@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-4OMCIY6F.js

@@ -1,99 +0,0 @@
-import {
-  SYNC_CREDENTIALS_COLLECTION,
-  ensureCollectionDEK,
-  grant,
-  revoke,
-  rotateKeys
-} from "./chunk-J4LPNIGK.js";
-import {
-  openEnvelopeJson
-} from "./chunk-MCHVVJIA.js";
-import {
-  encrypt
-} from "./chunk-3OPY6MK2.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YN5IAHN6.js";
-import {
-  PermissionDeniedError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-party/team/active.ts
-function withTeam() {
-  return {
-    async grant(team, vault, options, factors) {
-      return team.runGrant(grant, vault, options, factors);
-    },
-    async revoke(team, vault, options, factors) {
-      return team.runRevoke(revoke, vault, options, factors);
-    },
-    async rotate(team, vault, collections) {
-      return team.runRotate(rotateKeys, vault, collections);
-    }
-  };
-}
-
-// src/with-party/team/sync-credentials.ts
-function requireAdminAccess(keyring) {
-  if (keyring.role !== "owner" && keyring.role !== "admin") {
-    throw new PermissionDeniedError(
-      `Sync credentials require owner or admin role. Current role: "${keyring.role}"`
-    );
-  }
-}
-async function putCredential(adapter, vault, keyring, credential) {
-  requireAdminAccess(keyring);
-  const getDek = await ensureCollectionDEK(adapter, vault, keyring);
-  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
-  const { iv, data } = await encrypt(JSON.stringify(credential), dek);
-  const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId);
-  const version = existing ? existing._v + 1 : 1;
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data,
-    _by: keyring.userId
-  };
-  await adapter.put(
-    vault,
-    SYNC_CREDENTIALS_COLLECTION,
-    credential.adapterId,
-    envelope,
-    existing ? existing._v : void 0
-  );
-}
-async function getCredential(adapter, vault, keyring, adapterId) {
-  requireAdminAccess(keyring);
-  const getDek = await ensureCollectionDEK(adapter, vault, keyring);
-  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
-  const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
-  if (!envelope) return null;
-  const plaintext = await openEnvelopeJson(envelope, dek);
-  return JSON.parse(plaintext);
-}
-async function deleteCredential(adapter, vault, keyring, adapterId) {
-  requireAdminAccess(keyring);
-  await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
-}
-async function listCredentials(adapter, vault, keyring) {
-  requireAdminAccess(keyring);
-  return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION);
-}
-async function credentialStatus(adapter, vault, keyring, adapterId) {
-  const credential = await getCredential(adapter, vault, keyring, adapterId);
-  if (!credential) return { exists: false };
-  const expired = credential.expiresAt ? Date.now() > new Date(credential.expiresAt).getTime() : false;
-  return { exists: true, expired };
-}
-
-export {
-  withTeam,
-  putCredential,
-  getCredential,
-  deleteCredential,
-  listCredentials,
-  credentialStatus
-};
-//# sourceMappingURL=chunk-4OMCIY6F.js.map

package/dist/chunk-5I35DOHK.js

@@ -1,94 +0,0 @@
-import {
-  sha256Hex
-} from "./chunk-3OPY6MK2.js";
-
-// src/with-shape/persisted-schemas/canonicalize.ts
-function canonicalize(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return "[" + value.map(canonicalize).join(",") + "]";
-  }
-  const obj = value;
-  const keys = Object.keys(obj).sort();
-  const parts = keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k]));
-  return "{" + parts.join(",") + "}";
-}
-
-// src/with-shape/persisted-schemas/derive.ts
-function isZodSchema(value) {
-  if (value === null || typeof value !== "object") return false;
-  const std = value["~standard"];
-  if (std && typeof std === "object" && std.vendor === "zod") return true;
-  const def = value._def;
-  if (!def || typeof def !== "object") return false;
-  return typeof def.typeName === "string" && def.typeName.startsWith("Zod");
-}
-function detectKind(validator) {
-  if (isZodSchema(validator)) return "Zod";
-  return "Unknown";
-}
-function isZod4Schema(value) {
-  if (value === null || typeof value !== "object") return false;
-  return "_zod" in value;
-}
-async function loadZodToJsonSchemaConverter() {
-  try {
-    const mod = await import("zod-to-json-schema");
-    if (!mod.zodToJsonSchema) {
-      throw new Error("zod-to-json-schema export missing");
-    }
-    return mod.zodToJsonSchema;
-  } catch (err) {
-    throw new Error(
-      `persistJsonSchema requires the optional peer-dep \`zod-to-json-schema\`. Install it: \`pnpm add zod-to-json-schema\` (or npm/yarn equivalent). Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function loadZodV4Converter() {
-  try {
-    const mod = await import("./zod-HAJM7LMS.js");
-    if (typeof mod.toJSONSchema !== "function") {
-      throw new Error("zod.toJSONSchema not available (zod v4 required)");
-    }
-    return mod.toJSONSchema;
-  } catch (err) {
-    throw new Error(
-      `persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function derivePersistedSchema(validator) {
-  const kind = detectKind(validator);
-  const derivedAt = (/* @__PURE__ */ new Date()).toISOString();
-  if (kind === "Zod") {
-    let jsonSchema;
-    if (isZod4Schema(validator)) {
-      const convert = await loadZodV4Converter();
-      jsonSchema = convert(validator);
-    } else {
-      const convert = await loadZodToJsonSchemaConverter();
-      jsonSchema = convert(validator);
-    }
-    const canonical = canonicalize(jsonSchema);
-    const hash = await sha256Hex(new TextEncoder().encode(canonical));
-    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt };
-  }
-  return {
-    _noydb_schema: 1,
-    kind,
-    jsonSchema: null,
-    hash: null,
-    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,
-    derivedAt
-  };
-}
-
-export {
-  canonicalize,
-  isZodSchema,
-  isZod4Schema,
-  derivePersistedSchema
-};
-//# sourceMappingURL=chunk-5I35DOHK.js.map

