@noy-db/hub 0.2.0-pre.30 → 0.2.0-pre.31

package/dist/bundle/index.d.cts

@@ -1,187 +0,0 @@
-import { T as TransferSealPayload } from '../decrypt-partition-C0iDpbSd.cjs';
-export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, D as DecryptedRecord, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as decryptExtractedPartition, j as encodeBundleHeader, r as readNoydbBundle, k as readNoydbBundleHeader, l as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../decrypt-partition-C0iDpbSd.cjs';
-export { g as generateULID, i as isULID } from '../ulid-DRH25k3y.cjs';
-import { bh as Vault, aW as NoydbStore, bd as SealingKeyProvider, bi as RecoveryEnrollmentInput, bj as ShamirRecoveryProvider } from '../types-CdVfiQgt.cjs';
-export { t as AdoptionStateError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, P as PartitionExtractionError, y as TransferSealError } from '../errors-BAWO5Z5a.cjs';
-import '../lazy-builder-eYZzLEL1.cjs';
-import '../predicate-BmhBSPCH.cjs';
-import '../strategy-mJExw4LQ.cjs';
-import '../strategy-BSxFXGzb.cjs';
-import '../index-BMmajblo.cjs';
-import '../index-C1SC1EPe.cjs';
-import '@noy-db/attestation';
-
-/**
- * Transitive-closure FK walker. Computes the set of
- * (collection, id) tuples reachable from seed predicates, so a
- * partition extraction ships a referentially-complete subset.
- *
- * Two-phase, plaintext, read-only (runs inside the unlocked vault
- * session — see foundation §13.4 / spec invariant 7):
- *   1. INBOUND expansion: from selected records, pull every record
- *      that references them (children travel with parents), to a
- *      fixed point.
- *   2. OUTBOUND completion: pull every parent the selected set
- *      references (no dangling FKs), transitively, WITHOUT
- *      re-expanding inbound from those parents (bounds the closure).
- *
- * The FK graph is auto-derived from the vault's existing RefRegistry
- * (the `ref('target')` declarations on collections) — no hand-written
- * edge list. See the design spec §4.1.
- *
- * @module
- */
-
-/** Seed predicate per collection. Records that return true become roots. */
-interface WalkClosureOptions {
-    readonly seeds: Record<string, (record: Record<string, unknown>) => boolean | Promise<boolean>>;
-    /** Max fixed-point iterations before throwing. Default 16. */
-    readonly maxDepth?: number;
-}
-interface ClosureResult {
-    /** collection → set of record ids that travel together. */
-    readonly closure: Map<string, Set<string>>;
-    readonly graph: {
-        /** Fixed-point iterations the walk needed to converge. */
-        readonly depth: number;
-        /** True if an edge pointed back to an already-selected node. */
-        readonly cyclesDetected: boolean;
-    };
-}
-declare function walkClosure(vault: Vault, opts: WalkClosureOptions): Promise<ClosureResult>;
-
-/**
- * Partition-extraction dry-run. Read-only preview of what an
- * `extractPartition` would move: record counts, byte totals, and the
- * timestamp span per collection — computed from raw encrypted
- * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.
- *
- * @module
- */
-
-interface ExtractionPreview {
-    readonly totalRecords: number;
-    /** Sum of serialized encrypted-envelope sizes (bytes). */
-    readonly totalBytes: number;
-    readonly byCollection: ReadonlyArray<{
-        readonly name: string;
-        readonly recordCount: number;
-        readonly bytes: number;
-        /** Earliest envelope `_ts` in this collection (lexicographic). */
-        readonly oldestTs?: string;
-        readonly newestTs?: string;
-    }>;
-    readonly graph: {
-        readonly depth: number;
-        readonly cyclesDetected: boolean;
-    };
-    /** Records the walk reached but whose envelope couldn't be read. */
-    readonly inaccessible: ReadonlyArray<{
-        readonly collection: string;
-        readonly id: string;
-    }>;
-}
-declare function describeExtraction(vault: Vault, opts: WalkClosureOptions): Promise<ExtractionPreview>;
-
-/**
- * Partition extraction. Walks the FK closure, re-encrypts
- * the selected records under fresh per-collection DEKs, seals those DEKs
- * under a one-time transfer key, and serializes an unowned
- * `extracted-partition` bundle.
- *
- * @module
- */
-
-interface ExtractPartitionResult {
-    readonly bundleBytes: Uint8Array;
-    /** Raw 32-byte transfer key — deliver out-of-band; required to adopt. */
-    readonly transferKey: Uint8Array;
-    readonly sealId: string;
-}
-/**
- * Extract a re-keyed, transfer-sealed partition. Owner-only
- * (invariant 5): producing a standalone re-keyed vault is an
- * ownership operation. Non-destructive on the source.
