@noy-db/hub 0.2.0-pre.2 → 0.2.0-pre.21

package/dist/fanout-sidecar-VJ52RIEY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations (#200).\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * Stored as plain JSON with AES-GCM bypassed (same pattern as\n * `_meta/policy`, `_meta/recovery-paper`, `_meta/sealed-passphrase`,\n * etc.): the sidecar is system metadata, not user data, and the\n * derived outputs themselves carry their own encryption envelopes.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../types.js'\nimport { NOYDB_FORMAT_VERSION } from '../types.js'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/** Read the sidecar; returns empty if absent. */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as FanoutSidecar\n    if (parsed._noydb_fanout !== 1) return undefined\n    if (!Array.isArray(parsed.keys)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/** Persist (insert/replace) the sidecar with a fresh key set. */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    // AES-GCM bypassed — sidecar is system metadata, no user data inside.\n    _iv: '',\n    _data: JSON.stringify(doc),\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;AAgDA,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAGA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,QAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,kBACpB,OACA,OACA,SAOe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA,IAE5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/issue-ORP37MVW.js

@@ -1,12 +0,0 @@
-import {
-  issueAttestationCore
-} from "./chunk-AHPFONIL.js";
-import "./chunk-4HIL6AHQ.js";
-import "./chunk-FZU343FL.js";
-import "./chunk-YS3POABP.js";
-import "./chunk-2PAQNPE3.js";
-import "./chunk-W3XXT26A.js";
-export {
-  issueAttestationCore
-};
-//# sourceMappingURL=issue-ORP37MVW.js.map

package/dist/mime-magic-CBBSOkjm.d.cts

@@ -1,50 +0,0 @@
-/**
- * Lightweight MIME type detection from magic bytes (file signatures).
- *
- * Designed for the blob store's auto-detection feature. Operates on the first 16 bytes of
- * plaintext — no filesystem access, no filename guessing.
- *
- * ## Detection strategies
- *
- * 1. **Prefix match** — magic bytes at offset 0 (most formats).
- * 2. **Offset match** — magic bytes at a fixed offset > 0 (ISOBMFF: offset 4).
- * 3. **Compound match** — two separate byte sequences at different offsets
- *    (RIFF-based: bytes 0-3 + bytes 8-11).
- *
- * ## Formats excluded (require offset > 16 bytes)
- *
- * - TAR (`ustar` at offset 257)
- * - ISO 9660 (`CD001` at offset 32769)
- *
- * @module
- */
-/**
- * Detect MIME type from the first bytes of a file.
- *
- * @param header - The first 16 bytes (or more) of the plaintext. Passing
- *   fewer than 16 bytes may miss compound and offset-based matches.
- * @returns Detected MIME type, or `'application/octet-stream'` if unknown.
- */
-declare function detectMimeType(header: Uint8Array): string;
-/**
- * Detect MIME type and whether the format is already compressed.
- *
- * Used by `BlobSet.put()` to decide whether to skip gzip compression.
- *
- * @param header - The first 16 bytes (or more) of the plaintext.
- * @returns `{ mime, preCompressed }` or `null` if no match.
- */
-declare function detectMagic(header: Uint8Array): {
-    mime: string;
-    format: string;
-    preCompressed: boolean;
-} | null;
-/**
- * Check whether a format is already compressed (should skip gzip).
- *
- * @param mimeType - A MIME type string.
- * @returns `true` if the format is known to be pre-compressed.
- */
-declare function isPreCompressed(mimeType: string): boolean;
-
-export { detectMimeType as a, detectMagic as d, isPreCompressed as i };

package/dist/mime-magic-CBBSOkjm.d.ts

@@ -1,50 +0,0 @@
-/**
- * Lightweight MIME type detection from magic bytes (file signatures).
- *
- * Designed for the blob store's auto-detection feature. Operates on the first 16 bytes of
- * plaintext — no filesystem access, no filename guessing.
- *
- * ## Detection strategies
- *
- * 1. **Prefix match** — magic bytes at offset 0 (most formats).
- * 2. **Offset match** — magic bytes at a fixed offset > 0 (ISOBMFF: offset 4).
- * 3. **Compound match** — two separate byte sequences at different offsets
- *    (RIFF-based: bytes 0-3 + bytes 8-11).
- *
- * ## Formats excluded (require offset > 16 bytes)
- *
- * - TAR (`ustar` at offset 257)
- * - ISO 9660 (`CD001` at offset 32769)
- *
- * @module
- */
-/**
- * Detect MIME type from the first bytes of a file.
- *
- * @param header - The first 16 bytes (or more) of the plaintext. Passing
- *   fewer than 16 bytes may miss compound and offset-based matches.
- * @returns Detected MIME type, or `'application/octet-stream'` if unknown.
- */
-declare function detectMimeType(header: Uint8Array): string;
-/**
- * Detect MIME type and whether the format is already compressed.
- *
- * Used by `BlobSet.put()` to decide whether to skip gzip compression.
- *
- * @param header - The first 16 bytes (or more) of the plaintext.
- * @returns `{ mime, preCompressed }` or `null` if no match.
- */
-declare function detectMagic(header: Uint8Array): {
-    mime: string;
-    format: string;
-    preCompressed: boolean;
-} | null;
-/**
- * Check whether a format is already compressed (should skip gzip).
- *
- * @param mimeType - A MIME type string.
- * @returns `true` if the format is known to be pre-compressed.
- */
-declare function isPreCompressed(mimeType: string): boolean;
-
-export { detectMimeType as a, detectMagic as d, isPreCompressed as i };

