@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-F44XWXOA.js

@@ -0,0 +1,392 @@
+import {
+  envelopePayloadHash
+} from "./chunk-EIZ4YOG2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+import {
+  DictKeyMissingError,
+  PermissionDeniedError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/via/lookup/handle.ts
+function isDeleteMarker(envelope) {
+  return envelope._del === true;
+}
+var DICT_COLLECTION_PREFIX = "_dict_";
+function dictCollectionName(dictionaryName) {
+  return `${DICT_COLLECTION_PREFIX}${dictionaryName}`;
+}
+var LookupHandle = class {
+  constructor(adapter, compartmentName, dictionaryName, keyring, reservedEnvelopes, encrypted, ledger, options, findAndUpdateReferences, emitter, buildDeleteMarker, onDirty, onRecordMutated, checkReferencesOnDelete) {
+    this.adapter = adapter;
+    this.compartmentName = compartmentName;
+    this.dictionaryName = dictionaryName;
+    this.keyring = keyring;
+    this.reservedEnvelopes = reservedEnvelopes;
+    this.encrypted = encrypted;
+    this.ledger = ledger;
+    this.options = options;
+    this.findAndUpdateReferences = findAndUpdateReferences;
+    this.emitter = emitter;
+    this.buildDeleteMarker = buildDeleteMarker;
+    this.onDirty = onDirty;
+    this.onRecordMutated = onRecordMutated;
+    this.checkReferencesOnDelete = checkReferencesOnDelete;
+    this.collName = dictCollectionName(dictionaryName);
+  }
+  adapter;
+  compartmentName;
+  dictionaryName;
+  keyring;
+  reservedEnvelopes;
+  encrypted;
+  ledger;
+  options;
+  findAndUpdateReferences;
+  emitter;
+  buildDeleteMarker;
+  onDirty;
+  onRecordMutated;
+  checkReferencesOnDelete;
+  collName;
+  /**
+   * Synchronous write-through cache for dict-join support.
+   * Populated on every `put()`, `delete()`, and `rename()`. The snapshot
+   * is built from this cache by `snapshotEntries()` — the query executor
+   * calls this synchronously inside `.toArray()`.
+   *
+   * `null` means "not yet initialized" — callers should use `list()`
+   * to warm the cache before using dict joins on pre-existing data.
+   */
+  _syncCache = /* @__PURE__ */ new Map();
+  /**
+   * Return all cached entries as `{ key, labels, ...labels }` records —
+   * usable synchronously by the join executor's `snapshot()` call.
+   * Returns an empty array when the cache has never been populated.
+   */
+  snapshotEntries() {
+    return Array.from(this._syncCache.values()).map((e) => ({
+      key: e.key,
+      labels: e.labels,
+      ...e.labels
+    }));
+  }
+  // ─── Access checks ────────────────────────────────────────────────
+  requireWriteAccess() {
+    const minRole = this.options.writableBy ?? "admin";
+    const roleRank = {
+      client: 1,
+      viewer: 2,
+      operator: 3,
+      admin: 4,
+      owner: 5
+    };
+    const callerRank = roleRank[this.keyring.role] ?? 0;
+    const requiredRank = roleRank[minRole] ?? 4;
+    if (callerRank < requiredRank) {
+      throw new PermissionDeniedError(
+        `Dictionary "${this.dictionaryName}" writes require "${minRole}" role or above. Current role: "${this.keyring.role}".`
+      );
+    }
+  }
+  // ─── Internal helpers ─────────────────────────────────────────────
+  async encryptEntry(entry, version) {
+    if (!this.encrypted) {
+      return {
+        _noydb: NOYDB_FORMAT_VERSION,
+        _v: version,
+        _ts: (/* @__PURE__ */ new Date()).toISOString(),
+        _iv: "",
+        _data: JSON.stringify(entry),
+        _by: this.keyring.userId
+      };
+    }
+    const envelope = await this.reservedEnvelopes.encrypt(this.collName, JSON.stringify(entry), version);
+    return { ...envelope, _by: this.keyring.userId };
+  }
+  async decryptEntry(envelope) {
+    if (!this.encrypted) {
+      return JSON.parse(envelope._data);
+    }
+    const json = await this.reservedEnvelopes.decrypt(this.collName, envelope);
+    return JSON.parse(json);
+  }
+  /** @internal #650 Task 4 — re-read `key`'s CURRENT adapter truth into `_syncCache` (delete the
+   *  cache entry when the key is now gone). Called by `Vault._invalidateSyncApplied` after a
+   *  reserved-lookup row applies via sync, so an already-warmed snapshot/membership/altIndex read
+   *  never sees a stale verdict for a pulled vocabulary edit — the same invalidation a local
+   *  put()/delete()/rename() already triggers via `_syncCache.set`/`delete` above. */
+  async _refreshSyncCache(key) {
+    const envelope = await this.adapter.get(this.compartmentName, this.collName, key);
+    if (!envelope || isDeleteMarker(envelope)) {
+      this._syncCache.delete(key);
+      return;
+    }
+    this._syncCache.set(key, await this.decryptEntry(envelope));
+  }
+  // ─── Public API ───────────────────────────────────────────────────
+  /**
+   * Add or overwrite a single dictionary entry.
