@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-SRVQHVNX.js

@@ -0,0 +1,164 @@
+import {
+  freezeAndDeleteClosure,
+  randomId
+} from "./chunk-7NS43EXZ.js";
+import {
+  buildAccessibleBundle,
+  resolveAccessibleCollections
+} from "./chunk-BCYQA5BK.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  NoydbError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/portability/request-withdrawal.ts
+var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
+var WithdrawalRequestError = class extends NoydbError {
+  constructor(message) {
+    super("WITHDRAWAL_REQUEST", message);
+    this.name = "WithdrawalRequestError";
+  }
+};
+function writeRequest(vault, req, expectedVersion) {
+  const { name: vaultName, adapter } = vault._introspectState();
+  const body = JSON.stringify(req);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: expectedVersion + 1,
+    _ts: req.decidedAt ?? req.requestedAt,
+    _iv: "",
+    _data: body,
+    _by: req.decidedBy ?? req.requester
+  };
+  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion);
+}
+async function readRequest(vault, requestId) {
+  const { name: vaultName, adapter } = vault._introspectState();
+  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId);
+  if (!env) throw new WithdrawalRequestError(`withdrawal request "${requestId}" not found`);
+  return { req: JSON.parse(env._data), version: env._v };
+}
+async function requestWithdrawal(vault, opts = {}) {
+  const { keyring } = vault._introspectState();
+  const collections = resolveAccessibleCollections(keyring, opts.scope, false);
+  if (!collections || collections.length === 0) {
+    throw new WithdrawalRequestError(
+      "requestWithdrawal needs a concrete scope.collections (the caller has all-collection access \u2014 name the collections to withdraw)"
+    );
+  }
+  const requestId = `wr-${randomId()}`;
+  const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const req = {
+    requestId,
+    requester: keyring.userId,
+    collections,
+    disposition: opts.disposition ?? "delete",
+    status: "pending",
+    requestedAt,
+    ...opts.legalBasis ? { legalBasis: opts.legalBasis } : {},
+    ...opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}
+  };
+  await writeRequest(vault, req, 0);
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: keyring.userId,
+    payloadHash: "",
+    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`
+  });
+  return { requestId, status: "pending", ...req.expiresAt ? { expiresAt: req.expiresAt } : {} };
+}
+async function listWithdrawalRequests(vault, opts = {}) {
+  const { name: vaultName, adapter } = vault._introspectState();
+  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION);
+  const out = [];
+  for (const id of ids) {
+    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id);
+    if (!env) continue;
+    const req = JSON.parse(env._data);
+    if (!opts.status || req.status === opts.status) out.push(req);
+  }
+  return out;
+}
+function assertApprover(vault) {
+  const { keyring } = vault._introspectState();
+  if (keyring.role !== "owner" && keyring.role !== "admin") {
+    throw new WithdrawalRequestError("approveWithdrawal / rejectWithdrawal require an owner or admin");
+  }
+  return keyring.userId;
+}
+function assertPending(req) {
+  if (req.status !== "pending") {
+    throw new WithdrawalRequestError(`withdrawal request "${req.requestId}" is already ${req.status}`);
+  }
+  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {
+    throw new WithdrawalRequestError(`withdrawal request "${req.requestId}" expired at ${req.expiresAt}`);
+  }
+}
+async function approveWithdrawal(vault, requestId, opts = {}) {
+  const approver = assertApprover(vault);
+  const { req, version } = await readRequest(vault, requestId);
+  assertPending(req);
+  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey);
+  const snapshot = await freezeAndDeleteClosure(vault, req.collections, {
+    disposition: req.disposition,
+    actorUserId: approver,
+    withdrawalId: `wd-${requestId}`
+  });
+  const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await writeRequest(vault, {
+    ...req,
+    status: "approved",
+    decidedAt,
+    decidedBy: approver,
+    ...snapshot ? { snapshotSha256: snapshot.sha256 } : {}
+  }, version);
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: approver,
+    payloadHash: "",
+    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`
+  });
+  return snapshot ? { bundle, snapshot } : { bundle };
+}
+async function rejectWithdrawal(vault, requestId, opts = {}) {
+  const approver = assertApprover(vault);
+  const { req, version } = await readRequest(vault, requestId);
+  assertPending(req);
+  const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const updated = {
+    ...req,
+    status: "rejected",
+    decidedAt,
+    decidedBy: approver,
+    ...opts.reason ? { rejectReason: opts.reason } : {}
+  };
+  await writeRequest(vault, updated, version);
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: approver,
+    payloadHash: "",
+    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`
+  });
+  return updated;
+}
+
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  requestWithdrawal,
+  listWithdrawalRequests,
+  approveWithdrawal,
+  rejectWithdrawal
+};
+//# sourceMappingURL=chunk-SRVQHVNX.js.map

package/dist/chunk-SYMS4546.js

@@ -0,0 +1,29 @@
+import {
+  decrypt,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek
+} from "./chunk-HUS3J5WM.js";
+
+// src/kernel/enclave/record-keys/sealed-slot.ts
+function parseSealedSlot(blob) {
+  const sep = blob.indexOf(":");
+  return { iv: blob.slice(0, sep), data: blob.slice(sep + 1) };
+}
+async function dualReadSealedSlot(blob, field, collection, cek, dek) {
+  const { iv, data } = parseSealedSlot(blob);
+  if (cek !== void 0) {
+    try {
+      const fieldKey2 = await deriveSealedFieldKeyFromCek(cek, collection, field);
+      return await decrypt(iv, data, fieldKey2);
+    } catch {
+    }
+  }
+  const fieldKey = await deriveSealedFieldKey(dek, collection, field);
+  return decrypt(iv, data, fieldKey);
+}
+
+export {
+  parseSealedSlot,
+  dualReadSealedSlot
+};
+//# sourceMappingURL=chunk-SYMS4546.js.map

package/dist/chunk-TPH5EO6L.js

@@ -0,0 +1,54 @@
+// src/with-formula/materialized-views/stale.ts
+var _staleByRegistry = /* @__PURE__ */ new WeakMap();
+function markMVStale(registry, mvName) {
+  let set = _staleByRegistry.get(registry);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    _staleByRegistry.set(registry, set);
+  }
+  set.add(mvName);
+}
+function isMVStale(registry, mvName) {
+  return _staleByRegistry.get(registry)?.has(mvName) ?? false;
+}
+async function resolveStaleMVOnRead(accessor, outputCollection, dispatchCtx) {
+  const registry = accessor.registry();
+  const pending = _staleByRegistry.get(registry);
+  if (!pending || pending.size === 0) return;
+  const candidates = [];
+  for (const mv of registry.all()) {
+    if (mv.outputCollection !== outputCollection) continue;
+    if (!pending.has(mv.spec.name)) continue;
+    candidates.push(mv.spec.name);
+  }
+  if (candidates.length === 0) return;
+  let executor = null;
+  for (const name of candidates) {
+    const reg = registry.byName(name);
+    if (!reg) {
+      pending.delete(name);
+      continue;
+    }
+    if (executor === null) {
+      ({ MaterializedViewExecutor: executor } = await import("./executor-GTVSUUBX.js"));
+    }
+    await executor.refresh(reg, {
+      getCollection: (n) => accessor.getCollection(n),
+      getActiveTxContext: () => accessor.getActiveTxContext(),
+      getQueryContext: () => accessor.getQueryContext(),
+      ...dispatchCtx !== void 0 ? { dispatchCtx } : {}
+    });
+    pending.delete(name);
+  }
+}
+function clearMVStale(registry, mvName) {
+  _staleByRegistry.get(registry)?.delete(mvName);
+}
+
+export {
+  markMVStale,
+  isMVStale,
+  resolveStaleMVOnRead,
+  clearMVStale
+};
+//# sourceMappingURL=chunk-TPH5EO6L.js.map

package/dist/chunk-UFILRICG.js

@@ -0,0 +1,14 @@
+// src/with-cargo/active.ts
+function withCargo() {
+  return {
+    async extractPartition(vault, opts) {
+      const { extractPartitionCore } = await import("./extract-partition-JUQTWDXR.js");
+      return extractPartitionCore(vault, opts);
+    }
+  };
+}
+
+export {
+  withCargo
+};
+//# sourceMappingURL=chunk-UFILRICG.js.map

package/dist/chunk-UTLEAJXC.js

@@ -0,0 +1,97 @@
+import {
+  MaterializedViewConfigError,
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/materialized-views/with-materialized-view.ts
+function withMaterializedView(spec) {
+  if (!spec.name || spec.name.length === 0) {
+    throw new ValidationError("withMaterializedView: name is required");
+  }
+  if (spec.query && spec.unionSources) {
+    throw new MaterializedViewConfigError(
+      "query and unionSources are mutually exclusive \u2014 pick one"
+    );
+  }
+  if (!spec.query && !spec.unionSources) {
+    throw new MaterializedViewConfigError(
+      "strategy must declare either query or unionSources"
+    );
+  }
+  if (spec.query !== void 0 && typeof spec.query !== "function") {
+    throw new ValidationError("withMaterializedView: query must be a function returning a Query<T>");
+  }
+  if (spec.unionSources) {
+    if (spec.unionSources.length < 1) {
+      throw new MaterializedViewConfigError(
+        "unionSources requires at least 1 source collection"
+      );
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const s of spec.unionSources) {
+      if (typeof s?.collection !== "string" || s.collection.length === 0) {
+        throw new MaterializedViewConfigError(
+          "each unionSources entry must declare a non-empty `collection` string"
+        );
+      }
+      if (typeof s.map !== "function") {
+        throw new MaterializedViewConfigError(
+          `unionSources entry for "${s.collection}" is missing a \`map\` function`
+        );
+      }
+      if (seen.has(s.collection)) {
+        throw new MaterializedViewConfigError(
+          `unionSources must reference distinct collections (duplicate: "${s.collection}")`
+        );
+      }
+      seen.add(s.collection);
+    }
+    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": groupBy must not be an empty array \u2014 omit it or provide at least one field name`
+      );
+    }
+    if (spec.aggregate && !spec.groupBy) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": UNION strategy with aggregate requires groupBy \u2014 use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`
+      );
+    }
+    if (spec.moneyFields && !spec.aggregate) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": moneyFields requires aggregate \u2014 moneyFields rewrites sum/min/max reducers over money output fields, so it is meaningless without an aggregate spec`
+      );
+    }
+    if (spec.unionSources.some((s) => s.join && s.join.length > 0) && (!spec.sources || spec.sources.length === 0)) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": a unionSources arm declares join(s) but no \`sources\` are listed \u2014 declare sources: [...] with the right-side (join-target) collection names so writes to them trigger MV refresh`
+      );
+    }
+    if (spec.predicates) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": predicates are not supported on UNION strategies \u2014 UNION mode does not use a Query<T> chain, so .wherePredicate() cannot fire. Use the query() form, or open an issue if per-arm predicates are needed`
+      );
+    }
+  }
+  if (spec.i18nLocale !== void 0 && spec.i18nFields === void 0) {
+    throw new MaterializedViewConfigError(
+      `withMaterializedView "${spec.name}": i18nLocale requires i18nFields \u2014 declare the i18nText descriptors of the group-key fields so they can be resolved at the mv layer before bucketing.`
+    );
+  }
+  if (typeof spec.rowKey !== "function") {
+    throw new ValidationError("withMaterializedView: rowKey is required (no default; see spec \xA7 Type surface)");
+  }
+  if (spec.refresh !== "eager" && spec.refresh !== "lazy" && spec.refresh !== "manual") {
+    throw new ValidationError(
+      `withMaterializedView: refresh must be 'eager' | 'lazy' | 'manual', got "${String(spec.refresh)}"`
+    );
+  }
+  return {
+    __noydb_strategy: "materialized-view",
+    spec
+  };
+}
+
+export {
+  withMaterializedView
+};
+//# sourceMappingURL=chunk-UTLEAJXC.js.map

package/dist/chunk-VA4ZWLFY.js

@@ -0,0 +1,123 @@
+import {
+  IllegalTransitionError,
+  RecordLockedError,
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/guards/with-guard.ts
+function withGuard(strategy) {
+  if (!strategy.collection || strategy.collection.length === 0) {
+    throw new ValidationError("withGuard: collection name is required");
+  }
+  return {
+    __noydb_strategy: "guard",
+    spec: strategy
+  };
+}
+
+// src/with-audit/guards/immutable-guard.ts
+function recordId(record) {
+  const id = record?.id;
+  return typeof id === "string" ? id : "";
+}
+function immutableGuard(config) {
+  const { collection, after, appendOnly, amendmentRoles, amendmentInvariant } = config;
+  if (appendOnly && after !== void 0) {
+    throw new ValidationError("immutableGuard: `after` and `appendOnly` are mutually exclusive");
+  }
+  if (!appendOnly && after === void 0) {
+    throw new ValidationError("immutableGuard: provide `after` or `appendOnly: true`");
+  }
+  const isImmutable = appendOnly ? () => true : after;
+  const reason = appendOnly ? "append-only collection" : "record is immutable after issue";
+  const spec = {
+    collection,
+    // Block updates to an already-immutable record. Inserts (existing
+    // null) and the transition write that first makes the record
+    // immutable are allowed — `after` reads the prior state.
+    check: (incoming, ctx) => {
+      if (ctx.existing !== null && isImmutable(ctx.existing)) {
+        throw new RecordLockedError(collection, recordId(incoming), reason);
+      }
+    },
+    // Block deletes of an immutable record.
+    onDelete: (existing) => {
+      if (isImmutable(existing)) {
+        throw new RecordLockedError(collection, recordId(existing), reason);
+      }
+    },
+    // The authorized override: inside an amendment transaction the
+    // check/onDelete are skipped and the change is ledgered. By default
+    // there is no extra invariant — the amendment itself is the
+    // sanctioned exception. Callers may supply `amendmentInvariant` to
+    // keep a constraint inviolable even under amendment (e.g. forbid
+    // deletes, or preserve a cross-record sum); a throw reverts the
+    // amendment and surfaces as `InvariantError`.
+    amendment: {
+      roles: amendmentRoles ?? ["admin", "owner"],
+      invariant: amendmentInvariant ?? (() => {
+      })
+    }
+  };
+  return withGuard(spec);
+}
+
+// src/with-audit/guards/transition-guard.ts
+function recordId2(record) {
+  const id = record?.id;
+  return typeof id === "string" ? id : "";
+}
+function stateOf(record, field) {
+  const v = record[field];
+  return typeof v === "string" ? v : String(v);
+}
+function transitionGuard(config) {
+  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config;
+  const allowIdempotent = config.allowIdempotent ?? true;
+  if (!field) {
+    throw new ValidationError("transitionGuard: `field` is required");
+  }
+  if (transitions === void 0 || typeof transitions !== "object") {
+    throw new ValidationError("transitionGuard: `transitions` must be a state\u2192states map");
+  }
+  const spec = {
+    collection,
+    check: (incoming, ctx) => {
+      const rec = incoming;
+      const to = stateOf(rec, field);
+      if (ctx.existing === null) {
+        if (initial !== void 0 && !initial.includes(to)) {
+          throw new IllegalTransitionError(collection, recordId2(rec), "(none)", to);
+        }
+        return;
+      }
+      const from = stateOf(ctx.existing, field);
+      if (from === to) {
+        if (allowIdempotent) return;
+        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
+      }
+      const allowed = transitions[from] ?? [];
+      if (!allowed.includes(to)) {
+        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
+      }
+    },
+    // The authorized override: inside an amendment transaction the check
+    // is skipped and the change is ledgered. By default no extra invariant
+    // — the amendment itself is the sanctioned exception. Callers may
+    // supply `amendmentInvariant` to keep a constraint inviolable even
+    // under amendment; a throw reverts the amendment as `InvariantError`.
+    amendment: {
+      roles: amendmentRoles ?? ["admin", "owner"],
+      invariant: amendmentInvariant ?? (() => {
+      })
+    }
+  };
+  return withGuard(spec);
+}
+
+export {
+  withGuard,
+  immutableGuard,
+  transitionGuard
+};
+//# sourceMappingURL=chunk-VA4ZWLFY.js.map