@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.1

package/dist/{chunk-B6PB7JLN.js → chunk-ZYUC53LT.js}

@@ -1,4 +1,9 @@
-// src/errors.ts
+// src/kernel/constants.ts
+var STATE_VAULT_NAME = "__noydb_state__";
+var USER_ENVELOPE_MAX_BYTES = 64 * 1024;
+var USER_ENVELOPE_COLLECTION = "_users";
+
+// src/kernel/errors.ts
 var NoydbError = class extends Error {
   /** Machine-readable error code. Stable across library versions. */
   code;
@@ -8,6 +13,21 @@ var NoydbError = class extends Error {
     this.code = code;
   }
 };
+var DebugPlaintextError = class extends NoydbError {
+  constructor(message = "debugPlaintext requires encrypt: false") {
+    super("DEBUG_PLAINTEXT_REQUIRES_UNENCRYPTED", message);
+    this.name = "DebugPlaintextError";
+  }
+};
+var DebugReservedFieldError = class extends NoydbError {
+  constructor(collection, field) {
+    super(
+      "DEBUG_RESERVED_FIELD",
+      `Record in "${collection}" has reserved field "${field}": the _ prefix is reserved under debugPlaintext mode`
+    );
+    this.name = "DebugReservedFieldError";
+  }
+};
 var DecryptionError = class extends NoydbError {
   constructor(message = "Decryption failed") {
     super("DECRYPTION_FAILED", message);
@@ -137,6 +157,18 @@ var PrivilegeEscalationError = class extends NoydbError {
     this.offendingCollection = offendingCollection;
   }
 };
+var ReservedVaultNameError = class extends NoydbError {
+  /** The rejected vault name. */
+  vaultName;
+  constructor(vaultName) {
+    super(
+      "RESERVED_VAULT_NAME",
+      `"${vaultName}" is a reserved internal vault name and cannot be used as a group name or partition key`
+    );
+    this.name = "ReservedVaultNameError";
+    this.vaultName = vaultName;
+  }
+};
 var PeriodClosedError = class extends NoydbError {
   periodName;
   endDate;
@@ -182,6 +214,23 @@ var FieldFrozenError = class extends NoydbError {
     this.fields = fields;
   }
 };
+var IllegalTransitionError = class extends NoydbError {
+  collection;
+  id;
+  from;
+  to;
+  constructor(collection, id, from, to) {
+    super(
+      "ILLEGAL_TRANSITION",
+      `Cannot transition ${collection}/${id} from "${from}" to "${to}" \u2014 not a declared arc. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
+    );
+    this.name = "IllegalTransitionError";
+    this.collection = collection;
+    this.id = id;
+    this.from = from;
+    this.to = to;
+  }
+};
 var InvariantError = class extends NoydbError {
   constructor(message) {
     super("INVARIANT_VIOLATED", message);
@@ -289,15 +338,55 @@ var LedgerContentionError = class extends NoydbError {
     this.attempts = attempts;
   }
 };
-var BundleVersionConflictError = class extends NoydbError {
+var SequenceContentionError = class extends NoydbError {
+  sequence;
+  attempts;
+  constructor(sequence, attempts) {
+    super(
+      "SEQUENCE_CONTENTION",
+      `vault.sequence("${sequence}").next(): failed to allocate after ${attempts} optimistic-CAS retries`
+    );
+    this.name = "SequenceContentionError";
+    this.sequence = sequence;
+    this.attempts = attempts;
+  }
+};
+var SequenceOfflineError = class extends NoydbError {
+  constructor() {
+    super(
+      "SEQUENCE_OFFLINE",
+      "vault.sequence().next() requires an online CAS-capable store (capabilities.casAtomic). Gap-free numbering cannot be serialized offline."
+    );
+    this.name = "SequenceOfflineError";
+  }
+};
+var SequenceNotEnabledError = class extends NoydbError {
+  constructor(message = "vault.sequence() requires the sequence capability. Pass `sequenceStrategy: withSequence()` to createNoydb().") {
+    super("SEQUENCE_NOT_ENABLED", message);
+    this.name = "SequenceNotEnabledError";
+  }
+};
+var NumberingUncertaintyError = class extends NoydbError {
+  series;
+  constructor(series) {
+    super(
+      "NUMBERING_UNCERTAINTY",
+      `Deferred numbering for series "${series}" cannot run: the store does not expose getStoreTime() (capabilities.serverWriteTime). Use a CAS sequence or a store with serverWriteTime.`
+    );
+    this.name = "NumberingUncertaintyError";
+    this.series = series;
+  }
+};
+var PodVersionConflictError = class extends NoydbError {
   /** The bundle handle of the newer remote version that rejected the push. */
   remoteVersion;
   constructor(remoteVersion, message = "Bundle version conflict \u2014 remote has been updated") {
     super("BUNDLE_VERSION_CONFLICT", message);
-    this.name = "BundleVersionConflictError";
+    this.name = "PodVersionConflictError";
     this.remoteVersion = remoteVersion;
   }
 };
+var BundleVersionConflictError = PodVersionConflictError;
 var NetworkError = class extends NoydbError {
   constructor(message = "Network error") {
     super("NETWORK_ERROR", message);
@@ -395,6 +484,31 @@ var IndexRequiredError = class extends NoydbError {
     this.missingFields = [...args.missingFields];
   }
 };
+var UniqueConstraintError = class extends NoydbError {
+  collection;
+  recordId;
+  fields;
+  conflictingId;
+  constructor(collection, recordId, fields, conflictingId) {
+    super(
+      "UNIQUE_CONSTRAINT",
+      `Unique constraint on ${collection}.[${fields.join(", ")}] violated: record "${recordId}" duplicates a value already held by "${conflictingId}".`
+    );
+    this.name = "UniqueConstraintError";
+    this.collection = collection;
+    this.recordId = recordId;
+    this.fields = fields;
+    this.conflictingId = conflictingId;
+  }
+};
+var UnsupportedIndexOptionError = class extends NoydbError {
+  option;
+  constructor(option, message) {
+    super("UNSUPPORTED_INDEX_OPTION", message);
+    this.name = "UnsupportedIndexOptionError";
+    this.option = option;
+  }
+};
 var IndexWriteFailureError = class extends NoydbError {
   recordId;
   field;
@@ -534,6 +648,36 @@ var ScriptViolationError = class extends NoydbError {
     this.sample = sample;
   }
 };
+var StaticDictReadonlyError = class extends NoydbError {
+  /** The static dictionary name that was the target of the mutation. */
+  dictionaryName;
+  constructor(dictionaryName) {
+    super(
+      "STATIC_DICT_READONLY",
+      `Dictionary "${dictionaryName}" is a staticDict \u2014 its labels are code constants with no mutation surface. put/putAll/rename/delete are not supported; change the label in the staticDict() table and redeploy.`
+    );
+    this.name = "StaticDictReadonlyError";
+    this.dictionaryName = dictionaryName;
+  }
+};
+var UnknownDictCodeError = class extends NoydbError {
+  /** The static dictionary name. */
+  dictionaryName;
+  /** The field that carried the unknown code. */
+  field;
+  /** The offending code value. */
+  code;
+  constructor(dictionaryName, field, code) {
+    super(
+      "UNKNOWN_DICT_CODE",
+      `Field "${field}": code "${code}" is not a known key of staticDict "${dictionaryName}". Use a declared code, or pass { validateCodes: false } on the descriptor to allow open codes.`
+    );
+    this.name = "UnknownDictCodeError";
+    this.dictionaryName = dictionaryName;
+    this.field = field;
+    this.code = code;
+  }
+};
 var TranslatorNotConfiguredError = class extends NoydbError {
   /** The field that requested auto-translation. */
   field;
@@ -593,6 +737,48 @@ var AttestationError = class extends NoydbError {
     this.name = "AttestationError";
   }
 };
+var AttestationNotEnabledError = class extends NoydbError {
+  constructor(message = 'Attestation requires the attestation capability. Pass `attestationStrategy: withAttestation()` from "@noy-db/hub/attestation" to createNoydb().') {
+    super("ATTESTATION_NOT_ENABLED", message);
+    this.name = "AttestationNotEnabledError";
+  }
+};
+var TiersNotEnabledError = class extends NoydbError {
+  constructor(message = 'Hierarchical tiers require the tiers capability. Pass `tiersStrategy: withTiers()` from "@noy-db/hub/tiers" to createNoydb().') {
+    super("TIERS_NOT_ENABLED", message);
+    this.name = "TiersNotEnabledError";
+  }
+};
+var SealedRecordNotEnabledError = class extends NoydbError {
+  constructor(message = 'Record-scoped CEK sealing requires the sealed-record capability. Pass `sealedRecordStrategy: withSealedRecord()` from "@noy-db/hub/sealed-record" to createNoydb().') {
+    super("SEALED_RECORD_NOT_ENABLED", message);
+    this.name = "SealedRecordNotEnabledError";
+  }
+};
+var PortabilityNotEnabledError = class extends NoydbError {
+  constructor(message = 'Data portability (export/withdrawal) requires the portability capability. Pass `portabilityStrategy: withPortability()` from "@noy-db/hub/portability" to createNoydb().') {
+    super("PORTABILITY_NOT_ENABLED", message);
+    this.name = "PortabilityNotEnabledError";
+  }
+};
+var CustodyNotEnabledError = class extends NoydbError {
+  constructor(message = "Sovereign custody (grant/revoke custodian, liberate) requires the custody capability. Pass `custodyStrategy: withCustody()` to createNoydb().") {
+    super("CUSTODY_NOT_ENABLED", message);
+    this.name = "CustodyNotEnabledError";
+  }
+};
+var SearchNotEnabledError = class extends NoydbError {
+  constructor(message = "Search / retrieval (search, retrieve, similarTo, warmIndex, flushIndex, and embedding compute) requires the search capability. Pass `searchStrategy: withSearch()` to createNoydb().") {
+    super("SEARCH_NOT_ENABLED", message);
+    this.name = "SearchNotEnabledError";
+  }
+};
+var CargoNotEnabledError = class extends NoydbError {
+  constructor(message = 'Partition extraction (extractPartition) requires the cargo capability. Pass `cargoStrategy: withCargo()` from "@noy-db/hub/cargo" to createNoydb().') {
+    super("CARGO_NOT_ENABLED", message);
+    this.name = "CargoNotEnabledError";
+  }
+};
 var SessionExpiredError = class extends NoydbError {
   sessionId;
   constructor(sessionId) {
@@ -863,9 +1049,209 @@ var SnapshotNotFoundError = class extends NoydbError {
     this.version = version;
   }
 };
+var UnknownShardError = class extends NoydbError {
+  partitionKey;
+  constructor(partitionKey, groupName) {
+    super(
+      "SHARD_UNKNOWN",
+      `No shard for partition key "${partitionKey}" in vault group "${groupName}" and autoCreate is disabled. Call group.createShard(${JSON.stringify(partitionKey)}) first, or enable sharding.autoCreate.`
+    );
+    this.name = "UnknownShardError";
+    this.partitionKey = partitionKey;
+  }
+};
+var ShardProvisioningError = class extends NoydbError {
+  vaultId;
+  constructor(vaultId, partitionKey) {
+    super(
+      "SHARD_PROVISIONING",
+      `Registry has a row for partition "${partitionKey}" (vault "${vaultId}") but that vault is not provisioned in the store. Refusing to recreate it \u2014 the registry and store have diverged. Investigate before retrying.`
+    );
+    this.name = "ShardProvisioningError";
+    this.vaultId = vaultId;
+  }
+};
+var DataResidencyError = class extends NoydbError {
+  vaultId;
+  requiredRegion;
+  backendRegion;
+  constructor(vaultId, requiredRegion, backendRegion) {
+    super(
+      "DATA_RESIDENCY",
+      `Shard "${vaultId}" requires region "${requiredRegion}" but its placement backend declares region ${backendRegion === void 0 ? "(none)" : `"${backendRegion}"`}. Refusing to provision \u2014 route this shard to a region-correct backend via routeStore({ vaultRoutes }) (e.g. a region-encoded partition key) before retrying.`
+    );
+    this.name = "DataResidencyError";
+    this.vaultId = vaultId;
+    this.requiredRegion = requiredRegion;
+    this.backendRegion = backendRegion;
+  }
+};
+var CrossShardJoinError = class extends NoydbError {
+  constructor(message) {
+    super("CROSS_SHARD_JOIN", message);
+    this.name = "CrossShardJoinError";
+  }
+};
+var VaultTemplateNotFoundError = class extends NoydbError {
+  templateName;
+  constructor(templateName) {
+    super(
+      "VAULT_TEMPLATE_NOT_FOUND",
+      `No vault template registered under "${templateName}". Register the template before opening the vault group.`
+    );
+    this.name = "VaultTemplateNotFoundError";
+    this.templateName = templateName;
+  }
+};
+var ForgetStrategyNotConfiguredError = class extends NoydbError {
+  constructor(message = 'vault.forget() requires a forget strategy. Pass `forgetStrategy: withForgetCascade({ subjects: { <collection>: <subjectField> } })` from "@noy-db/hub/forget" to createNoydb().') {
+    super("FORGET_NOT_CONFIGURED", message);
+    this.name = "ForgetStrategyNotConfiguredError";
+  }
+};
+var SealedRecordExpiredError = class extends NoydbError {
+  expiresAt;
+  constructor(expiresAt) {
+    super(
+      "SEALED_RECORD_EXPIRED",
+      `Sealed record CEK expired at ${expiresAt}. The grantor must re-seal the record with a later expiresAt.`
+    );
+    this.name = "SealedRecordExpiredError";
+    this.expiresAt = expiresAt;
+  }
+};
+var SealedRecordMismatchError = class extends NoydbError {
+  expected;
+  actual;
+  constructor(expected, actual) {
+    super(
+      "SEALED_RECORD_MISMATCH",
+      `Sealed CEK binding is for ${actual.collection}/${actual.id} but was presented against ${expected.collection}/${expected.id}. A CEK sealed for one record cannot decrypt another.`
+    );
+    this.name = "SealedRecordMismatchError";
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+var RecordCekNotFoundError = class extends NoydbError {
+  collection;
+  id;
+  constructor(collection, id) {
+    super(
+      "RECORD_CEK_NOT_FOUND",
+      `No per-record CEK for ${collection}/${id}. The record is missing, or its collection was not opened with { perRecordKeys: true } \u2014 only per-record-key records carry a sealable CEK.`
+    );
+    this.name = "RecordCekNotFoundError";
+    this.collection = collection;
+    this.id = id;
+  }
+};
+var EmbeddingDimMismatchError = class extends NoydbError {
+  field;
+  expected;
+  actual;
+  constructor(field, expected, actual) {
+    super(
+      "EMBEDDING_DIM_MISMATCH",
+      `Embedding for "${field}" has dim ${actual}, expected ${expected}.`
+    );
+    this.name = "EmbeddingDimMismatchError";
+    this.field = field;
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+var EmbeddingModelMismatchError = class extends NoydbError {
+  expected;
+  found;
+  constructor(expected, found) {
+    super(
+      "EMBEDDING_MODEL_MISMATCH",
+      `Embedding model mismatch: collection uses "${expected}" but a stored vector is "${found}". Run vault.embeddings.reindex() after changing the encoder.`
+    );
+    this.name = "EmbeddingModelMismatchError";
+    this.expected = expected;
+    this.found = found;
+  }
+};
+var UserEnvelopeOversizedError = class extends NoydbError {
+  bytes;
+  limit;
+  constructor(bytes, limit = USER_ENVELOPE_MAX_BYTES) {
+    super(
+      "USER_ENVELOPE_OVERSIZED",
+      `User envelope payload is ${bytes} bytes; soft cap is ${limit} bytes. Move large data into the vault's regular collections.`
+    );
+    this.name = "UserEnvelopeOversizedError";
+    this.bytes = bytes;
+    this.limit = limit;
+  }
+};
+var PolicyDeniedError = class extends NoydbError {
+  gate;
+  reason;
+  required;
+  constructor(gate, reason, required, message) {
+    super(
+      "POLICY_DENIED",
+      message ?? `Gate "${gate}" denied: ${reason}.`
+    );
+    this.name = "PolicyDeniedError";
+    this.gate = gate;
+    this.reason = reason;
+    this.required = required;
+  }
+};
+var RecoveryNotEnrolledError = class extends NoydbError {
+  constructor(message = 'Recovery profile not enrolled. Pass `recovery: [{ profile: "paper", codes: 10 }]` to `createNoydb()`, or set `policy.gates["recover-passphrase"].enabled = false` to opt out of recovery (passphrase loss = data loss). See https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md.') {
+    super("RECOVERY_NOT_ENROLLED", message);
+    this.name = "RecoveryNotEnrolledError";
+  }
+};
+var ManagedRecoveryNotEnrolledError = class extends NoydbError {
+  vault;
+  constructor(vault) {
+    super(
+      "MANAGED_RECOVERY_NOT_ENROLLED",
+      `Managed-mode vault "${vault}" requires at least one strong recovery profile (Shamir today; multi-channel / admin-mediated when they ship). Paper alone is NOT strong under managed mode \u2014 losing the paper sheet would mean losing every record permanently. Bootstrap with \`db.openVaultAndEnrollRecovery("${vault}", { recovery: [{ profile: "shamir", k: 2, n: 3 }] })\`, or call \`db.enrollRecovery(vault, { profile: "shamir", k, n })\` separately, then re-attempt \`openVault\`.`
+    );
+    this.name = "ManagedRecoveryNotEnrolledError";
+    this.vault = vault;
+  }
+};
+var RecoveryProfileNotImplementedError = class extends NoydbError {
+  profile;
+  tracking;
+  constructor(profile, tracking) {
+    super(
+      "RECOVERY_PROFILE_NOT_IMPLEMENTED",
+      `Recovery profile "${profile}" is not yet implemented in this hub release. Tracking: ${tracking}. Use the "paper" profile via @noy-db/on-recovery in the meantime.`
+    );
+    this.name = "RecoveryProfileNotImplementedError";
+    this.profile = profile;
+    this.tracking = tracking;
+  }
+};
+var EnclaveNotSupportedError = class extends NoydbError {
+  /** The optional group that is not supported by this enclave. */
+  group;
+  constructor(group, detail) {
+    super(
+      "ENCLAVE_NOT_SUPPORTED",
+      `enclave: ${group} is not supported by this enclave${detail ? ` \u2014 ${detail}` : ""}`
+    );
+    this.name = "EnclaveNotSupportedError";
+    this.group = group;
+  }
+};
 
 export {
+  STATE_VAULT_NAME,
+  USER_ENVELOPE_MAX_BYTES,
+  USER_ENVELOPE_COLLECTION,
   NoydbError,
+  DebugPlaintextError,
+  DebugReservedFieldError,
   DecryptionError,
   TamperedError,
   InvalidKeyError,
@@ -880,9 +1266,11 @@ export {
   ImportCapabilityError,
   StoreCapabilityError,
   PrivilegeEscalationError,
+  ReservedVaultNameError,
   PeriodClosedError,
   RecordLockedError,
   FieldFrozenError,
+  IllegalTransitionError,
   InvariantError,
   AmendmentForbiddenError,
   DirectoryDisabledError,
@@ -893,6 +1281,11 @@ export {
   DelegationTargetMissingError,
   ConflictError,
   LedgerContentionError,
+  SequenceContentionError,
+  SequenceOfflineError,
+  SequenceNotEnabledError,
+  NumberingUncertaintyError,
+  PodVersionConflictError,
   BundleVersionConflictError,
   NetworkError,
   NotFoundError,
@@ -906,6 +1299,8 @@ export {
   QuiesceTimeoutError,
   GroupCardinalityError,
   IndexRequiredError,
+  UniqueConstraintError,
+  UnsupportedIndexOptionError,
   IndexWriteFailureError,
   BundleIntegrityError,
   BundleSealMismatchError,
@@ -915,6 +1310,8 @@ export {
   MissingTranslationError,
   LocaleNotSpecifiedError,
   ScriptViolationError,
+  StaticDictReadonlyError,
+  UnknownDictCodeError,
   TranslatorNotConfiguredError,
   BackupLedgerError,
   BackupCorruptedError,
@@ -922,6 +1319,13 @@ export {
   TransferSealError,
   AdoptionStateError,
   AttestationError,
+  AttestationNotEnabledError,
+  TiersNotEnabledError,
+  SealedRecordNotEnabledError,
+  PortabilityNotEnabledError,
+  CustodyNotEnabledError,
+  SearchNotEnabledError,
+  CargoNotEnabledError,
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
@@ -944,6 +1348,23 @@ export {
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError,
   OverlayIdMismatchError,
-  SnapshotNotFoundError
-};
-//# sourceMappingURL=chunk-B6PB7JLN.js.map
+  SnapshotNotFoundError,
+  UnknownShardError,
+  ShardProvisioningError,
+  DataResidencyError,
+  CrossShardJoinError,
+  VaultTemplateNotFoundError,
+  ForgetStrategyNotConfiguredError,
+  SealedRecordExpiredError,
+  SealedRecordMismatchError,
+  RecordCekNotFoundError,
+  EmbeddingDimMismatchError,
+  EmbeddingModelMismatchError,
+  UserEnvelopeOversizedError,
+  PolicyDeniedError,
+  RecoveryNotEnrolledError,
+  ManagedRecoveryNotEnrolledError,
+  RecoveryProfileNotImplementedError,
+  EnclaveNotSupportedError
+};
+//# sourceMappingURL=chunk-ZYUC53LT.js.map