@noy-db/hub 0.2.0-pre.10 → 0.2.0-pre.11

package/dist/bundle/index.d.cts

@@ -1,6 +1,6 @@
-import { T as TransferSealPayload } from '../ulid-CLMjmyhG.cjs';
-export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-CLMjmyhG.cjs';
-import { bw as Vault, b3 as NoydbStore, bs as SealingKeyProvider, bx as RecoveryEnrollmentInput, by as ShamirRecoveryProvider } from '../types-n2_IfwlQ.cjs';
+import { T as TransferSealPayload } from '../ulid-DQ1hcJvZ.cjs';
+export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-DQ1hcJvZ.cjs';
+import { bw as Vault, b3 as NoydbStore, bs as SealingKeyProvider, bx as RecoveryEnrollmentInput, by as ShamirRecoveryProvider } from '../types-DiSXn3a4.cjs';
 export { p as AdoptionStateError, B as BackupCorruptedError, q as BackupLedgerError, r as BundleIntegrityError, s as BundleSealMismatchError, t as BundleVersionConflictError, P as PartitionExtractionError, u as TransferSealError } from '../index-B8bjExET.cjs';
 import '../lazy-builder-Ci5_YG73.cjs';
 import '../predicate-Bt5ft-9c.cjs';

package/dist/bundle/index.d.ts

@@ -1,6 +1,6 @@
-import { T as TransferSealPayload } from '../ulid-B9SMWj5i.js';
-export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-B9SMWj5i.js';
-import { bw as Vault, b3 as NoydbStore, bs as SealingKeyProvider, bx as RecoveryEnrollmentInput, by as ShamirRecoveryProvider } from '../types-CaNQm4i8.js';
+import { T as TransferSealPayload } from '../ulid-8p83wbR4.js';
+export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-8p83wbR4.js';
+import { bw as Vault, b3 as NoydbStore, bs as SealingKeyProvider, bx as RecoveryEnrollmentInput, by as ShamirRecoveryProvider } from '../types-CD8mc8zR.js';
 export { p as AdoptionStateError, B as BackupCorruptedError, q as BackupLedgerError, r as BundleIntegrityError, s as BundleSealMismatchError, t as BundleVersionConflictError, P as PartitionExtractionError, u as TransferSealError } from '../index-DfUbNad8.js';
 import '../lazy-builder-D5GU14TS.js';
 import '../predicate-Bt5ft-9c.js';

package/dist/bundle/index.js

@@ -1,7 +1,7 @@
 import {
   SCHEMAS_COLLECTION,
   resolveManagedSecret
-} from "../chunk-PM3QYWUU.js";
+} from "../chunk-LJXYPGRH.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -20,11 +20,11 @@ import {
   resetBrotliSupportCache,
   validateBundleHeader,
   writeNoydbBundle
-} from "../chunk-BB27JMWB.js";
-import "../chunk-2N62W5YP.js";
+} from "../chunk-TGALXXLV.js";
+import "../chunk-JQ4NEJJ6.js";
 import {
   createOwnerKeyring
-} from "../chunk-HQSQC2XL.js";
+} from "../chunk-QCXNMCHN.js";
 import {
   generateULID,
   isULID
@@ -32,7 +32,7 @@ import {
 import {
   LEDGER_COLLECTION,
   LedgerStore
-} from "../chunk-4CLICFEY.js";
+} from "../chunk-6MFH4BMK.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -41,7 +41,7 @@ import {
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "../chunk-WIRRPTFH.js";
+} from "../chunk-SLV4LAKX.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -532,7 +532,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("../noydb-YAZNH5TI.js");
+    const { createNoydb } = await import("../noydb-SH4RLE47.js");
     const db = await createNoydb({
       store,
       user: userId,

package/dist/{chunk-3LPV6BXR.js → chunk-3DGHRDCX.js}

@@ -56,7 +56,7 @@ function validatePeriodName(name, existing) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-O7FXOG3D.js");
+  const { envelopePayloadHash } = await import("./ledger-NYCGJX2D.js");
   await ledger.append({
     op: "put",
     collection: PERIODS_COLLECTION,
@@ -87,4 +87,4 @@ export {
   appendPeriodLedgerEntry,
   withPeriods
 };
-//# sourceMappingURL=chunk-3LPV6BXR.js.map
+//# sourceMappingURL=chunk-3DGHRDCX.js.map

