@noy-db/hub 0.1.0-pre.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (195) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +197 -0
  3. package/dist/aggregate/index.cjs +476 -0
  4. package/dist/aggregate/index.cjs.map +1 -0
  5. package/dist/aggregate/index.d.cts +38 -0
  6. package/dist/aggregate/index.d.ts +38 -0
  7. package/dist/aggregate/index.js +53 -0
  8. package/dist/aggregate/index.js.map +1 -0
  9. package/dist/blobs/index.cjs +1480 -0
  10. package/dist/blobs/index.cjs.map +1 -0
  11. package/dist/blobs/index.d.cts +45 -0
  12. package/dist/blobs/index.d.ts +45 -0
  13. package/dist/blobs/index.js +48 -0
  14. package/dist/blobs/index.js.map +1 -0
  15. package/dist/bundle/index.cjs +436 -0
  16. package/dist/bundle/index.cjs.map +1 -0
  17. package/dist/bundle/index.d.cts +7 -0
  18. package/dist/bundle/index.d.ts +7 -0
  19. package/dist/bundle/index.js +40 -0
  20. package/dist/bundle/index.js.map +1 -0
  21. package/dist/chunk-2QR2PQTT.js +217 -0
  22. package/dist/chunk-2QR2PQTT.js.map +1 -0
  23. package/dist/chunk-4OWFYIDQ.js +79 -0
  24. package/dist/chunk-4OWFYIDQ.js.map +1 -0
  25. package/dist/chunk-5AATM2M2.js +90 -0
  26. package/dist/chunk-5AATM2M2.js.map +1 -0
  27. package/dist/chunk-ACLDOTNQ.js +543 -0
  28. package/dist/chunk-ACLDOTNQ.js.map +1 -0
  29. package/dist/chunk-BTDCBVJW.js +160 -0
  30. package/dist/chunk-BTDCBVJW.js.map +1 -0
  31. package/dist/chunk-CIMZBAZB.js +72 -0
  32. package/dist/chunk-CIMZBAZB.js.map +1 -0
  33. package/dist/chunk-E445ICYI.js +365 -0
  34. package/dist/chunk-E445ICYI.js.map +1 -0
  35. package/dist/chunk-EXQRC2L4.js +722 -0
  36. package/dist/chunk-EXQRC2L4.js.map +1 -0
  37. package/dist/chunk-FZU343FL.js +32 -0
  38. package/dist/chunk-FZU343FL.js.map +1 -0
  39. package/dist/chunk-GJILMRPO.js +354 -0
  40. package/dist/chunk-GJILMRPO.js.map +1 -0
  41. package/dist/chunk-GOUT6DND.js +1285 -0
  42. package/dist/chunk-GOUT6DND.js.map +1 -0
  43. package/dist/chunk-J66GRPNH.js +111 -0
  44. package/dist/chunk-J66GRPNH.js.map +1 -0
  45. package/dist/chunk-M2F2JAWB.js +464 -0
  46. package/dist/chunk-M2F2JAWB.js.map +1 -0
  47. package/dist/chunk-M5INGEFC.js +84 -0
  48. package/dist/chunk-M5INGEFC.js.map +1 -0
  49. package/dist/chunk-M62XNWRA.js +72 -0
  50. package/dist/chunk-M62XNWRA.js.map +1 -0
  51. package/dist/chunk-MR4424N3.js +275 -0
  52. package/dist/chunk-MR4424N3.js.map +1 -0
  53. package/dist/chunk-NPC4LFV5.js +132 -0
  54. package/dist/chunk-NPC4LFV5.js.map +1 -0
  55. package/dist/chunk-NXFEYLVG.js +311 -0
  56. package/dist/chunk-NXFEYLVG.js.map +1 -0
  57. package/dist/chunk-R36SIKES.js +79 -0
  58. package/dist/chunk-R36SIKES.js.map +1 -0
  59. package/dist/chunk-TDR6T5CJ.js +381 -0
  60. package/dist/chunk-TDR6T5CJ.js.map +1 -0
  61. package/dist/chunk-UF3BUNQZ.js +1 -0
  62. package/dist/chunk-UF3BUNQZ.js.map +1 -0
  63. package/dist/chunk-UQFSPSWG.js +1109 -0
  64. package/dist/chunk-UQFSPSWG.js.map +1 -0
  65. package/dist/chunk-USKYUS74.js +793 -0
  66. package/dist/chunk-USKYUS74.js.map +1 -0
  67. package/dist/chunk-XCL3WP6J.js +121 -0
  68. package/dist/chunk-XCL3WP6J.js.map +1 -0
  69. package/dist/chunk-XHFOENR2.js +680 -0
  70. package/dist/chunk-XHFOENR2.js.map +1 -0
  71. package/dist/chunk-ZFKD4QMV.js +430 -0
  72. package/dist/chunk-ZFKD4QMV.js.map +1 -0
  73. package/dist/chunk-ZLMV3TUA.js +490 -0
  74. package/dist/chunk-ZLMV3TUA.js.map +1 -0
  75. package/dist/chunk-ZRG4V3F5.js +17 -0
  76. package/dist/chunk-ZRG4V3F5.js.map +1 -0
  77. package/dist/consent/index.cjs +204 -0
  78. package/dist/consent/index.cjs.map +1 -0
  79. package/dist/consent/index.d.cts +24 -0
  80. package/dist/consent/index.d.ts +24 -0
  81. package/dist/consent/index.js +23 -0
  82. package/dist/consent/index.js.map +1 -0
  83. package/dist/crdt/index.cjs +152 -0
  84. package/dist/crdt/index.cjs.map +1 -0
  85. package/dist/crdt/index.d.cts +30 -0
