@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/fanout-sidecar-GF3DJ6KR.js

@@ -1,71 +0,0 @@
-import {
-  encrypt,
-  openEnvelopeJson
-} from "./chunk-5O3AOPDT.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
-import "./chunk-ZYUC53LT.js";
-import "./chunk-PZ5AY32C.js";
-
-// src/with-formula/derivations/fanout-sidecar.ts
-var FANOUT_DEK_COLLECTION = "_meta";
-function recordId(source, sourceId, outputKey) {
-  return `derivations-fanout/${source}/${sourceId}/${outputKey}`;
-}
-async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
-  const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
-  if (!envelope) return void 0;
-  try {
-    const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
-    const parsed = JSON.parse(json);
-    if (parsed._noydb_fanout !== 1) return void 0;
-    if (!Array.isArray(parsed.keys)) return void 0;
-    return parsed;
-  } catch {
-    return void 0;
-  }
-}
-async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
-  const doc = {
-    _noydb_fanout: 1,
-    source: payload.source,
-    sourceId: payload.sourceId,
-    outputKey: payload.outputKey,
-    outputCollection: payload.outputCollection,
-    keys: payload.keys,
-    emittedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const id = recordId(payload.source, payload.sourceId, payload.outputKey);
-  const prior = await store.get(vault, "_meta", id);
-  const json = JSON.stringify(doc);
-  let envelope;
-  if (!encrypted) {
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: json
-    };
-  } else {
-    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: (prior?._v ?? 0) + 1,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: iv,
-      _data: data
-    };
-  }
-  await store.put(vault, "_meta", id, envelope);
-}
-async function deleteFanoutSidecar(store, vault, source, sourceId, outputKey) {
-  await store.delete(vault, "_meta", recordId(source, sourceId, outputKey));
-}
-export {
-  deleteFanoutSidecar,
-  loadFanoutSidecar,
-  saveFanoutSidecar
-};
-//# sourceMappingURL=fanout-sidecar-GF3DJ6KR.js.map

package/dist/fanout-sidecar-GF3DJ6KR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns empty if absent.\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  try {\n    // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n    const json = (!encrypted || envelope._iv === '')\n      ? envelope._data\n      : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION))\n    const parsed = JSON.parse(json) as FanoutSidecar\n    if (parsed._noydb_fanout !== 1) return undefined\n    if (!Array.isArray(parsed.keys)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: json,\n    }\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION))\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: iv,\n      _data: data,\n    }\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;AA6BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AASA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AAEF,UAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,UAAU,MAAM,OAAO,qBAAqB,CAAC;AACxE,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,QAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,CAAC;AAC5E,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/forget/index.d.ts

@@ -1,36 +0,0 @@
-import { S as SubjectDeclaration, F as ForgetStrategy } from '../subject-index-O75wKshW.js';
-export { a as ForgetResult, N as NO_FORGET, b as SUBJECT_INDEX_COLLECTION, c as SubjectRef } from '../subject-index-O75wKshW.js';
-
-/**
- * `withForgetCascade` — the active factory for GDPR right-to-erasure via
- * per-record CEK crypto-shred. Mirrors the canonical
- * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split
- * used by the other services.
- *
- * @module
- */
-
-/**
- * Declare GDPR crypto-shred for one or more collections.
- *
- * Each declared collection is forced to `perRecordKeys: true` (a shred can
- * only guarantee erasure of a record whose body is keyed off a per-record
- * CEK). On write, Noydb extracts `record[subjectField]` and maintains an
- * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so
- * `vault.forget(subjectId)` can find every record for a subject and rewrite
- * each to a tombstone (body + history permanently undecryptable) while the
- * collection DEK and every other record stay intact.
- *
- * @example
- * ```ts
- * createNoydb({
- *   secret, user,
- *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),
- * })
- * const result = await vault.forget('buyer-123')
- * // → { subject, recordsShredded, historyVersionsShredded, collections, … }
- * ```
- */
-declare function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy;
-
-export { ForgetStrategy, SubjectDeclaration, withForgetCascade };

