@noy-db/hub 0.2.0-pre.6 → 0.2.0-pre.8

package/dist/{chunk-W277AG6N.js → chunk-6774ZOQ7.js}

@@ -4,36 +4,37 @@ import {
 import {
   TxContext,
   revertExecuted
-} from "./chunk-LJO6Q3X6.js";
+} from "./chunk-TFBP23BX.js";
 import {
   OverlayedCollection
-} from "./chunk-34XGYMQT.js";
+} from "./chunk-DJHHA6XH.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-RIHZBSWJ.js";
+} from "./chunk-2WUSG3IT.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema,
   resolveManagedSecret,
   savePersistedSchema,
   saveSealedPassphrase
-} from "./chunk-E225X5CQ.js";
+} from "./chunk-I5FOWO4J.js";
 import {
   loadPublicEnvelope,
   readPublicEnvelope,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-WEA4TDTJ.js";
+} from "./chunk-ML236QKC.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-ZQMYB56Z.js";
+} from "./chunk-JWRVQKRZ.js";
 import {
   getAtPath,
   isDictCollectionName,
+  resolvePolicy,
   setAtPathInPlace
-} from "./chunk-JICBEFBT.js";
+} from "./chunk-22DWZL57.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
@@ -55,11 +56,11 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-Y3P5DEMZ.js";
+} from "./chunk-3YPCK6JX.js";
 import {
   assertTierAccess,
   dekKey
-} from "./chunk-TNBIWSQ7.js";
+} from "./chunk-U26HQ6KJ.js";
 import {
   USER_ENVELOPE_COLLECTION,
   buildRecipientKeyringFile,
@@ -83,7 +84,7 @@ import {
   rotateKeys,
   saveUserEnvelope,
   updateKeyringIdentity
-} from "./chunk-T6MTNGBM.js";
+} from "./chunk-DONMZAD2.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-2QR2PQTT.js";
@@ -93,7 +94,7 @@ import {
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
-} from "./chunk-6A4AMQ2H.js";
+} from "./chunk-PE2FR4J3.js";
 import {
   sha256Hex as sha256Hex2
 } from "./chunk-Z6FNBOTC.js";
@@ -101,22 +102,22 @@ import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-XDW37COG.js";
+} from "./chunk-2GLDA55J.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-JSYTGEX4.js";
+} from "./chunk-3BFJOWSU.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-5OVIFUQE.js";
+} from "./chunk-WIRRPTFH.js";
 import {
   decrypt,
   encrypt,
   encryptDeterministic,
   sha256Hex
-} from "./chunk-EKTOYEZ3.js";
+} from "./chunk-PP6W64Y3.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -129,6 +130,7 @@ import {
   IndexWriteFailureError,
   InvalidKeyError,
   KeyringCorruptError,
+  LocaleNotSpecifiedError,
   MigrationRequiredError,
   NoAccessError,
   NoydbError,
@@ -143,7 +145,7 @@ import {
   TierNotGrantedError,
   TranslatorNotConfiguredError,
   ValidationError
-} from "./chunk-6HJ2ZALB.js";
+} from "./chunk-B6PB7JLN.js";
 
 // src/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -331,6 +333,9 @@ var NO_I18N = {
   validateI18nTextValue() {
     throw notEnabled("i18nText field validation");
   },
+  enforceScript(value) {
+    return { value, warnings: [] };
+  },
   buildDictionaryHandle() {
     throw notEnabled("vault.dictionary()");
   }
@@ -646,7 +651,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-SOLEQVUB.js"));
+      ({ DerivationExecutor } = await import("./executor-B4QIYGZX.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1114,7 +1119,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-74WGLVZ2.js");
+      const { resolveStaleMVOnRead } = await import("./stale-6ZDBTQT7.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -1313,6 +1318,22 @@ var Collection = class {
         setAtPathInPlace(obj, field, translated);
       }
     }
+    if (this.i18nFields) {
+      const obj = record;
+      for (const [field, descriptor] of Object.entries(this.i18nFields)) {
+        if (!descriptor.options.script) continue;
+        for (const leaf of getAtPath(obj, field)) {
+          if (!leaf || typeof leaf !== "object" || Array.isArray(leaf)) continue;
+          const leafMap = leaf;
+          const { value: cleaned } = this.i18nStrategy.enforceScript(
+            leafMap,
+            field,
+            descriptor
+          );
+          if (cleaned !== leafMap) Object.assign(leafMap, cleaned);
+        }
+      }
+    }
     if (this.i18nPutValidator !== void 0) {
       this.i18nPutValidator(record);
     }
@@ -1485,7 +1506,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-RWICJI7J.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-BWXXDQ7K.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -1494,7 +1515,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-74WGLVZ2.js");
+          staleHelpers = await import("./stale-6ZDBTQT7.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -1523,7 +1544,7 @@ var Collection = class {
       const mode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
       if (mode === "eager") {
         if (DerivationExecutor === null) {
-          ({ DerivationExecutor } = await import("./executor-SOLEQVUB.js"));
+          ({ DerivationExecutor } = await import("./executor-B4QIYGZX.js"));
         }
         const sourceWithId = { ...incoming, id };
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -1542,7 +1563,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-EVICRM46.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-OKPMMPLG.js");
             const prior = await loadFanoutSidecar(
               this.adapter,
               this.vault,
@@ -1834,7 +1855,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-EVICRM46.js");
+          helpers = await import("./fanout-sidecar-OKPMMPLG.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(
           this.adapter,
@@ -1874,7 +1895,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-RWICJI7J.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-BWXXDQ7K.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -1883,7 +1904,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-74WGLVZ2.js");
+          staleHelpers = await import("./stale-6ZDBTQT7.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -1906,7 +1927,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-74WGLVZ2.js");
+      const { resolveStaleMVOnRead } = await import("./stale-6ZDBTQT7.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -2755,17 +2776,52 @@ var Collection = class {
     }
     if (hasDict && this.dictKeyFields && this.dictLabelResolver && locale !== "raw") {
       const withLabels = { ...result };
+      const resolver = this.dictLabelResolver;
       for (const [field, desc] of Object.entries(this.dictKeyFields)) {
-        const key = result[field];
-        if (typeof key !== "string") continue;
-        const label = await this.dictLabelResolver(
-          desc.name,
-          key,
-          locale,
-          localeOpts?.fallback
-        );
-        if (label !== void 0) {
-          withLabels[`${field}Label`] = label;
+        const policy = desc.onMissing ? resolvePolicy(desc.onMissing, "read") : "null";
+        const fallback = policy === "substitute" ? localeOpts?.fallback ?? desc.substitute : localeOpts?.fallback;
+        const resolveKey = async (key) => {
+          const label = await resolver(desc.name, key, locale, fallback);
+          if (label === void 0) {
+            if (policy === "throw") {
+              throw new LocaleNotSpecifiedError(
+                field,
+                `dictKey "${field}": no label for key "${key}" in locale "${locale}".`
+              );
+            }
+            return null;
+          }
+          return label;
+        };
+        if (field.includes("[].")) {
+          const parts = field.split("[].");
+          const arrayKey = parts[0];
+          const leaf = parts[1];
+          if (!leaf || leaf.includes(".")) continue;
+          const arr = withLabels[arrayKey];
+          if (!Array.isArray(arr)) continue;
+          const labelKey = `${leaf}Label`;
+          withLabels[arrayKey] = await Promise.all(
+            arr.map(async (el) => {
+              if (!el || typeof el !== "object" || Array.isArray(el)) return el;
+              const k = el[leaf];
+              if (typeof k !== "string") return el;
+              return { ...el, [labelKey]: await resolveKey(k) };
+            })
+          );
+          continue;
+        }
+        const val = result[field];
+        if (Array.isArray(val)) {
+          withLabels[`${field}Label`] = await Promise.all(
+            val.map(async (k) => ({
+              key: k,
+              label: typeof k === "string" ? await resolveKey(k) : null
+            }))
+          );
+        } else if (typeof val === "string") {
+          const label = await resolveKey(val);
+          if (label !== null) withLabels[`${field}Label`] = label;
         }
       }
       result = withLabels;
@@ -5339,12 +5395,12 @@ var Vault = class {
     if (!fieldSchema) {
       throw new AttestationError(`issueAttestation: collection '${collectionName}' has no attestation field-schema. Declare it via vault.collection('${collectionName}', { attestation: { fields: [...] } }).`);
     }
-    const { issueAttestationCore } = await import("./issue-IODMTPME.js");
+    const { issueAttestationCore } = await import("./issue-VGDPP4B5.js");
     const out = await issueAttestationCore(this.makeIssueContext(), { collection: collectionName, id, fieldSchema });
     return { docId: out.docId, qr: out.qr, keyId: out.keyId, publicKeyB64: out.publicKeyB64 };
   }
   async getDocumentSigningPublicKey() {
-    const { loadSigner, loadOrCreateSigner } = await import("./signer-WGDJNWSU.js");
+    const { loadSigner, loadOrCreateSigner } = await import("./signer-72QAUSVW.js");
     const existing = await loadSigner(this.adapter, this.name, this.getDEK);
     if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
     if (this.keyring.role !== "owner") {
@@ -5370,19 +5426,19 @@ var Vault = class {
     };
   }
   async revokeAttestation(docId) {
-    const { revokeDocCore } = await import("./revoke-R5NIQ74J.js");
+    const { revokeDocCore } = await import("./revoke-JCC7N56X.js");
     await revokeDocCore(this.makeRevokeContext(), docId);
   }
   async unrevokeAttestation(docId) {
-    const { unrevokeDocCore } = await import("./revoke-R5NIQ74J.js");
+    const { unrevokeDocCore } = await import("./revoke-JCC7N56X.js");
     await unrevokeDocCore(this.makeRevokeContext(), docId);
   }
   async getRevokedDocIds() {
-    const { getRevokedDocIdsCore } = await import("./revoke-R5NIQ74J.js");
+    const { getRevokedDocIdsCore } = await import("./revoke-JCC7N56X.js");
     return getRevokedDocIdsCore(this.makeRevokeContext());
   }
   async publishRevocationList() {
-    const { publishRevocationListCore } = await import("./revoke-R5NIQ74J.js");
+    const { publishRevocationListCore } = await import("./revoke-JCC7N56X.js");
     return publishRevocationListCore(this.makeRevokeContext());
   }
   makeRevokeContext() {
@@ -5699,7 +5755,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-446I2NMN.js"),
+      import("./registry-3QP3YKQS.js"),
       import("./read-only-facade-ITU6L7BL.js")
     ]);
     const registry = new DerivationRegistry();
@@ -5730,7 +5786,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-4NEW7LQY.js");
+    const { MaterializedViewRegistry } = await import("./registry-OJIOSBV6.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -5754,7 +5810,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-524KJZG4.js");
+    const { OverlayedViewRegistry } = await import("./registry-USRVT6YF.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -5801,13 +5857,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-RWICJI7J.js");
+    const { MaterializedViewExecutor } = await import("./executor-BWXXDQ7K.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-74WGLVZ2.js");
+    const { clearMVStale } = await import("./stale-6ZDBTQT7.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -5823,7 +5879,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-SOLEQVUB.js");
+    const { DerivationExecutor } = await import("./executor-B4QIYGZX.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.readOnlyFacade ?? new (await import("./read-only-facade-ITU6L7BL.js")).ReadOnlyVaultFacade(this) };
@@ -5848,7 +5904,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-EVICRM46.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-OKPMMPLG.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -6069,7 +6125,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-42LO4WFO.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-RI54P6I5.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -6091,7 +6147,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-42LO4WFO.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-RI54P6I5.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -6560,7 +6616,7 @@ var Vault = class {
    * @see docs/subsystems/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-YKHKP74C.js");
+    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-BW6OXORV.js");
     return readPublicEnvelope2(this.adapter, this.name, opts);
   }
   /**
@@ -7624,16 +7680,32 @@ var QuickUnlockStore = class {
   }
 };
 
-// src/tx/strategy.ts
+// src/snapshots/strategy.ts
 var NOT_ENABLED4 = new Error(
+  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
+);
+var NO_SNAPSHOTS = {
+  async snapshot() {
+    throw NOT_ENABLED4;
+  },
+  async listSnapshots() {
+    throw NOT_ENABLED4;
+  },
+  async restoreSnapshot() {
+    throw NOT_ENABLED4;
+  }
+};
+
+// src/tx/strategy.ts
+var NOT_ENABLED5 = new Error(
   'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
 );
 var NO_TX = {
   async runTransaction() {
-    throw NOT_ENABLED4;
+    throw NOT_ENABLED5;
   },
   async runDryRun() {
-    throw NOT_ENABLED4;
+    throw NOT_ENABLED5;
   }
 };
 
@@ -7976,6 +8048,7 @@ var Noydb = class {
   txStrategy;
   sessionStrategy;
   syncStrategy;
+  snapshotStrategy;
   /**
    * Currently-running multi-record transaction, set by
    * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -8000,6 +8073,7 @@ var Noydb = class {
     this.txStrategy = options.txStrategy ?? NO_TX;
     this.sessionStrategy = options.sessionStrategy ?? NO_SESSION;
     this.syncStrategy = options.syncStrategy ?? NO_SYNC;
+    this.snapshotStrategy = options.snapshotStrategy ?? NO_SNAPSHOTS;
     this.publicEnvelopeSchema = resolveSchema(options.publicEnvelope);
     if (options.sessionPolicy) {
       this.sessionStrategy.validateSessionPolicy(options.sessionPolicy);
@@ -8035,7 +8109,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-AWCHQ2KN.js");
+      const { GuardExecutor } = await import("./executor-5PNY7LGW.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming);
       }
@@ -9986,6 +10060,45 @@ var Noydb = class {
     this.keyringCache.set(vault, keyring);
     return keyring;
   }
+  /**
+   * Take an on-demand checkpoint of the given vault.
+   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * @throws ValidationError when the vault is not open
+   */
+  async snapshot(vault, opts) {
+    if (this.closed) throw new ValidationError("Instance is closed");
+    const v = this.vaultCache.get(vault);
+    if (!v) {
+      throw new ValidationError(
+        `Vault "${vault}" is not open. Call openVault() first.`
+      );
+    }
+    return this.snapshotStrategy.snapshot(v, this.options.user, opts);
+  }
+  /**
+   * List all snapshots for the given vault, newest first.
+   * Reads only the sidecar index — does not download snapshot bytes.
+   */
+  async listSnapshots(vault) {
+    if (this.closed) throw new ValidationError("Instance is closed");
+    return this.snapshotStrategy.listSnapshots(vault);
+  }
+  /**
+   * Restore the vault to a previously snapshotted state.
+   * Runs `verifyBackupIntegrity()` automatically on restore.
+   * @throws SnapshotNotFoundError when `version` doesn't exist in the store
+   * @throws ValidationError when the vault is not open
+   */
+  async restoreSnapshot(vault, version) {
+    if (this.closed) throw new ValidationError("Instance is closed");
+    const v = this.vaultCache.get(vault);
+    if (!v) {
+      throw new ValidationError(
+        `Vault "${vault}" is not open. Call openVault() first.`
+      );
+    }
+    return this.snapshotStrategy.restoreSnapshot(v, version);
+  }
 };
 async function createNoydb(options) {
   const encrypted = options.encrypt !== false;
@@ -10060,4 +10173,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-W277AG6N.js.map
+//# sourceMappingURL=chunk-6774ZOQ7.js.map