package/dist/chunk-5VG4IJR7.js

@@ -1,235 +0,0 @@
-import {
-  resolveManagedSecret
-} from "./chunk-YCXCR7VG.js";
-import {
-  parseExtractedPartitionBody,
-  readPod,
-  readPodHeader
-} from "./chunk-QSFOZUYL.js";
-import {
-  createOwnerKeyring
-} from "./chunk-J4LPNIGK.js";
-import {
-  LedgerStore
-} from "./chunk-3JXPAHOZ.js";
-import {
-  LEDGER_COLLECTION
-} from "./chunk-I7FD46FF.js";
-import {
-  openEnvelopeJson
-} from "./chunk-MCHVVJIA.js";
-import {
-  base64ToBuffer,
-  wrapKey
-} from "./chunk-3OPY6MK2.js";
-import {
-  AdoptionStateError,
-  TransferSealError,
-  ValidationError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-cargo/adopt-partition.ts
-async function unsealDeks(seal, transferKey) {
-  if (transferKey.byteLength !== 32) {
-    throw new TransferSealError(
-      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
-    );
-  }
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
-  const raw = base64ToBuffer(seal.payload);
-  let plaintext;
-  try {
-    plaintext = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: raw.slice(0, 12) },
-      key,
-      raw.slice(12)
-    );
-  } catch {
-    throw new TransferSealError(
-      "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
-    );
-  }
-  let dekMap;
-  try {
-    dekMap = JSON.parse(new TextDecoder().decode(plaintext));
-  } catch {
-    throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
-  }
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collection, b64] of Object.entries(dekMap)) {
-    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
-    deks.set(collection, dek);
-  }
-  return deks;
-}
-async function adoptPartition(bundleBytes, opts) {
-  const { transferKey, destinationStore, vaultName } = opts;
-  const header = readPodHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new ValidationError(
-      "adoptPartition requires an extracted-partition bundle with a transfer seal. For ordinary backups use readPod + vault.load."
-    );
-  }
-  const { dumpJson } = await readPod(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  await unsealDeks(seal, transferKey);
-  const existing = await destinationStore.get(vaultName, "_meta", "adoption");
-  if (existing) {
-    const prior = JSON.parse(existing._data);
-    if (prior.sealId === seal.sealId) {
-      throw new AdoptionStateError(
-        `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
-      );
-    }
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds an adopted partition (sealId ${prior.sealId}); adopting a different partition (sealId ${seal.sealId}) here would overwrite it. Adopt into a fresh vaultName instead.`
-    );
-  }
-  const existingKeyring = await destinationStore.list(vaultName, "_keyring");
-  if (existingKeyring.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds a keyring (an unrelated owner exists at this slot); adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`
-    );
-  }
-  const backup = JSON.parse(dump);
-  await destinationStore.saveAll(vaultName, backup.collections);
-  if (backup._internal) {
-    for (const [collection, records] of Object.entries(backup._internal)) {
-      for (const [id, envelope] of Object.entries(records)) {
-        await destinationStore.put(vaultName, collection, id, envelope);
-      }
-    }
-  }
-  const adoptedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true, transferSeal: seal };
-  await destinationStore.put(vaultName, "_meta", "adoption", {
-    _noydb: 1,
-    _v: 1,
-    _ts: adoptedAt,
-    _iv: "",
-    _data: JSON.stringify(adoption)
-  });
-  return { vaultName, needsOwner: true, sealId: seal.sealId };
-}
-function isManaged(o) {
-  return "passphraseMode" in o && o.passphraseMode === "managed";
-}
-async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
-  const { userId, transferKey } = opts;
-  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === "shamir")) {
-    throw new AdoptionStateError(
-      "managed-mode adoption requires at least one strong (shamir) recovery profile in `recovery` \u2014 paper alone is not strong when there is no user passphrase to fall back on."
