@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-PR5LC5YX.js

@@ -0,0 +1,265 @@
+import {
+  installViaBinder
+} from "./chunk-ARSAMO24.js";
+import {
+  SealedHandle
+} from "./chunk-CKZW6P5V.js";
+import {
+  ClassifiedConfigError,
+  ClassifiedNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/via/classified/descriptor.ts
+function isClassifiedFieldSpec(x) {
+  return typeof x === "object" && x !== null && x._noydbClassified === true;
+}
+function isClassifiedGroup(x) {
+  return typeof x === "object" && x !== null && x._noydbClassifiedGroup === true;
+}
+
+// src/via/classified/errors.ts
+var ClassifiedNeverStoredError = class extends Error {
+  constructor(collection, field) {
+    super(`Field "${field}" in collection "${collection}" is classified storage:'never' (e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedNeverStoredError";
+  }
+  collection;
+  field;
+};
+var ClassifiedValidationError = class extends Error {
+  constructor(collection, field, detail) {
+    super(`Classified field "${field}" in collection "${collection}" failed validation: ${detail}`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedValidationError";
+  }
+  collection;
+  field;
+};
+
+// src/via/classified/resolve.ts
+function resolveClassifiedFields(collection, config) {
+  const byField = {};
+  const claim = (field, spec) => {
+    if (byField[field] !== void 0) {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${field}" is claimed twice \u2014 storage forms are mutually exclusive per field (R5): a field is digest-only OR recoverable OR never, exactly one`
+      );
+    }
+    byField[field] = spec;
+  };
+  for (const [key, entry] of Object.entries(config)) {
+    if (isClassifiedGroup(entry)) {
+      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec);
+    } else {
+      claim(key, entry);
+    }
+  }
+  const riderComputed = {};
+  for (const [field, spec] of Object.entries(byField)) {
+    for (const [name, rider] of Object.entries(spec.riders ?? {})) {
+      const companion = `${field}_${name}`;
+      if (byField[companion] !== void 0 || riderComputed[companion] !== void 0) {
+        throw new ClassifiedConfigError(collection, `rider companion "${companion}" collides with a declared field`);
+      }
+      riderComputed[companion] = (record) => record[field] === void 0 ? void 0 : rider(record[field]);
+    }
+  }
+  return { byField, riderComputed };
+}
+
+// src/via/classified/write.ts
+function enforceClassifiedWrite(record, byField, collection) {
+  for (const [field, spec] of Object.entries(byField)) {
+    const value = record[field];
+    if (value === void 0) continue;
+    if (value === null && spec.storage === "digest-only") continue;
+    if (spec.storage === "never") throw new ClassifiedNeverStoredError(collection, field);
+    const problem = spec.validate?.(value) ?? null;
+    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem);
+  }
+}
+
+// src/via/classified/guards.ts
+function guardClassifiedCompat(collection, byField, ctx) {
+  const digestOnly = Object.entries(byField).filter(([, s]) => s.storage === "digest-only");
+  const protectedForms = Object.values(byField).filter((s) => s.storage === "digest-only" || s.storage === "recoverable");
+  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {
+    throw new ClassifiedConfigError(
+      collection,
+      "digest-only/recoverable classified fields cannot combine with a crdt mode or a conflictPolicy resolver \u2014 merge paths bypass write enforcement (R2)"
+    );
+  }
+  for (const [f, spec] of Object.entries(byField)) {
+    if (spec.equatable === true && spec.storage !== "digest-only") {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${f}" declares equatable but storage is '${spec.storage}' \u2014 equatable is a digest-only knob; recoverable equality is _det's job (R7)`
+      );
+    }
+  }
+  const hasEquatable = Object.values(byField).some((s) => s.equatable === true);
+  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {
+    throw new ClassifiedConfigError(
+      collection,
+      `classified equatable fields require \`acknowledgeEquatableRisk: true\` \u2014 equal values produce equal store-visible index tags (a partition leak a DEK holder can offline-dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`
+    );
+  }
+  if (digestOnly.length === 0) return;
+  if (!ctx.storeCiphertext) {
+    throw new ClassifiedConfigError(
+      collection,
+      `storage:'digest-only' requires an encrypted collection \u2014 with encrypt: false the write path skips the digest slot entirely and the secret would persist as raw plaintext`
+    );
+  }
+  if (!ctx.perRecordKeys) {
+    throw new ClassifiedConfigError(
+      collection,
+      `storage:'digest-only' requires perRecordKeys: true \u2014 vdig keys derive from the per-record CEK so forget() shreds them (R1)`
+    );
+  }
+  for (const [f, spec] of digestOnly) {
+    const n = spec.notLastN ?? 0;
+    if (!Number.isInteger(n) || n < 0 || n > 8) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" declares notLastN ${n} \u2014 must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented)`
+      );
+    }
+    if (ctx.bareSensitiveFields.has(f)) {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${f}" is digest-only AND listed in sensitive[] \u2014 storage forms are mutually exclusive per field (R5)`
+      );
+    }
+    if (ctx.deterministicFields?.has(f)) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" cannot be deterministic \u2014 equality-correlatable ciphertext defeats per-write salts (R3)`
+      );
+    }
+    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f) || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`
+      );
+    }
+  }
+}
+
+// src/via/classified/binding.ts
+function recoverableFields(byField) {
+  return Object.entries(byField).filter(([, spec]) => spec.storage === "recoverable").map(([field]) => field);
+}
+function sealFieldNames(byField, guardCtx) {
+  return [...recoverableFields(byField), ...guardCtx.bareSensitiveFields];
+}
+async function encodeClassifiedAtRest(record, crypto, fields) {
+  let open = record;
+  let sealed;
+  for (const field of fields) {
+    if (!(field in record)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    const ref = await crypto.sealedSlots.seal(field, value);
+    if (open === record) open = { ...record };
+    delete open[field];
+    sealed ??= {};
+    sealed[field] = ref;
+  }
+  return sealed ? { record: open, sealed } : { record };
+}
+async function decodeClassifiedAtRest(record, sealed, crypto, opts, fields) {
+  let out = record;
+  for (const field of fields) {
+    const ref = sealed[field];
+    if (ref === void 0) continue;
+    if (out === record) out = { ...record };
+    out[field] = opts.asHandles ? new SealedHandle(() => crypto.sealedSlots.unseal(field, ref)) : await crypto.sealedSlots.unseal(field, ref);
+  }
+  return out;
+}
+async function eraseClassified(ctx, cfg) {
+  let shredded = 0;
+  const residue = [];
+  if (cfg.classifySealedShred) {
+    const { slots } = await cfg.classifySealedShred(ctx.live);
+    for (const slot of slots) {
+      if (slot.class === "shreddable" || slot.class === "live-shreddable+dekResidue-in-backups") {
+        shredded += 1;
+        await ctx.crypto.sealedSlots.delete(slot.field);
+      }
+      if (slot.class === "dekResidue" || slot.class === "live-shreddable+dekResidue-in-backups") {
+        residue.push({ kind: "classified-sealed-dek-residue", field: slot.field });
+      }
+    }
+  }
+  if (cfg.purgeSealedCekEnvelopes) {
+    shredded += await cfg.purgeSealedCekEnvelopes(ctx.id);
+  }
+  return { shredded, residue };
+}
+function buildClassifiedDescribeFragment(byField) {
+  return {
+    classifiedFields: Object.fromEntries(
+      Object.entries(byField).map(([field, spec]) => [field, { storage: spec.storage, sensitivity: spec.sensitivity }])
+    )
+  };
+}
+function classifiedBinding(cfg) {
+  const resolved = resolveClassifiedFields(cfg.collectionName, cfg.entries);
+  guardClassifiedCompat(cfg.collectionName, resolved.byField, cfg.guardCtx);
+  const byField = resolved.byField;
+  const sealFields = sealFieldNames(byField, cfg.guardCtx);
+  return {
+    brand: "classified",
+    posture: { encryptedAtRest: "sealed", queryable: "det-exact", exportable: false, forgettable: true },
+    covers: (field) => field in byField,
+    // async (rather than a bare passthrough) so a refusal is always a
+    // rejected Promise for direct callers, matching every other async-stack
+    // hook's calling convention — `enforceClassifiedWrite` itself stays sync.
+    enforceWrite: async (record, _ctx) => enforceClassifiedWrite(record, byField, cfg.collectionName),
+    encodeAtRest: (record, crypto) => encodeClassifiedAtRest(record, crypto, sealFields),
+    decodeAtRest: (record, sealed, crypto, opts) => decodeClassifiedAtRest(record, sealed, crypto, opts, sealFields),
+    erase: (ctx) => eraseClassified(ctx, cfg),
+    describeFragment: () => buildClassifiedDescribeFragment(byField)
+  };
+}
+function linkClassifiedVia() {
+  installViaBinder("classified", (c) => classifiedBinding(c));
+}
+
+// src/port/with/classified-strategy.ts
+linkClassifiedVia();
+var NO_CLASSIFIED = {
+  async reveal() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async verify() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async verifyText() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async matchGroup() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async computeTarget() {
+    throw new ClassifiedNotEnabledError();
+  }
+};
+
+export {
+  isClassifiedFieldSpec,
+  isClassifiedGroup,
+  ClassifiedNeverStoredError,
+  ClassifiedValidationError,
+  resolveClassifiedFields,
+  guardClassifiedCompat,
+  enforceClassifiedWrite,
+  NO_CLASSIFIED
+};
+//# sourceMappingURL=chunk-PR5LC5YX.js.map

package/dist/chunk-PXWVF7MC.js

@@ -0,0 +1,135 @@
+import {
+  freezeSnapshotOnly
+} from "./chunk-7NS43EXZ.js";
+import {
+  resolveManagedSecret
+} from "./chunk-KPGX66PM.js";
+import {
+  createOwnerKeyring
+} from "./chunk-5ZOSG3RJ.js";
+import {
+  wrapKey
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  PermissionDeniedError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/team/deed.ts
+var DEED_RECORD_ID = "deed";
+async function createDeedOwner(store, vault, ownerUserId, sealing) {
+  const passphrase = await resolveManagedSecret(store, vault, sealing);
+  const keyring = await createOwnerKeyring(store, vault, ownerUserId, passphrase);
+  await saveDeedMarker(store, vault, {
+    ownerUserId,
+    sealedUnder: sealing.id,
+    latent: true,
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return keyring;
+}
+async function loadDeedMarker(store, vault) {
+  const envelope = await store.get(vault, "_meta", DEED_RECORD_ID);
+  if (!envelope) return null;
+  let payload;
+  try {
+    payload = JSON.parse(envelope._data);
+  } catch {
+    return null;
+  }
+  if (typeof payload !== "object" || payload === null) return null;
+  const r = payload;
+  if (r._noydb_deed !== 1) return null;
+  if (typeof r.ownerUserId !== "string" || typeof r.sealedUnder !== "string" || r.latent !== true || typeof r.issuedAt !== "string") {
+    return null;
+  }
+  const marker = {
+    ownerUserId: r.ownerUserId,
+    sealedUnder: r.sealedUnder,
+    latent: true,
+    issuedAt: r.issuedAt,
+    ...typeof r.liberatedAt === "string" ? { liberatedAt: r.liberatedAt } : {}
+  };
+  return marker;
+}
+async function isDeedVault(store, vault) {
+  return await loadDeedMarker(store, vault) !== null;
+}
+async function saveDeedMarker(store, vault, marker) {
+  const persisted = { _noydb_deed: 1, ...marker };
+  const prior = await store.get(vault, "_meta", DEED_RECORD_ID);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the marker is plaintext audit metadata.
+    _iv: "",
+    _data: JSON.stringify(persisted)
+  };
+  await store.put(vault, "_meta", DEED_RECORD_ID, env);
+}
+
+// src/with-party/custody/liberate.ts
+async function liberateVault(vault, opts) {
+  await vault.noydb.checkGate(vault.name, "liberate-vault", opts.factors);
+  const { name: vaultName, adapter, keyring } = vault._introspectState();
+  if (keyring.role !== "custodian") {
+    throw new PermissionDeniedError(
+      "liberation is claimed only by the custodian (the de-facto authority holding the DEKs)"
+    );
+  }
+  const existing = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
+  if (existing) {
+    throw new PermissionDeniedError(
+      `liberateVault: newOwnerId "${opts.newOwnerId}" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`
+    );
+  }
+  const collections = await listOperationalCollections(vault);
+  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId });
+  const newOwner = await createOwnerKeyring(adapter, vaultName, opts.newOwnerId, opts.newOwnerPassphrase);
+  if (!newOwner.kek) {
+    throw new PermissionDeniedError(
+      `new owner keyring for "${opts.newOwnerId}" has no KEK to re-wrap the incumbent DEKs under`
+    );
+  }
+  const env = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
+  if (!env) {
+    throw new PermissionDeniedError(`new owner keyring for "${opts.newOwnerId}" did not persist`);
+  }
+  const keyringFile = JSON.parse(env._data);
+  const mergedDeks = { ...keyringFile.deks };
+  for (const [collection, dek] of keyring.deks) {
+    mergedDeks[collection] = await wrapKey(dek, newOwner.kek);
+  }
+  const mergedFile = { ...keyringFile, deks: mergedDeks };
+  await adapter.put(vaultName, "_keyring", opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) });
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: opts.newOwnerId,
+    payloadHash: "",
+    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`
+  });
+  const marker = await loadDeedMarker(adapter, vaultName);
+  if (marker) {
+    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  return { snapshot };
+}
+async function listOperationalCollections(vault) {
+  const { keyring } = vault._introspectState();
+  return [...keyring.deks.keys()].filter((c) => !c.startsWith("_"));
+}
+
+export {
+  DEED_RECORD_ID,
+  createDeedOwner,
+  loadDeedMarker,
+  isDeedVault,
+  liberateVault
+};
+//# sourceMappingURL=chunk-PXWVF7MC.js.map

package/dist/chunk-Q3XSMOZM.js

@@ -0,0 +1,40 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+
+// src/with-shape/schema-update/fence.ts
+var FENCE_RECORD_ID = "schema-fence";
+var META_COLLECTION = "_meta";
+var DEFAULT_FENCE = { currentSchemaVersion: 0, fenceState: "normal" };
+async function loadFence(store, vault) {
+  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID);
+  if (!envelope) return DEFAULT_FENCE;
+  try {
+    const parsed = JSON.parse(envelope._data);
+    if (!isFenceDoc(parsed)) return DEFAULT_FENCE;
+    return parsed;
+  } catch {
+    return DEFAULT_FENCE;
+  }
+}
+async function saveFence(store, vault, fence) {
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(fence)
+  };
+  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope);
+}
+function isFenceDoc(x) {
+  if (x === null || typeof x !== "object") return false;
+  const o = x;
+  return typeof o["currentSchemaVersion"] === "number" && (o["fenceState"] === "normal" || o["fenceState"] === "draining" || o["fenceState"] === "migrating" || o["fenceState"] === "complete");
+}
+
+export {
+  loadFence,
+  saveFence
+};
+//# sourceMappingURL=chunk-Q3XSMOZM.js.map

package/dist/chunk-QLLKLFE2.js

@@ -0,0 +1,94 @@
+import {
+  sha256Hex
+} from "./chunk-HUS3J5WM.js";
+
+// src/with-shape/persisted-schemas/canonicalize.ts
+function canonicalize(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(canonicalize).join(",") + "]";
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  const parts = keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k]));
+  return "{" + parts.join(",") + "}";
+}
+
+// src/with-shape/persisted-schemas/derive.ts
+function isZodSchema(value) {
+  if (value === null || typeof value !== "object") return false;
+  const std = value["~standard"];
+  if (std && typeof std === "object" && std.vendor === "zod") return true;
+  const def = value._def;
+  if (!def || typeof def !== "object") return false;
+  return typeof def.typeName === "string" && def.typeName.startsWith("Zod");
+}
+function detectKind(validator) {
+  if (isZodSchema(validator)) return "Zod";
+  return "Unknown";
+}
+function isZod4Schema(value) {
+  if (value === null || typeof value !== "object") return false;
+  return "_zod" in value;
+}
+async function loadZodToJsonSchemaConverter() {
+  try {
+    const mod = await import("zod-to-json-schema");
+    if (!mod.zodToJsonSchema) {
+      throw new Error("zod-to-json-schema export missing");
+    }
+    return mod.zodToJsonSchema;
+  } catch (err) {
+    throw new Error(
+      `persistJsonSchema requires the optional peer-dep \`zod-to-json-schema\`. Install it: \`pnpm add zod-to-json-schema\` (or npm/yarn equivalent). Original error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function loadZodV4Converter() {
+  try {
+    const mod = await import("./zod-HAJM7LMS.js");
+    if (typeof mod.toJSONSchema !== "function") {
+      throw new Error("zod.toJSONSchema not available (zod v4 required)");
+    }
+    return mod.toJSONSchema;
+  } catch (err) {
+    throw new Error(
+      `persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. Original error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function derivePersistedSchema(validator) {
+  const kind = detectKind(validator);
+  const derivedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (kind === "Zod") {
+    let jsonSchema;
+    if (isZod4Schema(validator)) {
+      const convert = await loadZodV4Converter();
+      jsonSchema = convert(validator);
+    } else {
+      const convert = await loadZodToJsonSchemaConverter();
+      jsonSchema = convert(validator);
+    }
+    const canonical = canonicalize(jsonSchema);
+    const hash = await sha256Hex(new TextEncoder().encode(canonical));
+    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt };
+  }
+  return {
+    _noydb_schema: 1,
+    kind,
+    jsonSchema: null,
+    hash: null,
+    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,
+    derivedAt
+  };
+}
+
+export {
+  canonicalize,
+  isZodSchema,
+  isZod4Schema,
+  derivePersistedSchema
+};
+//# sourceMappingURL=chunk-QLLKLFE2.js.map