package/dist/noydb-5H3C24GG.js

@@ -1,34 +0,0 @@
-import {
-  Noydb,
-  createNoydb
-} from "./chunk-E535SAN4.js";
-import "./chunk-EMIGCR7X.js";
-import "./chunk-3Z2TPHC4.js";
-import "./chunk-YTXSFG3C.js";
-import "./chunk-7BRE6EUA.js";
-import "./chunk-UND4XIB6.js";
-import "./chunk-243PNUA6.js";
-import "./chunk-QPEXPHJR.js";
-import "./chunk-UF3BUNQZ.js";
-import "./chunk-LRAZDV5X.js";
-import "./chunk-EUYOGYGV.js";
-import "./chunk-7BUTTVMR.js";
-import "./chunk-Q6W2CMEJ.js";
-import "./chunk-2QR2PQTT.js";
-import "./chunk-FZU343FL.js";
-import "./chunk-7Z23ZFLV.js";
-import "./chunk-XG3PTSCD.js";
-import "./chunk-J4KLMEUL.js";
-import "./chunk-YMYK7US4.js";
-import "./chunk-5ZGZ6HIZ.js";
-import "./chunk-VRBCTEKQ.js";
-import "./chunk-MRIBLZL3.js";
-import "./chunk-PFSNOPBQ.js";
-import "./chunk-YS3POABP.js";
-import "./chunk-2PAQNPE3.js";
-import "./chunk-W3XXT26A.js";
-export {
-  Noydb,
-  createNoydb
-};
-//# sourceMappingURL=noydb-5H3C24GG.js.map

package/dist/read-only-facade-ITU6L7BL.js

@@ -1,7 +0,0 @@
-import {
-  ReadOnlyVaultFacade
-} from "./chunk-UMLVJTYV.js";
-export {
-  ReadOnlyVaultFacade
-};
-//# sourceMappingURL=read-only-facade-ITU6L7BL.js.map

package/dist/registry-7HE6VJGC.js

@@ -1,8 +0,0 @@
-import {
-  OverlayedViewRegistry
-} from "./chunk-FAQVNJD4.js";
-import "./chunk-W3XXT26A.js";
-export {
-  OverlayedViewRegistry
-};
-//# sourceMappingURL=registry-7HE6VJGC.js.map

package/dist/registry-PSIPG2QR.js

@@ -1,8 +0,0 @@
-import {
-  DerivationRegistry
-} from "./chunk-GIV6DWBG.js";
-import "./chunk-W3XXT26A.js";
-export {
-  DerivationRegistry
-};
-//# sourceMappingURL=registry-PSIPG2QR.js.map

package/dist/registry-RFGGMVNJ.js

@@ -1,7 +0,0 @@
-import {
-  GuardRegistry
-} from "./chunk-PEULZC6M.js";
-export {
-  GuardRegistry
-};
-//# sourceMappingURL=registry-RFGGMVNJ.js.map

package/dist/with-derivation-BKXXa8Vt.d.ts

@@ -1,13 +0,0 @@
-import { aw as DerivationStrategy, aA as DerivationStrategyHandle } from './types-BoFFiskX.js';
-
-/**
- * Register a deterministic derivation: one source collection → one or
- * more typed outputs, computed by the user's `derive` function on
- * plaintext after DEK unwrap. Outputs are encrypted with the same DEK
- * as the source and written via the standard `Collection.put` path.
- *
- * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.
- */
-declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown>>>(spec: DerivationStrategy<TSource, TOutputs>): DerivationStrategyHandle;
-
-export { withDerivation as w };

package/dist/with-derivation-BjQ7q4NE.d.cts

@@ -1,13 +0,0 @@
-import { aw as DerivationStrategy, aA as DerivationStrategyHandle } from './types-DJG8HG6F.cjs';
-
-/**
- * Register a deterministic derivation: one source collection → one or
- * more typed outputs, computed by the user's `derive` function on
- * plaintext after DEK unwrap. Outputs are encrypted with the same DEK
- * as the source and written via the standard `Collection.put` path.
- *
- * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.
- */
-declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown>>>(spec: DerivationStrategy<TSource, TOutputs>): DerivationStrategyHandle;
-
-export { withDerivation as w };

package/dist/with-guard-C25yNjzd.d.ts

@@ -1,18 +0,0 @@
-import { ah as GuardStrategy, al as GuardStrategyHandle } from './types-BoFFiskX.js';
-
-/**
- * Register a guard for a collection. Guards run on every `put()` /
- * `delete()` for the named collection (after permissions, before
- * encryption) and may:
- *
- *   - `check` — block writes by throwing (typically `RecordLockedError`)
- *   - `frozenFields` — freeze specific fields once a condition is true
- *   - `amendment` — declare an authorized-override path with invariant
- *
- * Pass the returned handle to `createNoydb({ strategies: [...] })`.
- *
- * @see docs/superpowers/specs/2026-05-18-guards-design.md
- */
-declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
-
-export { withGuard as w };

package/dist/with-guard-DQme5DKE.d.cts

@@ -1,18 +0,0 @@
-import { ah as GuardStrategy, al as GuardStrategyHandle } from './types-DJG8HG6F.cjs';
-
-/**
- * Register a guard for a collection. Guards run on every `put()` /
- * `delete()` for the named collection (after permissions, before
- * encryption) and may:
- *
- *   - `check` — block writes by throwing (typically `RecordLockedError`)
- *   - `frozenFields` — freeze specific fields once a condition is true
- *   - `amendment` — declare an authorized-override path with invariant
- *
- * Pass the returned handle to `createNoydb({ strategies: [...] })`.
- *
- * @see docs/superpowers/specs/2026-05-18-guards-design.md
- */
-declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
-
-export { withGuard as w };