@noy-db/hub 0.2.0-pre.10 → 0.2.0-pre.11

package/dist/i18n/index.d.cts

@@ -1,5 +1,5 @@
-import { I as I18nStrategy } from '../types-n2_IfwlQ.cjs';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, L as Layer, O as OnMissing, h as OnMissingPolicy, R as ResolveI18nOptions, S as ScriptWarning, i as applyI18nLocale, j as dictCollectionName, k as dictKey, l as enforceScript, m as getAtPath, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, s as resolveI18nText, t as resolvePolicy, u as setAtPathInPlace, v as validateI18nTextValue } from '../types-n2_IfwlQ.cjs';
+import { I as I18nStrategy } from '../types-DiSXn3a4.cjs';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, L as Layer, O as OnMissing, h as OnMissingPolicy, R as ResolveI18nOptions, S as ScriptWarning, i as applyI18nLocale, j as dictCollectionName, k as dictKey, l as enforceScript, m as getAtPath, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, s as resolveI18nText, t as resolvePolicy, u as setAtPathInPlace, v as validateI18nTextValue } from '../types-DiSXn3a4.cjs';
 export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, T as TranslatorNotConfiguredError } from '../index-B8bjExET.cjs';
 import '../lazy-builder-Ci5_YG73.cjs';
 import '../predicate-Bt5ft-9c.cjs';

package/dist/i18n/index.d.ts

@@ -1,5 +1,5 @@
-import { I as I18nStrategy } from '../types-CaNQm4i8.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, L as Layer, O as OnMissing, h as OnMissingPolicy, R as ResolveI18nOptions, S as ScriptWarning, i as applyI18nLocale, j as dictCollectionName, k as dictKey, l as enforceScript, m as getAtPath, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, s as resolveI18nText, t as resolvePolicy, u as setAtPathInPlace, v as validateI18nTextValue } from '../types-CaNQm4i8.js';
+import { I as I18nStrategy } from '../types-CD8mc8zR.js';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, L as Layer, O as OnMissing, h as OnMissingPolicy, R as ResolveI18nOptions, S as ScriptWarning, i as applyI18nLocale, j as dictCollectionName, k as dictKey, l as enforceScript, m as getAtPath, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, s as resolveI18nText, t as resolvePolicy, u as setAtPathInPlace, v as validateI18nTextValue } from '../types-CD8mc8zR.js';
 export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, T as TranslatorNotConfiguredError } from '../index-DfUbNad8.js';
 import '../lazy-builder-D5GU14TS.js';
 import '../predicate-Bt5ft-9c.js';

package/dist/i18n/index.js

@@ -17,10 +17,10 @@ import {
   resolvePolicy,
   setAtPathInPlace,
   validateI18nTextValue
-} from "../chunk-GNHAC43Q.js";
-import "../chunk-HQSQC2XL.js";
+} from "../chunk-ZBBW7YQN.js";
+import "../chunk-QCXNMCHN.js";
 import "../chunk-Z6FNBOTC.js";
-import "../chunk-WIRRPTFH.js";
+import "../chunk-SLV4LAKX.js";
 import "../chunk-R233SLY3.js";
 import {
   DictKeyInUseError,

package/dist/index.cjs

@@ -7940,6 +7940,18 @@ async function loadKeyring(adapter, vault, userId, passphrase) {
     ...keyringFile.policy !== void 0 && { policy: keyringFile.policy }
   };
 }
+async function assertKeyringOpenAllowed(store, vault, userId, create) {
+  const keyringUsers = await store.list(vault, "_keyring");
+  if (keyringUsers.includes(userId)) return;
+  if (!create) {
+    throw new NoAccessError(`Vault "${vault}" not opened: create disabled and no keyring for "${userId}".`);
+  }
+  if (keyringUsers.length > 0) {
+    throw new NoAccessError(
+      `No keyring for user "${userId}" in vault "${vault}" (held by other principals) \u2014 refusing to self-provision.`
+    );
+  }
+}
 async function createOwnerKeyring(adapter, vault, userId, passphrase, passphraseOpts) {
   if (passphraseOpts?.validate && !passphraseOpts.allowWeakPassphrase) {
     assertStrongPassphrase(passphrase, passphraseOpts);
@@ -20779,7 +20791,7 @@ var Noydb = class {
       }
       return comp;
     }
-    const keyring = await this.getKeyringInternal(name);
+    const keyring = await this.getKeyringInternal(name, { create: opts?.create !== false });
     if (!this.activeTier.has(name)) {
       this.activeTier.set(name, 1);
     }
@@ -21207,7 +21219,7 @@ var Noydb = class {
       const vaultId = vaultIds[idx];
       const task = (async () => {
         try {
-          const comp = await this.openVault(vaultId);
+          const comp = await this.openVault(vaultId, { create: options.create !== false });
           const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
@@ -22549,7 +22561,7 @@ var Noydb = class {
    * accesses see them. Not exposed publicly — callers outside hub
    * should use {@link getKeyring}, which returns a defensive copy.
    */
-  async getKeyringInternal(vault) {
+  async getKeyringInternal(vault, opts = { create: true }) {
     if (this.options.encrypt === false) {
       return createPlaintextKeyring(this.options.user);
     }
@@ -22560,6 +22572,7 @@ var Noydb = class {
       this.keyringCache.set(vault, keyring2);
       return keyring2;
     }
+    await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
     if (this.options.passphraseMode === "managed") {
       effectiveSecret = await resolveManagedSecret(