@noy-db/hub 0.2.0-pre.23 → 0.2.0-pre.24

package/dist/i18n/index.d.cts

@@ -1,12 +1,12 @@
-export { I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, O as OnMissing, c as OnMissingPolicy, R as ResolveI18nOptions, d as applyI18nLocale, g as getAtPath, i as i18nText, e as isI18nTextDescriptor, r as resolveI18nText, f as resolvePolicy, s as setAtPathInPlace, v as validateI18nTextValue } from '../strategy-WtB-jXYv.cjs';
-import { I as I18nStrategy } from '../types-Bhs2i_Ll.cjs';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, S as ScriptWarning, e as StaticDictDescriptor, f as dictCollectionName, g as dictKey, h as enforceScript, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, l as isStaticDictDescriptor, s as staticDict } from '../types-Bhs2i_Ll.cjs';
-export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, b as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError } from '../errors-Dkc_fi-S.cjs';
+export { I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, O as OnMissing, c as OnMissingPolicy, R as ResolveI18nOptions, d as applyI18nLocale, g as getAtPath, i as i18nText, e as isI18nTextDescriptor, r as resolveI18nText, f as resolvePolicy, s as setAtPathInPlace, v as validateI18nTextValue } from '../strategy-BWmgRPA2.cjs';
+import { I as I18nStrategy } from '../types-COQ6qJZh.cjs';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, S as ScriptWarning, e as StaticDictDescriptor, f as dictCollectionName, g as dictKey, h as enforceScript, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, l as isStaticDictDescriptor, s as staticDict } from '../types-COQ6qJZh.cjs';
+export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, b as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError } from '../errors-B2tUcRPg.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
 import '../strategy-BSxFXGzb.cjs';
 import '../index-BMmajblo.cjs';
-import '../index-tZqVB9g5.cjs';
+import '../index-BthnP2MA.cjs';
 import '@noy-db/attestation';
 
 /**

package/dist/i18n/index.d.ts

@@ -1,12 +1,12 @@
-export { I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, O as OnMissing, c as OnMissingPolicy, R as ResolveI18nOptions, d as applyI18nLocale, g as getAtPath, i as i18nText, e as isI18nTextDescriptor, r as resolveI18nText, f as resolvePolicy, s as setAtPathInPlace, v as validateI18nTextValue } from '../strategy-54eIwox5.js';
-import { I as I18nStrategy } from '../types-DONgts0n.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, S as ScriptWarning, e as StaticDictDescriptor, f as dictCollectionName, g as dictKey, h as enforceScript, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, l as isStaticDictDescriptor, s as staticDict } from '../types-DONgts0n.js';
-export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, b as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError } from '../errors-Dkc_fi-S.js';
+export { I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, O as OnMissing, c as OnMissingPolicy, R as ResolveI18nOptions, d as applyI18nLocale, g as getAtPath, i as i18nText, e as isI18nTextDescriptor, r as resolveI18nText, f as resolvePolicy, s as setAtPathInPlace, v as validateI18nTextValue } from '../strategy-D47TC5X6.js';
+import { I as I18nStrategy } from '../types-BGRX6sPT.js';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, S as ScriptWarning, e as StaticDictDescriptor, f as dictCollectionName, g as dictKey, h as enforceScript, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, l as isStaticDictDescriptor, s as staticDict } from '../types-BGRX6sPT.js';
+export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, b as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError } from '../errors-B2tUcRPg.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
 import '../strategy-BSxFXGzb.js';
 import '../index-BMmajblo.js';
-import '../index-Bm9hIY7t.js';
+import '../index-BLff_E35.js';
 import '@noy-db/attestation';
 
 /**

package/dist/i18n/index.js

@@ -7,7 +7,7 @@ import {
   isDictKeyDescriptor,
   isStaticDictDescriptor,
   staticDict
-} from "../chunk-O5XKZCUD.js";
+} from "../chunk-7X4EF35A.js";
 import {
   applyI18nLocale,
   enforceScript,
@@ -19,11 +19,11 @@ import {
   resolvePolicy,
   setAtPathInPlace,
   validateI18nTextValue
-} from "../chunk-TNH5SLCD.js";
-import "../chunk-FRRJIUSI.js";
+} from "../chunk-HD4QCT2O.js";
+import "../chunk-B5CSNGSE.js";
 import "../chunk-PDVP3C2I.js";
-import "../chunk-TA6HPKWQ.js";
-import "../chunk-37VGJM3T.js";
+import "../chunk-LR7CODVN.js";
+import "../chunk-WQ3KAGOV.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -34,7 +34,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-OTWT6BAJ.js";
+} from "../chunk-4BB4T3O7.js";
 
