundle/index.cjs

@@ -23,6 +23,7 @@ __export(bundle_exports, {
   BackupCorruptedError: () => BackupCorruptedError,
   BackupLedgerError: () => BackupLedgerError,
   BundleIntegrityError: () => BundleIntegrityError,
+  BundleSealMismatchError: () => BundleSealMismatchError,
   BundleVersionConflictError: () => BundleVersionConflictError,
   COMPRESSION_BROTLI: () => COMPRESSION_BROTLI,
   COMPRESSION_GZIP: () => COMPRESSION_GZIP,
@@ -57,7 +58,8 @@ var ALLOWED_HEADER_KEYS = /* @__PURE__ */ new Set([
   "handle",
   "bodyBytes",
   "bodySha256",
-  "publicEnvelope"
+  "publicEnvelope",
+  "autoUnlock"
 ]);
 function validateBundleHeader(parsed) {
   if (parsed === null || typeof parsed !== "object") {
@@ -112,6 +114,14 @@ function validateBundleHeader(parsed) {
       );
     }
   }
+  if (h["autoUnlock"] !== void 0) {
+    if (h["autoUnlock"] !== "unsealed" && h["autoUnlock"] !== "sealed") {
+      const got = typeof h["autoUnlock"] === "string" ? `"${h["autoUnlock"]}"` : typeof h["autoUnlock"];
+      throw new Error(
+        `.noydb bundle header.autoUnlock must be 'unsealed' or 'sealed' when present, got ${got}.`
+      );
+    }
+  }
 }
 function encodeBundleHeader(header) {
   validateBundleHeader(header);
@@ -120,7 +130,8 @@ function encodeBundleHeader(header) {
     handle: header.handle,
     bodyBytes: header.bodyBytes,
     bodySha256: header.bodySha256,
-    ...header.publicEnvelope !== void 0 ? { publicEnvelope: header.publicEnvelope } : {}
+    ...header.publicEnvelope !== void 0 ? { publicEnvelope: header.publicEnvelope } : {},
+    ...header.autoUnlock !== void 0 ? { autoUnlock: header.autoUnlock } : {}
   });
   return new TextEncoder().encode(json);
 }
@@ -173,12 +184,38 @@ var BundleVersionConflictError = class extends NoydbError {
     this.remoteVersion = remoteVersion;
   }
 };
+var ValidationError = class extends NoydbError {
+  constructor(message = "Validation error") {
+    super("VALIDATION_ERROR", message);
+    this.name = "ValidationError";
+  }
+};
 var BundleIntegrityError = class extends NoydbError {
   constructor(message) {
     super("BUNDLE_INTEGRITY", `.noydb bundle integrity check failed: ${message}`);
     this.name = "BundleIntegrityError";
   }
 };
+var BundleSealMismatchError = class extends NoydbError {
+  userId;
+  pid;
+  constructor(userId, pid) {
+    super(
+      "BUNDLE_SEAL_MISMATCH",
+      `bundle carries sealed passphrase for user "${userId}" under provider "${pid}", but no registered provider matches that pid.
+
+Resolutions:
+  1. Configure a provider matching the pid and retry import.
+  2. Pass \`attemptUnsealAcrossProviders: true\` to try each registered
+     provider regardless of pid (extra credential prompts may surface).
+  3. Inspect the bundle without unsealing \u2014 pass no \`sealingProviders\`
+     to receive the sealed entries unmodified for offline analysis.`
+    );
+    this.name = "BundleSealMismatchError";
+    this.userId = userId;
+    this.pid = pid;
+  }
+};
 var BackupLedgerError = class extends NoydbError {
   /** First-broken-entry index, if known. */
   divergedAt;
@@ -201,6 +238,167 @@ var BackupCorruptedError = class extends NoydbError {
 };
 
 // src/bundle/bundle.ts
+function validateAutoUnlockOptions(opts) {
+  if (opts.autoPassphrases !== void 0 && opts.sealedPassphrases !== void 0) {
+    throw new ValidationError(
+      "writeNoydbBundle: `autoPassphrases` and `sealedPassphrases` are mutually exclusive. Choose one or the other."
