@noy-db/hub 0.2.0-pre.15 → 0.2.0-pre.16

package/dist/team/index.d.cts

@@ -1,10 +1,10 @@
-import { b3 as NoydbStore, b1 as UnlockedKeyring } from '../types-BpPV5uyy.cjs';
-export { bt as BundleRecipient, cv as EnrollAuthenticatorOptions, cw as EnrollAuthenticatorWrappingDEKsOptions, cx as EnrollAuthenticatorWrappingKEKOptions, d2 as ListUsersOptions, du as PaperRecoveryEntry, dC as PresenceHandle, dX as RecoverPassphraseInput, dY as RecoverPassphraseResult, dZ as RecoverUserOptions, d_ as RecoveryProof, e1 as RotatePassphraseInput, el as SlotRewrapCeremony, em as SlotRewrapContext, ev as SyncEngine, eD as SyncTransaction, eQ as UpdateAuthenticatorOptions, f8 as WrappedDeksBlob, fe as buildRecipientKeyringFile, ff as burnPaperRecoveryEntry, g1 as changeSecret, g2 as createOwnerKeyring, fi as deriveMagicLinkContentKey, fj as enrollAuthenticator, g3 as ensureCollectionDEK, fm as evaluateExportCapability, fn as evaluateImportCapability, fo as findAuthenticator, g4 as grant, fp as hasExportCapability, fq as hasImportCapability, fs as isMagicLinkGrantExpired, fx as listMagicLinkGrants, fy as listUsers, fz as listUsersWithEnvelopes, g5 as loadKeyring, fB as loadPaperRecoveryEntries, fE as magicLinkGrantRecordId, fF as mintPaperRecoveryEntry, fH as mintWrappedDeksBlob, g6 as persistKeyring, fJ as readMagicLinkGrantRecord, fv as recoverPassphrase, fK as recoverUser, fL as removeAuthenticator, g7 as revoke, fO as revokeMagicLinkGrant, fw as rotatePassphrase, fP as savePaperRecoveryEntries, fS as unwrapDeksFromBlob, fT as unwrapDeksFromPaperEntry, fV as unwrapMagicLinkGrant, g8 as updateAuthenticator, g9 as updateKeyringIdentity, g0 as writeMagicLinkGrant } from '../types-BpPV5uyy.cjs';
+import { a$ as NoydbStore, aZ as UnlockedKeyring } from '../types-Bze6vkwm.cjs';
+export { bp as BundleRecipient, ct as EnrollAuthenticatorOptions, cu as EnrollAuthenticatorWrappingDEKsOptions, cv as EnrollAuthenticatorWrappingKEKOptions, d0 as ListUsersOptions, ds as PaperRecoveryEntry, dA as PresenceHandle, dV as RecoverPassphraseInput, dW as RecoverPassphraseResult, dX as RecoverUserOptions, dY as RecoveryProof, d$ as RotatePassphraseInput, ek as SlotRewrapCeremony, el as SlotRewrapContext, eu as SyncEngine, eC as SyncTransaction, eS as UpdateAuthenticatorOptions, fa as WrappedDeksBlob, fg as buildRecipientKeyringFile, fh as burnPaperRecoveryEntry, g5 as changeSecret, g6 as createOwnerKeyring, fk as deriveMagicLinkContentKey, fl as enrollAuthenticator, g7 as ensureCollectionDEK, fo as evaluateExportCapability, fp as evaluateImportCapability, fq as findAuthenticator, g8 as grant, fr as hasExportCapability, fs as hasImportCapability, fu as isMagicLinkGrantExpired, fz as listMagicLinkGrants, fA as listUsers, fB as listUsersWithEnvelopes, g9 as loadKeyring, fD as loadPaperRecoveryEntries, fG as magicLinkGrantRecordId, fH as mintPaperRecoveryEntry, fJ as mintWrappedDeksBlob, ga as persistKeyring, fL as readMagicLinkGrantRecord, fx as recoverPassphrase, fM as recoverUser, fN as removeAuthenticator, gb as revoke, fR as revokeMagicLinkGrant, fy as rotatePassphrase, fT as savePaperRecoveryEntries, fW as unwrapDeksFromBlob, fX as unwrapDeksFromPaperEntry, fZ as unwrapMagicLinkGrant, gc as updateAuthenticator, gd as updateKeyringIdentity, g4 as writeMagicLinkGrant } from '../types-Bze6vkwm.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
-import '../strategy-CbneC7bS.cjs';
+import '../strategy-BtW8fAjz.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-D95VK1Qy.cjs';
+import '../index-C8Bk3-VF.cjs';
 import '@noy-db/attestation';
 