-    );
-  }
-  const adoptionEnv = await store.get(vaultName, "_meta", "adoption");
-  if (!adoptionEnv) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
-    );
-  }
-  const adoption = JSON.parse(adoptionEnv._data);
-  if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
-    );
-  }
-  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey);
-  const existingKeyring = await store.get(vaultName, "_keyring", userId);
-  const otherOwners = (await store.list(vaultName, "_keyring")).filter((u) => u !== userId);
-  if (otherOwners.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has a keyring for a different owner; cannot create owner "${userId}".`
-    );
-  }
-  const partitionCollections = [...partitionDeks.keys()];
-  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
-  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
-  if (!ownerMinted) {
-    const passphrase = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.passphrase;
-    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase);
-    const env = await store.get(vaultName, "_keyring", userId);
-    if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
-    const keyringFile = JSON.parse(env._data);
-    const kek = unlocked.kek;
-    if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
-    const mergedDeks = { ...keyringFile.deks };
-    for (const [collection, dek] of partitionDeks) {
-      mergedDeks[collection] = await wrapKey(dek, kek);
-    }
-    const mergedFile = { ...keyringFile, deks: mergedDeks };
-    await store.put(vaultName, "_keyring", userId, { ...env, _data: JSON.stringify(mergedFile) });
-  }
-  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION);
-  if (ledgerDek) {
-    const ledger = new LedgerStore({
-      adapter: store,
-      vault: vaultName,
-      encrypted: true,
-      getDEK: async () => ledgerDek,
-      actor: userId
-    });
-    const creationReason = `creation-of-new-owner:${userId}`;
-    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`;
-    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason));
-    if (!recordedReasons.has(creationReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: creationReason });
-    }
-    if (!recordedReasons.has(consumedReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: consumedReason });
-    }
-  }
-  if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-BWF6EPIR.js");
-    const db = await createNoydb({
-      store,
-      user: userId,
-      passphraseMode: "managed",
-      sealingKey: opts.sealingKey,
-      shamirRecovery: opts.shamirRecovery
-    });
-    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery });
-  }
-  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await store.put(vaultName, "_meta", "adoption", { ...adoptionEnv, _data: JSON.stringify(consumed) });
-  return { vaultName, userId };
-}
-
-// src/with-cargo/decrypt-partition.ts
-async function decryptExtractedPartition(bundleBytes, transferKey) {
-  const header = readPodHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new Error("decryptExtractedPartition: bundle is not an extracted-partition.");
-  }
-  const { dumpJson } = await readPod(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  const deks = await unsealDeks(seal, transferKey);
-  const backup = JSON.parse(dump);
-  const out = {};
-  for (const [collection, byId] of Object.entries(backup.collections)) {
-    const dek = deks.get(collection);
-    if (dek === void 0) continue;
-    const recs = [];
-    for (const [id, env] of Object.entries(byId)) {
-      const plaintext = await openEnvelopeJson(env, dek);
-      const body = JSON.parse(plaintext);
-      recs.push({
-        id,
-        record: { ...body, id },
-        ts: env._ts,
-        version: env._v,
-        ...env._source !== void 0 ? { source: env._source } : {},
-        ...env._sourceTs !== void 0 ? { sourceTs: env._sourceTs } : {}
-      });
-    }
-    out[collection] = recs;
-  }
-  return out;
-}
-
-export {
-  unsealDeks,
-  adoptPartition,
-  createOwnerOnAdoptedPartition,
-  decryptExtractedPartition
-};
-//# sourceMappingURL=chunk-5VG4IJR7.js.map

package/dist/chunk-5YESYH2C.js

@@ -1,155 +0,0 @@
-import {
-  ConflictError,
-  PodVersionConflictError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-pod/pod-store.ts
-var BUNDLE_STORE_VERSION = 1;
-var MAX_CONFLICT_RETRIES = 3;
-function wrapPodStore(bundle, options) {
-  const autoFlush = options?.autoFlush !== false;
-  const snapshots = /* @__PURE__ */ new Map();
-  const versions = /* @__PURE__ */ new Map();
-  const loaded = /* @__PURE__ */ new Set();
-  let batchDepth = 0;
-  async function load(vault) {
-    if (loaded.has(vault)) return snapshots.get(vault);
-    const result = await bundle.readBundle(vault);
-    if (result) {
-      const text = new TextDecoder().decode(result.bytes);
-      const format = JSON.parse(text);
-      snapshots.set(vault, format.data);
-      versions.set(vault, result.version);
-    } else {
-      snapshots.set(vault, {});
-      versions.set(vault, null);
-    }
-    loaded.add(vault);
-    return snapshots.get(vault);
-  }
-  async function flush(vault) {
-    const snapshot = snapshots.get(vault) ?? {};
-    const format = {
-      _noydb_bundle_store: BUNDLE_STORE_VERSION,
-      vault,
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      data: snapshot
-    };
-    const bytes = new TextEncoder().encode(JSON.stringify(format));
-    const expectedVersion = versions.get(vault) ?? null;
-    for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {
-      try {
-        const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion);
-        versions.set(vault, newVersion);
-        return;
-      } catch (err) {
-        if (err instanceof PodVersionConflictError && attempt < MAX_CONFLICT_RETRIES - 1) {
-          const remote = await bundle.readBundle(vault);
-          if (remote) {
-            const remoteText = new TextDecoder().decode(remote.bytes);
-            const remoteFormat = JSON.parse(remoteText);
-            const localSnap = snapshots.get(vault) ?? {};
-            const mergedSnap = mergeSnapshots(remoteFormat.data, localSnap);
-            snapshots.set(vault, mergedSnap);
-            versions.set(vault, remote.version);
-          }
-          continue;
-        }
-        throw err;
-      }
-    }
-  }
-  async function maybeFlush(vault) {
-    if (autoFlush && batchDepth === 0) {
-      await flush(vault);
-    }
-  }
-  const store = {
-    name: bundle.name ?? "bundle",
-    async flush(vaultId) {
-      await flush(vaultId);
-    },
-    async batch(vaultId, fn) {
-      await load(vaultId);
-      batchDepth++;
-      try {
-        await fn();
-      } finally {
-        batchDepth--;
-      }
-      await flush(vaultId);
-    },
-    async get(vault, collection, id) {
-      const snap = await load(vault);
-      return snap[collection]?.[id] ?? null;
-    },
-    async put(vault, collection, id, envelope, expectedVersion) {
-      const snap = await load(vault);
-      if (expectedVersion !== void 0) {
-        const current = snap[collection]?.[id];
-        const currentVersion = current?._v ?? 0;
-        if (currentVersion !== expectedVersion) {
-          throw new ConflictError(
-            currentVersion,
-            `Expected version ${expectedVersion} but found ${currentVersion} on ${collection}/${id}`
-          );
-        }
-      }
-      snap[collection] ??= {};
-      snap[collection][id] = envelope;
-      await maybeFlush(vault);
-    },
-    async delete(vault, collection, id) {
-      const snap = await load(vault);
-      if (snap[collection]) {
-        delete snap[collection][id];
-        await maybeFlush(vault);
-      }
-    },
-    async list(vault, collection) {
-      const snap = await load(vault);
-      return Object.keys(snap[collection] ?? {});
-    },
-    async loadAll(vault) {
-      return await load(vault);
-    },
-    async saveAll(vault, data) {
-      snapshots.set(vault, data);
-      loaded.add(vault);
-      await flush(vault);
-    }
-  };
-  return store;
-}
-function mergeSnapshots(remote, local) {
-  const merged = {};
-  for (const [coll, records] of Object.entries(remote)) {
-    merged[coll] = { ...records };
-  }
-  for (const [coll, records] of Object.entries(local)) {
-    if (!merged[coll]) {
-      merged[coll] = { ...records };
-      continue;
-    }
-    for (const [id, envelope] of Object.entries(records)) {
-      const existing = merged[coll][id];
-      if (!existing || envelope._ts >= existing._ts) {
-        merged[coll][id] = envelope;
-      }
-    }
-  }
-  return merged;
-}
-function createPodStore(factory) {
-  return factory;
-}
-var wrapBundleStore = wrapPodStore;
-var createBundleStore = createPodStore;
-
-export {
-  wrapPodStore,
-  createPodStore,
-  wrapBundleStore,
-  createBundleStore
-};
-//# sourceMappingURL=chunk-5YESYH2C.js.map