@noy-db/hub 0.2.0-pre.1 → 0.2.0-pre.11

package/dist/team/index.d.cts

@@ -1,10 +1,11 @@
-import { aO as NoydbStore, aM as UnlockedKeyring } from '../types-C4lwMKKF.cjs';
-export { bu as BundleRecipient, bR as EnrollAuthenticatorOptions, bS as EnrollAuthenticatorWrappingDEKsOptions, bT as EnrollAuthenticatorWrappingKEKOptions, ci as ListUsersOptions, cG as PaperRecoveryEntry, cO as PresenceHandle, d7 as RecoverPassphraseInput, d8 as RecoverPassphraseResult, d9 as RecoverUserOptions, da as RecoveryProof, dd as RotatePassphraseInput, dq as SlotRewrapCeremony, dr as SlotRewrapContext, dy as SyncEngine, dG as SyncTransaction, dO as UpdateAuthenticatorOptions, e0 as WrappedDeksBlob, e2 as buildRecipientKeyringFile, e3 as burnPaperRecoveryEntry, eO as changeSecret, eP as createOwnerKeyring, e6 as deriveMagicLinkContentKey, e7 as enrollAuthenticator, eQ as ensureCollectionDEK, e9 as evaluateExportCapability, ea as evaluateImportCapability, eb as findAuthenticator, eR as grant, ec as hasExportCapability, ed as hasImportCapability, ef as isMagicLinkGrantExpired, ek as listMagicLinkGrants, el as listUsers, em as listUsersWithEnvelopes, eS as loadKeyring, eo as loadPaperRecoveryEntries, er as magicLinkGrantRecordId, es as mintPaperRecoveryEntry, eu as mintWrappedDeksBlob, eT as persistKeyring, ew as readMagicLinkGrantRecord, ei as recoverPassphrase, ex as recoverUser, ey as removeAuthenticator, eU as revoke, eB as revokeMagicLinkGrant, ej as rotatePassphrase, eC as savePaperRecoveryEntries, eF as unwrapDeksFromBlob, eG as unwrapDeksFromPaperEntry, eI as unwrapMagicLinkGrant, eV as updateAuthenticator, eW as updateKeyringIdentity, eN as writeMagicLinkGrant } from '../types-C4lwMKKF.cjs';
-import '../lazy-builder-C-rPfWG0.cjs';
-import '../predicate-Dnu81tsS.cjs';
-import '../strategy-DSTrsZ8t.cjs';
+import { b3 as NoydbStore, b1 as UnlockedKeyring } from '../types-DiSXn3a4.cjs';
+export { bt as BundleRecipient, cg as EnrollAuthenticatorOptions, ch as EnrollAuthenticatorWrappingDEKsOptions, ci as EnrollAuthenticatorWrappingKEKOptions, cN as ListUsersOptions, d9 as PaperRecoveryEntry, dh as PresenceHandle, dD as RecoverPassphraseInput, dE as RecoverPassphraseResult, dF as RecoverUserOptions, dG as RecoveryProof, dJ as RotatePassphraseInput, dV as SlotRewrapCeremony, dW as SlotRewrapContext, e1 as SyncEngine, e9 as SyncTransaction, em as UpdateAuthenticatorOptions, eB as WrappedDeksBlob, eH as buildRecipientKeyringFile, eI as burnPaperRecoveryEntry, fr as changeSecret, fs as createOwnerKeyring, eL as deriveMagicLinkContentKey, eM as enrollAuthenticator, ft as ensureCollectionDEK, eO as evaluateExportCapability, eP as evaluateImportCapability, eQ as findAuthenticator, fu as grant, eR as hasExportCapability, eS as hasImportCapability, eU as isMagicLinkGrantExpired, eZ as listMagicLinkGrants, e_ as listUsers, e$ as listUsersWithEnvelopes, fv as loadKeyring, f1 as loadPaperRecoveryEntries, f4 as magicLinkGrantRecordId, f5 as mintPaperRecoveryEntry, f7 as mintWrappedDeksBlob, fw as persistKeyring, f9 as readMagicLinkGrantRecord, eX as recoverPassphrase, fa as recoverUser, fb as removeAuthenticator, fx as revoke, fe as revokeMagicLinkGrant, eY as rotatePassphrase, ff as savePaperRecoveryEntries, fi as unwrapDeksFromBlob, fj as unwrapDeksFromPaperEntry, fl as unwrapMagicLinkGrant, fy as updateAuthenticator, fz as updateKeyringIdentity, fq as writeMagicLinkGrant } from '../types-DiSXn3a4.cjs';
+import '../lazy-builder-Ci5_YG73.cjs';
+import '../predicate-Bt5ft-9c.cjs';
+import '../strategy-CT2LCKAX.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-CmVgTkqk.cjs';
+import '../index-B8bjExET.cjs';
+import '@noy-db/attestation';
 