 /**

package/dist/team/index.d.ts

@@ -1,10 +1,10 @@
-import { b3 as NoydbStore, b1 as UnlockedKeyring } from '../types-4t1-tWS4.js';
-export { bt as BundleRecipient, cv as EnrollAuthenticatorOptions, cw as EnrollAuthenticatorWrappingDEKsOptions, cx as EnrollAuthenticatorWrappingKEKOptions, d2 as ListUsersOptions, du as PaperRecoveryEntry, dC as PresenceHandle, dX as RecoverPassphraseInput, dY as RecoverPassphraseResult, dZ as RecoverUserOptions, d_ as RecoveryProof, e1 as RotatePassphraseInput, el as SlotRewrapCeremony, em as SlotRewrapContext, ev as SyncEngine, eD as SyncTransaction, eQ as UpdateAuthenticatorOptions, f8 as WrappedDeksBlob, fe as buildRecipientKeyringFile, ff as burnPaperRecoveryEntry, g1 as changeSecret, g2 as createOwnerKeyring, fi as deriveMagicLinkContentKey, fj as enrollAuthenticator, g3 as ensureCollectionDEK, fm as evaluateExportCapability, fn as evaluateImportCapability, fo as findAuthenticator, g4 as grant, fp as hasExportCapability, fq as hasImportCapability, fs as isMagicLinkGrantExpired, fx as listMagicLinkGrants, fy as listUsers, fz as listUsersWithEnvelopes, g5 as loadKeyring, fB as loadPaperRecoveryEntries, fE as magicLinkGrantRecordId, fF as mintPaperRecoveryEntry, fH as mintWrappedDeksBlob, g6 as persistKeyring, fJ as readMagicLinkGrantRecord, fv as recoverPassphrase, fK as recoverUser, fL as removeAuthenticator, g7 as revoke, fO as revokeMagicLinkGrant, fw as rotatePassphrase, fP as savePaperRecoveryEntries, fS as unwrapDeksFromBlob, fT as unwrapDeksFromPaperEntry, fV as unwrapMagicLinkGrant, g8 as updateAuthenticator, g9 as updateKeyringIdentity, g0 as writeMagicLinkGrant } from '../types-4t1-tWS4.js';
+import { a$ as NoydbStore, aZ as UnlockedKeyring } from '../types-DrmBTscX.js';
+export { bp as BundleRecipient, ct as EnrollAuthenticatorOptions, cu as EnrollAuthenticatorWrappingDEKsOptions, cv as EnrollAuthenticatorWrappingKEKOptions, d0 as ListUsersOptions, ds as PaperRecoveryEntry, dA as PresenceHandle, dV as RecoverPassphraseInput, dW as RecoverPassphraseResult, dX as RecoverUserOptions, dY as RecoveryProof, d$ as RotatePassphraseInput, ek as SlotRewrapCeremony, el as SlotRewrapContext, eu as SyncEngine, eC as SyncTransaction, eS as UpdateAuthenticatorOptions, fa as WrappedDeksBlob, fg as buildRecipientKeyringFile, fh as burnPaperRecoveryEntry, g5 as changeSecret, g6 as createOwnerKeyring, fk as deriveMagicLinkContentKey, fl as enrollAuthenticator, g7 as ensureCollectionDEK, fo as evaluateExportCapability, fp as evaluateImportCapability, fq as findAuthenticator, g8 as grant, fr as hasExportCapability, fs as hasImportCapability, fu as isMagicLinkGrantExpired, fz as listMagicLinkGrants, fA as listUsers, fB as listUsersWithEnvelopes, g9 as loadKeyring, fD as loadPaperRecoveryEntries, fG as magicLinkGrantRecordId, fH as mintPaperRecoveryEntry, fJ as mintWrappedDeksBlob, ga as persistKeyring, fL as readMagicLinkGrantRecord, fx as recoverPassphrase, fM as recoverUser, fN as removeAuthenticator, gb as revoke, fR as revokeMagicLinkGrant, fy as rotatePassphrase, fT as savePaperRecoveryEntries, fW as unwrapDeksFromBlob, fX as unwrapDeksFromPaperEntry, fZ as unwrapMagicLinkGrant, gc as updateAuthenticator, gd as updateKeyringIdentity, g4 as writeMagicLinkGrant } from '../types-DrmBTscX.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
-import '../strategy-CbneC7bS.js';
+import '../strategy-BtW8fAjz.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-XNB2r6bX.js';
+import '../index-nP99bXLg.js';
 import '@noy-db/attestation';
 