- */
-declare function extractPartition(vault: Vault, opts: WalkClosureOptions & {
-    readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none';
-    readonly carrySchemas?: boolean;
-    readonly carryLedger?: boolean;
-    /**
-     * FR-7 structural field projection: per-collection allow-list of fields
-     * to keep. Non-listed fields are dropped from each record BEFORE
-     * re-encryption (so they never travel in the bundle); `id` is always
-     * preserved. A projected collection's persisted schema is NOT carried.
-     * Absent/empty → un-projected behavior (byte-identical to today).
-     */
-    readonly fieldProjection?: Record<string, readonly string[]>;
-}): Promise<ExtractPartitionResult>;
-
-/**
- * Reverse of `sealDeks`. Imports the transfer key, decrypts the
- * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and
- * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a
- * wrong key (AES-GCM auth-tag failure) or malformed payload.
- */
-declare function unsealDeks(seal: TransferSealPayload, transferKey: Uint8Array): Promise<Map<string, CryptoKey>>;
-interface AdoptPartitionOptions {
-    readonly transferKey: Uint8Array;
-    readonly destinationStore: NoydbStore;
-    readonly vaultName: string;
-}
-interface AdoptPartitionResult {
-    readonly vaultName: string;
-    readonly needsOwner: true;
-    readonly sealId: string;
-}
-declare function adoptPartition(bundleBytes: Uint8Array, opts: AdoptPartitionOptions): Promise<AdoptPartitionResult>;
-interface CreateOwnerResult {
-    readonly vaultName: string;
-    readonly userId: string;
-}
-/** Standard-mode owner: recipient supplies the passphrase. */
-interface CreateOwnerStandardOptions {
-    readonly userId: string;
-    readonly passphrase: string;
-    readonly transferKey: Uint8Array;
-}
-/**
- * Managed-mode owner: the passphrase is minted + sealed under
- * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
- * auto-unlocks on the recipient's device. Managed mode mandates a strong
- * (Shamir) recovery profile at creation, which needs the
- * `shamirRecovery` provider injected.
- */
-interface CreateOwnerManagedOptions {
-    readonly userId: string;
-    readonly passphraseMode: 'managed';
-    readonly sealingKey: SealingKeyProvider;
-    readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
-    readonly shamirRecovery: ShamirRecoveryProvider;
-    readonly transferKey: Uint8Array;
-}
-type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions;
-/**
- * Mint the first owner keyring on an adopted-but-unowned partition,
- * then destroy the transfer seal.
- *
- * Standard mode: the recipient supplies a passphrase. Managed mode: the
- * passphrase is minted + sealed under a `SealingKeyProvider` and a strong
- * (Shamir) recovery profile is enrolled — orchestrated via the existing
- * `openVaultAndEnrollRecovery` ceremony.
- *
- * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base
- * keyring, then wraps the partition's DEKs (recovered from the seal) under that
- * KEK and re-persists the merged keyring file.
- *
- * Idempotent under retry: the seal is destroyed LAST (Stage D), after the
- * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —
- * strong-recovery enrollment (Stage C). A failure in the fallible enrollment
- * step leaves the seal intact, and re-running with the same `userId` +
- * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery
- * arrays may re-enroll an already-enrolled profile on retry; managed mode's
- * mandated single Shamir profile does not.)
- */
-declare function createOwnerOnAdoptedPartition(store: NoydbStore, vaultName: string, opts: CreateOwnerOptions): Promise<CreateOwnerResult>;
-
-export { type AdoptPartitionOptions, type AdoptPartitionResult, type ClosureResult, type CreateOwnerManagedOptions, type CreateOwnerOptions, type CreateOwnerResult, type CreateOwnerStandardOptions, type ExtractPartitionResult, type ExtractionPreview, type WalkClosureOptions, adoptPartition, createOwnerOnAdoptedPartition, describeExtraction, extractPartition, unsealDeks, walkClosure };

package/dist/consent/index.cjs

@@ -1,204 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/consent/index.ts
-var consent_exports = {};
-__export(consent_exports, {
-  CONSENT_AUDIT_COLLECTION: () => CONSENT_AUDIT_COLLECTION,
-  loadConsentEntries: () => loadConsentEntries,
-  withConsent: () => withConsent,
-  writeConsentEntry: () => writeConsentEntry
-});
-module.exports = __toCommonJS(consent_exports);
-
-// src/errors.ts
-var NoydbError = class extends Error {
-  /** Machine-readable error code. Stable across library versions. */
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "NoydbError";
-    this.code = code;
-  }
-};
-var DecryptionError = class extends NoydbError {
-  constructor(message = "Decryption failed") {
-    super("DECRYPTION_FAILED", message);
-    this.name = "DecryptionError";
-  }
-};
-var TamperedError = class extends NoydbError {
-  constructor(message = "Data integrity check failed \u2014 record may have been tampered with") {
-    super("TAMPERED", message);
-    this.name = "TamperedError";
-  }
-};
-
-// src/crypto.ts
-var IV_BYTES = 12;
-var subtle = globalThis.crypto.subtle;
-async function encrypt(plaintext, dek) {
-  const iv = generateIV();
-  const encoded = new TextEncoder().encode(plaintext);
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    encoded
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decrypt(ivBase64, dataBase64, dek) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      dek,
-      ciphertext
-    );
-    return new TextDecoder().decode(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-function generateIV() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
-}
-function bufferToBase64(buffer) {
-  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary);
-}
-function base64ToBuffer(base64) {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-
-// src/bundle/ulid.ts
-var CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function encodeBase32(value, length) {
-  let out = "";
-  let v = value;
-  for (let i = 0; i < length; i++) {
-    out = CROCKFORD_ALPHABET[v % 32] + out;
-    v = Math.floor(v / 32);
-  }
-  return out;
-}
-function generateULID() {
-  const now = Date.now();
-  const timestampHigh = Math.floor(now / 16777216);
-  const timestampLow = now & 16777215;
-  const tsPart = encodeBase32(timestampHigh, 5) + encodeBase32(timestampLow, 5);
-  const randBytes = new Uint8Array(10);
-  crypto.getRandomValues(randBytes);
-  const rand1 = randBytes[0] * 2 ** 32 + (randBytes[1] << 24 >>> 0) + (randBytes[2] << 16) + (randBytes[3] << 8) + randBytes[4];
-  const rand2 = randBytes[5] * 2 ** 32 + (randBytes[6] << 24 >>> 0) + (randBytes[7] << 16) + (randBytes[8] << 8) + randBytes[9];
-  const randPart = encodeBase32(rand1, 8) + encodeBase32(rand2, 8);
-  return tsPart + randPart;
-}
-
-// src/consent/consent.ts
-var CONSENT_AUDIT_COLLECTION = "_consent_audit";
-async function writeConsentEntry(adapter, vault, encrypted, entry, getDEK) {
-  const id = generateULID();
-  const full = {
-    id,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    ...entry
-  };
-  const envelope = await buildEnvelope(full, encrypted, getDEK);
-  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope);
-}
-async function loadConsentEntries(adapter, vault, encrypted, getDEK, filter = {}) {
-  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION);
-  const entries = [];
-  for (const id of ids.sort()) {
-    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id);
-    if (!envelope) continue;
-    const entry = await decryptEntry(envelope, encrypted, getDEK);
-    if (!matchesFilter(entry, filter)) continue;
-    entries.push(entry);
-  }
-  return entries;
-}
-async function buildEnvelope(entry, encrypted, getDEK) {
-  const json = JSON.stringify(entry);
-  if (!encrypted) {
-    return {
-      _noydb: 1,
-      _v: 1,
-      _ts: entry.timestamp,
-      _iv: "",
-      _data: json
-    };
-  }
-  const dek = await getDEK(CONSENT_AUDIT_COLLECTION);
-  const { iv, data } = await encrypt(json, dek);
-  return {
-    _noydb: 1,
-    _v: 1,
-    _ts: entry.timestamp,
-    _iv: iv,
-    _data: data
-  };
-}
-async function decryptEntry(envelope, encrypted, getDEK) {
-  const json = encrypted ? await decrypt(envelope._iv, envelope._data, await getDEK(CONSENT_AUDIT_COLLECTION)) : envelope._data;
-  return JSON.parse(json);
-}
-function matchesFilter(entry, f) {
-  if (f.since && entry.timestamp < f.since) return false;
-  if (f.until && entry.timestamp > f.until) return false;
-  if (f.collection && entry.collection !== f.collection) return false;
-  if (f.actor && entry.actor !== f.actor) return false;
-  if (f.purpose && entry.purpose !== f.purpose) return false;
-  return true;
-}
-
-// src/consent/active.ts
-function withConsent() {
-  return {
-    write: writeConsentEntry,
-    read: loadConsentEntries
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CONSENT_AUDIT_COLLECTION,
-  loadConsentEntries,
-  withConsent,
-  writeConsentEntry
-});
-//# sourceMappingURL=index.cjs.map