  86. package/dist/crdt/index.d.ts +30 -0
  87. package/dist/crdt/index.js +24 -0
  88. package/dist/crdt/index.js.map +1 -0
  89. package/dist/crypto-IVKU7YTT.js +44 -0
  90. package/dist/crypto-IVKU7YTT.js.map +1 -0
  91. package/dist/delegation-XDJCBTI2.js +16 -0
  92. package/dist/delegation-XDJCBTI2.js.map +1 -0
  93. package/dist/dev-unlock-CeXic1xC.d.cts +263 -0
  94. package/dist/dev-unlock-KrKkcqD3.d.ts +263 -0
  95. package/dist/hash-9KO1BGxh.d.cts +63 -0
  96. package/dist/hash-ChfJjRjQ.d.ts +63 -0
  97. package/dist/history/index.cjs +1215 -0
  98. package/dist/history/index.cjs.map +1 -0
  99. package/dist/history/index.d.cts +62 -0
  100. package/dist/history/index.d.ts +62 -0
  101. package/dist/history/index.js +79 -0
  102. package/dist/history/index.js.map +1 -0
  103. package/dist/i18n/index.cjs +746 -0
  104. package/dist/i18n/index.cjs.map +1 -0
  105. package/dist/i18n/index.d.cts +38 -0
  106. package/dist/i18n/index.d.ts +38 -0
  107. package/dist/i18n/index.js +55 -0
  108. package/dist/i18n/index.js.map +1 -0
  109. package/dist/index-BRHBCmLt.d.ts +1940 -0
  110. package/dist/index-C8kQtmOk.d.ts +380 -0
  111. package/dist/index-DN-J-5wT.d.cts +1940 -0
  112. package/dist/index-DhjMjz7L.d.cts +380 -0
  113. package/dist/index.cjs +14756 -0
  114. package/dist/index.cjs.map +1 -0
  115. package/dist/index.d.cts +269 -0
  116. package/dist/index.d.ts +269 -0
  117. package/dist/index.js +6085 -0
  118. package/dist/index.js.map +1 -0
  119. package/dist/indexing/index.cjs +736 -0
  120. package/dist/indexing/index.cjs.map +1 -0
  121. package/dist/indexing/index.d.cts +36 -0
  122. package/dist/indexing/index.d.ts +36 -0
  123. package/dist/indexing/index.js +77 -0
  124. package/dist/indexing/index.js.map +1 -0
  125. package/dist/lazy-builder-BwEoBQZ9.d.ts +304 -0
  126. package/dist/lazy-builder-CZVLKh0Z.d.cts +304 -0
  127. package/dist/ledger-2NX4L7PN.js +33 -0
  128. package/dist/ledger-2NX4L7PN.js.map +1 -0
  129. package/dist/mime-magic-CBBSOkjm.d.cts +50 -0
  130. package/dist/mime-magic-CBBSOkjm.d.ts +50 -0
  131. package/dist/periods/index.cjs +1035 -0
  132. package/dist/periods/index.cjs.map +1 -0
  133. package/dist/periods/index.d.cts +21 -0
  134. package/dist/periods/index.d.ts +21 -0
  135. package/dist/periods/index.js +25 -0
  136. package/dist/periods/index.js.map +1 -0
  137. package/dist/predicate-SBHmi6D0.d.cts +161 -0
  138. package/dist/predicate-SBHmi6D0.d.ts +161 -0
  139. package/dist/query/index.cjs +1957 -0
  140. package/dist/query/index.cjs.map +1 -0
  141. package/dist/query/index.d.cts +3 -0
  142. package/dist/query/index.d.ts +3 -0
  143. package/dist/query/index.js +62 -0
  144. package/dist/query/index.js.map +1 -0
  145. package/dist/session/index.cjs +487 -0
  146. package/dist/session/index.cjs.map +1 -0
  147. package/dist/session/index.d.cts +45 -0
  148. package/dist/session/index.d.ts +45 -0
  149. package/dist/session/index.js +44 -0
  150. package/dist/session/index.js.map +1 -0
  151. package/dist/shadow/index.cjs +133 -0
  152. package/dist/shadow/index.cjs.map +1 -0
  153. package/dist/shadow/index.d.cts +16 -0
  154. package/dist/shadow/index.d.ts +16 -0
  155. package/dist/shadow/index.js +20 -0
  156. package/dist/shadow/index.js.map +1 -0
  157. package/dist/store/index.cjs +1069 -0
  158. package/dist/store/index.cjs.map +1 -0
  159. package/dist/store/index.d.cts +491 -0
  160. package/dist/store/index.d.ts +491 -0
  161. package/dist/store/index.js +34 -0
  162. package/dist/store/index.js.map +1 -0
  163. package/dist/strategy-BSxFXGzb.d.cts +110 -0
  164. package/dist/strategy-BSxFXGzb.d.ts +110 -0
  165. package/dist/strategy-D-SrOLCl.d.cts +548 -0
  166. package/dist/strategy-D-SrOLCl.d.ts +548 -0
  167. package/dist/sync/index.cjs +1062 -0
  168. package/dist/sync/index.cjs.map +1 -0
  169. package/dist/sync/index.d.cts +42 -0
