@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-4R4Q64W5.js

@@ -0,0 +1,34 @@
+import {
+  TierNotGrantedError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/team/tiers.ts
+function dekKey(collection, tier) {
+  if (tier <= 0) return collection;
+  return `${collection}#${tier}`;
+}
+function effectiveClearance(keyring, collection) {
+  let max = 0;
+  const prefix = `${collection}#`;
+  for (const key of keyring.deks.keys()) {
+    if (!key.startsWith(prefix)) continue;
+    const suffix = key.slice(prefix.length);
+    const n = Number.parseInt(suffix, 10);
+    if (Number.isFinite(n) && n > max) max = n;
+  }
+  return max;
+}
+function assertTierAccess(keyring, collection, tier) {
+  if (tier <= 0) return;
+  if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return;
+  if (!keyring.deks.has(dekKey(collection, tier))) {
+    throw new TierNotGrantedError(collection, tier);
+  }
+}
+
+export {
+  dekKey,
+  effectiveClearance,
+  assertTierAccess
+};
+//# sourceMappingURL=chunk-4R4Q64W5.js.map

package/dist/chunk-57V5S7PW.js

@@ -0,0 +1,130 @@
+import {
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-AWB5JZW6.js";
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  NoydbError
+} from "./chunk-FH542DDY.js";
+
+// src/with-shape/links/link-set.ts
+var LinkSet = class {
+  constructor(adapter, vault, name, spec, encrypted, getDEK, actor, emitter, endpointExists) {
+    this.adapter = adapter;
+    this.vault = vault;
+    this.name = name;
+    this.spec = spec;
+    this.encrypted = encrypted;
+    this.getDEK = getDEK;
+    this.actor = actor;
+    this.emitter = emitter;
+    this.endpointExists = endpointExists;
+    this.collName = linkCollectionName(name);
+  }
+  adapter;
+  vault;
+  name;
+  spec;
+  encrypted;
+  getDEK;
+  actor;
+  emitter;
+  endpointExists;
+  collName;
+  dekPromise = null;
+  dek() {
+    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
+    return this.dekPromise;
+  }
+  async encryptEntry(entry, version) {
+    const json = JSON.stringify(entry);
+    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
+    if (!this.encrypted) return { ...base, _iv: "", _data: json };
+    const { iv, data } = await encrypt(json, await this.dek());
+    return { ...base, _iv: iv, _data: data };
+  }
+  async decryptEntry(env) {
+    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+    return JSON.parse(json);
+  }
+  async connect(aId, bId, meta) {
+    if (!await this.endpointExists(this.spec.a, aId)) {
+      throw new LinkEndpointError(this.name, this.spec.a, aId);
+    }
+    if (!await this.endpointExists(this.spec.b, bId)) {
+      throw new LinkEndpointError(this.name, this.spec.b, bId);
+    }
+    const key = linkRowKey(aId, bId);
+    const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
+    const existing = await this.adapter.get(this.vault, this.collName, key);
+    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
+    await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
+    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
+  }
+  async disconnect(aId, bId) {
+    const key = linkRowKey(aId, bId);
+    const existing = await this.adapter.get(this.vault, this.collName, key);
+    if (!existing) return;
+    await this.adapter.delete(this.vault, this.collName, key);
+    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "delete" });
+  }
+  async has(aId, bId) {
+    return await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId)) !== null;
+  }
+  async of(id) {
+    const rows = await this.list();
+    return rows.filter((r) => r.a === id || r.b === id);
+  }
+  async list() {
+    const keys = await this.adapter.list(this.vault, this.collName);
+    const out = [];
+    for (const key of keys) {
+      const env = await this.adapter.get(this.vault, this.collName, key);
+      if (!env) continue;
+      const e = await this.decryptEntry(env);
+      out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
+    }
+    return out;
+  }
+  // ── Vault-internal cascade helpers ──────────────────────────────────
+  /** @internal — rows where the deleted endpoint id matches the relevant slot. */
+  async _rowsTouchingEndpoint(collection, id) {
+    const rows = await this.list();
+    return rows.filter(
+      (r) => this.spec.a === collection && r.a === id || this.spec.b === collection && r.b === id
+    );
+  }
+  /** @internal — the storage collection name (for tx pre-image capture). */
+  get _collectionName() {
+    return this.collName;
+  }
+};
+var LinkEndpointError = class extends NoydbError {
+  link;
+  endpoint;
+  missingId;
+  constructor(link, endpoint, missingId) {
+    super(
+      "LINK_ENDPOINT",
+      `link("${link}").connect: endpoint "${endpoint}" has no record "${missingId}".`
+    );
+    this.name = "LinkEndpointError";
+    this.link = link;
+    this.endpoint = endpoint;
+    this.missingId = missingId;
+  }
+};
+
+export {
+  LinkSet,
+  LinkEndpointError
+};
+//# sourceMappingURL=chunk-57V5S7PW.js.map

package/dist/chunk-5JB73NMC.js

@@ -0,0 +1,202 @@
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  ConflictError,
+  SequenceContentionError,
+  SequenceNotEnabledError,
+  SequenceOfflineError,
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-commit/sequence/strategy.ts
+var NO_SEQUENCE = {
+  createStore() {
+    throw new SequenceNotEnabledError();
+  }
+};
+
+// src/with-commit/sequence/index.ts
+var SEQUENCE_COLLECTION = "_sequences";
+var MAX_NEXT_ATTEMPTS = 16;
+var SEQ_FORMAT_TOKEN = /\{([^{}]*)\}/g;
+var SEQ_PAD_TOKEN = /^seq:0(\d+)$/;
+var SEQ_PARTITION_TOKEN = /^partition\.(\d+)$/;
+function compileSequenceFormat(format, series, partition) {
+  const parts = partition ?? [];
+  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {
+    const token = m[1] ?? "";
+    if (token === "seq") continue;
+    if (SEQ_PAD_TOKEN.test(token)) continue;
+    const partMatch = SEQ_PARTITION_TOKEN.exec(token);
+    if (partMatch) {
+      const idx = Number(partMatch[1]);
+      if (idx >= parts.length) {
+        throw new ValidationError(
+          `sequence("${series}"): format token "{${token}}" references partition index ${idx}, but only ${parts.length} partition component(s) were supplied.`
+        );
+      }
+      continue;
+    }
+    throw new ValidationError(
+      `sequence("${series}"): format contains unknown token "{${token}}". Accepted tokens: {seq}, {seq:0N}, {partition.i}.`
+    );
+  }
+  return (serial) => format.replace(SEQ_FORMAT_TOKEN, (full, token) => {
+    if (token === "seq") return String(serial);
+    const padMatch = SEQ_PAD_TOKEN.exec(token);
+    if (padMatch) return String(serial).padStart(Number(padMatch[1]), "0");
+    const partMatch = SEQ_PARTITION_TOKEN.exec(token);
+    if (partMatch) return String(parts[Number(partMatch[1])]);
+    return full;
+  });
+}
+function resolveSequenceKey(series, opts) {
+  const partition = opts?.partition;
+  if (!partition || partition.length === 0) return series;
+  const parts = partition.map((p) => {
+    if (typeof p === "number" && !Number.isFinite(p)) {
+      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`);
+    }
+    const s = String(p);
+    if (s === "") {
+      throw new ValidationError("sequence partition component must not be empty");
+    }
+    return encodeURIComponent(s);
+  });
+  return `${series}\0${parts.join("/")}`;
+}
+async function sleepBackoff(attempt) {
+  const ceil = Math.min(2 ** attempt, 32);
+  const ms = Math.floor(Math.random() * ceil);
+  await new Promise((r) => setTimeout(r, ms));
+}
+var SequenceStore = class {
+  adapter;
+  vault;
+  encrypted;
+  getDEK;
+  actor;
+  /**
+   * Memoized DEK promise. The `_sequences` collection DEK is created on
+   * first access; without sharing one promise, a burst of concurrent
+   * `next()` calls would each trigger DEK creation and diverge (one
+   * writer's ciphertext unreadable by another). One shared promise → one
+   * DEK.
+   */
+  dekPromise = null;
+  constructor(opts) {
+    this.adapter = opts.adapter;
+    this.vault = opts.vault;
