@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/{chunk-JNUWZ6D3.js.map → chunk-PLS64NCS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-audit/attestation/signer.ts"],"sourcesContent":["import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport { generateDocSigningKeyPair } from '@noy-db/attestation'\n\nexport const ATTESTATIONS_COLLECTION = '_attestations'\nexport const SIGNER_RECORD_ID = '_signer'\nexport const REVOKED_RECORD_ID = '_revoked'\n\nexport interface DocSigner {\n  readonly keyId: string\n  readonly publicKeyB64: string\n  readonly privateKeyPkcs8B64: string\n}\n\n/**\n * Pure read: return the firm's persisted document-signing keypair, or `null`\n * if none has been minted yet. Never writes — callers that must NOT mint\n * (e.g. an ungated public-key getter) use this instead of `loadOrCreateSigner`.\n *\n * Stored as an encrypted record `_attestations/_signer` under the\n * `_attestations` collection DEK (resolved via `getDEK`, which is\n * AES-KW-wrapped under the owner KEK + persisted by the keyring). The KEK\n * itself is AES-KW-only and cannot AES-GCM-encrypt these bytes — hence\n * storage under a normal collection DEK.\n */\nexport async function loadSigner(\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<DocSigner | null> {\n  const existing = await store.get(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID)\n  if (!existing) return null\n  const dek = await getDEK(ATTESTATIONS_COLLECTION)\n  const json = await openEnvelopeJson(existing, dek)\n  return JSON.parse(json) as DocSigner\n}\n\n/**\n * Lazily mint (or load) the firm's Ed25519 document-signing keypair.\n *\n * On a concurrent first-mint, two callers can both read `null` and both mint\n * distinct keypairs. The `put(…, expectedVersion: 0)` (\"must not already\n * exist\") lets exactly one win; the loser catches `ConflictError`, re-reads,\n * and returns the winner's signer — converging on a single keypair rather than\n * clobbering it or surfacing a raw conflict. (All real stores treat a missing\n * record + `ev: 0` as a no-conflict write, so the catch fires on lost-race only.)\n */\nexport async function loadOrCreateSigner(\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<DocSigner> {\n  const existing = await loadSigner(store, vault, getDEK)\n  if (existing) return existing\n\n  const dek = await getDEK(ATTESTATIONS_COLLECTION)\n  const signer = await generateDocSigningKeyPair()\n  const { iv, data } = await encrypt(JSON.stringify(signer), dek)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: iv, _data: data,\n  }\n  try {\n    await store.put(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID, env, 0)\n    return signer\n  } catch (e) {\n    if (!(e instanceof ConflictError)) throw e\n    // Lost the race — another writer minted first. Adopt the winner.\n    const winner = await loadSigner(store, vault, getDEK)\n    if (!winner) {\n      throw new ConflictError(0, 'loadOrCreateSigner: signer mint lost a concurrent race but the winning record could not be re-read.')\n    }\n    return winner\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAIA,SAAS,iCAAiC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAmBjC,eAAsB,WACpB,OACA,OACA,QAC2B;AAC3B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,yBAAyB,gBAAgB;AACjF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,uBAAuB;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,GAAG;AACjD,SAAO,KAAK,MAAM,IAAI;AACxB;AAYA,eAAsB,mBACpB,OACA,OACA,QACoB;AACpB,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,MAAM;AACtD,MAAI,SAAU,QAAO;AAErB,QAAM,MAAM,MAAM,OAAO,uBAAuB;AAChD,QAAM,SAAS,MAAM,0BAA0B;AAC/C,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,GAAG;AAC9D,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IAAsB,IAAI;AAAA,IAAG,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAAG,KAAK;AAAA,IAAI,OAAO;AAAA,EACtF;AACA,MAAI;AACF,UAAM,MAAM,IAAI,OAAO,yBAAyB,kBAAkB,KAAK,CAAC;AACxE,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,eAAgB,OAAM;AAEzC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,MAAM;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,GAAG,qGAAqG;AAAA,IAClI;AACA,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/with-audit/attestation/signer.ts"],"sourcesContent":["import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport { generateDocSigningKeyPair } from '@noy-db/attestation'\n\nexport const ATTESTATIONS_COLLECTION = '_attestations'\nexport const SIGNER_RECORD_ID = '_signer'\nexport const REVOKED_RECORD_ID = '_revoked'\n\nexport interface DocSigner {\n  readonly keyId: string\n  readonly publicKeyB64: string\n  readonly privateKeyPkcs8B64: string\n}\n\n/**\n * Pure read: return the firm's persisted document-signing keypair, or `null`\n * if none has been minted yet. Never writes — callers that must NOT mint\n * (e.g. an ungated public-key getter) use this instead of `loadOrCreateSigner`.\n *\n * Stored as an encrypted record `_attestations/_signer` under the\n * `_attestations` collection DEK (resolved via `getDEK`, which is\n * AES-KW-wrapped under the owner KEK + persisted by the keyring). The KEK\n * itself is AES-KW-only and cannot AES-GCM-encrypt these bytes — hence\n * storage under a normal collection DEK.\n */\nexport async function loadSigner(\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<DocSigner | null> {\n  const existing = await store.get(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID)\n  if (!existing) return null\n  const dek = await getDEK(ATTESTATIONS_COLLECTION)\n  const json = await openEnvelopeJson(existing, dek)\n  return JSON.parse(json) as DocSigner\n}\n\n/**\n * Lazily mint (or load) the firm's Ed25519 document-signing keypair.\n *\n * On a concurrent first-mint, two callers can both read `null` and both mint\n * distinct keypairs. The `put(…, expectedVersion: 0)` (\"must not already\n * exist\") lets exactly one win; the loser catches `ConflictError`, re-reads,\n * and returns the winner's signer — converging on a single keypair rather than\n * clobbering it or surfacing a raw conflict. (All real stores treat a missing\n * record + `ev: 0` as a no-conflict write, so the catch fires on lost-race only.)\n */\nexport async function loadOrCreateSigner(\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<DocSigner> {\n  const existing = await loadSigner(store, vault, getDEK)\n  if (existing) return existing\n\n  const dek = await getDEK(ATTESTATIONS_COLLECTION)\n  const signer = await generateDocSigningKeyPair()\n  const { iv, data } = await encrypt(JSON.stringify(signer), dek)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: iv, _data: data,\n  }\n  try {\n    await store.put(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID, env, 0)\n    return signer\n  } catch (e) {\n    if (!(e instanceof ConflictError)) throw e\n    // Lost the race — another writer minted first. Adopt the winner.\n    const winner = await loadSigner(store, vault, getDEK)\n    if (!winner) {\n      throw new ConflictError(0, 'loadOrCreateSigner: signer mint lost a concurrent race but the winning record could not be re-read.')\n    }\n    return winner\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAIA,SAAS,iCAAiC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAmBjC,eAAsB,WACpB,OACA,OACA,QAC2B;AAC3B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,yBAAyB,gBAAgB;AACjF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,uBAAuB;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,GAAG;AACjD,SAAO,KAAK,MAAM,IAAI;AACxB;AAYA,eAAsB,mBACpB,OACA,OACA,QACoB;AACpB,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,MAAM;AACtD,MAAI,SAAU,QAAO;AAErB,QAAM,MAAM,MAAM,OAAO,uBAAuB;AAChD,QAAM,SAAS,MAAM,0BAA0B;AAC/C,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,GAAG;AAC9D,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IAAsB,IAAI;AAAA,IAAG,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAAG,KAAK;AAAA,IAAI,OAAO;AAAA,EACtF;AACA,MAAI;AACF,UAAM,MAAM,IAAI,OAAO,yBAAyB,kBAAkB,KAAK,CAAC;AACxE,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,eAAgB,OAAM;AAEzC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,MAAM;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,GAAG,qGAAqG;AAAA,IAClI;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-EIZUR2XW.js → chunk-PS2NEWEX.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/with-formula/overlay-views/with-overlayed-view.ts
 function withOverlayedView(spec) {
@@ -33,4 +33,4 @@ function withOverlayedView(spec) {
 export {
   withOverlayedView
 };
-//# sourceMappingURL=chunk-EIZUR2XW.js.map
+//# sourceMappingURL=chunk-PS2NEWEX.js.map

package/dist/chunk-QA2KUPCP.js

@@ -0,0 +1,45 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-YN5IAHN6.js";
+
+// src/kernel/enclave/record-keys/tombstone.ts
+function isTombstoneShape(envelope) {
+  return envelope._data === "" && envelope._cek === void 0 && envelope._del !== true;
+}
+function isTombstone(envelope, encrypted) {
+  if (!encrypted) return false;
+  return isTombstoneShape(envelope);
+}
+function buildTombstone(version, actor) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: "",
+    ...actor ? { _by: actor } : {}
+  };
+}
+function isDeleteMarker(envelope) {
+  return envelope._del === true;
+}
+function buildDeleteMarker(version, actor) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: "",
+    _del: true,
+    ...actor ? { _by: actor } : {}
+  };
+}
+
+export {
+  isTombstoneShape,
+  isTombstone,
+  buildTombstone,
+  isDeleteMarker,
+  buildDeleteMarker
+};
+//# sourceMappingURL=chunk-QA2KUPCP.js.map

package/dist/chunk-QA2KUPCP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/record-keys/tombstone.ts"],"sourcesContent":["/**\n * Tombstone shape + predicate for the per-record-key (CEK) layer.\n *\n * A *tombstone* is the residue a GDPR crypto-shred (`vault.forget()`)\n * leaves on disk: the live envelope rewritten to `{ _noydb, _v, _ts, _by,\n * _iv:'', _data:'' }`, dropping `_iv`/`_data`/`_cek`/`_det`. With the wrapped\n * per-record CEK gone, the body — and every history version under the same\n * CEK — is permanently undecryptable, while the record KEY survives so the\n * version counter and \"record existed and was erased\" persist for the audit\n * ledger.\n *\n * These two helpers are the pure, collection-independent core of that\n * contract: {@link buildTombstone} mints the shape, {@link isTombstone}\n * recognises it on the read path. The orchestration that *writes* a tombstone\n * (`_writeTombstone`) and drives `vault.forget()` lives with the collection /\n * vault; it calls into these.\n */\nimport { NOYDB_FORMAT_VERSION, type EncryptedEnvelope } from '../../types.js'\n\n/**\n * Shape-only tombstone recognition for layers that have no per-collection\n * context (the sync engine, #590): a tombstone carries an empty `_data` and\n * no wrapped CEK. No live envelope can match — record bodies never serialize\n * to the empty string (the `_sync` meta envelope carries non-empty `_data`,\n * and legacy migration envelopes carry non-empty `_iv`/`_data`).\n */\nexport function isTombstoneShape(envelope: EncryptedEnvelope): boolean {\n  return envelope._data === '' && envelope._cek === undefined && envelope._del !== true\n}\n\n/**\n * Is this envelope a crypto-shred tombstone?\n *\n * A tombstone carries no body (`_data` empty) and no wrapped CEK (`_cek`\n * absent) — decrypting it would call `decrypt('', '', dek)` → an AES-GCM\n * throw, so every read choke point must short-circuit to `null` instead.\n *\n * `encrypted` is the collection's encryption flag: on an unencrypted\n * collection there are no envelopes to shred, so nothing is ever a tombstone.\n * (Legacy migration envelopes carry non-empty `_iv`/`_data`, so they are not\n * tombstones and stay readable.)\n */\nexport function isTombstone(envelope: EncryptedEnvelope, encrypted: boolean): boolean {\n  if (!encrypted) return false\n  return isTombstoneShape(envelope)\n}\n\n/**\n * Mint a tombstone envelope from a record's live version + actor.\n *\n * Keeps `_v` (the displaced version) so the counter is monotonic across the\n * shred, stamps a fresh `_ts`, and records `_by` when an actor is supplied.\n * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the\n * erasure.\n */\nexport function buildTombstone(version: number, actor: string): EncryptedEnvelope {\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: '',\n    ...(actor ? { _by: actor } : {}),\n  }\n}\n\n/** #589: is this envelope an ordinary-delete marker (version-ordered, reads as absent)? */\nexport function isDeleteMarker(envelope: EncryptedEnvelope): boolean {\n  return envelope._del === true\n}\n\n/**\n * Mint a delete marker from the deleted record's next version + actor (#589).\n * Minted at the NEXT version (`existing._v + 1`) — unlike `buildTombstone`, which\n * keeps the displaced `_v` — so it wins convergence over the pre-delete copy and a\n * re-create can still win over it at a higher version.\n */\nexport function buildDeleteMarker(version: number, actor: string): EncryptedEnvelope {\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: '',\n    _del: true,\n    ...(actor ? { _by: actor } : {}),\n  }\n}\n"],"mappings":";;;;;AA0BO,SAAS,iBAAiB,UAAsC;AACrE,SAAO,SAAS,UAAU,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS;AACnF;AAcO,SAAS,YAAY,UAA6B,WAA6B;AACpF,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,iBAAiB,QAAQ;AAClC;AAUO,SAAS,eAAe,SAAiB,OAAkC;AAChF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,GAAI,QAAQ,EAAE,KAAK,MAAM,IAAI,CAAC;AAAA,EAChC;AACF;AAGO,SAAS,eAAe,UAAsC;AACnE,SAAO,SAAS,SAAS;AAC3B;AAQO,SAAS,kBAAkB,SAAiB,OAAkC;AACnF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,GAAI,QAAQ,EAAE,KAAK,MAAM,IAAI,CAAC;AAAA,EAChC;AACF;","names":[]}

package/dist/{chunk-WYSO2NIH.js → chunk-QOC3VYL2.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-WYSO2NIH.js.map
+//# sourceMappingURL=chunk-QOC3VYL2.js.map

package/dist/{chunk-FISN7WE4.js → chunk-QSFOZUYL.js}

@@ -1,14 +1,14 @@
 import {
   pickLocale
-} from "./chunk-SMXWYP24.js";
+} from "./chunk-OXCSVM3B.js";
 import {
   sha256Hex
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-3OPY6MK2.js";
 import {
   BundleIntegrityError,
   BundleSealMismatchError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/with-pod/format.ts
 var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
@@ -608,6 +608,30 @@ function applySliceFilters(dumpJson, opts) {
   }
   return JSON.stringify(backup);
 }
+async function applySatelliteLivenessFilter(vault, dumpJson) {
+  const backup = JSON.parse(dumpJson);
+  if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
+  if (typeof vault._introspectState !== "function") return dumpJson;
+  const { adapter, name, getDEK } = vault._introspectState();
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-HQIE2YG7.js");
+  const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
+  if (satLive.size === 0) return dumpJson;
+  const next = {};
+  for (const [collName, records] of Object.entries(backup.collections)) {
+    const live = satLive.get(collName);
+    if (!live) {
+      next[collName] = records;
+      continue;
+    }
+    const kept = {};
+    for (const [id, env] of Object.entries(records)) {
+      if (live.has(id)) kept[id] = env;
+    }
+    next[collName] = kept;
+  }
+  backup.collections = next;
+  return JSON.stringify(backup);
+}
 async function applyPlaintextFilters(vault, dumpJson, opts) {
   if (opts.where === void 0 && opts.tierAtMost === void 0) {
     return dumpJson;
@@ -674,7 +698,8 @@ async function writePod(vault, opts = {}) {
   const autoUnlockMode = validateAutoUnlockOptions(opts, normalizedAutoUnlock);
   const handle = await vault.getBundleHandle();
   const dumpJson = await vault.dump();
-  const rekeyed = await applyRecipientRewrap(vault, dumpJson, opts);
+  const satelliteFiltered = await applySatelliteLivenessFilter(vault, dumpJson);
+  const rekeyed = await applyRecipientRewrap(vault, satelliteFiltered, opts);
   const plainFiltered = await applyPlaintextFilters(vault, rekeyed, opts);
   const filtered = applySliceFilters(plainFiltered, opts);
   const bodyJsonStr = normalizedAutoUnlock === null ? filtered : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock));
@@ -795,4 +820,4 @@ export {
   readPod,
   readNoydbBundle
 };
-//# sourceMappingURL=chunk-FISN7WE4.js.map
+//# sourceMappingURL=chunk-QSFOZUYL.js.map