  170. package/dist/sync/index.d.ts +42 -0
  171. package/dist/sync/index.js +28 -0
  172. package/dist/sync/index.js.map +1 -0
  173. package/dist/team/index.cjs +1233 -0
  174. package/dist/team/index.cjs.map +1 -0
  175. package/dist/team/index.d.cts +117 -0
  176. package/dist/team/index.d.ts +117 -0
  177. package/dist/team/index.js +39 -0
  178. package/dist/team/index.js.map +1 -0
  179. package/dist/tx/index.cjs +212 -0
  180. package/dist/tx/index.cjs.map +1 -0
  181. package/dist/tx/index.d.cts +20 -0
  182. package/dist/tx/index.d.ts +20 -0
  183. package/dist/tx/index.js +20 -0
  184. package/dist/tx/index.js.map +1 -0
  185. package/dist/types-BZpCZB8N.d.ts +7526 -0
  186. package/dist/types-Bfs0qr5F.d.cts +7526 -0
  187. package/dist/ulid-COREQ2RQ.js +9 -0
  188. package/dist/ulid-COREQ2RQ.js.map +1 -0
  189. package/dist/util/index.cjs +230 -0
  190. package/dist/util/index.cjs.map +1 -0
  191. package/dist/util/index.d.cts +77 -0
  192. package/dist/util/index.d.ts +77 -0
  193. package/dist/util/index.js +190 -0
  194. package/dist/util/index.js.map +1 -0
  195. package/package.json +244 -0
@@ -0,0 +1,746 @@
1
+ "use strict";
2
+ var __defProp = Object.defineProperty;
3
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
+ var __getOwnPropNames = Object.getOwnPropertyNames;
5
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
6
+ var __export = (target, all) => {
7
+ for (var name in all)
8
+ __defProp(target, name, { get: all[name], enumerable: true });
9
+ };
10
+ var __copyProps = (to, from, except, desc) => {
11
+ if (from && typeof from === "object" || typeof from === "function") {
12
+ for (let key of __getOwnPropNames(from))
13
+ if (!__hasOwnProp.call(to, key) && key !== except)
14
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
+ }
16
+ return to;
17
+ };
18
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
+
20
+ // src/i18n/index.ts
21
+ var i18n_exports = {};
22
+ __export(i18n_exports, {
23
+ DICT_COLLECTION_PREFIX: () => DICT_COLLECTION_PREFIX,
24
+ DictionaryHandle: () => DictionaryHandle,
25
+ applyI18nLocale: () => applyI18nLocale,
26
+ dictCollectionName: () => dictCollectionName,
27
+ dictKey: () => dictKey,
28
+ i18nText: () => i18nText,
29
+ isDictCollectionName: () => isDictCollectionName,
30
+ isDictKeyDescriptor: () => isDictKeyDescriptor,
31
+ isI18nTextDescriptor: () => isI18nTextDescriptor,
32
+ resolveI18nText: () => resolveI18nText,
33
+ validateI18nTextValue: () => validateI18nTextValue,
34
+ withI18n: () => withI18n
35
+ });
36
+ module.exports = __toCommonJS(i18n_exports);
37
+
38
+ // src/errors.ts
39
+ var NoydbError = class extends Error {
40
+ /** Machine-readable error code. Stable across library versions. */
41
+ code;
42
+ constructor(code, message) {
43
+ super(message);
44
+ this.name = "NoydbError";
45
+ this.code = code;
46
+ }
47
+ };
48
+ var DecryptionError = class extends NoydbError {
49
+ constructor(message = "Decryption failed") {
50
+ super("DECRYPTION_FAILED", message);
51
+ this.name = "DecryptionError";
52
+ }
53
+ };
54
+ var TamperedError = class extends NoydbError {
55
+ constructor(message = "Data integrity check failed \u2014 record may have been tampered with") {
56
+ super("TAMPERED", message);
57
+ this.name = "TamperedError";
58
+ }
59
+ };
60
+ var PermissionDeniedError = class extends NoydbError {
61
+ constructor(message = "Permission denied \u2014 insufficient role for this operation") {
62
+ super("PERMISSION_DENIED", message);
63
+ this.name = "PermissionDeniedError";
64
+ }
65
+ };
66
+ var DictKeyMissingError = class extends NoydbError {
67
+ /** The dictionary name. */
68
+ dictionaryName;
69
+ /** The key that was not found. */
70
+ key;
71
+ constructor(dictionaryName, key) {
72
+ super(
73
+ "DICT_KEY_MISSING",
74
+ `Dictionary "${dictionaryName}" has no entry for key "${key}".`
75
+ );
76
+ this.name = "DictKeyMissingError";