package/dist/guards/index.d.ts

@@ -1,35 +0,0 @@
-export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from '../transition-guard-C7ol6oPw.js';
-import { bJ as GuardStrategy, bK as GuardChange, bL as GuardContext } from '../index-BzUo1B6n.js';
-export { bM as AmendmentForbiddenError, bN as FieldFrozenError, bO as GuardRegistry, bP as GuardStrategyHandle, bQ as IllegalTransitionError, bR as InvariantError, bS as ReadOnlyVaultFacade, bT as RecordLockedError } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Pure functions that execute the work declared by a `GuardStrategy`.
- * Stateless — `GuardRegistry` decides when to call these.
- *
- * @internal
- */
-declare const GuardExecutor: {
-    /**
-     * Compare existing vs incoming for each `frozenFields.fields` entry
-     * when `frozenFields.when(existing)` is true. Throws
-     * `FieldFrozenError` listing every changed frozen field.
-     *
-     * @param skipFields — field names that are schema-owned computed fields.
-     *   These are excluded from the comparison because `incoming` carries the
-     *   raw user input (computed fields not yet evaluated), so comparing
-     *   `existing[field]` vs `incoming[field]` would always look like a
-     *   change even when the computed result is unchanged.
-     */
-    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T, skipFields?: ReadonlySet<string>): Promise<void>;
-    /**
-     * Run a single guard's invariant over its slice of the change-set.
-     * Any throw is converted to `InvariantError` unless it already is one.
-     */
-    runInvariant<T extends Record<string, unknown>>(guard: GuardStrategy<T>, changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>): Promise<void>;
-};
-
-export { GuardChange, GuardContext, GuardExecutor, GuardStrategy };

package/dist/hash-Cp5uwiox.d.ts

@@ -1,67 +0,0 @@
-import { cV as EncryptedEnvelope } from './index-BzUo1B6n.js';
-
-/**
- * Ledger storage constants — pinned in their own leaf module so
- * always-on core code (vault.ts, dictionary.ts) can import them
- * without dragging the `LedgerStore` class into the bundle.
- *
- * `splitting: true` in tsup is not enough on its own: when a
- * source file exports both pure constants and a heavyweight class,
- * the bundler keeps the entire chunk reachable from any importer.
- * Extracting the constants lets the floor scenario import them
- * without paying for the class.
- *
- * @internal
- */
-/** The internal collection name used for ledger entry storage. */
-declare const LEDGER_COLLECTION = "_ledger";
-/**
- * The internal collection name used for delta payload storage.
- *
- * Deltas live in a sibling collection (not inside `_ledger`) for two
- * reasons:
- *
- *   1. **Listing efficiency.** `ledger.loadAllEntries()` calls
- *      `adapter.list(_ledger)` which would otherwise return every
- *      delta key alongside every entry key. Splitting them keeps the
- *      list small (one key per ledger entry) and the delta reads
- *      keyed by the entry's index.
- *
- *   2. **Prune-friendliness.** A future `pruneHistory()` will delete
- *      old deltas while keeping the ledger chain intact (folding old
- *      deltas into a base snapshot). Separating the storage makes
- *      that deletion a targeted operation on one collection instead
- *      of a filter across a mixed list.
- *
- * Both collections share the same ledger DEK — one DEK, two
- * internal collections, same zero-knowledge guarantees.
- */
-declare const LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
-
-/**
- * Envelope payload hash — pinned in its own leaf module so consumers
- * (DictionaryHandle, the active history strategy) can import it
- * without dragging in the `LedgerStore` class.
- *
- * see `constants.ts` for the broader rationale.
- *
- * @internal
- */
-
-/**
- * Compute the `payloadHash` value for an encrypted envelope. Used by
- * `LedgerStore.append` for both put (hash the new envelope) and
- * delete (hash the previous envelope) paths, and by
- * `DictionaryHandle` so its ledger entries match the same contract.
- *
- * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext
- * map (`_sealed`) when a record carries one — so the ledger attests to
- * both the open body AND every sealed value.
- *
- * Returns the empty string when there is no envelope (delete of a
- * never-existed record). The empty string tolerated by the ledger
- * entry's `payloadHash` field as the canonical "nothing here" value.
- */
-declare function envelopePayloadHash(envelope: EncryptedEnvelope | null): Promise<string>;
-
-export { LEDGER_COLLECTION as L, LEDGER_DELTAS_COLLECTION as a, envelopePayloadHash as e };