 // src/i18n/active.ts
 function withI18n() {

package/dist/index-B8MoIS7B.d.ts

@@ -0,0 +1,70 @@
+import './predicate-BmhBSPCH.js';
+import './strategy-D47TC5X6.js';
+import './ulid-DRH25k3y.js';
+import './errors-B2tUcRPg.js';
+import './types-BGRX6sPT.js';
+import './index-BLff_E35.js';
+
+interface EncryptResult {
+    iv: string;
+    data: string;
+}
+/**
+ * Encrypt raw bytes with AES-256-GCM using a fresh random IV.
+ * Used by the attachment store so binary blobs avoid double base64 encoding
+ * (the existing `encrypt()` function calls `TextEncoder` on a string — here
+ * we pass the `Uint8Array` directly to `subtle.encrypt`).
+ */
+declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<EncryptResult>;
+/**
+ * Decrypt AES-256-GCM ciphertext back to raw bytes.
+ * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
+ */
+declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
+/**
+ * SHA-256 hex digest of raw bytes. Used to derive content-addressed
+ * eTags for blob deduplication. Computed on plaintext bytes
+ * before compression and encryption so the eTag identifies content, not
+ * ciphertext, and survives re-encryption (key rotation, re-upload).
+ */
+declare function sha256Hex(data: Uint8Array): Promise<string>;
+/**
+ * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
+ *
+ * The presence key is domain-separated from the data DEK by the fixed salt
+ * `'noydb-presence'` and the `info` = collection name. This means:
+ *  - The adapter never sees the presence key.
+ *  - Presence payloads rotate automatically when the collection DEK is rotated.
+ *  - Revoked users cannot derive the new presence key after a DEK rotation.
+ *
+ * @param dek            The collection's AES-256-GCM DEK (extractable).
+ * @param collectionName Used as the HKDF `info` parameter for domain separation.
+ * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
+ */
+declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
+/**
+ * Encrypt a plaintext string with AES-256-GCM and a deterministic,
+ * HKDF-derived IV.
+ *
+ * The same `{ dek, context, plaintext }` triple always produces the
+ * same `{ iv, data }` — call this twice and you can string-compare the
+ * ciphertexts to check equality of the inputs without decrypting them.
+ *
+ * @param context  Domain-separation string — by convention
+ *                 `'<collection>/<field>'`. Different contexts encrypt
+ *                 the same plaintext to different ciphertexts, so
+ *                 `email` in collection `users` does not collide with
+ *                 `email` in collection `customers`.
+ */
+declare function encryptDeterministic(plaintext: string, dek: CryptoKey, context: string): Promise<EncryptResult>;
+/**
+ * Counterpart to {@link encryptDeterministic}. The IV is stored
+ * alongside the ciphertext (exactly like the randomized path), so
+ * decrypt uses the stored IV and verifies the GCM auth tag — a tampered
+ * ciphertext throws `TamperedError` just like randomized AES-GCM.
+ */
+declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
+declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
+declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
+
+export { bufferToBase64 as a, base64ToBuffer as b, decryptDeterministic as c, decryptBytes as d, derivePresenceKey as e, encryptBytes as f, encryptDeterministic as g, sha256Hex as s };

package/dist/{index-Bm9hIY7t.d.ts → index-BLff_E35.d.ts}

@@ -1,6 +1,6 @@
 import { C as CollectionIndexes, a as Clause, O as Operator } from './predicate-BmhBSPCH.js';
-import { N as NoydbError } from './errors-Dkc_fi-S.js';
-import { a as I18nTextDescriptor, N as MoneyDescriptor, A as AggregateStrategy, j as AggregateSpec, k as Aggregation, h as AggregateResult, o as GroupedQuery, p as GroupedQueryN } from './strategy-54eIwox5.js';
+import { N as NoydbError } from './errors-B2tUcRPg.js';
+import { a as I18nTextDescriptor, N as MoneyDescriptor, A as AggregateStrategy, j as AggregateSpec, k as Aggregation, h as AggregateResult, o as GroupedQuery, p as GroupedQueryN } from './strategy-D47TC5X6.js';
 
