@noy-db/hub 0.2.0-pre.1 → 0.2.0-pre.3

package/dist/team/index.d.cts

@@ -1,10 +1,11 @@
-import { aO as NoydbStore, aM as UnlockedKeyring } from '../types-C4lwMKKF.cjs';
-export { bu as BundleRecipient, bR as EnrollAuthenticatorOptions, bS as EnrollAuthenticatorWrappingDEKsOptions, bT as EnrollAuthenticatorWrappingKEKOptions, ci as ListUsersOptions, cG as PaperRecoveryEntry, cO as PresenceHandle, d7 as RecoverPassphraseInput, d8 as RecoverPassphraseResult, d9 as RecoverUserOptions, da as RecoveryProof, dd as RotatePassphraseInput, dq as SlotRewrapCeremony, dr as SlotRewrapContext, dy as SyncEngine, dG as SyncTransaction, dO as UpdateAuthenticatorOptions, e0 as WrappedDeksBlob, e2 as buildRecipientKeyringFile, e3 as burnPaperRecoveryEntry, eO as changeSecret, eP as createOwnerKeyring, e6 as deriveMagicLinkContentKey, e7 as enrollAuthenticator, eQ as ensureCollectionDEK, e9 as evaluateExportCapability, ea as evaluateImportCapability, eb as findAuthenticator, eR as grant, ec as hasExportCapability, ed as hasImportCapability, ef as isMagicLinkGrantExpired, ek as listMagicLinkGrants, el as listUsers, em as listUsersWithEnvelopes, eS as loadKeyring, eo as loadPaperRecoveryEntries, er as magicLinkGrantRecordId, es as mintPaperRecoveryEntry, eu as mintWrappedDeksBlob, eT as persistKeyring, ew as readMagicLinkGrantRecord, ei as recoverPassphrase, ex as recoverUser, ey as removeAuthenticator, eU as revoke, eB as revokeMagicLinkGrant, ej as rotatePassphrase, eC as savePaperRecoveryEntries, eF as unwrapDeksFromBlob, eG as unwrapDeksFromPaperEntry, eI as unwrapMagicLinkGrant, eV as updateAuthenticator, eW as updateKeyringIdentity, eN as writeMagicLinkGrant } from '../types-C4lwMKKF.cjs';
+import { aO as NoydbStore, aM as UnlockedKeyring } from '../types-CSLcfytP.cjs';
+export { bc as BundleRecipient, b$ as EnrollAuthenticatorOptions, c0 as EnrollAuthenticatorWrappingDEKsOptions, c1 as EnrollAuthenticatorWrappingKEKOptions, cw as ListUsersOptions, cV as PaperRecoveryEntry, d1 as PresenceHandle, dm as RecoverPassphraseInput, dn as RecoverPassphraseResult, dp as RecoverUserOptions, dq as RecoveryProof, dt as RotatePassphraseInput, dF as SlotRewrapCeremony, dG as SlotRewrapContext, dN as SyncEngine, dV as SyncTransaction, e6 as UpdateAuthenticatorOptions, el as WrappedDeksBlob, er as buildRecipientKeyringFile, es as burnPaperRecoveryEntry, fb as changeSecret, fc as createOwnerKeyring, ev as deriveMagicLinkContentKey, ew as enrollAuthenticator, fd as ensureCollectionDEK, ey as evaluateExportCapability, ez as evaluateImportCapability, eA as findAuthenticator, fe as grant, eB as hasExportCapability, eC as hasImportCapability, eE as isMagicLinkGrantExpired, eJ as listMagicLinkGrants, eK as listUsers, eL as listUsersWithEnvelopes, ff as loadKeyring, eN as loadPaperRecoveryEntries, eQ as magicLinkGrantRecordId, eR as mintPaperRecoveryEntry, eT as mintWrappedDeksBlob, fg as persistKeyring, eV as readMagicLinkGrantRecord, eH as recoverPassphrase, eW as recoverUser, eX as removeAuthenticator, fh as revoke, e_ as revokeMagicLinkGrant, eI as rotatePassphrase, e$ as savePaperRecoveryEntries, f2 as unwrapDeksFromBlob, f3 as unwrapDeksFromPaperEntry, f5 as unwrapMagicLinkGrant, fi as updateAuthenticator, fj as updateKeyringIdentity, fa as writeMagicLinkGrant } from '../types-CSLcfytP.cjs';
 import '../lazy-builder-C-rPfWG0.cjs';
 import '../predicate-Dnu81tsS.cjs';
 import '../strategy-DSTrsZ8t.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-CmVgTkqk.cjs';
+import '../index-DVkvrgpm.cjs';
+import '@noy-db/attestation';
 