+    );
+  }
+  if (opts.autoPassphrases !== void 0) {
+    if (opts.autoPassphrases.policy !== "public-by-design") {
+      throw new ValidationError(
+        'writeNoydbBundle: `autoPassphrases` requires `policy: "public-by-design"`. This is an explicit opt-in marker \u2014 bundling plaintext credentials is safe only when those credentials are intended to be public (demo data, sample vaults). For production credentials, use `sealedPassphrases` instead.'
+      );
+    }
+    const userCount = Object.keys(opts.autoPassphrases.perUser).length;
+    if (userCount === 0) {
+      throw new ValidationError(
+        "writeNoydbBundle: `autoPassphrases.perUser` must have at least one entry."
+      );
+    }
+    return "unsealed";
+  }
+  if (opts.sealedPassphrases !== void 0) {
+    if (opts.sealedPassphrases.mode !== "self-target") {
+      throw new ValidationError(
+        `writeNoydbBundle: \`sealedPassphrases.mode\` must be 'self-target' in slice 1 (got '${opts.sealedPassphrases.mode}'). Recipient-target sealing via the RecipientSealer interface is deferred per foundation \xA711.4.`
+      );
+    }
+    if (opts.sealedPassphrases.provider === void 0) {
+      throw new ValidationError(
+        "writeNoydbBundle: `sealedPassphrases.provider` is required (a `SealingKeyProvider`)."
+      );
+    }
+    const userCount = Object.keys(opts.sealedPassphrases.perUser).length;
+    if (userCount === 0) {
+      throw new ValidationError(
+        "writeNoydbBundle: `sealedPassphrases.perUser` must have at least one entry."
+      );
+    }
+    return "sealed";
+  }
+  return null;
+}
+async function buildAutoUnlockWrapper(dumpJson, opts) {
+  if (opts.autoPassphrases !== void 0) {
+    return {
+      _noydb_bundle_body: 1,
+      dump: dumpJson,
+      _autoUnlock: {
+        kind: "unsealed",
+        perUser: { ...opts.autoPassphrases.perUser }
+      }
+    };
+  }
+  if (opts.sealedPassphrases === void 0) {
+    throw new Error("unreachable \u2014 validation should have caught this");
+  }
+  const { provider, perUser } = opts.sealedPassphrases;
+  const sealedPerUser = {};
+  const encoder = new TextEncoder();
+  for (const [userId, passphrase] of Object.entries(perUser)) {
+    const sealed = await provider.seal(encoder.encode(passphrase));
+    sealedPerUser[userId] = {
+      pid: provider.id,
+      sealed: bytesToBase64(sealed),
+      alg: "aes-256-gcm"
+    };
+  }
+  return {
+    _noydb_bundle_body: 1,
+    dump: dumpJson,
+    _autoUnlock: { kind: "sealed", perUser: sealedPerUser }
+  };
+}
+function parseAutoUnlockBody(bodyString) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyString);
+  } catch (err) {
+    throw new BundleIntegrityError(
+      "header declared autoUnlock but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new BundleIntegrityError("autoUnlock body is not a JSON object");
+  }
+  const obj = parsed;
+  if (obj["_noydb_bundle_body"] !== 1) {
+    throw new BundleIntegrityError(
+      "autoUnlock body missing `_noydb_bundle_body: 1` discriminator"
+    );
+  }
+  if (typeof obj["dump"] !== "string") {
+    throw new BundleIntegrityError("autoUnlock body must carry a string `dump` field");
+  }
+  const blob = obj["_autoUnlock"];
+  if (typeof blob !== "object" || blob === null) {
+    throw new BundleIntegrityError("autoUnlock body missing `_autoUnlock` blob");
+  }
+  const blobObj = blob;
+  const kind = blobObj["kind"];
+  if (kind !== "unsealed" && kind !== "sealed") {
+    throw new BundleIntegrityError(
+      `autoUnlock blob has invalid kind ${String(kind)}; expected 'unsealed' or 'sealed'`
+    );
+  }
+  return {
+    dump: obj["dump"],
+    blob
+  };
+}
+async function resolveAutoUnlock(blob, opts) {
+  if (blob.kind === "unsealed") {
+    return { kind: "unsealed", perUser: { ...blob.perUser } };
+  }
+  if (opts.sealingProviders === void 0 || opts.sealingProviders.length === 0) {
+    const passthrough = {};
+    for (const [userId, entry] of Object.entries(blob.perUser)) {
+      passthrough[userId] = entry.sealed;
+    }
+    return { kind: "sealed", perUser: passthrough };