 /**
  * Foreign-key references — the soft-FK mechanism.

package/dist/{index-tZqVB9g5.d.cts → index-BthnP2MA.d.cts}

@@ -1,6 +1,6 @@
 import { C as CollectionIndexes, a as Clause, O as Operator } from './predicate-BmhBSPCH.cjs';
-import { N as NoydbError } from './errors-Dkc_fi-S.cjs';
-import { a as I18nTextDescriptor, N as MoneyDescriptor, A as AggregateStrategy, j as AggregateSpec, k as Aggregation, h as AggregateResult, o as GroupedQuery, p as GroupedQueryN } from './strategy-WtB-jXYv.cjs';
+import { N as NoydbError } from './errors-B2tUcRPg.cjs';
+import { a as I18nTextDescriptor, N as MoneyDescriptor, A as AggregateStrategy, j as AggregateSpec, k as Aggregation, h as AggregateResult, o as GroupedQuery, p as GroupedQueryN } from './strategy-BWmgRPA2.cjs';
 
 /**
  * Foreign-key references — the soft-FK mechanism.

package/dist/index-da0M3NnR.d.cts

@@ -0,0 +1,70 @@
+import './predicate-BmhBSPCH.cjs';
+import './strategy-BWmgRPA2.cjs';
+import './ulid-DRH25k3y.cjs';
+import './errors-B2tUcRPg.cjs';
+import './types-COQ6qJZh.cjs';
+import './index-BthnP2MA.cjs';
+
+interface EncryptResult {
+    iv: string;
+    data: string;
+}
+/**
+ * Encrypt raw bytes with AES-256-GCM using a fresh random IV.
+ * Used by the attachment store so binary blobs avoid double base64 encoding
+ * (the existing `encrypt()` function calls `TextEncoder` on a string — here
+ * we pass the `Uint8Array` directly to `subtle.encrypt`).
+ */
+declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<EncryptResult>;
+/**
+ * Decrypt AES-256-GCM ciphertext back to raw bytes.
+ * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
+ */
+declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
+/**
+ * SHA-256 hex digest of raw bytes. Used to derive content-addressed
+ * eTags for blob deduplication. Computed on plaintext bytes
+ * before compression and encryption so the eTag identifies content, not
+ * ciphertext, and survives re-encryption (key rotation, re-upload).
+ */
+declare function sha256Hex(data: Uint8Array): Promise<string>;
+/**
+ * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
+ *
+ * The presence key is domain-separated from the data DEK by the fixed salt
+ * `'noydb-presence'` and the `info` = collection name. This means:
+ *  - The adapter never sees the presence key.
+ *  - Presence payloads rotate automatically when the collection DEK is rotated.
+ *  - Revoked users cannot derive the new presence key after a DEK rotation.
+ *
+ * @param dek            The collection's AES-256-GCM DEK (extractable).
+ * @param collectionName Used as the HKDF `info` parameter for domain separation.
+ * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
+ */
+declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
+/**
+ * Encrypt a plaintext string with AES-256-GCM and a deterministic,
+ * HKDF-derived IV.
+ *
+ * The same `{ dek, context, plaintext }` triple always produces the
+ * same `{ iv, data }` — call this twice and you can string-compare the
+ * ciphertexts to check equality of the inputs without decrypting them.
+ *
+ * @param context  Domain-separation string — by convention
+ *                 `'<collection>/<field>'`. Different contexts encrypt
+ *                 the same plaintext to different ciphertexts, so
+ *                 `email` in collection `users` does not collide with
+ *                 `email` in collection `customers`.
+ */
+declare function encryptDeterministic(plaintext: string, dek: CryptoKey, context: string): Promise<EncryptResult>;
+/**
+ * Counterpart to {@link encryptDeterministic}. The IV is stored
+ * alongside the ciphertext (exactly like the randomized path), so
+ * decrypt uses the stored IV and verifies the GCM auth tag — a tampered
+ * ciphertext throws `TamperedError` just like randomized AES-GCM.
+ */
+declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
+declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
+declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
+
+export { bufferToBase64 as a, base64ToBuffer as b, decryptDeterministic as c, decryptBytes as d, derivePresenceKey as e, encryptBytes as f, encryptDeterministic as g, sha256Hex as s };