 /**
  * _sync_credentials reserved collection —

package/dist/team/index.d.ts

@@ -1,10 +1,11 @@
-import { aO as NoydbStore, aM as UnlockedKeyring } from '../types-DW9RGSSs.js';
-export { bu as BundleRecipient, bR as EnrollAuthenticatorOptions, bS as EnrollAuthenticatorWrappingDEKsOptions, bT as EnrollAuthenticatorWrappingKEKOptions, ci as ListUsersOptions, cG as PaperRecoveryEntry, cO as PresenceHandle, d7 as RecoverPassphraseInput, d8 as RecoverPassphraseResult, d9 as RecoverUserOptions, da as RecoveryProof, dd as RotatePassphraseInput, dq as SlotRewrapCeremony, dr as SlotRewrapContext, dy as SyncEngine, dG as SyncTransaction, dO as UpdateAuthenticatorOptions, e0 as WrappedDeksBlob, e2 as buildRecipientKeyringFile, e3 as burnPaperRecoveryEntry, eO as changeSecret, eP as createOwnerKeyring, e6 as deriveMagicLinkContentKey, e7 as enrollAuthenticator, eQ as ensureCollectionDEK, e9 as evaluateExportCapability, ea as evaluateImportCapability, eb as findAuthenticator, eR as grant, ec as hasExportCapability, ed as hasImportCapability, ef as isMagicLinkGrantExpired, ek as listMagicLinkGrants, el as listUsers, em as listUsersWithEnvelopes, eS as loadKeyring, eo as loadPaperRecoveryEntries, er as magicLinkGrantRecordId, es as mintPaperRecoveryEntry, eu as mintWrappedDeksBlob, eT as persistKeyring, ew as readMagicLinkGrantRecord, ei as recoverPassphrase, ex as recoverUser, ey as removeAuthenticator, eU as revoke, eB as revokeMagicLinkGrant, ej as rotatePassphrase, eC as savePaperRecoveryEntries, eF as unwrapDeksFromBlob, eG as unwrapDeksFromPaperEntry, eI as unwrapMagicLinkGrant, eV as updateAuthenticator, eW as updateKeyringIdentity, eN as writeMagicLinkGrant } from '../types-DW9RGSSs.js';
+import { aO as NoydbStore, aM as UnlockedKeyring } from '../types-D9eB0Rvh.js';
+export { bc as BundleRecipient, b$ as EnrollAuthenticatorOptions, c0 as EnrollAuthenticatorWrappingDEKsOptions, c1 as EnrollAuthenticatorWrappingKEKOptions, cw as ListUsersOptions, cV as PaperRecoveryEntry, d1 as PresenceHandle, dm as RecoverPassphraseInput, dn as RecoverPassphraseResult, dp as RecoverUserOptions, dq as RecoveryProof, dt as RotatePassphraseInput, dF as SlotRewrapCeremony, dG as SlotRewrapContext, dN as SyncEngine, dV as SyncTransaction, e6 as UpdateAuthenticatorOptions, el as WrappedDeksBlob, er as buildRecipientKeyringFile, es as burnPaperRecoveryEntry, fb as changeSecret, fc as createOwnerKeyring, ev as deriveMagicLinkContentKey, ew as enrollAuthenticator, fd as ensureCollectionDEK, ey as evaluateExportCapability, ez as evaluateImportCapability, eA as findAuthenticator, fe as grant, eB as hasExportCapability, eC as hasImportCapability, eE as isMagicLinkGrantExpired, eJ as listMagicLinkGrants, eK as listUsers, eL as listUsersWithEnvelopes, ff as loadKeyring, eN as loadPaperRecoveryEntries, eQ as magicLinkGrantRecordId, eR as mintPaperRecoveryEntry, eT as mintWrappedDeksBlob, fg as persistKeyring, eV as readMagicLinkGrantRecord, eH as recoverPassphrase, eW as recoverUser, eX as removeAuthenticator, fh as revoke, e_ as revokeMagicLinkGrant, eI as rotatePassphrase, e$ as savePaperRecoveryEntries, f2 as unwrapDeksFromBlob, f3 as unwrapDeksFromPaperEntry, f5 as unwrapMagicLinkGrant, fi as updateAuthenticator, fj as updateKeyringIdentity, fa as writeMagicLinkGrant } from '../types-D9eB0Rvh.js';
 import '../lazy-builder-Rpd-V3jP.js';
 import '../predicate-Dnu81tsS.js';
 import '../strategy-DSTrsZ8t.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-CNwA-B6-.js';
+import '../index-BF1B2HB9.js';
+import '@noy-db/attestation';
 