77
+ this.dictionaryName = dictionaryName;
78
+ this.key = key;
79
+ }
80
+ };
81
+ var MissingTranslationError = class extends NoydbError {
82
+ /** The field name whose translation(s) are missing. */
83
+ field;
84
+ /** Locale codes that were required but absent. */
85
+ missing;
86
+ constructor(field, missing, message) {
87
+ super(
88
+ "MISSING_TRANSLATION",
89
+ message ?? `Field "${field}": missing required translation(s): ${missing.join(", ")}.`
90
+ );
91
+ this.name = "MissingTranslationError";
92
+ this.field = field;
93
+ this.missing = missing;
94
+ }
95
+ };
96
+ var LocaleNotSpecifiedError = class extends NoydbError {
97
+ /** The field name that required a locale. */
98
+ field;
99
+ constructor(field, message) {
100
+ super(
101
+ "LOCALE_NOT_SPECIFIED",
102
+ message ?? `Cannot read i18nText field "${field}" without a locale. Pass { locale } to get()/list()/query() or set a default via openVault(name, { locale }).`
103
+ );
104
+ this.name = "LocaleNotSpecifiedError";
105
+ this.field = field;
106
+ }
107
+ };
108
+
109
+ // src/i18n/core.ts
110
+ function i18nText(options) {
111
+ return { _noydbI18nText: true, options };
112
+ }
113
+ function isI18nTextDescriptor(x) {
114
+ return typeof x === "object" && x !== null && x._noydbI18nText === true;
115
+ }
116
+ function validateI18nTextValue(value, field, descriptor) {
117
+ const { options } = descriptor;
118
+ if (typeof value !== "object" || value === null || Array.isArray(value)) {
119
+ throw new MissingTranslationError(
120
+ field,
121
+ options.languages,
122
+ `Field "${field}" must be a { [locale]: string } map, got ${typeof value}.`
123
+ );
124
+ }
125
+ const map = value;
126
+ for (const [locale, v] of Object.entries(map)) {
127
+ if (typeof v !== "string") {
128
+ throw new MissingTranslationError(
129
+ field,
130
+ [locale],
131
+ `Field "${field}": locale "${locale}" must be a string, got ${typeof v}.`
132
+ );
133
+ }
134
+ }
135
+ const { required } = options;
136
+ if (required === "all") {
137
+ const missing = options.languages.filter(
138
+ (lang) => !(lang in map) || map[lang] === ""
139
+ );
140
+ if (missing.length > 0) {
141
+ throw new MissingTranslationError(
142
+ field,
143
+ missing,
144
+ `Field "${field}" requires all declared languages. Missing: ${missing.join(", ")}.`
145
+ );
146
+ }
147
+ } else if (required === "any") {
148
+ const present = options.languages.some(
149
+ (lang) => lang in map && map[lang] !== ""
150
+ );
151
+ if (!present) {
152
+ throw new MissingTranslationError(
153
+ field,
154
+ options.languages,
155
+ `Field "${field}" requires at least one declared language. None present.`
156
+ );
157
+ }
158
+ } else {
159
+ const requiredList = required;
160
+ const missing = requiredList.filter(
161
+ (lang) => !(lang in map) || map[lang] === ""
162
+ );
163
+ if (missing.length > 0) {
164
+ throw new MissingTranslationError(
165
+ field,
166
+ missing,
167
+ `Field "${field}" requires: ${requiredList.join(", ")}. Missing: ${missing.join(", ")}.`
168
+ );
169
+ }
170
+ }
171
+ }
172
+ function resolveI18nText(value, locale, fallback, field) {
173
+ if (locale === "raw") {
174
+ return value;
175
+ }
176
+ if (!locale) {
177
+ throw new LocaleNotSpecifiedError(field ?? "<unknown>");
178
+ }
179
+ if (value[locale] !== void 0 && value[locale] !== "") {
180
+ return value[locale];
181
+ }
182
+ const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
183
+ for (const fb of chain) {
184
+ if (fb === "any") {
185
+ const any = Object.values(value).find((v) => v !== "");
186
+ if (any !== void 0) return any;
187
+ } else if (value[fb] !== void 0 && value[fb] !== "") {
188
+ return value[fb];
189
+ }
190
+ }
191
+ throw new LocaleNotSpecifiedError(
192
+ field ?? "<unknown>",
193
+ `No translation available for locale "${locale}"` + (chain.length > 0 ? ` or fallback chain [${chain.join(", ")}]` : "") + "."
