@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-BEIRE5K4.js

@@ -0,0 +1,164 @@
+import {
+  ViaGraph
+} from "./chunk-7QIXUSDQ.js";
+import {
+  sha256Hex
+} from "./chunk-HUS3J5WM.js";
+import {
+  DerivationCycleError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/derivations/strategy-hash.ts
+async function computeStrategyHash(source, outputKeys, derive, sources) {
+  const canonical = JSON.stringify({
+    source,
+    outputs: [...outputKeys].sort(),
+    derive: derive.toString(),
+    // Declared sibling sources — adding/removing a trigger
+    // collection invalidates cached derived records. Omitted when empty
+    // so strategies without siblings keep their existing hash.
+    ...sources?.length ? { sources: [...sources].sort() } : {}
+  });
+  const bytes = new TextEncoder().encode(canonical);
+  return sha256Hex(bytes);
+}
+
+// src/with-formula/derivations/registry.ts
+var WHOLE_RECORD = "*";
+function stripArtifactSuffix(displayId) {
+  const suffix = `.${WHOLE_RECORD}`;
+  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId;
+}
+var DerivationRegistry = class {
+  _bySource = /* @__PURE__ */ new Map();
+  _byOutput = /* @__PURE__ */ new Map();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async register(spec) {
+    const outputKeys = Object.keys(spec.outputs);
+    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources);
+    const reg = { spec, strategyHash };
+    const fromSource = this._bySource.get(spec.source);
+    if (fromSource) fromSource.push(reg);
+    else this._bySource.set(spec.source, [reg]);
+    for (const extra of spec.sources ?? []) {
+      const fromExtra = this._bySource.get(extra);
+      if (fromExtra) fromExtra.push(reg);
+      else this._bySource.set(extra, [reg]);
+    }
+    for (const t of spec.triggerBy ?? []) {
+      const fromTrigger = this._bySource.get(t.collection);
+      if (fromTrigger) fromTrigger.push(reg);
+      else this._bySource.set(t.collection, [reg]);
+    }
+    if (spec.rollup) {
+      const fromRollup = this._bySource.get(spec.rollup.from);
+      if (fromRollup) fromRollup.push(reg);
+      else this._bySource.set(spec.rollup.from, [reg]);
+    }
+    for (const key of outputKeys) {
+      const output = spec.outputs[key];
+      if (!output) continue;
+      const outputCollection = output.collection;
+      const arr = this._byOutput.get(outputCollection);
+      if (arr) arr.push(reg);
+      else this._byOutput.set(outputCollection, [reg]);
+    }
+  }
+  strategiesForSource(source) {
+    return this._bySource.get(source) ?? [];
+  }
+  strategiesProducingOutput(collection) {
+    return this._byOutput.get(collection) ?? [];
+  }
+  /**
+   * All registered strategies as a flat, deduplicated array.
+   * Each strategy is indexed once per source (not once per output key),
+   * so iterating `_bySource.values()` naturally yields each strategy
+   * exactly once per source — deduplication is handled by flattening
+   * the per-source arrays and collecting into a Set by identity.
+   *
+   * Used by `dumpSchema()` / `describeDerivations()` in the introspection
+   * walker to populate the derivations map.
+   */
+  all() {
+    const seen = /* @__PURE__ */ new Set();
+    for (const strategies of this._bySource.values()) {
+      for (const s of strategies) seen.add(s);
+    }
+    return [...seen];
+  }
+  /**
+   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per
+   * (non-self-write) output key — target = the output collection (a
+   * `WHOLE_RECORD` artifact node), sources = every collection that can
+   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,
+   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys
+   * `register()` indexes under `_bySource`. The self-write reverse-denorm
+   * output (`output.collection === source` with `denorm` declared) is
+   * skipped — the SAME condition the old local DFS used; it is not a cycle
+   * (see the comment `validate()` used to carry, now on this skip).
+   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge
+   * targeting the real `rollup.field` on the parent (`source`) — the
+   * self-write output above only covers the cycle-DFS skip, not
+   * dispatch/taint (Tasks 3/4/6), which need the real field.
+   */
+  edges() {
+    const out = [];
+    for (const reg of this.all()) {
+      const spec = reg.spec;
+      const triggerCollections = [
+        spec.source,
+        ...spec.sources ?? [],
+        ...(spec.triggerBy ?? []).map((t) => t.collection),
+        ...spec.rollup ? [spec.rollup.from] : []
+      ];
+      const sources = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }));
+      for (const key of Object.keys(spec.outputs)) {
+        const output = spec.outputs[key];
+        if (!output) continue;
+        if (output.shape === "record" && output.collection === spec.source && output.denorm !== void 0) continue;
+        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: "derivation", grain: "record" });
+      }
+      if (spec.rollup) {
+        out.push({
+          target: { collection: spec.source, field: spec.rollup.field },
+          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],
+          kind: "rollup",
+          grain: "aggregate"
+        });
+      }
+    }
+    return out;
+  }
+  /**
+   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —
+   * retires the local DFS). Call after all `register()` calls complete (i.e.
+   * at vault open). Throws `DerivationCycleError` on the first cycle found —
+   * SAME class/timing as before; the message/path is byte-identical to the
+   * pre-#638 shape for a pure record-shape derivation cycle (the
+   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection
+   * name before re-throwing).
+   *
+   * `graph` is the caller's shared per-vault graph, ALREADY carrying this
+   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)
+   * — omit it (e.g. this registry's own unit tests) to validate this
+   * registry's edges in isolation against a throwaway graph.
+   */
+  validate(graph) {
+    const g = graph ?? new ViaGraph();
+    if (!graph) {
+      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain);
+    }
+    try {
+      g.assertAcyclic();
+    } catch (e) {
+      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix));
+      throw e;
+    }
+  }
+};
+
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=chunk-BEIRE5K4.js.map