package/dist/{chunk-4CLICFEY.js → chunk-6MFH4BMK.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-Z6FNBOTC.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   decrypt,
   encrypt
@@ -683,4 +683,4 @@ export {
   LEDGER_DELTAS_COLLECTION,
   LedgerStore
 };
-//# sourceMappingURL=chunk-4CLICFEY.js.map
+//# sourceMappingURL=chunk-6MFH4BMK.js.map

package/dist/{chunk-5IXJGFF2.js → chunk-73YLDCNF.js}

@@ -2,10 +2,10 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-HHOO7HGH.js";
+} from "./chunk-GKI4SDP7.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   decrypt,
   encrypt
@@ -80,4 +80,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-5IXJGFF2.js.map
+//# sourceMappingURL=chunk-73YLDCNF.js.map

package/dist/{chunk-DRXIZOFV.js → chunk-77DWLQRY.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   encrypt
 } from "./chunk-R233SLY3.js";
@@ -230,4 +230,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-DRXIZOFV.js.map
+//# sourceMappingURL=chunk-77DWLQRY.js.map

package/dist/{chunk-TY32C732.js → chunk-EBVBE7UK.js}

@@ -1,13 +1,13 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-HHOO7HGH.js";
+} from "./chunk-GKI4SDP7.js";
 import {
   generateULID
 } from "./chunk-FZU343FL.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   encrypt
 } from "./chunk-R233SLY3.js";
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-TY32C732.js.map
+//# sourceMappingURL=chunk-EBVBE7UK.js.map

package/dist/{chunk-HHOO7HGH.js → chunk-GKI4SDP7.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   decrypt,
   encrypt
@@ -54,4 +54,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-HHOO7HGH.js.map
+//# sourceMappingURL=chunk-GKI4SDP7.js.map

package/dist/{chunk-2N62W5YP.js → chunk-JQ4NEJJ6.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   ValidationError
 } from "./chunk-O6EJ6WTI.js";
@@ -152,4 +152,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-2N62W5YP.js.map
+//# sourceMappingURL=chunk-JQ4NEJJ6.js.map

package/dist/{chunk-PM3QYWUU.js → chunk-LJXYPGRH.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   decrypt,
   encrypt
@@ -248,4 +248,4 @@ export {
   loadSealedPassphrase,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-PM3QYWUU.js.map
+//# sourceMappingURL=chunk-LJXYPGRH.js.map