194
+ );
195
+ }
196
+ function applyI18nLocale(record, i18nFields, locale, fallback) {
197
+ const fieldNames = Object.keys(i18nFields);
198
+ if (fieldNames.length === 0) return record;
199
+ const result = { ...record };
200
+ for (const field of fieldNames) {
201
+ const raw = result[field];
202
+ if (raw === void 0 || raw === null) continue;
203
+ if (typeof raw !== "object" || Array.isArray(raw)) continue;
204
+ result[field] = resolveI18nText(
205
+ raw,
206
+ locale,
207
+ fallback,
208
+ field
209
+ );
210
+ }
211
+ return result;
212
+ }
213
+
214
+ // src/types.ts
215
+ var NOYDB_FORMAT_VERSION = 1;
216
+ var NOYDB_KEYRING_VERSION = 1;
217
+
218
+ // src/crypto.ts
219
+ var IV_BYTES = 12;
220
+ var KEY_BITS = 256;
221
+ var subtle = globalThis.crypto.subtle;
222
+ async function generateDEK() {
223
+ return subtle.generateKey(
224
+ { name: "AES-GCM", length: KEY_BITS },
225
+ true,
226
+ // extractable — needed for AES-KW wrapping
227
+ ["encrypt", "decrypt"]
228
+ );
229
+ }
230
+ async function wrapKey(dek, kek) {
231
+ const wrapped = await subtle.wrapKey("raw", dek, kek, "AES-KW");
232
+ return bufferToBase64(wrapped);
233
+ }
234
+ async function encrypt(plaintext, dek) {
235
+ const iv = generateIV();
236
+ const encoded = new TextEncoder().encode(plaintext);
237
+ const ciphertext = await subtle.encrypt(
238
+ { name: "AES-GCM", iv },
239
+ dek,
240
+ encoded
241
+ );
242
+ return {
243
+ iv: bufferToBase64(iv),
244
+ data: bufferToBase64(ciphertext)
245
+ };
246
+ }
247
+ async function decrypt(ivBase64, dataBase64, dek) {
248
+ const iv = base64ToBuffer(ivBase64);
249
+ const ciphertext = base64ToBuffer(dataBase64);
250
+ try {
251
+ const plaintext = await subtle.decrypt(
252
+ { name: "AES-GCM", iv },
253
+ dek,
254
+ ciphertext
255
+ );
256
+ return new TextDecoder().decode(plaintext);
257
+ } catch (err) {
258
+ if (err instanceof Error && err.name === "OperationError") {
259
+ throw new TamperedError();
260
+ }
261
+ throw new DecryptionError(
262
+ err instanceof Error ? err.message : "Decryption failed"
263
+ );
264
+ }
265
+ }
266
+ function generateIV() {
267
+ return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
268
+ }
269
+ function bufferToBase64(buffer) {
270
+ const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
271
+ let binary = "";
272
+ for (let i = 0; i < bytes.length; i++) {
273
+ binary += String.fromCharCode(bytes[i]);
274
+ }
275
+ return btoa(binary);
276
+ }
277
+ function base64ToBuffer(base64) {
278
+ const binary = atob(base64);
279
+ const bytes = new Uint8Array(binary.length);
280
+ for (let i = 0; i < binary.length; i++) {
281
+ bytes[i] = binary.charCodeAt(i);
282
+ }
283
+ return bytes;
284
+ }
285
+
286
+ // src/team/keyring.ts
287
+ async function ensureCollectionDEK(adapter, vault, keyring) {
288
+ const inFlight = /* @__PURE__ */ new Map();
289
+ return async (collectionName) => {
290
+ const existing = keyring.deks.get(collectionName);
291
+ if (existing) return existing;
292
+ const pending = inFlight.get(collectionName);
293
+ if (pending) return pending;
294
+ const promise = (async () => {
295
+ const dek = await generateDEK();
296
+ keyring.deks.set(collectionName, dek);
297
+ await persistKeyring(adapter, vault, keyring);
298
+ return dek;
299
+ })();
300
+ inFlight.set(collectionName, promise);
301
+ try {
302
+ return await promise;
303
+ } finally {
304
+ inFlight.delete(collectionName);
305
+ }
306
+ };
307
+ }
308
+ async function persistKeyring(adapter, vault, keyring) {
309
+ const wrappedDeks = {};
310
+ for (const [collName, dek] of keyring.deks) {
311
+ wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
312
+ }
313
+ const keyringFile = {
314
+ _noydb_keyring: NOYDB_KEYRING_VERSION,
315
+ user_id: keyring.userId,
316
+ display_name: keyring.displayName,
317
+ role: keyring.role,
318
+ permissions: keyring.permissions,
319
+ deks: wrappedDeks,
320
+ salt: bufferToBase64(keyring.salt),
321
+ created_at: (/* @__PURE__ */ new Date()).toISOString(),
322
+ granted_by: keyring.userId,
323
+ ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
324
+ ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability }
325
+ };
326
+ await writeKeyringFile(adapter, vault, keyring.userId, keyringFile);
327
+ }
328
+ async function writeKeyringFile(adapter, vault, userId, keyringFile) {
329
+ const envelope = {
330
+ _noydb: 1,
331
+ _v: 1,
332
+ _ts: (/* @__PURE__ */ new Date()).toISOString(),
333
+ _iv: "",
334
+ _data: JSON.stringify(keyringFile)
335
+ };
336
+ await adapter.put(vault, "_keyring", userId, envelope);
337
+ }
338
+
339
+ // src/history/ledger/entry.ts
340
+ async function sha256Hex(input) {
341
+ const bytes = new TextEncoder().encode(input);