+  }
+  const providersByPid = /* @__PURE__ */ new Map();
+  for (const p of opts.sealingProviders) providersByPid.set(p.id, p);
+  const decoder = new TextDecoder();
+  const unsealedMap = {};
+  for (const [userId, entry] of Object.entries(blob.perUser)) {
+    const provider = providersByPid.get(entry.pid);
+    if (provider === void 0) {
+      if (opts.attemptUnsealAcrossProviders === true) {
+        let opened = null;
+        for (const candidate of opts.sealingProviders) {
+          try {
+            const plaintextBytes2 = await candidate.unseal(base64ToBytes(entry.sealed));
+            opened = decoder.decode(plaintextBytes2);
+            break;
+          } catch {
+          }
+        }
+        if (opened === null) {
+          throw new BundleSealMismatchError(userId, entry.pid);
+        }
+        unsealedMap[userId] = opened;
+        continue;
+      }
+      throw new BundleSealMismatchError(userId, entry.pid);
+    }
+    const plaintextBytes = await provider.unseal(base64ToBytes(entry.sealed));
+    unsealedMap[userId] = decoder.decode(plaintextBytes);
+  }
+  return { kind: "sealed", perUser: unsealedMap };
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+function base64ToBytes(b64) {
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
 var cachedBrotliSupport = null;
 function supportsBrotliCompression() {
   if (cachedBrotliSupport !== null) return cachedBrotliSupport;
@@ -356,12 +554,14 @@ async function writeNoydbBundle(vault, opts = {}) {
       "writeNoydbBundle: pass either exportPassphrase or recipients, not both"
     );
   }
+  const autoUnlockMode = validateAutoUnlockOptions(opts);
   const handle = await vault.getBundleHandle();
   const dumpJson = await vault.dump();
   const rekeyed = await applyRecipientRewrap(vault, dumpJson, opts);
   const plainFiltered = await applyPlaintextFilters(vault, rekeyed, opts);
   const filtered = applySliceFilters(plainFiltered, opts);
-  const dumpBytes = new TextEncoder().encode(filtered);
+  const bodyJsonStr = autoUnlockMode === null ? filtered : JSON.stringify(await buildAutoUnlockWrapper(filtered, opts));
+  const dumpBytes = new TextEncoder().encode(bodyJsonStr);
   const { format, streamFormat } = selectCompression(opts.compression);
   const body = streamFormat === null ? dumpBytes : await pumpThroughStream(dumpBytes, new CompressionStream(streamFormat));
   const bodySha256 = await sha256Hex(body);
@@ -371,7 +571,8 @@ async function writeNoydbBundle(vault, opts = {}) {
     handle,
     bodyBytes: body.length,
     bodySha256,
-    ...publicEnvelope !== void 0 ? { publicEnvelope } : {}
+    ...publicEnvelope !== void 0 ? { publicEnvelope } : {},
+    ...autoUnlockMode !== null ? { autoUnlock: autoUnlockMode } : {}
   };
   const headerBytes = encodeBundleHeader(header);
   const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES);
@@ -413,7 +614,7 @@ function parsePrefixAndHeader(bytes) {
 function readNoydbBundleHeader(bytes) {
   return parsePrefixAndHeader(bytes).header;
 }
-async function readNoydbBundle(bytes) {
+async function readNoydbBundle(bytes, opts = {}) {
   const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes);
   const body = bytes.slice(bodyOffset);
   if (body.length !== header.bodyBytes) {
@@ -440,8 +641,13 @@ async function readNoydbBundle(bytes) {
       );
     }
   }
-  const dumpJson = new TextDecoder("utf-8", { fatal: true }).decode(dumpBytes);
-  return { header, dumpJson };
+  const bodyString = new TextDecoder("utf-8", { fatal: true }).decode(dumpBytes);
+  if (header.autoUnlock === void 0) {
+    return { header, dumpJson: bodyString };
+  }
+  const { dump, blob } = parseAutoUnlockBody(bodyString);
+  const autoUnlock = await resolveAutoUnlock(blob, opts);
+  return { header, dumpJson: dump, autoUnlock };
 }
 
 // src/bundle/ulid.ts
@@ -475,6 +681,7 @@ function isULID(value) {
   BackupCorruptedError,
   BackupLedgerError,
   BundleIntegrityError,
+  BundleSealMismatchError,
   BundleVersionConflictError,
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,