package/dist/{chunk-4USCAEDT.js → chunk-MPOLUAMI.js}

@@ -19,22 +19,22 @@ import {
   resolveManagedSecret,
   savePersistedSchema,
   saveSealedPassphrase
-} from "./chunk-PM3QYWUU.js";
+} from "./chunk-LJXYPGRH.js";
 import {
   loadPublicEnvelope,
   readPublicEnvelope,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-2N62W5YP.js";
+} from "./chunk-JQ4NEJJ6.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-3LPV6BXR.js";
+} from "./chunk-3DGHRDCX.js";
 import {
   getAtPath,
   isDictCollectionName,
   resolvePolicy,
   setAtPathInPlace
-} from "./chunk-GNHAC43Q.js";
+} from "./chunk-ZBBW7YQN.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
@@ -56,13 +56,14 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-PXTQPZO4.js";
+} from "./chunk-YVZRTCGG.js";
 import {
   assertTierAccess,
   dekKey
 } from "./chunk-CXFOITNS.js";
 import {
   USER_ENVELOPE_COLLECTION,
+  assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
   changeSecret,
   createOwnerKeyring,
@@ -84,7 +85,7 @@ import {
   rotateKeys,
   saveUserEnvelope,
   updateKeyringIdentity
-} from "./chunk-HQSQC2XL.js";
+} from "./chunk-QCXNMCHN.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-2QR2PQTT.js";
@@ -94,7 +95,7 @@ import {
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
-} from "./chunk-4CLICFEY.js";
+} from "./chunk-6MFH4BMK.js";
 import {
   sha256Hex as sha256Hex2
 } from "./chunk-Z6FNBOTC.js";
@@ -113,11 +114,11 @@ import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-DRXIZOFV.js";
+} from "./chunk-77DWLQRY.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-SLV4LAKX.js";
 import {
   decrypt,
   encrypt,
@@ -1693,7 +1694,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-OKPMMPLG.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-F3ZRFU4H.js");
             const prior = await loadFanoutSidecar(
               this.adapter,
               this.vault,
@@ -1986,7 +1987,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-OKPMMPLG.js");
+          helpers = await import("./fanout-sidecar-F3ZRFU4H.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(
           this.adapter,
@@ -5595,12 +5596,12 @@ var Vault = class {
     if (!fieldSchema) {
       throw new AttestationError(`issueAttestation: collection '${collectionName}' has no attestation field-schema. Declare it via vault.collection('${collectionName}', { attestation: { fields: [...] } }).`);
     }
-    const { issueAttestationCore } = await import("./issue-3W6IVLKH.js");
+    const { issueAttestationCore } = await import("./issue-IVTVSKWW.js");
     const out = await issueAttestationCore(this.makeIssueContext(), { collection: collectionName, id, fieldSchema });
     return { docId: out.docId, qr: out.qr, keyId: out.keyId, publicKeyB64: out.publicKeyB64 };
   }
   async getDocumentSigningPublicKey() {
-    const { loadSigner, loadOrCreateSigner } = await import("./signer-7NPTB3SQ.js");
+    const { loadSigner, loadOrCreateSigner } = await import("./signer-QNU66JF5.js");
     const existing = await loadSigner(this.adapter, this.name, this.getDEK);
     if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
     if (this.keyring.role !== "owner") {
@@ -5626,19 +5627,19 @@ var Vault = class {
     };
   }
   async revokeAttestation(docId) {
-    const { revokeDocCore } = await import("./revoke-S6JMSLUN.js");
+    const { revokeDocCore } = await import("./revoke-RT7QYB4G.js");
     await revokeDocCore(this.makeRevokeContext(), docId);
   }
   async unrevokeAttestation(docId) {
-    const { unrevokeDocCore } = await import("./revoke-S6JMSLUN.js");
+    const { unrevokeDocCore } = await import("./revoke-RT7QYB4G.js");
     await unrevokeDocCore(this.makeRevokeContext(), docId);
   }
   async getRevokedDocIds() {
-    const { getRevokedDocIdsCore } = await import("./revoke-S6JMSLUN.js");
+    const { getRevokedDocIdsCore } = await import("./revoke-RT7QYB4G.js");
     return getRevokedDocIdsCore(this.makeRevokeContext());
   }
   async publishRevocationList() {
-    const { publishRevocationListCore } = await import("./revoke-S6JMSLUN.js");
+    const { publishRevocationListCore } = await import("./revoke-RT7QYB4G.js");
     return publishRevocationListCore(this.makeRevokeContext());
   }
   makeRevokeContext() {
@@ -6104,7 +6105,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-OKPMMPLG.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-F3ZRFU4H.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -6816,7 +6817,7 @@ var Vault = class {
    * @see docs/subsystems/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-HMYHZIRH.js");
+    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-QOXZEHKH.js");
     return readPublicEnvelope2(this.adapter, this.name, opts);
   }
   /**
@@ -8548,7 +8549,7 @@ var Noydb = class {
       }
       return comp;
     }
-    const keyring = await this.getKeyringInternal(name);
+    const keyring = await this.getKeyringInternal(name, { create: opts?.create !== false });
     if (!this.activeTier.has(name)) {
       this.activeTier.set(name, 1);
     }
@@ -8976,7 +8977,7 @@ var Noydb = class {
       const vaultId = vaultIds[idx];
       const task = (async () => {
         try {
-          const comp = await this.openVault(vaultId);
+          const comp = await this.openVault(vaultId, { create: options.create !== false });
           const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
@@ -10318,7 +10319,7 @@ var Noydb = class {
    * accesses see them. Not exposed publicly — callers outside hub
    * should use {@link getKeyring}, which returns a defensive copy.
    */
-  async getKeyringInternal(vault) {
+  async getKeyringInternal(vault, opts = { create: true }) {
     if (this.options.encrypt === false) {
       return createPlaintextKeyring(this.options.user);
     }
@@ -10329,6 +10330,7 @@ var Noydb = class {
       this.keyringCache.set(vault, keyring2);
       return keyring2;
     }
+    await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
     if (this.options.passphraseMode === "managed") {
       effectiveSecret = await resolveManagedSecret(
@@ -10526,4 +10528,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-4USCAEDT.js.map
+//# sourceMappingURL=chunk-MPOLUAMI.js.map