package/dist/history/index.d.ts

@@ -1,61 +0,0 @@
-import { cS as HistoryStrategy, cT as NoydbStore, cU as HistoryOptions, cV as EncryptedEnvelope, cW as PruneOptions } from '../index-BzUo1B6n.js';
-export { cX as AppendInput, cY as ChangeType, cZ as CollectionInstant, cE as DiffEntry, c_ as JsonPatch, c$ as JsonPatchOp, d0 as LedgerStore, d1 as VaultEngine, d2 as VaultInstant, d3 as VerifyResult, d4 as applyPatch, d5 as computePatch, d6 as diff, d7 as formatDiff } from '../index-BzUo1B6n.js';
-export { L as LedgerEntry, d as canonicalJson, h as hashEntry, p as paddedIndex, e as parseIndex, s as sha256Hex } from '../subject-index-O75wKshW.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from '../hash-Cp5uwiox.js';
-import '../describe-aBkJR2sd.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active history strategy — `withHistory()` returns the real
- * implementation that wires per-record snapshots, the hash-chained
- * audit ledger, JSON-patch deltas, and time-machine reads into the
- * core write/read paths.
- *
- * Consumers opt in by:
- *
- * ```ts
- * import { createNoydb } from '@noy-db/hub'
- * import { withHistory } from '@noy-db/hub/history'
- *
- * const db = await createNoydb({
- *   store: ...,
- *   user: ...,
- *   historyStrategy: withHistory(),
- * })
- * ```
- *
- * The factory is a thin wrapper that delegates to the existing
- * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and
- * `time-machine.ts` modules. Splitting the import chain through this
- * file is what lets `tsup` tree-shake the heavy modules out of the
- * default `@noy-db/hub` bundle when no `withHistory()` import is
- * present in the consumer.
- *
- * @public
- */
-
-/**
- * Build the active history strategy. Today the factory takes no
- * options; per-collection retention tuning still flows through
- * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.
- *
- * Future option slots (kept off the LTS surface for now):
- *   - global maxVersions cap
- *   - global beforeDate prune cadence
- *   - ledger encryption toggle (today inferred from vault.encrypted)
- */
-declare function withHistory(): HistoryStrategy;
-
-/** Save a history entry (a complete encrypted envelope snapshot). */
-declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
-/** Get history entries for a record, sorted newest-first. */
-declare function getHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, options?: HistoryOptions): Promise<EncryptedEnvelope[]>;
-/** Get a specific version's envelope from history. */
-declare function getVersionEnvelope(adapter: NoydbStore, vault: string, collection: string, recordId: string, version: number): Promise<EncryptedEnvelope | null>;
-/** Prune history entries. Returns the number of entries deleted. */
-declare function pruneHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string | undefined, options: PruneOptions): Promise<number>;
-/** Clear all history for a vault, optionally scoped to a collection or record. */
-declare function clearHistory(adapter: NoydbStore, vault: string, collection?: string, recordId?: string): Promise<number>;
-
-export { HistoryStrategy, clearHistory, getHistory, getVersionEnvelope, pruneHistory, saveHistory, withHistory };