 /**
  * _sync_credentials reserved collection —

package/dist/team/index.d.ts

@@ -1,10 +1,11 @@
-import { aO as NoydbStore, aM as UnlockedKeyring } from '../types-DW9RGSSs.js';
-export { bu as BundleRecipient, bR as EnrollAuthenticatorOptions, bS as EnrollAuthenticatorWrappingDEKsOptions, bT as EnrollAuthenticatorWrappingKEKOptions, ci as ListUsersOptions, cG as PaperRecoveryEntry, cO as PresenceHandle, d7 as RecoverPassphraseInput, d8 as RecoverPassphraseResult, d9 as RecoverUserOptions, da as RecoveryProof, dd as RotatePassphraseInput, dq as SlotRewrapCeremony, dr as SlotRewrapContext, dy as SyncEngine, dG as SyncTransaction, dO as UpdateAuthenticatorOptions, e0 as WrappedDeksBlob, e2 as buildRecipientKeyringFile, e3 as burnPaperRecoveryEntry, eO as changeSecret, eP as createOwnerKeyring, e6 as deriveMagicLinkContentKey, e7 as enrollAuthenticator, eQ as ensureCollectionDEK, e9 as evaluateExportCapability, ea as evaluateImportCapability, eb as findAuthenticator, eR as grant, ec as hasExportCapability, ed as hasImportCapability, ef as isMagicLinkGrantExpired, ek as listMagicLinkGrants, el as listUsers, em as listUsersWithEnvelopes, eS as loadKeyring, eo as loadPaperRecoveryEntries, er as magicLinkGrantRecordId, es as mintPaperRecoveryEntry, eu as mintWrappedDeksBlob, eT as persistKeyring, ew as readMagicLinkGrantRecord, ei as recoverPassphrase, ex as recoverUser, ey as removeAuthenticator, eU as revoke, eB as revokeMagicLinkGrant, ej as rotatePassphrase, eC as savePaperRecoveryEntries, eF as unwrapDeksFromBlob, eG as unwrapDeksFromPaperEntry, eI as unwrapMagicLinkGrant, eV as updateAuthenticator, eW as updateKeyringIdentity, eN as writeMagicLinkGrant } from '../types-DW9RGSSs.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+import { b3 as NoydbStore, b1 as UnlockedKeyring } from '../types-CD8mc8zR.js';
+export { bt as BundleRecipient, cg as EnrollAuthenticatorOptions, ch as EnrollAuthenticatorWrappingDEKsOptions, ci as EnrollAuthenticatorWrappingKEKOptions, cN as ListUsersOptions, d9 as PaperRecoveryEntry, dh as PresenceHandle, dD as RecoverPassphraseInput, dE as RecoverPassphraseResult, dF as RecoverUserOptions, dG as RecoveryProof, dJ as RotatePassphraseInput, dV as SlotRewrapCeremony, dW as SlotRewrapContext, e1 as SyncEngine, e9 as SyncTransaction, em as UpdateAuthenticatorOptions, eB as WrappedDeksBlob, eH as buildRecipientKeyringFile, eI as burnPaperRecoveryEntry, fr as changeSecret, fs as createOwnerKeyring, eL as deriveMagicLinkContentKey, eM as enrollAuthenticator, ft as ensureCollectionDEK, eO as evaluateExportCapability, eP as evaluateImportCapability, eQ as findAuthenticator, fu as grant, eR as hasExportCapability, eS as hasImportCapability, eU as isMagicLinkGrantExpired, eZ as listMagicLinkGrants, e_ as listUsers, e$ as listUsersWithEnvelopes, fv as loadKeyring, f1 as loadPaperRecoveryEntries, f4 as magicLinkGrantRecordId, f5 as mintPaperRecoveryEntry, f7 as mintWrappedDeksBlob, fw as persistKeyring, f9 as readMagicLinkGrantRecord, eX as recoverPassphrase, fa as recoverUser, fb as removeAuthenticator, fx as revoke, fe as revokeMagicLinkGrant, eY as rotatePassphrase, ff as savePaperRecoveryEntries, fi as unwrapDeksFromBlob, fj as unwrapDeksFromPaperEntry, fl as unwrapMagicLinkGrant, fy as updateAuthenticator, fz as updateKeyringIdentity, fq as writeMagicLinkGrant } from '../types-CD8mc8zR.js';
+import '../lazy-builder-D5GU14TS.js';
+import '../predicate-Bt5ft-9c.js';
+import '../strategy-CT2LCKAX.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-CNwA-B6-.js';
+import '../index-DfUbNad8.js';
+import '@noy-db/attestation';
 
