@noy-db/hub 0.2.0-pre.23 → 0.2.0-pre.25

package/dist/bundle/index.d.cts

@@ -1,13 +1,14 @@
-import { T as TransferSealPayload } from '../ulid-Bg-IBJyA.cjs';
-export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-Bg-IBJyA.cjs';
-import { bh as Vault, aW as NoydbStore, bd as SealingKeyProvider, bi as RecoveryEnrollmentInput, bj as ShamirRecoveryProvider } from '../types-Bhs2i_Ll.cjs';
-export { t as AdoptionStateError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, P as PartitionExtractionError, y as TransferSealError } from '../errors-Dkc_fi-S.cjs';
+import { T as TransferSealPayload } from '../decrypt-partition-C71vhnND.cjs';
+export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, D as DecryptedRecord, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as decryptExtractedPartition, j as encodeBundleHeader, r as readNoydbBundle, k as readNoydbBundleHeader, l as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../decrypt-partition-C71vhnND.cjs';
+export { g as generateULID, i as isULID } from '../ulid-DRH25k3y.cjs';
+import { bh as Vault, aW as NoydbStore, bd as SealingKeyProvider, bi as RecoveryEnrollmentInput, bj as ShamirRecoveryProvider } from '../types-BCYvhKzr.cjs';
+export { t as AdoptionStateError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, P as PartitionExtractionError, y as TransferSealError } from '../errors-Dwk2k1xY.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
-import '../strategy-WtB-jXYv.cjs';
+import '../strategy-D1zjEV3n.cjs';
 import '../strategy-BSxFXGzb.cjs';
 import '../index-BMmajblo.cjs';
-import '../index-tZqVB9g5.cjs';
+import '../index-DoxKSsMj.cjs';
 import '@noy-db/attestation';
 
 /**
@@ -106,6 +107,14 @@ declare function extractPartition(vault: Vault, opts: WalkClosureOptions & {
     readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none';
     readonly carrySchemas?: boolean;
     readonly carryLedger?: boolean;
+    /**
+     * FR-7 structural field projection: per-collection allow-list of fields
+     * to keep. Non-listed fields are dropped from each record BEFORE
+     * re-encryption (so they never travel in the bundle); `id` is always
+     * preserved. A projected collection's persisted schema is NOT carried.
+     * Absent/empty → un-projected behavior (byte-identical to today).
+     */
+    readonly fieldProjection?: Record<string, readonly string[]>;
 }): Promise<ExtractPartitionResult>;
 
 /**

package/dist/bundle/index.d.ts

@@ -1,13 +1,14 @@
-import { T as TransferSealPayload } from '../ulid-Dwt3JEcy.js';
-export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-Dwt3JEcy.js';
-import { bh as Vault, aW as NoydbStore, bd as SealingKeyProvider, bi as RecoveryEnrollmentInput, bj as ShamirRecoveryProvider } from '../types-DONgts0n.js';
-export { t as AdoptionStateError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, P as PartitionExtractionError, y as TransferSealError } from '../errors-Dkc_fi-S.js';
+import { T as TransferSealPayload } from '../decrypt-partition-CyyJUWLR.js';
+export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, D as DecryptedRecord, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as decryptExtractedPartition, j as encodeBundleHeader, r as readNoydbBundle, k as readNoydbBundleHeader, l as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../decrypt-partition-CyyJUWLR.js';
+export { g as generateULID, i as isULID } from '../ulid-DRH25k3y.js';
+import { bh as Vault, aW as NoydbStore, bd as SealingKeyProvider, bi as RecoveryEnrollmentInput, bj as ShamirRecoveryProvider } from '../types-CCq0WHh9.js';
+export { t as AdoptionStateError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, P as PartitionExtractionError, y as TransferSealError } from '../errors-Dwk2k1xY.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
-import '../strategy-54eIwox5.js';
+import '../strategy-YQ1qJWyq.js';
 import '../strategy-BSxFXGzb.js';
 import '../index-BMmajblo.js';
-import '../index-Bm9hIY7t.js';
+import '../index-LaexBi3v.js';
 import '@noy-db/attestation';
 
 /**
@@ -106,6 +107,14 @@ declare function extractPartition(vault: Vault, opts: WalkClosureOptions & {
     readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none';
     readonly carrySchemas?: boolean;
     readonly carryLedger?: boolean;
+    /**
+     * FR-7 structural field projection: per-collection allow-list of fields
+     * to keep. Non-listed fields are dropped from each record BEFORE
+     * re-encryption (so they never travel in the bundle); `id` is always
+     * preserved. A projected collection's persisted schema is NOT carried.
+     * Absent/empty → un-projected behavior (byte-identical to today).
+     */
+    readonly fieldProjection?: Record<string, readonly string[]>;
 }): Promise<ExtractPartitionResult>;
 
 /**

package/dist/bundle/index.js

@@ -1,7 +1,12 @@
 import {
-  SCHEMAS_COLLECTION,
-  resolveManagedSecret
-} from "../chunk-C6W5KVDV.js";
+  adoptPartition,
+  createOwnerOnAdoptedPartition,
+  decryptExtractedPartition,
+  unsealDeks
+} from "../chunk-RZOGD7IF.js";
+import {
+  SCHEMAS_COLLECTION
+} from "../chunk-YP2AYE5W.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -14,26 +19,22 @@ import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper,
   encodeBundleHeader,
-  parseExtractedPartitionBody,
   readNoydbBundle,
   readNoydbBundleHeader,
   resetBrotliSupportCache,
   validateBundleHeader,
   writeNoydbBundle
-} from "../chunk-WE2BUQD2.js";
-import "../chunk-JOK73NDT.js";
-import "../chunk-BZW5IL43.js";
-import {
-  createOwnerKeyring
-} from "../chunk-FRRJIUSI.js";
+} from "../chunk-N4EXCKWP.js";
+import "../chunk-HUXDQIVU.js";
+import "../chunk-Y5CTT6K5.js";
+import "../chunk-UNBX2HMA.js";
 import {
   generateULID,
   isULID
 } from "../chunk-FZU343FL.js";
 import {
-  LEDGER_COLLECTION,
-  LedgerStore
-} from "../chunk-JDCPRJVS.js";
+  LEDGER_COLLECTION
+} from "../chunk-EYZJULEN.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -42,17 +43,15 @@ import {
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "../chunk-TA6HPKWQ.js";
+} from "../chunk-LR7CODVN.js";
 import {
-  base64ToBuffer,
   bufferToBase64,
   decrypt,
   encrypt,
   generateDEK,
   unwrapCek,
-  wrapCek,
-  wrapKey
-} from "../chunk-37VGJM3T.js";
+  wrapCek
+} from "../chunk-7JSP3E67.js";
 import {
   AdoptionStateError,
   BackupCorruptedError,
@@ -61,9 +60,8 @@ import {
   BundleSealMismatchError,
   BundleVersionConflictError,
   PartitionExtractionError,
-  TransferSealError,
-  ValidationError
-} from "../chunk-OTWT6BAJ.js";
+  TransferSealError
+} from "../chunk-DDOYOMAD.js";
 
 // src/bundle/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -208,7 +206,7 @@ async function describeExtraction(vault, opts) {
 }
 