package/dist/i18n/index.d.ts

@@ -1,37 +0,0 @@
-import { I as I18nStrategy } from '../index-BzUo1B6n.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictKeyInUseError, d as DictKeyMissingError, e as DictionaryHandle, f as DictionaryOptions, g as I18nMap, h as I18nTextDescriptor, i as I18nTextOptions, L as Layer, j as LocaleNotSpecifiedError, M as MissingTranslationError, O as OnMissing, k as OnMissingPolicy, R as ReservedCollectionNameError, l as ResolveI18nOptions, S as ScriptViolationError, m as ScriptWarning, n as StaticDictDescriptor, o as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError, p as applyI18nLocale, q as dictCollectionName, r as dictKey, s as enforceScript, t as getAtPath, u as i18nText, v as inferScripts, w as isDictCollectionName, x as isDictKeyDescriptor, y as isI18nTextDescriptor, z as isStaticDictDescriptor, A as resolveI18nText, B as resolvePolicy, C as setAtPathInPlace, E as staticDict, F as stripI18nFilled, G as validateI18nTextValue } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active i18n strategy — `withI18n()` returns the real implementation
- * that wires multi-locale resolution, i18nText validation, and the
- * `DictionaryHandle` for `dictKey` fields into the core read/write
- * paths.
- *
- * Consumers opt in by:
- *
- * ```ts
- * import { createNoydb } from '@noy-db/hub'
- * import { withI18n } from '@noy-db/hub/i18n'
- *
- * const db = await createNoydb({
- *   store: ...,
- *   user: ...,
- *   i18nStrategy: withI18n(),
- * })
- * ```
- *
- * The factory delegates to the existing `core.ts` and `dictionary.ts`
- * modules. Splitting the import chain through this file is what lets
- * tsup tree-shake the `~854 LOC` of dictionary + locale resolution
- * out of the default bundle when no `withI18n()` import is present.
- *
- * @public
- */
-
-declare function withI18n(): I18nStrategy;
-
-export { I18nStrategy, withI18n };

package/dist/in/index.d.ts

@@ -1,5 +0,0 @@
-export { ey as ChangeEvent, ci as Collection, gg as LiveQuery, gR as Noydb, dS as Query, V as Vault } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';