342
+ const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
343
+ return bytesToHex(new Uint8Array(digest));
344
+ }
345
+ function bytesToHex(bytes) {
346
+ const hex = new Array(bytes.length);
347
+ for (let i = 0; i < bytes.length; i++) {
348
+ hex[i] = (bytes[i] ?? 0).toString(16).padStart(2, "0");
349
+ }
350
+ return hex.join("");
351
+ }
352
+
353
+ // src/history/ledger/hash.ts
354
+ async function envelopePayloadHash(envelope) {
355
+ if (!envelope) return "";
356
+ return sha256Hex(envelope._data);
357
+ }
358
+
359
+ // src/i18n/dictionary.ts
360
+ var DICT_COLLECTION_PREFIX = "_dict_";
361
+ function dictCollectionName(dictionaryName) {
362
+ return `${DICT_COLLECTION_PREFIX}${dictionaryName}`;
363
+ }
364
+ function isDictCollectionName(name) {
365
+ return name.startsWith(DICT_COLLECTION_PREFIX);
366
+ }
367
+ function dictKey(name, keys) {
368
+ return { _noydbDictKey: true, name, keys };
369
+ }
370
+ function isDictKeyDescriptor(x) {
371
+ return typeof x === "object" && x !== null && x._noydbDictKey === true;
372
+ }
373
+ var DictionaryHandle = class {
374
+ constructor(adapter, compartmentName, dictionaryName, keyring, getDEK, encrypted, ledger, options, findAndUpdateReferences, emitter) {
375
+ this.adapter = adapter;
376
+ this.compartmentName = compartmentName;
377
+ this.dictionaryName = dictionaryName;
378
+ this.keyring = keyring;
379
+ this.getDEK = getDEK;
380
+ this.encrypted = encrypted;
381
+ this.ledger = ledger;
382
+ this.options = options;
383
+ this.findAndUpdateReferences = findAndUpdateReferences;
384
+ this.emitter = emitter;
385
+ this.collName = dictCollectionName(dictionaryName);
386
+ }
387
+ adapter;
388
+ compartmentName;
389
+ dictionaryName;
390
+ keyring;
391
+ getDEK;
392
+ encrypted;
393
+ ledger;
394
+ options;
395
+ findAndUpdateReferences;
396
+ emitter;
397
+ collName;
398
+ /**
399
+ * Synchronous write-through cache for dict-join support.
400
+ * Populated on every `put()`, `delete()`, and `rename()`. The snapshot
401
+ * is built from this cache by `snapshotEntries()` — the query executor
402
+ * calls this synchronously inside `.toArray()`.
403
+ *
404
+ * `null` means "not yet initialized" — callers should use `list()`
405
+ * to warm the cache before using dict joins on pre-existing data.
406
+ */
407
+ _syncCache = /* @__PURE__ */ new Map();
408
+ /**
409
+ * Return all cached entries as `{ key, labels, ...labels }` records —
410
+ * usable synchronously by the join executor's `snapshot()` call.
411
+ * Returns an empty array when the cache has never been populated.
412
+ */
413
+ snapshotEntries() {
414
+ return Array.from(this._syncCache.values()).map((e) => ({
415
+ key: e.key,
416
+ labels: e.labels,
417
+ ...e.labels
418
+ }));
419
+ }
420
+ // ─── Access checks ────────────────────────────────────────────────
421
+ requireWriteAccess() {
422
+ const minRole = this.options.writableBy ?? "admin";
423
+ const roleRank = {
424
+ client: 1,
425
+ viewer: 2,
426
+ operator: 3,
427
+ admin: 4,
428
+ owner: 5
429
+ };
430
+ const callerRank = roleRank[this.keyring.role] ?? 0;
431
+ const requiredRank = roleRank[minRole] ?? 4;
432
+ if (callerRank < requiredRank) {
433
+ throw new PermissionDeniedError(
434
+ `Dictionary "${this.dictionaryName}" writes require "${minRole}" role or above. Current role: "${this.keyring.role}".`
435
+ );
436
+ }
437
+ }
438
+ // ─── Internal helpers ─────────────────────────────────────────────
439
+ async getDekForDict() {
440
+ const resolve = await ensureCollectionDEK(
441
+ this.adapter,
442
+ this.compartmentName,
443
+ this.keyring
444
+ );
445
+ return resolve(this.collName);
446
+ }
447
+ async encryptEntry(entry, version) {
448
+ if (!this.encrypted) {
449
+ return {
450
+ _noydb: NOYDB_FORMAT_VERSION,
451
+ _v: version,
452
+ _ts: (/* @__PURE__ */ new Date()).toISOString(),
453
+ _iv: "",
454
+ _data: JSON.stringify(entry),
455
+ _by: this.keyring.userId
456
+ };
457
+ }
458
+ const dek = await this.getDekForDict();
459
+ const { iv, data } = await encrypt(JSON.stringify(entry), dek);
460
+ return {
461
+ _noydb: NOYDB_FORMAT_VERSION,
462
+ _v: version,
463
+ _ts: (/* @__PURE__ */ new Date()).toISOString(),
464
+ _iv: iv,
465
+ _data: data,
466
+ _by: this.keyring.userId
467
+ };
468
+ }
469
+ async decryptEntry(envelope) {
470
+ if (!this.encrypted) {
471
+ return JSON.parse(envelope._data);
472
+ }
473
+ const dek = await this.getDekForDict();
474
+ const json = await decrypt(envelope._iv, envelope._data, dek);
475
+ return JSON.parse(json);
476
+ }
477
+ // ─── Public API ───────────────────────────────────────────────────
478
+ /**
479
+ * Add or overwrite a single dictionary entry.
480
+ *
481
+ * @param key The stable key to store (e.g. `'paid'`).
482
+ * @param labels Locale → label map (e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`).
483
+ */
484
+ async put(key, labels) {
485
+ this.requireWriteAccess();
486
+ const entry = { key, labels };
487
+ const existing = await this.adapter.get(
488
+ this.compartmentName,
489
+ this.collName,
490
+ key
491
+ );
492
+ const version = existing ? existing._v + 1 : 1;
493
+ const envelope = await this.encryptEntry(entry, version);
494
+ await this.adapter.put(
495
+ this.compartmentName,
496
+ this.collName,
497
+ key,
498
+ envelope,
499
+ existing ? existing._v : void 0
500
+ );
501
+ this._syncCache.set(key, entry);
502
+ this.emitter.emit("change", {
503
+ vault: this.compartmentName,
504
+ collection: this.collName,
505
+ id: key,
506
+ action: "put"
507
+ });
508
+ if (this.ledger) {
509
+ await this.ledger.append({
510
+ op: "put",
511
+ collection: this.collName,
512
+ id: key,
513
+ version,
514
+ actor: this.keyring.userId,
515
+ // — must be the real envelope hash so
516
+ // vault.verifyBackupIntegrity()'s data-cross-check matches.
517
+ payloadHash: await envelopePayloadHash(envelope)
518
+ });
519
+ }
520
+ }
521
+ /**
522
+ * Batch-add or overwrite multiple dictionary entries in one call.
523
+ *
524
+ * @param entries `{ key: { locale: label } }` map.
525
+ */
526
+ async putAll(entries) {
527
+ this.requireWriteAccess();
528
+ for (const [key, labels] of Object.entries(entries)) {
529
+ await this.put(key, labels);
530
+ }
531
+ }
532
+ /**
533
+ * Load the label map for a single key.
534
+ *
535
+ * @returns The label map, or `null` if the key doesn't exist.
536
+ */
537
+ async get(key) {
538
+ const envelope = await this.adapter.get(
539
+ this.compartmentName,
540
+ this.collName,
541
+ key
542
+ );
543
+ if (!envelope) return null;
544
+ const entry = await this.decryptEntry(envelope);
545
+ return entry.labels;
546
+ }
547
+ /**
548
+ * Delete a dictionary key.
549
+ *
550
+ * Default mode is `'strict'` — throws `DictKeyInUseError` if any
551
+ * registered collection has a record referencing this key. Pass
552
+ * `{ mode: 'warn' }` to skip the check (dev-mode cleanup only).
553
+ */
554
+ async delete(key, opts = {}) {
555
+ this.requireWriteAccess();
556
+ const existing = await this.adapter.get(
557
+ this.compartmentName,
558
+ this.collName,
559
+ key
560
+ );
561
+ if (!existing) {
562
+ throw new DictKeyMissingError(this.dictionaryName, key);
563
+ }
564
+ const mode = opts.mode ?? "strict";
565
+ if (mode === "strict" && this.findAndUpdateReferences) {
566
+ }
567
+ await this.adapter.delete(this.compartmentName, this.collName, key);
568
+ this._syncCache.delete(key);
569
+ this.emitter.emit("change", {
570
+ vault: this.compartmentName,
571
+ collection: this.collName,
572
+ id: key,
573
+ action: "delete"
574
+ });
575
+ if (this.ledger) {
576
+ await this.ledger.append({
577
+ op: "delete",
578
+ collection: this.collName,
579
+ id: key,
580
+ version: existing._v,
581
+ actor: this.keyring.userId,
582
+ // — for delete the prior envelope is what was just
583
+ // removed; we hash it so the chain captures intent. The
584
+ // verifyBackupIntegrity data-cross-check skips delete
585
+ // entries entirely (the live record is gone), but the
586
+ // chain still benefits from a stable non-empty hash.
587
+ payloadHash: await envelopePayloadHash(existing)
588
+ });
589
+ }
590
+ }
591
+ /**
592
+ * Rename a dictionary key — the only sanctioned mass-mutation path.
593
+ *
594
+ * Atomically:
595
+ * 1. Adds the new key with the same labels as the old key.
596
+ * 2. Updates every registered record that stores the old key to
597
+ * store the new key instead.
598
+ * 3. Deletes the old key.
599
+ * 4. Appends a single ledger entry recording the rename.
600
+ *
601
+ * Respects ACL: throws `PermissionDeniedError` before any mutation
602
+ * if the caller can't write. The cascade is best-effort atomic
603
+ * within this call — no two-phase commit across adapter calls.