 // src/bundle/extract-partition.ts
-async function reKeyClosure(vault, closure) {
+async function reKeyClosure(vault, closure, fieldProjection) {
   const { name: vaultName, adapter, getDEK } = vault._introspectState();
   const collections = {};
   const deks = /* @__PURE__ */ new Map();
@@ -217,29 +215,40 @@ async function reKeyClosure(vault, closure) {
     const destDek = await generateDEK();
     deks.set(collectionName, destDek);
     const out = {};
+    const projList = fieldProjection?.[collectionName];
+    const proj = projList ? new Set(projList) : void 0;
+    const project = (plaintext) => {
+      if (!proj) return plaintext;
+      const rec = JSON.parse(plaintext);
+      const kept = {};
+      if ("id" in rec) kept["id"] = rec["id"];
+      for (const f of proj) if (f in rec) kept[f] = rec[f];
+      return JSON.stringify(kept);
+    };
     for (const id of ids) {
       const env = await adapter.get(vaultName, collectionName, id);
       if (!env) continue;
       if (env._cek !== void 0) {
         const cek = await unwrapCek(env._cek, srcDek);
         const plaintext2 = await decrypt(env._iv, env._data, cek);
-        const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
+        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek);
         const wrapped = await wrapCek(cek, destDek);
         out[id] = { ...env, _iv: iv2, _data: data2, _cek: wrapped };
         continue;
       }
       const plaintext = await decrypt(env._iv, env._data, srcDek);
-      const { iv, data } = await encrypt(plaintext, destDek);
+      const { iv, data } = await encrypt(project(plaintext), destDek);
       out[id] = { ...env, _iv: iv, _data: data };
     }
     collections[collectionName] = out;
   }
   return { collections, deks };
 }
-async function reKeySchemas(vault, closure, destDeks) {
+async function reKeySchemas(vault, closure, destDeks, fieldProjection) {
   const { name: vaultName, adapter, getDEK } = vault._introspectState();
   const out = {};
   for (const collectionName of closure.keys()) {
+    if (fieldProjection?.[collectionName]) continue;
     const env = await adapter.get(vaultName, SCHEMAS_COLLECTION, collectionName);
     if (!env) continue;
     const destDek = destDeks.get(collectionName);
@@ -331,6 +340,11 @@ async function sealDeks(deks) {
   };
 }
 async function extractPartition(vault, opts) {
+  if (vault.role === "custodian") {
+    throw new PartitionExtractionError(
+      "extractPartition is owner-only; a custodian cannot extract-and-sever (FR-6: producing a re-keyed standalone partition is an ownership operation; use the Deed owner)."
+    );
+  }
   if (vault.role !== "owner") {
     throw new PartitionExtractionError(
       `extractPartition requires the 'owner' role on the source vault; caller is '${vault.role}'. Producing a re-keyed standalone partition is an ownership operation.`
@@ -338,7 +352,7 @@ async function extractPartition(vault, opts) {
   }
   if (opts.carrySchemas) await vault._drainPendingSchemaWrites();
   const { closure } = await walkClosure(vault, opts);
-  const { collections, deks } = await reKeyClosure(vault, closure);
+  const { collections, deks } = await reKeyClosure(vault, closure, opts.fieldProjection);
   let ledgerHead;
   let ledgerEntries;
   if (opts.carryLedger && vault._getLedgerOrNull() !== null) {
@@ -350,7 +364,7 @@ async function extractPartition(vault, opts) {
       deks.set(LEDGER_COLLECTION, ledgerDek);
     }
   }
-  const internalSchemas = opts.carrySchemas ? await reKeySchemas(vault, closure, deks) : {};
+  const internalSchemas = opts.carrySchemas ? await reKeySchemas(vault, closure, deks, opts.fieldProjection) : {};
   const internal = {};
   if (Object.keys(internalSchemas).length > 0) internal[SCHEMAS_COLLECTION] = internalSchemas;
   if (ledgerEntries) internal[LEDGER_COLLECTION] = ledgerEntries;
@@ -391,172 +405,6 @@ async function extractPartition(vault, opts) {
   });
   return { bundleBytes, transferKey, sealId: seal.sealId };
 }
-
-// src/bundle/adopt-partition.ts
-async function unsealDeks(seal, transferKey) {
-  if (transferKey.byteLength !== 32) {
-    throw new TransferSealError(
-      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
-    );
-  }
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
-  const raw = base64ToBuffer(seal.payload);
-  let plaintext;
-  try {
-    plaintext = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: raw.slice(0, 12) },
-      key,
-      raw.slice(12)
-    );
-  } catch {
-    throw new TransferSealError(
-      "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
-    );
-  }
-  let dekMap;
-  try {
-    dekMap = JSON.parse(new TextDecoder().decode(plaintext));
-  } catch {
-    throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
-  }
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collection, b64] of Object.entries(dekMap)) {
-    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
-    deks.set(collection, dek);
-  }
-  return deks;
-}
-async function adoptPartition(bundleBytes, opts) {
-  const { transferKey, destinationStore, vaultName } = opts;
-  const header = readNoydbBundleHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new ValidationError(
-      "adoptPartition requires an extracted-partition bundle with a transfer seal. For ordinary backups use readNoydbBundle + vault.load."
-    );
-  }
-  const { dumpJson } = await readNoydbBundle(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  await unsealDeks(seal, transferKey);
-  const existing = await destinationStore.get(vaultName, "_meta", "adoption");
-  if (existing) {
-    const prior = JSON.parse(existing._data);
-    if (prior.sealId === seal.sealId) {
-      throw new AdoptionStateError(
-        `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
-      );
-    }
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds an adopted partition (sealId ${prior.sealId}); adopting a different partition (sealId ${seal.sealId}) here would overwrite it. Adopt into a fresh vaultName instead.`
-    );
-  }
-  const existingKeyring = await destinationStore.list(vaultName, "_keyring");
-  if (existingKeyring.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds a keyring (an unrelated owner exists at this slot); adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`
-    );
-  }
-  const backup = JSON.parse(dump);
-  await destinationStore.saveAll(vaultName, backup.collections);
-  if (backup._internal) {
-    for (const [collection, records] of Object.entries(backup._internal)) {
-      for (const [id, envelope] of Object.entries(records)) {
-        await destinationStore.put(vaultName, collection, id, envelope);
-      }
-    }
-  }
-  const adoptedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true, transferSeal: seal };
-  await destinationStore.put(vaultName, "_meta", "adoption", {
-    _noydb: 1,
-    _v: 1,
-    _ts: adoptedAt,
-    _iv: "",
-    _data: JSON.stringify(adoption)
-  });
-  return { vaultName, needsOwner: true, sealId: seal.sealId };
-}
-function isManaged(o) {
-  return "passphraseMode" in o && o.passphraseMode === "managed";
-}
-async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
-  const { userId, transferKey } = opts;
-  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === "shamir")) {
-    throw new AdoptionStateError(
-      "managed-mode adoption requires at least one strong (shamir) recovery profile in `recovery` \u2014 paper alone is not strong when there is no user passphrase to fall back on."
-    );
-  }
-  const adoptionEnv = await store.get(vaultName, "_meta", "adoption");
-  if (!adoptionEnv) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
-    );
-  }
-  const adoption = JSON.parse(adoptionEnv._data);
-  if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
-    );
-  }
-  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey);
-  const existingKeyring = await store.get(vaultName, "_keyring", userId);
-  const otherOwners = (await store.list(vaultName, "_keyring")).filter((u) => u !== userId);
-  if (otherOwners.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has a keyring for a different owner; cannot create owner "${userId}".`
-    );
-  }
-  const partitionCollections = [...partitionDeks.keys()];
-  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
-  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
-  if (!ownerMinted) {
-    const passphrase = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.passphrase;
-    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase);
-    const env = await store.get(vaultName, "_keyring", userId);
-    if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
-    const keyringFile = JSON.parse(env._data);
-    const kek = unlocked.kek;
-    if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
-    const mergedDeks = { ...keyringFile.deks };
-    for (const [collection, dek] of partitionDeks) {
-      mergedDeks[collection] = await wrapKey(dek, kek);
-    }
-    const mergedFile = { ...keyringFile, deks: mergedDeks };
-    await store.put(vaultName, "_keyring", userId, { ...env, _data: JSON.stringify(mergedFile) });
-  }
-  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION);
-  if (ledgerDek) {
-    const ledger = new LedgerStore({
-      adapter: store,
-      vault: vaultName,
-      encrypted: true,
-      getDEK: async () => ledgerDek,
-      actor: userId
-    });
-    const creationReason = `creation-of-new-owner:${userId}`;
-    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`;
-    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason));
-    if (!recordedReasons.has(creationReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: creationReason });
-    }
-    if (!recordedReasons.has(consumedReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: consumedReason });
-    }
-  }
-  if (isManaged(opts)) {
-    const { createNoydb } = await import("../noydb-VGR2HLDB.js");
-    const db = await createNoydb({
-      store,
-      user: userId,
-      passphraseMode: "managed",
-      sealingKey: opts.sealingKey,
-      shamirRecovery: opts.shamirRecovery
-    });
-    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery });
-  }
-  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await store.put(vaultName, "_meta", "adoption", { ...adoptionEnv, _data: JSON.stringify(consumed) });
-  return { vaultName, userId };
-}
 export {
   AdoptionStateError,
   BackupCorruptedError,
@@ -576,6 +424,7 @@ export {
   TransferSealError,
   adoptPartition,
   createOwnerOnAdoptedPartition,
+  decryptExtractedPartition,
   describeExtraction,
   encodeBundleHeader,
   extractPartition,