 /**
  * _sync_credentials reserved collection —

package/dist/team/index.js

@@ -1,20 +1,22 @@
 import {
   SYNC_CREDENTIALS_COLLECTION,
-  burnPaperRecoveryEntry,
   credentialStatus,
   deleteCredential,
+  getCredential,
+  listCredentials,
+  putCredential
+} from "../chunk-4OQWR46B.js";
+import {
+  burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
-  getCredential,
   isMagicLinkGrantExpired,
-  listCredentials,
   listMagicLinkGrants,
   loadPaperRecoveryEntries,
   magicLinkGrantRecordId,
   mintPaperRecoveryEntry,
   mintWrappedDeksBlob,
-  putCredential,
   readMagicLinkGrantRecord,
   recoverPassphrase,
   recoverUser,
@@ -27,13 +29,13 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-CBAHB2BF.js";
-import "../chunk-DYBQG5PQ.js";
+} from "../chunk-2EYC3WDT.js";
+import "../chunk-6S3LLAQ5.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-4TFSM22V.js";
+} from "../chunk-LS3JLEIB.js";
 import {
   buildRecipientKeyringFile,
   changeSecret,
@@ -50,11 +52,11 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-PA6R5ZCI.js";
+} from "../chunk-TLFUDXVV.js";
 import "../chunk-2QR2PQTT.js";
-import "../chunk-YS3POABP.js";
-import "../chunk-WCA2NROQ.js";
-import "../chunk-ADQ5MQ54.js";
+import "../chunk-FXQYZNOW.js";
+import "../chunk-UOF74WQY.js";
+import "../chunk-YDLAFP36.js";
 export {
   PresenceHandle,
   SYNC_CREDENTIALS_COLLECTION,

package/dist/tx/index.cjs

@@ -174,7 +174,35 @@ module.exports = __toCommonJS(tx_exports);
 
 // src/tx/transaction.ts
 init_errors();
+
+// src/bundle/ulid.ts
+var CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function encodeBase32(value, length) {
+  let out = "";
+  let v = value;
+  for (let i = 0; i < length; i++) {
+    out = CROCKFORD_ALPHABET[v % 32] + out;
+    v = Math.floor(v / 32);
+  }
+  return out;
+}
+function generateULID() {
+  const now = Date.now();
+  const timestampHigh = Math.floor(now / 16777216);
+  const timestampLow = now & 16777215;
+  const tsPart = encodeBase32(timestampHigh, 5) + encodeBase32(timestampLow, 5);
+  const randBytes = new Uint8Array(10);
+  crypto.getRandomValues(randBytes);
+  const rand1 = randBytes[0] * 2 ** 32 + (randBytes[1] << 24 >>> 0) + (randBytes[2] << 16) + (randBytes[3] << 8) + randBytes[4];
+  const rand2 = randBytes[5] * 2 ** 32 + (randBytes[6] << 24 >>> 0) + (randBytes[7] << 16) + (randBytes[8] << 8) + randBytes[9];
+  const randPart = encodeBase32(rand1, 8) + encodeBase32(rand2, 8);
+  return tsPart + randPart;
+}
+
+// src/tx/transaction.ts
 var TxContext = class {
+  /** Stable id for this transaction; shared by all writes it performs (#230). */
+  txId = generateULID();
   /** @internal */
   _ops = [];
   /**
@@ -449,9 +477,61 @@ function keyOf(op) {
   return `${op.vaultName}\0${op.collectionName}\0${op.id}`;
 }
 
+// src/tx/dry-run.ts
+var SEP = " ";
+var keyOf2 = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
+async function runDryRun(db, fn) {
+  const ctx = new TxContext(db);
+  await fn(ctx);
+  const lastOp = /* @__PURE__ */ new Map();
+  for (const op of ctx._ops) lastOp.set(keyOf2(op), op);
+  const affected = [];
+  const guardViolations = [];
+  for (const op of lastOp.values()) {
+    const v = db.vault(op.vaultName);
+    const coll = v.collection(op.collectionName);
+    const before = await coll.get(op.id);
+    if (op.type === "delete") {
+      affected.push({ vault: op.vaultName, op: "delete", collection: op.collectionName, docId: op.id, before, after: null });
+      continue;
+    }
+    const after = op.record ?? null;
+    affected.push({
+      vault: op.vaultName,
+      op: before === null ? "create" : "update",
+      collection: op.collectionName,
+      docId: op.id,
+      before,
+      after
+    });
+    const registry = v._getGuardRegistry();
+    if (!registry) continue;
+    const guards = registry.guardsFor(op.collectionName);
+    if (guards.length === 0) continue;
+    const facade = v._getReadOnlyFacade();
+    if (!facade) continue;
+    const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
+    try {
+      await registry.runChecks(op.collectionName, after, gctx);
+      const { GuardExecutor: GuardExecutor2 } = await Promise.resolve().then(() => (init_executor(), executor_exports));
+      for (const g of guards) {
+        await GuardExecutor2.checkFrozenFields(g, op.id, before, after);
+      }
+    } catch (err) {
+      guardViolations.push({
+        vault: op.vaultName,
+        collection: op.collectionName,
+        docId: op.id,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { affected, guardViolations };
+}
+
 // src/tx/active.ts
 function withTransactions() {
-  return { runTransaction };
+  return { runTransaction, runDryRun };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {