@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-H6HM6CVR.js

@@ -0,0 +1,279 @@
+import {
+  assertTierAccess,
+  dekKey
+} from "./chunk-4R4Q64W5.js";
+import {
+  rewrapBodyToDek
+} from "./chunk-QQJXBZCO.js";
+import {
+  decrypt,
+  encrypt,
+  unwrapCek
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  TierDemoteDeniedError,
+  TiersNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/tiers/active.ts
+function withTiers() {
+  return {
+    async putAtTier(ctx, id, record, tier, opts) {
+      const { putAtTier: putAtTier2 } = await import("./tiers/index.js");
+      return putAtTier2(ctx, id, record, tier, opts);
+    },
+    async getAtTier(ctx, id) {
+      const { getAtTier: getAtTier2 } = await import("./tiers/index.js");
+      return getAtTier2(ctx, id);
+    },
+    async listAtTier(ctx) {
+      const { listAtTier: listAtTier2 } = await import("./tiers/index.js");
+      return listAtTier2(ctx);
+    },
+    async elevate(ctx, id, toTier) {
+      const { elevate: elevate2 } = await import("./tiers/index.js");
+      return elevate2(ctx, id, toTier);
+    },
+    async demote(ctx, id, toTier) {
+      const { demote: demote2 } = await import("./tiers/index.js");
+      return demote2(ctx, id, toTier);
+    }
+  };
+}
+
+// src/with-audit/tiers/strategy.ts
+var NO_TIERS = {
+  async putAtTier() {
+    throw new TiersNotEnabledError();
+  },
+  async getAtTier() {
+    throw new TiersNotEnabledError();
+  },
+  async listAtTier() {
+    throw new TiersNotEnabledError();
+  },
+  async elevate() {
+    throw new TiersNotEnabledError();
+  },
+  async demote() {
+    throw new TiersNotEnabledError();
+  }
+};
+
+// src/with-audit/tiers/index.ts
+function assertTiersEnabled(ctx) {
+  if (!ctx.tiers) {
+    throw new Error(
+      `Collection "${ctx.name}": hierarchical tiers are not enabled. Pass { tiers: [0, 1, 2, \u2026] } to vault.collection() to opt in.`
+    );
+  }
+}
+function assertDeclaredTier(ctx, tier) {
+  if (tier < 0 || !Number.isInteger(tier)) {
+    throw new Error(`Collection "${ctx.name}": tier must be a non-negative integer, got ${tier}`);
+  }
+  if (tier === 0) return;
+  if (!ctx.tiers || !ctx.tiers.has(tier)) {
+    throw new Error(
+      `Collection "${ctx.name}": tier ${tier} is not declared in { tiers: [...] }`
+    );
+  }
+}
+function isElevatorOrOwner(ctx) {
+  return ctx.keyring.role === "owner" || ctx.keyring.role === "admin";
+}
+async function putAtTier(ctx, id, record, tier, opts) {
+  assertTiersEnabled(ctx);
+  assertDeclaredTier(ctx, tier);
+  assertTierAccess(ctx.keyring, ctx.name, tier);
+  const key = dekKey(ctx.name, tier);
+  const dek = await ctx.getDEK(key);
+  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  const version = existing ? existing._v + 1 : 1;
+  const json = JSON.stringify(record);
+  const { iv, data } = await encrypt(json, dek);
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _by: ctx.keyring.userId,
+    ...tier > 0 && { _tier: tier },
+    ...ctx.provenance && opts?.source !== void 0 ? { _source: opts.source, _sourceTs: opts.sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {}
+  };
+  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope);
+  if (tier > 0) {
+    ctx.emitCrossTierEvent({
+      actor: ctx.keyring.userId,
+      collection: ctx.name,
+      id,
+      tier,
+      authorization: opts?.elevation ? "elevation" : "inherent",
+      op: "put",
+      ts: envelope._ts,
+      ...opts?.elevation && {
+        reason: opts.elevation.reason,
+        elevatedFrom: opts.elevation.fromTier
+      }
+    });
+  }
+}
+async function getAtTier(ctx, id) {
+  assertTiersEnabled(ctx);
+  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  if (!envelope) return null;
+  const tier = envelope._tier ?? 0;
+  if (tier === 0) {
+    return ctx.codec.decryptRecord(envelope, { id });
+  }
+  const key = dekKey(ctx.name, tier);
+  if (!ctx.keyring.deks.has(key)) {
+    if (ctx.tierMode === "ghost") {
+      return { _ghost: true, _tier: tier };
+    }
+    return null;
+  }
+  const dek = await ctx.getDEK(key);
+  let plaintext;
+  let cek;
+  if (envelope._cek !== void 0) {
+    cek = await unwrapCek(envelope._cek, dek);
+    ctx.cekCache?.set(id, cek, 1);
+    plaintext = await decrypt(envelope._iv, envelope._data, cek);
+  } else {
+    plaintext = await decrypt(envelope._iv, envelope._data, dek);
+  }
+  let record = JSON.parse(plaintext);
+  if (envelope._sealed !== void 0) {
+    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id });
+  }
+  ctx.emitCrossTierEvent({
+    actor: ctx.keyring.userId,
+    collection: ctx.name,
+    id,
+    tier,
+    authorization: isElevatorOrOwner(ctx) ? "inherent" : "delegation",
+    op: "get",
+    ts: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return record;
+}
+async function listAtTier(ctx) {
+  assertTiersEnabled(ctx);
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  const out = [];
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env) continue;
+    const tier = env._tier ?? 0;
+    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier));
+    if (!readable && ctx.tierMode === "invisibility") continue;
+    out.push({ id, tier, readable });
+  }
+  return out;
+}
+async function elevate(ctx, id, toTier) {
+  assertTiersEnabled(ctx);
+  assertDeclaredTier(ctx, toTier);
+  assertTierAccess(ctx.keyring, ctx.name, toTier);
+  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  if (!envelope) throw new Error(`Record "${id}" not found in collection "${ctx.name}"`);
+  const fromTier = envelope._tier ?? 0;
+  if (toTier === fromTier) return;
+  if (toTier < fromTier) {
+    throw new Error(`Use demote() to lower the tier of "${id}" from ${fromTier} to ${toTier}`);
+  }
+  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier);
+  const fromKey = dekKey(ctx.name, fromTier);
+  const toKey = dekKey(ctx.name, toTier);
+  const fromDek = await ctx.getDEK(fromKey);
+  const toDek = await ctx.getDEK(toKey);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
+  if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
+  const next = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: envelope._v + 1,
+    _ts: now,
+    _iv: body._iv,
+    _data: body._data,
+    _by: ctx.keyring.userId,
+    _tier: toTier,
+    _elevatedBy: ctx.keyring.userId,
+    ...body._cek !== void 0 ? { _cek: body._cek } : {}
+  };
+  await ctx.adapter.put(ctx.vault, ctx.name, id, next);
+  ctx.emitCrossTierEvent({
+    actor: ctx.keyring.userId,
+    collection: ctx.name,
+    id,
+    tier: toTier,
+    authorization: "elevation",
+    op: "elevate",
+    ts: now
+  });
+}
+async function demote(ctx, id, toTier) {
+  assertTiersEnabled(ctx);
+  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`);
+  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  if (!envelope) throw new Error(`Record "${id}" not found in collection "${ctx.name}"`);
+  const fromTier = envelope._tier ?? 0;
+  if (toTier === fromTier) return;
+  if (toTier > fromTier) {
+    throw new Error(`Use elevate() to raise the tier of "${id}" from ${fromTier} to ${toTier}`);
+  }
+  const isOwner = ctx.keyring.role === "owner";
+  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId;
+  if (!isOwner && !isOriginalElevator) {
+    throw new TierDemoteDeniedError(id, fromTier);
+  }
+  assertTierAccess(ctx.keyring, ctx.name, fromTier);
+  if (toTier > 0) assertDeclaredTier(ctx, toTier);
+  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier));
+  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier));
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
+  if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
+  const next = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: envelope._v + 1,
+    _ts: now,
+    _iv: body._iv,
+    _data: body._data,
+    _by: ctx.keyring.userId,
+    ...toTier > 0 && { _tier: toTier },
+    ...body._cek !== void 0 ? { _cek: body._cek } : {}
+  };
+  await ctx.adapter.put(ctx.vault, ctx.name, id, next);
+  ctx.emitCrossTierEvent({
+    actor: ctx.keyring.userId,
+    collection: ctx.name,
+    id,
+    tier: fromTier,
+    authorization: "elevation",
+    op: "demote",
+    ts: now
+  });
+}
+function classifySealedShred(ctx, live) {
+  return ctx.codec.classifySealedShred(live);
+}
+
+export {
+  withTiers,
+  NO_TIERS,
+  assertTiersEnabled,
+  assertDeclaredTier,
+  putAtTier,
+  getAtTier,
+  listAtTier,
+  elevate,
+  demote,
+  classifySealedShred
+};
+//# sourceMappingURL=chunk-H6HM6CVR.js.map

package/dist/chunk-HFJIGWJC.js

@@ -0,0 +1,382 @@
+import {
+  listUserEnvelopeIds,
+  loadUserEnvelope,
+  persistUserVisibility,
+  readUserVisibility,
+  saveUserEnvelope
+} from "./chunk-4N5QFSNQ.js";
+import {
+  PolicyDeniedError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/directory/user-envelope/api.ts
+var UserApi = class {
+  /** keyringId → set of listeners. Wildcard '*' fires on every change. */
+  listeners = /* @__PURE__ */ new Map();
+  adapter;
+  vaultName;
+  /** The writer's own keyringId. Frozen at construction time. */
+  writerKeyringId;
+  getDek;
+  /**
+   * Policy-gate validator. When omitted, gates are skipped — useful
+   * for low-level tests that exercise the storage layer directly.
+   * Production paths always wire the Noydb-backed implementation.
+   */
+  checkGate;
+  /**
+   * Noydb-backed `exportMyAccessibleData`, injected by the Vault
+   * (which holds the keyring + bundle machinery). Omitted in low-level tests.
+   */
+  exportAccessible;
+  /**
+   * Noydb-backed `unilateralWithdrawal`, injected by the Vault.
+   * Destructive — extract + dispose (delete | freeze). Omitted in low-level tests.
+   */
+  unilateralWithdraw;
+  /**
+   * Noydb-backed two-party withdrawal ceremony, injected by the
+   * Vault. requestWithdraw = requester side; the rest = owner side.
+   */
+  requestWithdraw;
+  listWithdrawals;
+  approveWithdraw;
+  rejectWithdraw;
+  constructor(deps) {
+    this.adapter = deps.adapter;
+    this.vaultName = deps.vaultName;
+    this.writerKeyringId = deps.writerKeyringId;
+    this.getDek = deps.getDek;
+    this.checkGate = deps.checkGate;
+    this.exportAccessible = deps.exportAccessible;
+    this.unilateralWithdraw = deps.unilateralWithdraw;
+    this.requestWithdraw = deps.requestWithdraw;
+    this.listWithdrawals = deps.listWithdrawals;
+    this.approveWithdraw = deps.approveWithdraw;
+    this.rejectWithdraw = deps.rejectWithdraw;
+  }
+  /**
+   * File a two-party withdrawal request for the caller's accessible
+   * scope. Non-destructive (writes a pending request); an owner later approves
+   * or rejects. This is the path for read-only roles (`client`/`viewer`) that
+   * cannot self-serve a destructive `unilateralWithdrawal`. Gated by
+   * `user-request-withdrawal` (enabled by default).
+   */
+  async requestWithdrawal(opts = {}) {
+    if (this.checkGate) await this.checkGate("user-request-withdrawal");
+    if (!this.requestWithdraw) {
+      throw new Error("requestWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
+    }
+    return this.requestWithdraw(opts);
+  }
+  /** Owner side: list filed withdrawal requests (optionally by status). */
+  async listWithdrawalRequests(opts = {}) {
+    if (!this.listWithdrawals) {
+      throw new Error("listWithdrawalRequests requires a Noydb-backed vault (not a bare UserApi)");
+    }
+    return this.listWithdrawals(opts);
+  }
+  /**
+   * Owner side: approve a pending request. Extracts the requester's
+   * recorded scope under firm authority, disposes of the source per the
+   * request's disposition, and returns the re-keyed bundle to hand back. Gated
+   * by `approve-user-withdrawal` (tier-2 default) + owner/admin role.
+   */
+  async approveWithdrawal(requestId, opts = {}) {
+    if (this.checkGate) await this.checkGate("approve-user-withdrawal");
+    if (!this.approveWithdraw) {
+      throw new Error("approveWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
+    }
+    return this.approveWithdraw(requestId, opts);
+  }
+  /** Owner side: reject a pending request (no data is touched). */
+  async rejectWithdrawal(requestId, opts = {}) {
+    if (this.checkGate) await this.checkGate("approve-user-withdrawal");
+    if (!this.rejectWithdraw) {
+      throw new Error("rejectWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
+    }
+    return this.rejectWithdraw(requestId, opts);
+  }
+  /**
+   * Single-party withdrawal: export the caller's accessible scope
+   * (re-keyed) and dispose of the source (`delete` or `freeze`). Gated by the
+   * fail-closed built-in `client-unilateral-withdraw` policy — undefined or
+   * disabled → throws (use `requestWithdrawal`). The firm enables it at vault
+   * creation.
+   */
+  async unilateralWithdrawal(opts) {
+    if (this.checkGate) await this.checkGate("client-unilateral-withdraw");
+    if (!this.unilateralWithdraw) {
+      throw new Error("unilateralWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
+    }
+    return this.unilateralWithdraw(opts);
+  }
+  /**
+   * Export the calling user's accessible scope as a portable, re-keyed
+   * `.noydb` bundle. Non-destructive and **always allowed** (data sovereignty
+   * by construction) but audited. Scope = the caller's DEK access set.
+   */
+  async exportMyAccessibleData(opts = {}) {
+    if (!this.exportAccessible) {
+      throw new Error("exportMyAccessibleData requires a Noydb-backed vault (not a bare UserApi)");
+    }
+    return this.exportAccessible(opts);
+  }
+  // ─── Write-self ──────────────────────────────────────────────────────
+  /** Read the writer's own envelope. Returns null if never written. */
+  async me() {
+    const dek = await this.getDek();
+    return loadUserEnvelope(this.adapter, this.vaultName, this.writerKeyringId, dek);
+  }
+  /**
+   * Deep-merge a partial patch into the writer's own envelope. Creates
+   * the envelope on first call. Optimistic-concurrency safe — a stale
+   * `_v` (parallel writer on another device) throws `ConflictError`.
+   *
+   * Patch semantics:
+   *   - `undefined` (or omitted key) — skip; existing value preserved
+   *   - `null` — delete the field from the merged result
+   *   - any other value — overwrite (deep-merge for plain objects,
+   *     replace for primitives / arrays)
+   *
+   * To clear a field, pass `null` rather than `undefined`. Callers
+   * with shape `T = string | null` where `null` is a meaningful value
+   * should use `setMe` for that specific field instead — `null` here
+   * always means delete.
+   *
+   * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
+   * Pass `presented` to satisfy tightened policies that require a
+   * factor proof (e.g. STRICT_POLICY's TOTP requirement).
+   */
+  async updateMe(patch, presented) {
+    if (this.checkGate) await this.checkGate("edit-own-profile", presented);
+    const dek = await this.getDek();
+    const current = await loadUserEnvelope(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      dek
+    );
+    const merged = current ? deepMerge(current.data, patch) : patch;
+    const written = await saveUserEnvelope(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      merged,
+      dek,
+      current?._v ?? 0
+    );
+    this.fireChange(this.writerKeyringId, written);
+    return written;
+  }
+  /**
+   * Replace the writer's own envelope with `payload`. Use sparingly —
+   * `updateMe` is the canonical mutation. No `expectedVersion` check;
+   * callers explicitly take last-write-wins semantics.
+   *
+   * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.
+   */
+  async setMe(payload, presented) {
+    if (this.checkGate) await this.checkGate("edit-own-profile", presented);
+    const dek = await this.getDek();
+    const written = await saveUserEnvelope(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      payload,
+      dek
+    );
+    this.fireChange(this.writerKeyringId, written);
+    return written;
+  }
+  // ─── Visibility ──────────────────────────────────────────────────────
+  /**
+   * Read the current user's visibility flag from
+   * `_meta/visibility/<keyringId>`. Returns `{ hidden: false }` when no
+   * document has been persisted (the default-visible case).
+   */
+  async getMyVisibility() {
+    const persisted = await readUserVisibility(this.adapter, this.vaultName, this.writerKeyringId);
+    return persisted ?? { hidden: false };
+  }
+  /**
+   * Update the current user's visibility in the team directory.
+   *
+   * - `hidden: true` — opt out of the default `listUsersWithEnvelopes`
+   *   listing. `owner`/`admin` callers can still see the user by passing
+   *   `{ includeHidden: true }`.
+   * - `hidden: false` — opt back in.
+   *
+   * Own-only by construction: the keyringId argument doesn't exist on
+   * this method, so no caller can hide or unhide another principal.
+   *
+   * Honest caveat: this is a UX flag, not a privacy guarantee. The
+   * envelope ciphertext at `_users/<keyringId>` and the keyring file at
+   * `_keyring/<userId>` are both still observable to anyone with direct
+   * store read access. See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
+   * "Directory visibility".
+   */
+  async setMyVisibility(visibility) {
+    await persistUserVisibility(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      { hidden: visibility.hidden }
+    );
+  }
+  // ─── Read-anyone ─────────────────────────────────────────────────────
+  /**
+   * Read another principal's envelope by their keyringId. Returns null
+   * if the principal exists but has no envelope yet, or if the
+   * keyringId does not exist at all.
+   *
+   * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for
+   * cross-principal reads. Reading your own envelope (`keyringId ===
+   * self`) is never gated; that's just `me()` written long-form.
+   */
+  async get(keyringId, presented) {
+    if (this.checkGate && keyringId !== this.writerKeyringId) {
+      await this.checkGate("view-team-profiles", presented);
+    }
+    const dek = await this.getDek();
+    return loadUserEnvelope(this.adapter, this.vaultName, keyringId, dek);
+  }
+  /**
+   * Read every persisted envelope in the vault. Order is store-defined.
+   *
+   * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets
+   * any authenticated session read all envelopes. Two privacy-strict
+   * opt-outs:
+   *
+   *  - `view-team-profiles.enabled: false` → list() returns only the
+   *    caller's own envelope (silent self-fallback, no thrown error).
+   *  - `view-team-profiles.minTier: 1` + insufficient tier → throws
+   *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The
+   *    caller is expected to elevate, not silently degrade.
+   *
+   * The asymmetry is deliberate: `enabled: false` is a deliberate
+   * design choice ("nobody sees teammate profiles in this app");
+   * `insufficient-tier` is "you need to authenticate further". Different
+   * UX prompts for different intents.
+   */
+  async list(presented) {
+    if (this.checkGate) {
+      try {
+        await this.checkGate("view-team-profiles", presented);
+      } catch (err) {
+        if (err instanceof PolicyDeniedError && err.reason === "disabled") {
+          const me = await this.me();
+          return me ? [me] : [];
+        }
+        throw err;
+      }
+    }
+    const dek = await this.getDek();
+    const ids = await listUserEnvelopeIds(this.adapter, this.vaultName);
+    const envelopes = await Promise.all(
+      ids.map((id) => loadUserEnvelope(this.adapter, this.vaultName, id, dek))
+    );
+    return envelopes.filter((e) => e !== null);
+  }
+  // ─── Reactive ────────────────────────────────────────────────────────
+  /**
+   * Listen for changes to a specific keyringId's envelope. The callback
+   * fires synchronously after every successful local `updateMe` /
+   * `setMe` for that principal.
+   *
+   * Cross-instance changes (a teammate edits their profile on their
+   * device, the sync engine pulls the diff onto this device) will fire
+   * subscribers when the sync layer replays the write through this API.
+   * In v1, subscribers do NOT fire on raw store changes — wire your sync
+   * layer to call back through `vault.user.setMe` / `updateMe` if you
+   * need that.
+   *
+   * Pass keyringId `'*'` to fire on every change in the vault.
+   */
+  subscribe(keyringId, cb) {
+    let listeners = this.listeners.get(keyringId);
+    if (!listeners) {
+      listeners = /* @__PURE__ */ new Set();
+      this.listeners.set(keyringId, listeners);
+    }
+    const wrapped = cb;
+    listeners.add(wrapped);
+    return () => {
+      listeners?.delete(wrapped);
+      if (listeners && listeners.size === 0) {
+        this.listeners.delete(keyringId);
+      }
+    };
+  }
+  /**
+   * Reactive handle that caches the current value and re-reads on every
+   * change for the given keyringId. Convenient for framework bindings:
+   *
+   *   const live = vault.user.live<UserShape>(vault.userId)
+   *   live.subscribe(env => render(env?.data))
+   *
+   * Initial value is `null` until the first `current()` call materializes
+   * it via `vault.user.get()`. Call `stop()` when done to release the
+   * subscription.
+   */
+  live(keyringId) {
+    let value = null;
+    let primed = false;
+    const unsubscribe = this.subscribe(keyringId, (env) => {
+      value = env;
+    });
+    return {
+      current() {
+        if (!primed) {
+          primed = true;
+        }
+        return value;
+      },
+      subscribe: (cb) => this.subscribe(keyringId, cb),
+      stop: unsubscribe
+    };
+  }
+  // ─── Internal: change emission ───────────────────────────────────────
+  fireChange(keyringId, env) {
+    const targeted = this.listeners.get(keyringId);
+    if (targeted) for (const l of targeted) l(env);
+    const wildcard = this.listeners.get("*");
+    if (wildcard) for (const l of wildcard) l(env);
+  }
+};
+var createUserApi = (deps) => new UserApi(deps);
+function deepMerge(source, patch) {
+  if (!isPlainObject(source) || !isPlainObject(patch)) {
+    return patch;
+  }
+  const out = { ...source };
+  for (const [key, patchVal] of Object.entries(patch)) {
+    if (patchVal === void 0) {
+      continue;
+    }
+    if (patchVal === null) {
+      delete out[key];
+      continue;
+    }
+    const sourceVal = source[key];
+    if (isPlainObject(patchVal)) {
+      const recurseSource = isPlainObject(sourceVal) ? sourceVal : {};
+      out[key] = deepMerge(recurseSource, patchVal);
+    } else {
+      out[key] = patchVal;
+    }
+  }
+  return out;
+}
+function isPlainObject(x) {
+  if (x === null || typeof x !== "object") return false;
+  if (Array.isArray(x)) return false;
+  const proto = Object.getPrototypeOf(x);
+  return proto === Object.prototype || proto === null;
+}
+
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=chunk-HFJIGWJC.js.map