 /**
  * _sync_credentials reserved collection —

package/dist/team/index.js

@@ -1,20 +1,22 @@
 import {
   SYNC_CREDENTIALS_COLLECTION,
-  burnPaperRecoveryEntry,
   credentialStatus,
   deleteCredential,
+  getCredential,
+  listCredentials,
+  putCredential
+} from "../chunk-PC3ZZBTO.js";
+import {
+  burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
-  getCredential,
   isMagicLinkGrantExpired,
-  listCredentials,
   listMagicLinkGrants,
   loadPaperRecoveryEntries,
   magicLinkGrantRecordId,
   mintPaperRecoveryEntry,
   mintWrappedDeksBlob,
-  putCredential,
   readMagicLinkGrantRecord,
   recoverPassphrase,
   recoverUser,
@@ -27,13 +29,13 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-CBAHB2BF.js";
-import "../chunk-DYBQG5PQ.js";
+} from "../chunk-YVZRTCGG.js";
+import "../chunk-CXFOITNS.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-4TFSM22V.js";
+} from "../chunk-YW5DBAPG.js";
 import {
   buildRecipientKeyringFile,
   changeSecret,
@@ -50,11 +52,11 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-PA6R5ZCI.js";
+} from "../chunk-QCXNMCHN.js";
 import "../chunk-2QR2PQTT.js";
-import "../chunk-YS3POABP.js";
-import "../chunk-WCA2NROQ.js";
-import "../chunk-ADQ5MQ54.js";
+import "../chunk-SLV4LAKX.js";
+import "../chunk-R233SLY3.js";
+import "../chunk-O6EJ6WTI.js";
 export {
   PresenceHandle,
   SYNC_CREDENTIALS_COLLECTION,

package/dist/tx/index.cjs

@@ -174,7 +174,35 @@ module.exports = __toCommonJS(tx_exports);
 
 // src/tx/transaction.ts
 init_errors();
+
+// src/bundle/ulid.ts
+var CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function encodeBase32(value, length) {
+  let out = "";
+  let v = value;
+  for (let i = 0; i < length; i++) {
+    out = CROCKFORD_ALPHABET[v % 32] + out;
+    v = Math.floor(v / 32);
+  }
+  return out;
+}
+function generateULID() {
+  const now = Date.now();
+  const timestampHigh = Math.floor(now / 16777216);
+  const timestampLow = now & 16777215;
+  const tsPart = encodeBase32(timestampHigh, 5) + encodeBase32(timestampLow, 5);
+  const randBytes = new Uint8Array(10);
+  crypto.getRandomValues(randBytes);
+  const rand1 = randBytes[0] * 2 ** 32 + (randBytes[1] << 24 >>> 0) + (randBytes[2] << 16) + (randBytes[3] << 8) + randBytes[4];
+  const rand2 = randBytes[5] * 2 ** 32 + (randBytes[6] << 24 >>> 0) + (randBytes[7] << 16) + (randBytes[8] << 8) + randBytes[9];
+  const randPart = encodeBase32(rand1, 8) + encodeBase32(rand2, 8);
+  return tsPart + randPart;
+}
+
+// src/tx/transaction.ts
 var TxContext = class {
+  /** Stable id for this transaction; shared by all writes it performs. */
+  txId = generateULID();
   /** @internal */
   _ops = [];
   /**
@@ -183,7 +211,7 @@ var TxContext = class {
    * restore prior state via `revertExecuted`. Side-effect writes (e.g.
    * recursive derivation outputs fired inside `Collection.put`) are
    * appended here in execution order so they roll back alongside the
-   * main staged ops (#133).
+   * main staged ops.
    */
   _executed = [];
   /** @internal */
@@ -449,9 +477,61 @@ function keyOf(op) {
   return `${op.vaultName}\0${op.collectionName}\0${op.id}`;
 }
 
+// src/tx/dry-run.ts
+var SEP = " ";
+var keyOf2 = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
+async function runDryRun(db, fn) {
+  const ctx = new TxContext(db);
+  await fn(ctx);
+  const lastOp = /* @__PURE__ */ new Map();
+  for (const op of ctx._ops) lastOp.set(keyOf2(op), op);
+  const affected = [];
+  const guardViolations = [];
+  for (const op of lastOp.values()) {
+    const v = db.vault(op.vaultName);
+    const coll = v.collection(op.collectionName);
+    const before = await coll.get(op.id);
+    if (op.type === "delete") {
+      affected.push({ vault: op.vaultName, op: "delete", collection: op.collectionName, docId: op.id, before, after: null });
+      continue;
+    }
+    const after = op.record ?? null;
+    affected.push({
+      vault: op.vaultName,
+      op: before === null ? "create" : "update",
+      collection: op.collectionName,
+      docId: op.id,
+      before,
+      after
+    });
+    const registry = v._getGuardRegistry();
+    if (!registry) continue;
+    const guards = registry.guardsFor(op.collectionName);
+    if (guards.length === 0) continue;
+    const facade = v._getReadOnlyFacade();
+    if (!facade) continue;
+    const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
+    try {
+      await registry.runChecks(op.collectionName, after, gctx);
+      const { GuardExecutor: GuardExecutor2 } = await Promise.resolve().then(() => (init_executor(), executor_exports));
+      for (const g of guards) {
+        await GuardExecutor2.checkFrozenFields(g, op.id, before, after);
+      }
+    } catch (err) {
+      guardViolations.push({
+        vault: op.vaultName,
+        collection: op.collectionName,
+        docId: op.id,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { affected, guardViolations };
+}
+
 // src/tx/active.ts
 function withTransactions() {
-  return { runTransaction };
+  return { runTransaction, runDryRun };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {