@noy-db/hub 0.2.0-pre.30 → 0.2.0-pre.31

package/dist/index-xJEPkvMb.d.cts

@@ -1,93 +0,0 @@
-import './predicate-BmhBSPCH.cjs';
-import './strategy-mJExw4LQ.cjs';
-import './ulid-DRH25k3y.cjs';
-import { e1 as RetrieveHit } from './types-CdVfiQgt.cjs';
-import './errors-BAWO5Z5a.cjs';
-import './index-C1SC1EPe.cjs';
-
-/**
- * #308 L3 — Reciprocal Rank Fusion. Merges N ranked `RetrieveHit` lists into
- * one, scoring each id by Σ 1/(k + rank) across the lists it appears in. Pure,
- * deterministic, no I/O — which is why it serves BOTH hybrid lexical⊕semantic
- * fusion AND klum-db's cross-vault federation (the lists are per-vault). The
- * fused `score` is the RRF score, NOT BM25 or cosine.
- */
-
-interface FuseOptions {
-    /** Only 'rrf' in v1 (default). */
-    readonly strategy?: 'rrf';
-    /** RRF constant; larger flattens the rank weighting. Default 60. */
-    readonly k?: number;
-    /** Truncate the fused output to this many hits. */
-    readonly limit?: number;
-}
-/**
- * Callers must supply hits with `rank >= 1` (the retrieve contract guarantees
- * it; a federation caller passing `rank: 0` with `k: 0` would divide by zero).
- * Doc-only note — no runtime guard; rank ≥ 1 is the retrieve contract.
- */
-declare function fuseRetrieval<T>(lists: ReadonlyArray<ReadonlyArray<RetrieveHit<T>>>, opts?: FuseOptions): RetrieveHit<T>[];
-
-interface EncryptResult {
-    iv: string;
-    data: string;
-}
-/**
- * Encrypt raw bytes with AES-256-GCM using a fresh random IV.
- * Used by the attachment store so binary blobs avoid double base64 encoding
- * (the existing `encrypt()` function calls `TextEncoder` on a string — here
- * we pass the `Uint8Array` directly to `subtle.encrypt`).
- */
-declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<EncryptResult>;
-/**
- * Decrypt AES-256-GCM ciphertext back to raw bytes.
- * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
- */
-declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
-/**
- * SHA-256 hex digest of raw bytes. Used to derive content-addressed
- * eTags for blob deduplication. Computed on plaintext bytes
- * before compression and encryption so the eTag identifies content, not
- * ciphertext, and survives re-encryption (key rotation, re-upload).
- */
-declare function sha256Hex(data: Uint8Array): Promise<string>;
-/**
- * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
- *
- * The presence key is domain-separated from the data DEK by the fixed salt
- * `'noydb-presence'` and the `info` = collection name. This means:
- *  - The adapter never sees the presence key.
- *  - Presence payloads rotate automatically when the collection DEK is rotated.
- *  - Revoked users cannot derive the new presence key after a DEK rotation.
- *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Used as the HKDF `info` parameter for domain separation.
- * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
- */
-declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
-/**
- * Encrypt a plaintext string with AES-256-GCM and a deterministic,
- * HKDF-derived IV.
- *
- * The same `{ dek, context, plaintext }` triple always produces the
- * same `{ iv, data }` — call this twice and you can string-compare the
- * ciphertexts to check equality of the inputs without decrypting them.
- *
- * @param context  Domain-separation string — by convention
- *                 `'<collection>/<field>'`. Different contexts encrypt
- *                 the same plaintext to different ciphertexts, so
- *                 `email` in collection `users` does not collide with
- *                 `email` in collection `customers`.
- */
-declare function encryptDeterministic(plaintext: string, dek: CryptoKey, context: string): Promise<EncryptResult>;
-/**
- * Counterpart to {@link encryptDeterministic}. The IV is stored
- * alongside the ciphertext (exactly like the randomized path), so
- * decrypt uses the stored IV and verifies the GCM auth tag — a tampered
- * ciphertext throws `TamperedError` just like randomized AES-GCM.
- */
-declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
-declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
-declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
-
-export { type FuseOptions as F, bufferToBase64 as a, base64ToBuffer as b, decryptDeterministic as c, decryptBytes as d, derivePresenceKey as e, encryptBytes as f, encryptDeterministic as g, fuseRetrieval as h, sha256Hex as s };