 /**

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   getCredential,
   listCredentials,
   putCredential
-} from "../chunk-NSCVNK5K.js";
+} from "../chunk-SCJPI4Z5.js";
 import {
   burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
@@ -29,13 +29,13 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-COFPAMX6.js";
+} from "../chunk-DLZ2ONOD.js";
 import "../chunk-4TBBMHVC.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-WBAYSNUQ.js";
+} from "../chunk-BI6ETQPF.js";
 import {
   buildRecipientKeyringFile,
   changeSecret,
@@ -52,9 +52,9 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-A5ZOOZFB.js";
+} from "../chunk-6H2ZUNR7.js";
 import "../chunk-2QR2PQTT.js";
-import "../chunk-GC4V7RU7.js";
+import "../chunk-F3BPIPLS.js";
 import "../chunk-YULZKK4F.js";
 import "../chunk-535SSHBS.js";
 export {

package/dist/tx/index.cjs

@@ -335,7 +335,7 @@ var TxCollection = class {
     this._ctx._ops.push(op);
   }
 };
-async function runTransaction(db, fn, options) {
+async function runTransaction(db, fn, options, txInvariants) {
   if (options?.amendment) {
     if (typeof options.reason !== "string" || options.reason.trim().length === 0) {
       throw new ValidationError(
@@ -359,12 +359,19 @@ async function runTransaction(db, fn, options) {
   }
   const priorEnvelopes = /* @__PURE__ */ new Map();
   const store = db._store;
+  const invariants = txInvariants ?? [];
+  const watchedScopes = new Set(invariants.map((i) => i.scope));
+  const plainBefore = /* @__PURE__ */ new Map();
   for (const op of ctx._ops) {
     const key = keyOf(op);
     if (!priorEnvelopes.has(key)) {
       const env = await store.get(op.vaultName, op.collectionName, op.id);
       priorEnvelopes.set(key, env);
     }
+    if (watchedScopes.has(op.collectionName) && !plainBefore.has(key)) {
+      const prior = await db.vault(op.vaultName).collection(op.collectionName).get(op.id);
+      plainBefore.set(key, prior ?? null);
+    }
     if (op.expectedVersion !== void 0) {
       const env = priorEnvelopes.get(key) ?? null;
       const actual = env?._v ?? 0;
@@ -462,6 +469,58 @@ async function runTransaction(db, fn, options) {
       );
     }
   }
+  if (invariants.length > 0) {
+    const lastOp = /* @__PURE__ */ new Map();
+    const order = [];
+    for (const op of ctx._ops) {
+      const key = keyOf(op);
+      if (!lastOp.has(key)) order.push(key);
+      lastOp.set(key, op);
+    }
+    const changesByScope = /* @__PURE__ */ new Map();
+    const scopeVault = /* @__PURE__ */ new Map();
+    for (const key of order) {
+      const op = lastOp.get(key);
+      if (!watchedScopes.has(op.collectionName)) continue;
+      const before = plainBefore.get(key) ?? null;
+      const after = op.type === "delete" ? null : op.record ?? null;
+      const change = { before, after };
+      const arr = changesByScope.get(op.collectionName);
+      if (arr) arr.push(change);
+      else changesByScope.set(op.collectionName, [change]);
+      scopeVault.set(op.collectionName, op.vaultName);
+    }
+    try {
+      for (const inv of invariants) {
+        const changes = changesByScope.get(inv.scope);
+        if (changes === void 0 || changes.length === 0) continue;
+        const vaultName = scopeVault.get(inv.scope);
+        const v = db.vault(vaultName);
+        const facade = v._getReadOnlyFacade() ?? {
+          collection(name) {
+            const c = v.collection(name);
+            return {
+              get: (id) => c.get(id),
+              list: () => c.list(),
+              query: () => c.query()
+            };
+          }
+        };
+        const ctxForInv = {
+          existing: null,
+          vault: facade,
+          userId: v.userId,
+          role: v.role
+        };
+        await inv.check(changes, ctxForInv);
+      }
+    } catch (err) {
+      await revertExecuted(ctx._executed, store, db);
+      throw err instanceof InvariantError ? err : new InvariantError(
+        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
+      );
+    }
+  }
   return bodyResult;
 }
 async function revertExecuted(executed, store, db) {
@@ -537,8 +596,12 @@ async function runDryRun(db, fn) {
 }
 
 // src/tx/active.ts
-function withTransactions() {
-  return { runTransaction, runDryRun };
+function withTransactions(opts) {
+  const invariants = opts?.invariants ?? [];
+  return {
+    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),
+    runDryRun
+  };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {