@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/index-qwuNvO2B.d.ts

@@ -0,0 +1,144 @@
+import { iA as RetrieveHit, c_ as NoydbStore, dn as SealingKeyProvider, c8 as UnlockedKeyring, eZ as CargoStrategy } from './index-DjWbxsjb.js';
+import './ulid-DRH25k3y.js';
+import './index-B9QdHytu.js';
+import './vault-diff-Z2DUayMe.js';
+
+/**
+ * L3 — Reciprocal Rank Fusion. Merges N ranked `RetrieveHit` lists into
+ * one, scoring each id by Σ 1/(k + rank) across the lists it appears in. Pure,
+ * deterministic, no I/O — which is why it serves BOTH hybrid lexical⊕semantic
+ * fusion AND klum-db's cross-vault federation (the lists are per-vault). The
+ * fused `score` is the RRF score, NOT BM25 or cosine.
+ */
+
+interface FuseOptions {
+    /** Only 'rrf' in v1 (default). */
+    readonly strategy?: 'rrf';
+    /** RRF constant; larger flattens the rank weighting. Default 60. */
+    readonly k?: number;
+    /** Truncate the fused output to this many hits. */
+    readonly limit?: number;
+}
+/**
+ * Callers must supply hits with `rank >= 1` (the retrieve contract guarantees
+ * it; a federation caller passing `rank: 0` with `k: 0` would divide by zero).
+ * Doc-only note — no runtime guard; rank ≥ 1 is the retrieve contract.
+ */
+declare function fuseRetrieval<T>(lists: ReadonlyArray<ReadonlyArray<RetrieveHit<T>>>, opts?: FuseOptions): RetrieveHit<T>[];
+
+/**
+ * Hub-core constants that must be referenceable without pulling any
+ * service chunk. Kept import-free.
+ */
+/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
+declare const STATE_VAULT_NAME = "__noydb_state__";
+/**
+ * Soft cap on the JSON-serialized user-envelope payload size. Generous (a
+ * typical profile + preferences + small app annex is ~1 KiB); rejects
+ * accidental "stuff app state in here" anti-patterns.
+ */
+declare const USER_ENVELOPE_MAX_BYTES: number;
+/**
+ * Reserved store collection name for user envelopes. Starts with `_` so the
+ * keyring grant machinery propagates the DEK to every granted user via the
+ * existing system-collection DEK propagation path in `team/keyring.ts`.
+ */
+declare const USER_ENVELOPE_COLLECTION = "_users";
+
+/**
+ * FR-6 — Deed: sealed / hidden-owner provisioning.
+ *
+ * A **Deed** is a vault owned by a *latent* principal who never
+ * authenticates. The owner credential (the random passphrase that
+ * derives `KEK_owner`) is minted machine-side and sealed under a
+ * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
+ * the cryptographic *inalienability anchor*: whoever holds the
+ * provider (the client / their KMS) is the only party that can ever
+ * re-derive `KEK_owner`. A firm-side custodian operates the vault
+ * fully but can never reach the owner key — there is deliberately NO
+ * firm-controlled fallback.
+ *
+ * Provisioning reuses the managed-mode seam:
+ *   - {@link resolveManagedSecret} mints + seals + persists the random
+ *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
+ *     subsequent open through the same provider).
+ *   - {@link createOwnerKeyring} derives `KEK_owner` from that
+ *     passphrase and writes the `_keyring/<ownerUserId>` file.
+ *
+ * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
+ * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
+ * sealing boundary protects them, so it must be readable without
+ * unlocking the vault (a custodian or auditor inspecting the vault must
+ * be able to see "this is a Deed vault, owner = X, sealed under Y"
+ * without any key). The marker itself is therefore never sealed; only
+ * the owner *credential* is.
+ *
+ * @module
+ */
+
+/** Reserved id for the Deed marker under `_meta`. */
+declare const DEED_RECORD_ID: "deed";
+/**
+ * Plaintext metadata recording a vault's latent-owner Deed. Persisted
+ * at `_meta/deed`. Readable without unlocking the vault by design — it
+ * carries no secret material, only the identity of the latent owner
+ * and the sealing boundary that anchors inalienability.
+ */
+interface DeedMarker {
+    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
+    readonly ownerUserId: string;
+    /**
+     * The `SealingKeyProvider.id` the owner credential is sealed under.
+     * The inalienability anchor: only the holder of this (non-firm)
+     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
+     */
+    readonly sealedUnder: string;
+    /** Always `true` for a Deed — the owner never authenticates interactively. */
+    readonly latent: true;
+    /** ISO-8601 timestamp the Deed was issued. */
+    readonly issuedAt: string;
+    /**
+     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
+     * via the audited Liberate ceremony), if any. Absent until liberation.
+     */
+    readonly liberatedAt?: string;
+}
+/**
+ * Provision a Deed: a latent owner whose credential is sealed under
+ * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
+ * via {@link resolveManagedSecret}, derives the owner keyring via
+ * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
+ * marker. Returns the unlocked owner keyring.
+ *
+ * The returned keyring is the only in-memory window onto `KEK_owner`
+ * for this call; the persistent re-entry point is the sealing provider
+ * (re-run {@link resolveManagedSecret} with the same provider to
+ * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
+ * unlock — no interactive passphrase is ever required).
+ *
+ * There is deliberately no firm-controlled fallback: the marker's
+ * `sealedUnder` is the single cryptographic anchor of ownership.
+ */
+declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
+/**
+ * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
+ * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
+ * unlocking required.
+ */
+declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
+/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
+declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
+
+/**
+ * Enable the cargo (partition extraction) capability.
+ * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side
+ * `extractPartition(vault, ...)` free function live. The extraction crypto
+ * engine is dynamically imported here, so it stays out of the floor bundle
+ * until opted in. The recipient-side `adoptPartition` /
+ * `decryptExtractedPartition` free functions — and `diffVault` (shared
+ * import/merge infra) — are ungated and unaffected.
+ */
+
+declare function withCargo(): CargoStrategy;
+
+export { DEED_RECORD_ID as D, type FuseOptions as F, STATE_VAULT_NAME as S, USER_ENVELOPE_COLLECTION as U, type DeedMarker as a, USER_ENVELOPE_MAX_BYTES as b, createDeedOwner as c, fuseRetrieval as f, isDeedVault as i, loadDeedMarker as l, withCargo as w };