@noy-db/hub 0.2.0-pre.30 → 0.2.0-pre.31

package/dist/team/index.d.cts

@@ -1,120 +0,0 @@
-import { aW as NoydbStore, aU as UnlockedKeyring } from '../types-CdVfiQgt.cjs';
-export { be as BundleRecipient, cj as EnrollAuthenticatorOptions, ck as EnrollAuthenticatorWrappingDEKsOptions, cl as EnrollAuthenticatorWrappingKEKOptions, d1 as ListUsersOptions, ds as PaperRecoveryEntry, dA as PresenceHandle, dV as RecoverPassphraseInput, dW as RecoverPassphraseResult, dX as RecoverUserOptions, dY as RecoveryProof, e4 as RotatePassphraseInput, en as SlotRewrapCeremony, eo as SlotRewrapContext, ew as SyncEngine, eE as SyncTransaction, eU as UpdateAuthenticatorOptions, fe as WrappedDeksBlob, fm as buildRecipientKeyringFile, fn as burnPaperRecoveryEntry, gl as changeSecret, gm as createOwnerKeyring, fr as deriveMagicLinkContentKey, fs as enrollAuthenticator, gn as ensureCollectionDEK, fv as evaluateExportCapability, fw as evaluateImportCapability, fy as findAuthenticator, go as grant, fz as hasExportCapability, fA as hasImportCapability, fD as isMagicLinkGrantExpired, fJ as listMagicLinkGrants, fK as listUsers, fL as listUsersWithEnvelopes, gp as loadKeyring, fO as loadPaperRecoveryEntries, fR as magicLinkGrantRecordId, fS as mintPaperRecoveryEntry, fU as mintWrappedDeksBlob, gq as persistKeyring, fX as readMagicLinkGrantRecord, fG as recoverPassphrase, fY as recoverUser, f_ as removeAuthenticator, gr as revoke, g3 as revokeMagicLinkGrant, fH as rotatePassphrase, g5 as savePaperRecoveryEntries, g9 as unwrapDeksFromBlob, ga as unwrapDeksFromPaperEntry, gc as unwrapMagicLinkGrant, gs as updateAuthenticator, gt as updateKeyringIdentity, gk as writeMagicLinkGrant } from '../types-CdVfiQgt.cjs';
-import '../lazy-builder-eYZzLEL1.cjs';
-import '../predicate-BmhBSPCH.cjs';
-import '../strategy-mJExw4LQ.cjs';
-import '../errors-BAWO5Z5a.cjs';
-import '../strategy-BSxFXGzb.cjs';
-import '../index-BMmajblo.cjs';
-import '../index-C1SC1EPe.cjs';
-import '@noy-db/attestation';
-
-/**
- * _sync_credentials reserved collection —
- *
- * Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as
- * encrypted records inside the vault itself. Tokens are wrapped with the
- * compartment's own DEK, live on disk as ciphertext like any other record, and
- * are accessed only through the dedicated API in this module — never via
- * `vault.collection('_sync_credentials')`.
- *
- * Design decisions
- * ────────────────
- *
- * **Why a reserved collection, not a separate store?**
- * The compartment's existing encryption stack (AES-256-GCM + collection DEK)
- * is exactly the right primitive for protecting OAuth tokens at rest. Using a
- * separate store would require a new encryption surface, new adapter calls,
- * and a new backup/restore path — all of which already exist for collections.
- *
- * **Why not exposed as a regular collection?**
- * The same reason `_keyring` and `_ledger` aren't: they have invariants that
- * must be enforced (naming scheme, no cross-user leakage, no schema
- * validation, no history/ledger writes for privacy). Routing through a
- * dedicated API enforces those invariants.
- *
- * **Token lifecycle:**
- * - `putCredential(vault, adapterId, token)` — store or overwrite
- * - `getCredential(vault, adapterId)` — load and decrypt
- * - `deleteCredential(vault, adapterId)` — remove
- * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)
- *
- * The `adapterId` is the record ID within the `_sync_credentials` collection.
- * It should be a stable, human-readable identifier for the adapter instance
- * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).
- *
- * **ACL:** only `owner` and `admin` roles can read/write sync credentials.
- * Operators, viewers, and clients cannot call this API. The check is made
- * against the caller's keyring role at call time.
- */
-
-/** The reserved collection name. Never collides with user collections. */
-declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
-/**
- * An OAuth/auth token stored in `_sync_credentials`.
- *
- * Fields mirror the OAuth2 token response shape. `customData` is an escape
- * hatch for adapter-specific secrets (API keys, connection strings, etc.)
- * that don't fit the OAuth2 shape.
- */
-interface SyncCredential {
-    /** Stable identifier for the adapter instance (e.g. 'google-drive'). */
-    readonly adapterId: string;
-    /** OAuth token type, usually 'Bearer'. */
-    readonly tokenType: string;
-    /** The access token. Expires at `expiresAt` if set. */
-    readonly accessToken: string;
-    /** Long-lived refresh token for renewing the access token. */
-    readonly refreshToken?: string;
-    /** ISO timestamp when `accessToken` expires. Absent means "no expiry". */
-    readonly expiresAt?: string;
-    /** Space-separated OAuth scopes. */
-    readonly scopes?: string;
-    /** Adapter-specific opaque data (API keys, endpoints, etc.). */
-    readonly customData?: Record<string, string>;
-}
-/**
- * Store or overwrite a sync credential for the given adapter.
- *
- * The credential is encrypted with the `_sync_credentials` collection DEK
- * (auto-generated on first use). The record ID is the `adapterId`.
- *
- * Requires owner or admin role.
- */
-declare function putCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, credential: SyncCredential): Promise<void>;
-/**
- * Load and decrypt a sync credential for the given adapter ID.
- *
- * Returns `null` if no credential exists for this adapter.
- * Requires owner or admin role.
- */
-declare function getCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<SyncCredential | null>;
-/**
- * Delete a sync credential by adapter ID.
- *
- * No-op if the credential doesn't exist. Requires owner or admin role.
- */
-declare function deleteCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<void>;
-/**
- * List all adapter IDs that have stored credentials.
- *
- * Returns only the IDs, never the credential payloads. Useful for
- * displaying "connected adapters" in UI without decrypting tokens.
- * Requires owner or admin role.
- */
-declare function listCredentials(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<string[]>;
-/**
- * Check whether a credential exists and whether its access token has expired.
- *
- * Returns `{ exists: false }` if no credential is stored, or
- * `{ exists: true, expired: boolean }` based on the `expiresAt` field.
- * Requires owner or admin role.
- */
-declare function credentialStatus(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<{
-    exists: false;
-} | {
-    exists: true;
-    expired: boolean;
-}>;
-
-export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential };

package/dist/transition-guard-tWZIsaXe.d.cts

@@ -1,165 +0,0 @@
-import { an as GuardStrategy, ar as GuardStrategyHandle, ao as GuardChange, ap as GuardContext } from './types-CdVfiQgt.cjs';
-
-/**
- * Register a guard for a collection. Guards run on every `put()` /
- * `delete()` for the named collection (after permissions, before
- * encryption) and may:
- *
- *   - `check` — block writes by throwing (typically `RecordLockedError`)
- *   - `frozenFields` — freeze specific fields once a condition is true
- *   - `amendment` — declare an authorized-override path with invariant
- *
- * Pass the returned handle to `createNoydb({ strategies: [...] })`.
- *
- * @see docs/superpowers/specs/2026-05-18-guards-design.md
- */
-declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
-
-/**
- * `immutableGuard` — declarative WORM / append-only sugar over the guard
- * subsystem.
- *
- * Issued fiscal documents (invoices, DDTs) must be immutable after issue.
- * That is expressible today with a hand-rolled `withGuard` (block on
- * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is
- * repetitive and easy to get subtly wrong. `immutableGuard` generates
- * exactly that guard from a declarative config, reusing the guard
- * machinery wholesale — `check`/`onDelete` rejection, the ledgered
- * `amendment` override, and composition with `periods`/`history`.
- *
- * ```ts
- * createNoydb({ guardStrategies: [
- *   immutableGuard({
- *     collection: 'invoices',
- *     after: (r) => r.status === 'issued',   // immutable once issued
- *   }),
- * ] })
- * ```
- *
- * A record is mutable until `after(record)` holds; from then on, updates
- * and deletes throw `RecordLockedError` unless performed inside an
- * `amendment` transaction by an authorized role (the override is
- * ledgered by the guard amendment mechanism). `appendOnly: true` is
- * shorthand for `after: () => true` — immutable from creation.
- */
-
-interface ImmutableGuardConfig<T extends Record<string, unknown>> {
-    /** The collection to make WORM. */
-    collection: string;
-    /**
-     * A record becomes immutable once this predicate holds. Evaluated on
-     * the *existing* (already-persisted) record, so the write that first
-     * makes it true is still allowed; subsequent writes are blocked.
-     * Mutually exclusive with `appendOnly`.
-     */
-    after?: (record: T) => boolean;
-    /** Shorthand for `after: () => true` — immutable from creation. */
-    appendOnly?: boolean;
-    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
-    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
-    /**
-     * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
-     * exactly: it receives every {before, after} pair touching this
-     * collection in the amendment plus the guard context; throwing reverts
-     * the whole amendment and surfaces as `InvariantError`.
-     *
-     * Use this to keep a constraint inviolable EVEN under amendment — e.g.
-     * forbid deleting an issued document by re-throwing on any
-     * `before !== null && after === null` change, or assert a cross-record
-     * sum is preserved. When omitted the amendment is unconditionally
-     * allowed (the amendment itself is the sanctioned, ledgered override) —
-     * this is the backward-compatible default.
-     */
-    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-}
-/**
- * Build an immutability guard. Pass the returned handle to
- * `createNoydb({ guardStrategies: [...] })`.
- */
-declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategyHandle<T>;
-
-/**
- * `transitionGuard` — declarative state-machine sugar over the guard
- * subsystem.
- *
- * Any record with a lifecycle field (invoice `status`, order state,
- * ticket workflow, subscription phase) needs transition validation: a
- * write may only move the field along a declared arc. That is expressible
- * with a hand-rolled `withGuard({ check })`, but every consumer
- * re-implements the same graph lookup + error. `transitionGuard`
- * generates exactly that guard from a state graph, reusing the guard
- * machinery wholesale — `check` rejection, the ledgered `amendment`
- * override, and composition with `periods`/`history`.
- *
- * It generalizes {@link immutableGuard}: WORM is the special case "every
- * state has no outgoing arcs", i.e. `transitions` mapping each state to `[]`.
- *
- * ```ts
- * createNoydb({ guardStrategies: [
- *   transitionGuard<Sale>({
- *     collection: 'sales', field: 'status',
- *     transitions: {                          // absence of an arc = forbidden
- *       draft: ['to_verify', 'cancelled'],
- *       to_verify: ['proforma', 'draft', 'cancelled'],
- *       proforma: ['invoiced', 'cancelled'],
- *       invoiced: ['paid'], paid: [], cancelled: [],
- *     },
- *     initial: ['draft', 'to_verify'],        // allowed status on insert
- *   }),
- * ] })
- * ```
- *
- * Semantics:
- * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in
- *   `initial`. When `initial` is omitted, any value is allowed on insert.
- * - **Update**: the arc `(existing[field] → incoming[field])` must be
- *   listed in `transitions[from]`, else `IllegalTransitionError`. A
- *   same-value write (`from === to`) is allowed when `allowIdempotent`
- *   (default `true`) — so writes that touch other fields without moving
- *   state pass.
- * - **Override**: inside an `amendment` transaction by an authorized role
- *   the check is skipped and the change is ledgered (mirrors every guard).
- *
- * The status graph is caller-supplied data — no UI, no domain logic.
- */
-
-interface TransitionGuardConfig<T extends Record<string, unknown>> {
-    /** The collection whose state field is governed. */
-    collection: string;
-    /** The state field on the record (e.g. `'status'`). */
-    field: keyof T & string;
-    /**
-     * The transition graph: each state maps to the states it may move to.
-     * A state absent from the map (or mapped to `[]`) is terminal — no
-     * outgoing arc, so any non-idempotent write from it is rejected.
-     */
-    transitions: Readonly<Record<string, readonly string[]>>;
-    /**
-     * States allowed as the initial value on insert (`existing === null`).
-     * Omit to allow any value on insert.
-     */
-    initial?: readonly string[];
-    /**
-     * Allow a same-value write (`from === to`) on update. Default `true` —
-     * lets a put that changes other fields, but not the state, through.
-     */
-    allowIdempotent?: boolean;
-    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
-    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
-    /**
-     * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
-     * exactly. When omitted the amendment is unconditionally allowed (the
-     * amendment itself is the sanctioned, ledgered override) — the
-     * backward-compatible default. Mirrors {@link immutableGuard}.
-     */
-    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-}
-/**
- * Build a state-machine transition guard. Pass the returned handle to
- * `createNoydb({ guardStrategies: [...] })`.
- */
-declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategyHandle<T>;
-
-export { type ImmutableGuardConfig as I, type TransitionGuardConfig as T, immutableGuard as i, transitionGuard as t, withGuard as w };