604
+ *
605
+ * Cascade-on-delete is NOT supported. Use `rename()` when you need
606
+ * to change a key that records reference.
607
+ */
608
+ async rename(oldKey, newKey) {
609
+ this.requireWriteAccess();
610
+ const existing = await this.adapter.get(
611
+ this.compartmentName,
612
+ this.collName,
613
+ oldKey
614
+ );
615
+ if (!existing) {
616
+ throw new DictKeyMissingError(this.dictionaryName, oldKey);
617
+ }
618
+ const oldEntry = await this.decryptEntry(existing);
619
+ const newEntry = { key: newKey, labels: oldEntry.labels };
620
+ const newEnvelope = await this.encryptEntry(newEntry, 1);
621
+ await this.adapter.put(
622
+ this.compartmentName,
623
+ this.collName,
624
+ newKey,
625
+ newEnvelope
626
+ );
627
+ if (this.findAndUpdateReferences) {
628
+ await this.findAndUpdateReferences(this.dictionaryName, oldKey, newKey);
629
+ }
630
+ await this.adapter.delete(this.compartmentName, this.collName, oldKey);
631
+ this._syncCache.delete(oldKey);
632
+ this._syncCache.set(newKey, newEntry);
633
+ this.emitter.emit("change", {
634
+ vault: this.compartmentName,
635
+ collection: this.collName,
636
+ id: oldKey,
637
+ action: "delete"
638
+ });
639
+ this.emitter.emit("change", {
640
+ vault: this.compartmentName,
641
+ collection: this.collName,
642
+ id: newKey,
643
+ action: "put"
644
+ });
645
+ if (this.ledger) {
646
+ await this.ledger.append({
647
+ op: "delete",
648
+ collection: this.collName,
649
+ id: oldKey,
650
+ version: existing._v,
651
+ actor: this.keyring.userId,
652
+ payloadHash: await envelopePayloadHash(existing)
653
+ });
654
+ await this.ledger.append({
655
+ op: "put",
656
+ collection: this.collName,
657
+ id: newKey,
658
+ version: 1,
659
+ actor: this.keyring.userId,
660
+ payloadHash: await envelopePayloadHash(newEnvelope)
661
+ });
662
+ }
663
+ }
664
+ /**
665
+ * List all entries in this dictionary.
666
+ *
667
+ * @returns Array of `{ key, labels }` objects.
668
+ */
669
+ async list() {
670
+ const keys = await this.adapter.list(this.compartmentName, this.collName);
671
+ const entries = [];
672
+ for (const key of keys) {
673
+ const envelope = await this.adapter.get(
674
+ this.compartmentName,
675
+ this.collName,
676
+ key
677
+ );
678
+ if (!envelope) continue;
679
+ const entry = await this.decryptEntry(envelope);
680
+ entries.push(entry);
681
+ this._syncCache.set(key, entry);
682
+ }
683
+ return entries;
684
+ }
685
+ /**
686
+ * Resolve a key to its label for the given locale.
687
+ *
688
+ * Used by the collection's locale-aware read path to populate
689
+ * `<field>Label` virtual fields. Returns `undefined` when the
690
+ * key doesn't exist or has no label for the requested locale
691
+ * (after exhausting the fallback chain).
692
+ */
693
+ async resolveLabel(key, locale, fallback) {
694
+ const labels = await this.get(key);
695
+ if (!labels) return void 0;
696
+ if (labels[locale] !== void 0) return labels[locale];
697
+ const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
698
+ for (const fb of chain) {
699
+ if (fb === "any") {
700
+ const any = Object.values(labels)[0];
701
+ if (any !== void 0) return any;
702
+ } else if (labels[fb] !== void 0) {
703
+ return labels[fb];
704
+ }
705
+ }
706
+ return void 0;
707
+ }
708
+ };
709
+
710
+ // src/i18n/active.ts
711
+ function withI18n() {
712
+ return {
713
+ applyI18nLocale,
714
+ validateI18nTextValue,
715
+ buildDictionaryHandle(opts) {
716
+ return new DictionaryHandle(
717
+ opts.adapter,
718
+ opts.compartmentName,
719
+ opts.dictionaryName,
720
+ opts.keyring,
721
+ opts.getDEK,
722
+ opts.encrypted,
723
+ opts.ledger,
724
+ opts.options,
725
+ opts.findAndUpdateReferences,
726
+ opts.emitter
727
+ );
728
+ }
729
+ };
730
+ }
731
+ // Annotate the CommonJS export names for ESM import in node:
732
+ 0 && (module.exports = {
733
+ DICT_COLLECTION_PREFIX,
734
+ DictionaryHandle,
735
+ applyI18nLocale,
736
+ dictCollectionName,
737
+ dictKey,
738
+ i18nText,
739
+ isDictCollectionName,
740
+ isDictKeyDescriptor,
741
+ isI18nTextDescriptor,
742
+ resolveI18nText,
743
+ validateI18nTextValue,
744
+ withI18n
745
+ });
746
+ //# sourceMappingURL=index.cjs.map