+    this.encrypted = opts.encrypted;
+    this.getDEK = opts.getDEK;
+    this.actor = opts.actor;
+  }
+  /** A handle bound to one sequence name. */
+  handle(name) {
+    return {
+      next: () => this.next(name),
+      peek: () => this.peek(name),
+      seedTo: (n) => this.seedTo(name, n)
+    };
+  }
+  assertOnline() {
+    if (this.adapter.capabilities?.casAtomic !== true) {
+      throw new SequenceOfflineError();
+    }
+  }
+  dek() {
+    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION);
+    return this.dekPromise;
+  }
+  async read(name) {
+    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
+    if (!env) return { env: null, value: 0 };
+    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+    const state = JSON.parse(json);
+    return { env, value: state.value };
+  }
+  async encryptState(state, version) {
+    const json = JSON.stringify(state);
+    if (!this.encrypted) {
+      return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+    }
+    const { iv, data } = await encrypt(json, await this.dek());
+    return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+  }
+  async peek(name) {
+    return (await this.read(name)).value;
+  }
+  async next(name) {
+    this.assertOnline();
+    let lastConflict;
+    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
+      const { env, value } = await this.read(name);
+      const nextValue = value + 1;
+      const expectedVersion = env?._v ?? 0;
+      const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1);
+      try {
+        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
+        return nextValue;
+      } catch (err) {
+        if (err instanceof ConflictError) {
+          lastConflict = err;
+          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
+          continue;
+        }
+        throw err;
+      }
+    }
+    void lastConflict;
+    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
+  }
+  async seedTo(name, n) {
+    this.assertOnline();
+    if (n <= 0) return;
+    let lastConflict;
+    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
+      const { env, value } = await this.read(name);
+      if (value >= n) return;
+      const expectedVersion = env?._v ?? 0;
+      const envelope = await this.encryptState({ value: n }, expectedVersion + 1);
+      try {
+        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
+        return;
+      } catch (err) {
+        if (err instanceof ConflictError) {
+          lastConflict = err;
+          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
+          continue;
+        }
+        throw err;
+      }
+    }
+    void lastConflict;
+    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
+  }
+};
+
+// src/with-commit/sequence/active.ts
+function withSequence() {
+  return {
+    createStore(opts) {
+      return new SequenceStore(opts);
+    }
+  };
+}
+
+export {
+  withSequence,
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey,
+  SequenceStore
+};
+//# sourceMappingURL=chunk-5JB73NMC.js.map

package/dist/chunk-5XIPOCQC.js

@@ -0,0 +1,155 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/directory/public-envelope/schema.ts
+var DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+);base64,/;
+function validatePublicEnvelopeInput(input, schema) {
+  const allowed = new Set(schema.fields);
+  for (const key of Object.keys(input)) {
+    const known = key === "name" || key === "description" || key === "icon" || key === "defaultLocale" ? key : void 0;
+    if (!known) {
+      throw new ValidationError(
+        `setPublicEnvelope: unknown field "${key}". Allowed fields: ${[...allowed].join(", ")}.`
+      );
+    }
+    if (!allowed.has(known)) {
+      throw new ValidationError(
+        `setPublicEnvelope: field "${known}" is not enabled in this vault's schema. Allowed fields: ${[...allowed].join(", ")}.`
+      );
+    }
+  }
+  if (input.name !== void 0) {
+    validateText(input.name, "name", schema.maxStringChars);
+  }
+  if (input.description !== void 0) {
+    validateText(input.description, "description", schema.maxStringChars);
+  }
+  if (input.icon !== void 0) {
+    validateIcon(input.icon, schema);
+  }
+  if (input.defaultLocale !== void 0 && typeof input.defaultLocale !== "string") {
+    throw new ValidationError(
+      `setPublicEnvelope: defaultLocale must be a string (BCP-47), got ${typeof input.defaultLocale}.`
+    );
+  }
+}
+function validateText(value, field, maxChars) {
+  if (typeof value === "string") {
+    if (value.length > maxChars) {
+      throw new ValidationError(
+        `setPublicEnvelope: ${field} exceeds the ${maxChars}-character cap (got ${value.length}).`
+      );
+    }
+    return;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ValidationError(
+      `setPublicEnvelope: ${field} must be a string or { [locale]: string } map, got ${typeof value}.`
+    );
+  }
+  for (const [locale, str] of Object.entries(value)) {
+    if (typeof str !== "string") {
+      throw new ValidationError(
+        `setPublicEnvelope: ${field}[${locale}] must be a string, got ${typeof str}.`
+      );
+    }
+    if (str.length > maxChars) {
+      throw new ValidationError(
+        `setPublicEnvelope: ${field}[${locale}] exceeds the ${maxChars}-character cap (got ${str.length}).`
+      );
+    }
+  }
+}
+function validateIcon(icon, schema) {
+  if (typeof icon !== "string") {
+    throw new ValidationError(
+      `setPublicEnvelope: icon must be a data: URL string, got ${typeof icon}.`
+    );
+  }
+  if (icon.length > schema.maxIconBytes) {
+    throw new ValidationError(
+      `setPublicEnvelope: icon exceeds the ${schema.maxIconBytes}-byte cap (got ${icon.length}).`
+    );
+  }
+  const m = DATA_URL_PREFIX.exec(icon);
+  if (!m) {
+    throw new ValidationError(
+      "setPublicEnvelope: icon must be a base64 data URL (`data:image/png;base64,\u2026` or `data:image/svg+xml;base64,\u2026`). External URLs are not supported in v1."
+    );
+  }
+  const mime = m[1];
+  if (!schema.iconMimeTypes.includes(mime)) {
+    throw new ValidationError(
+      `setPublicEnvelope: icon MIME type "${mime}" is not allowed. Permitted types: ${schema.iconMimeTypes.join(", ")}.`
+    );
+  }
+}
+function isPublicEnvelope(x) {
+  if (x === null || typeof x !== "object" || Array.isArray(x)) return false;
+  const obj = x;
+  return obj["_noydb_public"] === 1 && typeof obj["version"] === "number";
+}
+
+// src/with-party/directory/public-envelope/storage.ts
+var PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
+async function loadPublicEnvelope(store, vault) {
+  const envelope = await store.get(vault, "_meta", PUBLIC_ENVELOPE_RECORD_ID);
+  if (!envelope) return void 0;
+  try {
+    const parsed = JSON.parse(envelope._data);
+    if (!isPublicEnvelope(parsed)) return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function savePublicEnvelope(store, vault, envelope) {
+  const wireEnvelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(envelope)
+  };
+  await store.put(vault, "_meta", PUBLIC_ENVELOPE_RECORD_ID, wireEnvelope);
+}
+async function readPublicEnvelope(store, vault, opts = {}) {
+  const raw = await loadPublicEnvelope(store, vault);
+  if (!raw) return void 0;
+  if (opts.locale === void 0) return raw;
+  return resolveLocale(raw, opts.locale);
+}
+function resolveLocale(envelope, locale) {
+  return {
+    ...envelope,
+    ...envelope.name !== void 0 ? { name: pickLocale(envelope.name, locale, envelope.defaultLocale) } : {},
+    ...envelope.description !== void 0 ? { description: pickLocale(envelope.description, locale, envelope.defaultLocale) } : {}
+  };
+}
+function pickLocale(value, locale, defaultLocale) {
+  if (typeof value === "string") return value;
+  if (value[locale] !== void 0 && value[locale] !== "") return value[locale];
+  if (defaultLocale && value[defaultLocale] !== void 0 && value[defaultLocale] !== "") {
+    return value[defaultLocale];
+  }
+  for (const v of Object.values(value)) {
+    if (v !== "") return v;
+  }
+  return "";
+}
+
+export {
+  validatePublicEnvelopeInput,
+  isPublicEnvelope,
+  PUBLIC_ENVELOPE_RECORD_ID,
+  loadPublicEnvelope,
+  savePublicEnvelope,
+  readPublicEnvelope,
+  resolveLocale,
+  pickLocale
+};
+//# sourceMappingURL=chunk-5XIPOCQC.js.map