package/dist/index-B9QdHytu.d.ts

@@ -1,123 +0,0 @@
-/**
- * Hub-level write lifecycle hooks. `onBeforeWrite` may abort (throw);
- * `onAfterWrite` is awaited and its errors are warned, not thrown. A
- * re-entrancy flag suppresses nested firing so a handler that writes can't
- * loop. Held on the Noydb instance, threaded into every Collection.
- */
-interface WriteEvent {
-    readonly op: 'create' | 'update' | 'delete';
-    readonly vault: string;
-    readonly collection: string;
-    readonly docId: string;
-    readonly before: unknown;
-    readonly after: unknown;
-    readonly baseVersion: number;
-    readonly version: number;
-    readonly userId: string;
-    readonly timestamp: number;
-    readonly txId: string;
-}
-type WriteHook = (event: WriteEvent) => void | Promise<void>;
-type Unsubscribe = () => void;
-declare class WriteHookRegistry {
-    #private;
-    /** True while handlers are running — used by the write path to skip nested firing. */
-    get suppressed(): boolean;
-    /** True when any hook is registered (cheap gate for the write path). */
-    get hasHandlers(): boolean;
-    onBeforeWrite(handler: WriteHook): Unsubscribe;
-    onAfterWrite(handler: WriteHook): Unsubscribe;
-    /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
-    runBefore(event: WriteEvent): Promise<void>;
-    /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
-    runAfter(event: WriteEvent): Promise<void>;
-}
-
-/**
- * Kernel coordination port — the injected `CoordinationProvider` seam for the
- * schema-fence drain-barrier.
- *
- * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
- * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)
- * drives it through the `Noydb` handle without ever naming a `by-*` package.
- * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.
- *
- * This module carries only the port TYPES plus two pure-ish helpers:
- * {@link isQuorum} (a pure quorum predicate extracted from the legacy
- * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol
- * the migration cutover and klum both call).
- *
- * @module
- */
-
-/** Vault fence state (the existing FenceDoc shape). */
-interface FenceState {
-    readonly currentSchemaVersion: number;
-    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
-}
-/** A writer's presence + ack, tagged with the session that owns it. */
-interface WriterPresence {
-    /** = today's clientId (one per tab/peer). */
-    readonly writerId: string;
-    /** Groups one user's writers across vaults (consolidation is klum's job). */
-    readonly sessionId: string;
-    readonly lastSeen: number;
-    readonly quiescedAtVersion: number | null;
-}
-/** Session-addressable drain-barrier coordination transport. Per-vault ops. */
-interface CoordinationProvider {
-    /** orchestrator → all writers */
-    setFence(vault: string, fence: FenceState): Promise<void>;
-    /**
-     * Fresh one-shot fence read for the write-path gate (`assertWritable`).
-     * A direct read (not a cached `observeFence` snapshot) avoids a staleness
-     * window and keeps the timing-sensitive cutover gate exact. The store
-     * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
-     */
-    readFence(vault: string): Promise<FenceState>;
-    /** writer observes fence changes (default: poll-emit; by-*: push) */
-    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
-    /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
-    reportPresence(vault: string, p: WriterPresence): Promise<void>;
-    /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
-    observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe;
-    /** orchestrator one-shot snapshot of reachable writers (quorum input) */
-    reachableWriters(vault: string, o: {
-        staleMs: number;
-        now: number;
-    }): Promise<readonly WriterPresence[]>;
-}
-/**
- * Pure quorum predicate: true when every writer (other than `excludeWriterId`)
- * has acked at exactly `generation`. An empty set is trivially a quorum.
- *
- * Extracted from the legacy `activeQuiesced` store-polling check so the
- * migration cutover, the store default provider, and `by-*` real-time
- * providers all share one definition of "everyone has drained".
- */
-declare function isQuorum(writers: readonly WriterPresence[], generation: number, excludeWriterId?: string): boolean;
-/** Inputs for {@link runDrainBarrier}. */
-interface DrainBarrierOptions {
-    readonly vault: string;
-    readonly generation: number;
-    readonly writerId: string;
-    readonly onFlush: () => Promise<void>;
-    readonly staleMs: number;
-    readonly quiesceTimeoutMs: number;
-    readonly now: () => number;
-    /** Optional seam (mainly for deterministic tests) run before each poll tick. */
-    readonly onPoll?: () => Promise<void>;
-}
-/**
- * The reusable drain-barrier protocol shared by the migration cutover and klum:
- *
- *   drain self → setFence(draining) → await quorum (presence push + isQuorum,
- *   polling as a fallback, or timeout) → run() → release-by-caller.
- *
- * Resolves once every reachable writer (excluding `writerId`) has quiesced at
- * `generation`, at which point `run` is invoked exactly once. Rejects with
- * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
- */
-declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;
-
-export { type CoordinationProvider as C, type DrainBarrierOptions as D, type FenceState as F, type Unsubscribe as U, type WriteEvent as W, type WriteHook as a, WriteHookRegistry as b, type WriterPresence as c, isQuorum as i, runDrainBarrier as r };

package/dist/index-BF9_96A5.d.ts

@@ -1,123 +0,0 @@
-import { cT as NoydbStore, dg as SealingKeyProvider, cF as UnlockedKeyring, ex as CargoStrategy } from './index-BzUo1B6n.js';
-import './ulid-DRH25k3y.js';
-import './index-B9QdHytu.js';
-import './kernel/index.js';
-import './describe-aBkJR2sd.js';
-import './vault-diff-B5fYNBL7.js';
-
-/**
- * Hub-core constants that must be referenceable without pulling any
- * service chunk. Kept import-free.
- */
-/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
-declare const STATE_VAULT_NAME = "__noydb_state__";
-/**
- * Soft cap on the JSON-serialized user-envelope payload size. Generous (a
- * typical profile + preferences + small app annex is ~1 KiB); rejects
- * accidental "stuff app state in here" anti-patterns.
- */
-declare const USER_ENVELOPE_MAX_BYTES: number;
-/**
- * Reserved store collection name for user envelopes. Starts with `_` so the
- * keyring grant machinery propagates the DEK to every granted user via the
- * existing system-collection DEK propagation path in `team/keyring.ts`.
- */
-declare const USER_ENVELOPE_COLLECTION = "_users";
-
-/**
- * FR-6 — Deed: sealed / hidden-owner provisioning.
- *
- * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
- * derives `KEK_owner`) is minted machine-side and sealed under a
- * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
- * the cryptographic *inalienability anchor*: whoever holds the
- * provider (the client / their KMS) is the only party that can ever
- * re-derive `KEK_owner`. A firm-side custodian operates the vault
- * fully but can never reach the owner key — there is deliberately NO
- * firm-controlled fallback.
- *
- * Provisioning reuses the managed-mode seam:
- *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
- *     subsequent open through the same provider).
- *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
- *
- * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
- * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
- * sealing boundary protects them, so it must be readable without
- * unlocking the vault (a custodian or auditor inspecting the vault must
- * be able to see "this is a Deed vault, owner = X, sealed under Y"
- * without any key). The marker itself is therefore never sealed; only
- * the owner *credential* is.
- *
- * @module
- */
-
-/** Reserved id for the Deed marker under `_meta`. */
-declare const DEED_RECORD_ID: "deed";
-/**
- * Plaintext metadata recording a vault's latent-owner Deed. Persisted
- * at `_meta/deed`. Readable without unlocking the vault by design — it
- * carries no secret material, only the identity of the latent owner
- * and the sealing boundary that anchors inalienability.
- */
-interface DeedMarker {
-    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
-    readonly ownerUserId: string;
-    /**
-     * The `SealingKeyProvider.id` the owner credential is sealed under.
-     * The inalienability anchor: only the holder of this (non-firm)
-     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
-     */
-    readonly sealedUnder: string;
-    /** Always `true` for a Deed — the owner never authenticates interactively. */
-    readonly latent: true;
-    /** ISO-8601 timestamp the Deed was issued. */
-    readonly issuedAt: string;
-    /**
-     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
-     * via the audited Liberate ceremony), if any. Absent until liberation.
-     */
-    readonly liberatedAt?: string;
-}
-/**
- * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
- * via {@link resolveManagedSecret}, derives the owner keyring via
- * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
- * marker. Returns the unlocked owner keyring.
- *
- * The returned keyring is the only in-memory window onto `KEK_owner`
- * for this call; the persistent re-entry point is the sealing provider
- * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
- *
- * There is deliberately no firm-controlled fallback: the marker's
- * `sealedUnder` is the single cryptographic anchor of ownership.
- */
-declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
-/**
- * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
- * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
- * unlocking required.
- */
-declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
-/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
-declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
-
-/**
- * Enable the cargo (partition extraction) capability.
- * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side
- * `extractPartition(vault, ...)` free function live. The extraction crypto
- * engine is dynamically imported here, so it stays out of the floor bundle
- * until opted in. The recipient-side `adoptPartition` /
- * `decryptExtractedPartition` free functions — and `diffVault` (shared
- * import/merge infra) — are ungated and unaffected.
- */
-
-declare function withCargo(): CargoStrategy;
-
-export { DEED_RECORD_ID as D, STATE_VAULT_NAME as S, USER_ENVELOPE_COLLECTION as U, type DeedMarker as a, USER_ENVELOPE_MAX_BYTES as b, createDeedOwner as c, isDeedVault as i, loadDeedMarker as l, withCargo as w };