@noy-db/hub 0.2.0-pre.10 → 0.2.0-pre.11

package/dist/blobs/index.d.cts

@@ -1,5 +1,5 @@
-import { B as BlobStrategy } from '../types-n2_IfwlQ.cjs';
-export { z as BLOB_CHUNKS_COLLECTION, A as BLOB_COLLECTION, C as BLOB_EVICTION_AUDIT_COLLECTION, E as BLOB_INDEX_COLLECTION, F as BLOB_SLOTS_PREFIX, G as BLOB_VERSIONS_PREFIX, H as BlobEvictionEntry, J as BlobFieldPolicy, K as BlobFieldsConfig, M as BlobObject, N as BlobPutOptions, Q as BlobResponseOptions, T as BlobSet, U as BlobStrategyOpenArgs, V as CompactRunOptions, W as CompactionContext, X as CompactionResult, Y as DEFAULT_CHUNK_SIZE, Z as EXPORT_AUDIT_COLLECTION, _ as ExportBlobsAbortedError, $ as ExportBlobsAuditEntry, a0 as ExportBlobsHandle, a1 as ExportBlobsOptions, a2 as ExportedBlob, a3 as SlotInfo, a4 as SlotRecord, a5 as VersionRecord, a6 as createExportBlobsHandle, a7 as runCompaction } from '../types-n2_IfwlQ.cjs';
+import { B as BlobStrategy } from '../types-DiSXn3a4.cjs';
+export { z as BLOB_CHUNKS_COLLECTION, A as BLOB_COLLECTION, C as BLOB_EVICTION_AUDIT_COLLECTION, E as BLOB_INDEX_COLLECTION, F as BLOB_SLOTS_PREFIX, G as BLOB_VERSIONS_PREFIX, H as BlobEvictionEntry, J as BlobFieldPolicy, K as BlobFieldsConfig, M as BlobObject, N as BlobPutOptions, Q as BlobResponseOptions, T as BlobSet, U as BlobStrategyOpenArgs, V as CompactRunOptions, W as CompactionContext, X as CompactionResult, Y as DEFAULT_CHUNK_SIZE, Z as EXPORT_AUDIT_COLLECTION, _ as ExportBlobsAbortedError, $ as ExportBlobsAuditEntry, a0 as ExportBlobsHandle, a1 as ExportBlobsOptions, a2 as ExportedBlob, a3 as SlotInfo, a4 as SlotRecord, a5 as VersionRecord, a6 as createExportBlobsHandle, a7 as runCompaction } from '../types-DiSXn3a4.cjs';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from '../mime-magic-CBBSOkjm.cjs';
 import '../lazy-builder-Ci5_YG73.cjs';
 import '../predicate-Bt5ft-9c.cjs';

package/dist/blobs/index.d.ts

@@ -1,5 +1,5 @@
-import { B as BlobStrategy } from '../types-CaNQm4i8.js';
-export { z as BLOB_CHUNKS_COLLECTION, A as BLOB_COLLECTION, C as BLOB_EVICTION_AUDIT_COLLECTION, E as BLOB_INDEX_COLLECTION, F as BLOB_SLOTS_PREFIX, G as BLOB_VERSIONS_PREFIX, H as BlobEvictionEntry, J as BlobFieldPolicy, K as BlobFieldsConfig, M as BlobObject, N as BlobPutOptions, Q as BlobResponseOptions, T as BlobSet, U as BlobStrategyOpenArgs, V as CompactRunOptions, W as CompactionContext, X as CompactionResult, Y as DEFAULT_CHUNK_SIZE, Z as EXPORT_AUDIT_COLLECTION, _ as ExportBlobsAbortedError, $ as ExportBlobsAuditEntry, a0 as ExportBlobsHandle, a1 as ExportBlobsOptions, a2 as ExportedBlob, a3 as SlotInfo, a4 as SlotRecord, a5 as VersionRecord, a6 as createExportBlobsHandle, a7 as runCompaction } from '../types-CaNQm4i8.js';
+import { B as BlobStrategy } from '../types-CD8mc8zR.js';
+export { z as BLOB_CHUNKS_COLLECTION, A as BLOB_COLLECTION, C as BLOB_EVICTION_AUDIT_COLLECTION, E as BLOB_INDEX_COLLECTION, F as BLOB_SLOTS_PREFIX, G as BLOB_VERSIONS_PREFIX, H as BlobEvictionEntry, J as BlobFieldPolicy, K as BlobFieldsConfig, M as BlobObject, N as BlobPutOptions, Q as BlobResponseOptions, T as BlobSet, U as BlobStrategyOpenArgs, V as CompactRunOptions, W as CompactionContext, X as CompactionResult, Y as DEFAULT_CHUNK_SIZE, Z as EXPORT_AUDIT_COLLECTION, _ as ExportBlobsAbortedError, $ as ExportBlobsAuditEntry, a0 as ExportBlobsHandle, a1 as ExportBlobsOptions, a2 as ExportedBlob, a3 as SlotInfo, a4 as SlotRecord, a5 as VersionRecord, a6 as createExportBlobsHandle, a7 as runCompaction } from '../types-CD8mc8zR.js';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from '../mime-magic-CBBSOkjm.js';
 import '../lazy-builder-D5GU14TS.js';
 import '../predicate-Bt5ft-9c.js';