package/dist/chunk-BZO4WCJI.js

@@ -0,0 +1,86 @@
+import {
+  grant,
+  revoke
+} from "./chunk-5ZOSG3RJ.js";
+import {
+  CargoNotEnabledError,
+  CustodyNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/with-cargo/strategy.ts
+var NO_CARGO = {
+  async extractPartition() {
+    throw new CargoNotEnabledError();
+  }
+};
+
+// src/with-party/custody/active.ts
+function withCustody() {
+  return {
+    async grantCustodian(host, vault, options, factors) {
+      return host._grantCustodianImpl(grant, vault, options, factors);
+    },
+    async revokeCustodian(host, vault, options, factors) {
+      return host._revokeCustodianImpl(revoke, vault, options, factors);
+    },
+    async liberate(vault, opts) {
+      const { liberateVault } = await import("./liberate-YUN7W5QG.js");
+      return liberateVault(vault, opts);
+    }
+  };
+}
+
+// src/with-party/custody/strategy.ts
+var NO_CUSTODY = {
+  async grantCustodian() {
+    throw new CustodyNotEnabledError();
+  },
+  async revokeCustodian() {
+    throw new CustodyNotEnabledError();
+  },
+  async liberate() {
+    throw new CustodyNotEnabledError();
+  }
+};
+
+// src/with-party/custody/index.ts
+var CustodyApi = class {
+  constructor(_grantCustodian, _revokeCustodian, _liberate) {
+    this._grantCustodian = _grantCustodian;
+    this._revokeCustodian = _revokeCustodian;
+    this._liberate = _liberate;
+  }
+  _grantCustodian;
+  _revokeCustodian;
+  _liberate;
+  /**
+   * Owner-only: grant the FR-6 `custodian` role. The custodian operates every
+   * collection (rw + access) but is provably unable to grant / revoke / rotate /
+   * extract-and-sever. Defended in depth (gate + owner-only role check) inside
+   * the injected `Noydb.grantCustodian`.
+   */
+  async grantCustodian(options, factors) {
+    return this._grantCustodian(options, factors);
+  }
+  /** Owner-only: revoke a custodian. */
+  async revokeCustodian(options, factors) {
+    return this._revokeCustodian(options, factors);
+  }
+  /**
+   * Custodian-only: the audited claim of ownership over a sealed-owner (Deed)
+   * vault. Mints a DISTINCT new owner re-wrapping the incumbent DEKs under a
+   * fresh KEK (the latent owner is never impersonated), ledger-audited. See
+   * {@link liberateVault}.
+   */
+  async liberate(opts) {
+    return this._liberate(opts);
+  }
+};
+
+export {
+  NO_CARGO,
+  withCustody,
+  NO_CUSTODY,
+  CustodyApi
+};
+//# sourceMappingURL=chunk-BZO4WCJI.js.map

package/dist/chunk-C3YH34IL.js

@@ -0,0 +1,75 @@
+import {
+  generateULID
+} from "./chunk-ZJADGNYF.js";
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+
+// src/with-audit/consent/consent.ts
+var CONSENT_AUDIT_COLLECTION = "_consent_audit";
+async function writeConsentEntry(adapter, vault, encrypted, entry, getDEK) {
+  const id = generateULID();
+  const full = {
+    id,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    ...entry
+  };
+  const envelope = await buildEnvelope(full, encrypted, getDEK);
+  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope);
+}
+async function loadConsentEntries(adapter, vault, encrypted, getDEK, filter = {}) {
+  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION);
+  const entries = [];
+  for (const id of ids.sort()) {
+    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id);
+    if (!envelope) continue;
+    const entry = await decryptEntry(envelope, encrypted, getDEK);
+    if (!matchesFilter(entry, filter)) continue;
+    entries.push(entry);
+  }
+  return entries;
+}
+async function buildEnvelope(entry, encrypted, getDEK) {
+  const json = JSON.stringify(entry);
+  if (!encrypted) {
+    return {
+      _noydb: 1,
+      _v: 1,
+      _ts: entry.timestamp,
+      _iv: "",
+      _data: json
+    };
+  }
+  const dek = await getDEK(CONSENT_AUDIT_COLLECTION);
+  const { iv, data } = await encrypt(json, dek);
+  return {
+    _noydb: 1,
+    _v: 1,
+    _ts: entry.timestamp,
+    _iv: iv,
+    _data: data
+  };
+}
+async function decryptEntry(envelope, encrypted, getDEK) {
+  if (!encrypted) return JSON.parse(envelope._data);
+  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION));
+  return JSON.parse(json);
+}
+function matchesFilter(entry, f) {
+  if (f.since && entry.timestamp < f.since) return false;
+  if (f.until && entry.timestamp > f.until) return false;
+  if (f.collection && entry.collection !== f.collection) return false;
+  if (f.actor && entry.actor !== f.actor) return false;
+  if (f.purpose && entry.purpose !== f.purpose) return false;
+  return true;
+}
+
+export {
+  CONSENT_AUDIT_COLLECTION,
+  writeConsentEntry,
+  loadConsentEntries
+};
+//# sourceMappingURL=chunk-C3YH34IL.js.map

package/dist/chunk-C7NTK5I3.js

@@ -0,0 +1,49 @@
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+
+// src/with-shape/persisted-schemas/storage.ts
+var SCHEMAS_COLLECTION = "_schemas";
+async function loadPersistedSchemaEntry(store, vault, collection, dek) {
+  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection);
+  if (!envelope) return { version: 0, payload: void 0 };
+  const version = envelope._v;
+  try {
+    const plaintext = await openEnvelopeJson(envelope, dek);
+    const parsed = JSON.parse(plaintext);
+    if (parsed._noydb_schema !== 1) return { version, payload: void 0 };
+    return { version, payload: parsed };
+  } catch {
+    return { version, payload: void 0 };
+  }
+}
+async function loadPersistedSchema(store, vault, collection, dek) {
+  return (await loadPersistedSchemaEntry(store, vault, collection, dek)).payload;
+}
+async function savePersistedSchema(store, vault, collection, dek, payload, expectedVersion) {
+  const json = JSON.stringify(payload);
+  const { iv, data } = await encrypt(json, dek);
+  const baseVersion = expectedVersion ?? (await store.get(vault, SCHEMAS_COLLECTION, collection))?._v ?? 0;
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: baseVersion + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data
+  };
+  await store.put(vault, SCHEMAS_COLLECTION, collection, env, expectedVersion);
+}
+
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchemaEntry,
+  loadPersistedSchema,
+  savePersistedSchema
+};
+//# sourceMappingURL=chunk-C7NTK5I3.js.map

package/dist/chunk-CB25ONKC.js

@@ -0,0 +1,129 @@
+import {
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/derivations/with-derivation.ts
+function withDerivation(spec) {
+  if (!spec.source || spec.source.length === 0) {
+    throw new ValidationError("withDerivation: source collection name is required");
+  }
+  if (!spec.outputs || Object.keys(spec.outputs).length === 0) {
+    throw new ValidationError("withDerivation: outputs map must declare at least one output");
+  }
+  if (spec.deterministic !== true) {
+    throw new ValidationError("withDerivation: v1 only supports deterministic derivations");
+  }
+  if (typeof spec.derive !== "function") {
+    throw new ValidationError("withDerivation: derive must be a function");
+  }
+  if (spec.sources !== void 0) {
+    for (const extra of spec.sources) {
+      if (typeof extra !== "string" || extra.length === 0) {
+        throw new ValidationError("withDerivation: each entry in sources[] must be a non-empty string");
+      }
+      if (extra === spec.source) {
+        throw new ValidationError(
+          `withDerivation: sources[] must not contain the primary source "${spec.source}"`
+        );
+      }
+    }
+  }
+  if (spec.triggerBy !== void 0) {
+    for (const t of spec.triggerBy) {
+      if (typeof t?.collection !== "string" || t.collection.length === 0) {
+        throw new ValidationError("withDerivation: each triggerBy entry needs a non-empty `collection`");
+      }
+      if (t.collection === spec.source) {
+        throw new ValidationError(
+          `withDerivation: triggerBy.collection must not equal the source "${spec.source}" (use sources[] for same-id triggers)`
+        );
+      }
+      if (typeof t.on !== "string" || t.on.length === 0) {
+        throw new ValidationError(
+          `withDerivation: triggerBy on "${t.collection}" needs a non-empty \`on\` (the FK field on the source)`
+        );
+      }
+      if (t.maxFanout !== void 0 && (!Number.isInteger(t.maxFanout) || t.maxFanout < 1)) {
+        throw new ValidationError(
+          `withDerivation: triggerBy maxFanout on "${t.collection}" must be a positive integer (got ${String(t.maxFanout)}).`
+        );
+      }
+    }
+  }
+  const lifecycleMode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
+  for (const [outputKey, outputSpec] of Object.entries(spec.outputs)) {
+    if (outputSpec.shape === "record" && outputSpec.collection === spec.source) {
+      if (!outputSpec.denorm || outputSpec.denorm.length === 0) {
+        throw new ValidationError(
+          `withDerivation: self-write output "${outputKey}" (collection === source "${spec.source}") must declare \`denorm: [...]\` naming the fields it maintains.`
+        );
+      }
+    }
+    if (outputSpec.shape === "array") {
+      if (lifecycleMode !== "eager") {
+        throw new ValidationError(
+          `withDerivation: shape 'array' supports lifecycle 'eager' only in this release Output "${outputKey}" declared lifecycle '${lifecycleMode}'. Switch to \`lifecycle: "eager"\` or use shape: "record".`
+        );
+      }
+      if (typeof outputSpec.key !== "function") {
+        throw new ValidationError(
+          `withDerivation: shape 'array' output "${outputKey}" requires \`key: (out) => string\`.`
+        );
+      }
+      if (outputSpec.maxFanout !== void 0) {
+        if (!Number.isInteger(outputSpec.maxFanout) || outputSpec.maxFanout < 1) {
+          throw new ValidationError(
+            `withDerivation: maxFanout for output "${outputKey}" must be a positive integer (got ${String(outputSpec.maxFanout)}).`
+          );
+        }
+      }
+    }
+  }
+  return {
+    __noydb_strategy: "derivation",
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    spec
+  };
+}
+
+// src/with-formula/derivations/with-rollup.ts
+function withRollup(config) {
+  const { from, key, into, field, compute } = config;
+  if (!from || from.length === 0) {
+    throw new ValidationError("withRollup: `from` (child collection) is required");
+  }
+  if (!into || into.length === 0) {
+    throw new ValidationError("withRollup: `into` (parent collection) is required");
+  }
+  if (from === into) {
+    throw new ValidationError("withRollup: `from` and `into` must be different collections");
+  }
+  if (!key || key.length === 0) {
+    throw new ValidationError("withRollup: `key` (FK field on the child) is required");
+  }
+  if (!field || field.length === 0) {
+    throw new ValidationError("withRollup: `field` (target field on the parent) is required");
+  }
+  if (typeof compute !== "function") {
+    throw new ValidationError("withRollup: `compute` must be a function");
+  }
+  const spec = {
+    source: into,
+    // the parent record is what carries the rolled-up field
+    deterministic: true,
+    rollup: { from, key, field, compute },
+    // Synthetic self-write output for registry / cycle bookkeeping. Dispatch
+    // patches `field` directly (value-equality guarded); the executor is not run.
+    outputs: { value: { shape: "record", collection: into, denorm: [field] } },
+    derive: () => ({ value: {} }),
+    // never invoked for a rollup strategy
+    lifecycle: "eager"
+  };
+  return { __noydb_strategy: "derivation", spec };
+}
+
+export {
+  withDerivation,
+  withRollup
+};
+//# sourceMappingURL=chunk-CB25ONKC.js.map

package/dist/chunk-CIKY6I4W.js

@@ -0,0 +1,21 @@
+import {
+  SealedRecordNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/sealed-record/strategy.ts
+var NO_SEALED_RECORD = {
+  async sealRecordToHost() {
+    throw new SealedRecordNotEnabledError();
+  },
+  async revokeSealedRecord() {
+    throw new SealedRecordNotEnabledError();
+  },
+  async rotateRecordCek() {
+    throw new SealedRecordNotEnabledError();
+  }
+};
+
+export {
+  NO_SEALED_RECORD
+};
+//# sourceMappingURL=chunk-CIKY6I4W.js.map

package/dist/chunk-CKZW6P5V.js

@@ -0,0 +1,32 @@
+// src/kernel/types.ts
+var NOYDB_FORMAT_VERSION = 1;
+var NOYDB_KEYRING_VERSION = 1;
+var NOYDB_BACKUP_VERSION = 1;
+var NOYDB_SYNC_VERSION = 1;
+var SealedHandle = class {
+  sealed = true;
+  #reveal;
+  constructor(reveal) {
+    this.#reveal = reveal;
+  }
+  reveal() {
+    return this.#reveal();
+  }
+  /** Non-leaking serialisation marker — never the underlying value. */
+  toJSON() {
+    return "[sealed]";
+  }
+};
+function createStore(factory) {
+  return factory;
+}
+
+export {
+  NOYDB_FORMAT_VERSION,
+  NOYDB_KEYRING_VERSION,
+  NOYDB_BACKUP_VERSION,
+  NOYDB_SYNC_VERSION,
+  SealedHandle,
+  createStore
+};
+//# sourceMappingURL=chunk-CKZW6P5V.js.map