package/dist/blobs/index.js

@@ -9,15 +9,15 @@ import {
   detectMagic,
   detectMimeType,
   isPreCompressed
-} from "../chunk-6EOXTJS2.js";
+} from "../chunk-V2PZC6AW.js";
 import {
   BLOB_EVICTION_AUDIT_COLLECTION,
   EXPORT_AUDIT_COLLECTION,
   ExportBlobsAbortedError,
   createExportBlobsHandle,
   runCompaction
-} from "../chunk-DRXIZOFV.js";
-import "../chunk-WIRRPTFH.js";
+} from "../chunk-77DWLQRY.js";
+import "../chunk-SLV4LAKX.js";
 import "../chunk-R233SLY3.js";
 import "../chunk-O6EJ6WTI.js";
 

package/dist/bundle/index.cjs

@@ -1498,6 +1498,18 @@ async function loadKeyring(adapter, vault, userId, passphrase) {
     ...keyringFile.policy !== void 0 && { policy: keyringFile.policy }
   };
 }
+async function assertKeyringOpenAllowed(store, vault, userId, create) {
+  const keyringUsers = await store.list(vault, "_keyring");
+  if (keyringUsers.includes(userId)) return;
+  if (!create) {
+    throw new NoAccessError(`Vault "${vault}" not opened: create disabled and no keyring for "${userId}".`);
+  }
+  if (keyringUsers.length > 0) {
+    throw new NoAccessError(
+      `No keyring for user "${userId}" in vault "${vault}" (held by other principals) \u2014 refusing to self-provision.`
+    );
+  }
+}
 async function createOwnerKeyring(adapter, vault, userId, passphrase, passphraseOpts) {
   if (passphraseOpts?.validate && !passphraseOpts.allowWeakPassphrase) {
     assertStrongPassphrase(passphrase, passphraseOpts);
@@ -16279,7 +16291,7 @@ var init_noydb = __esm({
           }
           return comp;
         }
-        const keyring = await this.getKeyringInternal(name);
+        const keyring = await this.getKeyringInternal(name, { create: opts?.create !== false });
         if (!this.activeTier.has(name)) {
           this.activeTier.set(name, 1);
         }
@@ -16707,7 +16719,7 @@ var init_noydb = __esm({
           const vaultId = vaultIds[idx];
           const task = (async () => {
             try {
-              const comp = await this.openVault(vaultId);
+              const comp = await this.openVault(vaultId, { create: options.create !== false });
               const result = await fn(comp);
               results[idx] = { vault: vaultId, result };
             } catch (err) {
@@ -18049,7 +18061,7 @@ var init_noydb = __esm({
        * accesses see them. Not exposed publicly — callers outside hub
        * should use {@link getKeyring}, which returns a defensive copy.
        */
-      async getKeyringInternal(vault) {
+      async getKeyringInternal(vault, opts = { create: true }) {
         if (this.options.encrypt === false) {
           return createPlaintextKeyring(this.options.user);
         }
@@ -18060,6 +18072,7 @@ var init_noydb = __esm({
           this.keyringCache.set(vault, keyring2);
           return keyring2;
         }
+        await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
         let effectiveSecret;
         if (this.options.passphraseMode === "managed") {
           effectiveSecret = await resolveManagedSecret(