+   *
+   * @param key    The stable key to store (e.g. `'paid'`).
+   * @param labels Locale → label map (e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`).
+   */
+  async put(key, labels) {
+    this.requireWriteAccess();
+    const entry = { key, labels };
+    const existing = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      key
+    );
+    const version = existing ? existing._v + 1 : 1;
+    const envelope = await this.encryptEntry(entry, version);
+    await this.adapter.put(
+      this.compartmentName,
+      this.collName,
+      key,
+      envelope,
+      existing ? existing._v : void 0
+    );
+    this._syncCache.set(key, entry);
+    await this.onDirty?.(this.collName, key, "put", version);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: key,
+      action: "put"
+    });
+    await this.onRecordMutated?.(this.collName, key, "put", version);
+    if (this.ledger) {
+      await this.ledger.append({
+        op: "put",
+        collection: this.collName,
+        id: key,
+        version,
+        actor: this.keyring.userId,
+        //  — must be the real envelope hash so
+        // vault.verifyBackupIntegrity()'s data-cross-check matches.
+        payloadHash: await envelopePayloadHash(envelope)
+      });
+    }
+  }
+  /**
+   * Batch-add or overwrite multiple dictionary entries in one call.
+   *
+   * @param entries  `{ key: { locale: label } }` map.
+   */
+  async putAll(entries) {
+    this.requireWriteAccess();
+    for (const [key, labels] of Object.entries(entries)) {
+      await this.put(key, labels);
+    }
+  }
+  /**
+   * Load the label map for a single key.
+   *
+   * @returns The label map, or `null` if the key doesn't exist.
+   */
+  async get(key) {
+    const envelope = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      key
+    );
+    if (!envelope || isDeleteMarker(envelope)) return null;
+    const entry = await this.decryptEntry(envelope);
+    return entry.labels;
+  }
+  /**
+   * Delete a dictionary key.
+   *
+   * Default mode is `'strict'` — throws `DictKeyInUseError` if any
+   * registered collection has a record referencing this key. Pass
+   * `{ mode: 'warn' }` to skip the check (dev-mode cleanup only).
+   *
+   * Under sync, deletion writes a version-ordered delete-marker row rather than removing the
+   * adapter key outright (#647 fix wave 1) — markers accumulate over time; GC is future work,
+   * acceptable for vocabulary-scale data.
+   */
+  async delete(key, opts = {}) {
+    this.requireWriteAccess();
+    const existing = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      key
+    );
+    if (!existing || isDeleteMarker(existing)) {
+      throw new DictKeyMissingError(this.dictionaryName, key);
+    }
+    const mode = opts.mode ?? "strict";
+    if (mode === "strict") {
+      await this.checkReferencesOnDelete?.(key);
+    }
+    const nextVersion = existing._v + 1;
+    if (this.onDirty) {
+      await this.adapter.put(this.compartmentName, this.collName, key, this.buildDeleteMarker(nextVersion, this.keyring.userId));
+    } else {
+      await this.adapter.delete(this.compartmentName, this.collName, key);
+    }
+    this._syncCache.delete(key);
+    await this.onDirty?.(this.collName, key, "put", nextVersion);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: key,
+      action: "delete"
+    });
+    await this.onRecordMutated?.(this.collName, key, "delete", nextVersion);
+    if (this.ledger) {
+      await this.ledger.append({
+        op: "delete",
+        collection: this.collName,
+        id: key,
+        version: existing._v,
+        actor: this.keyring.userId,
+        //  — for delete the prior envelope is what was just
+        // removed; we hash it so the chain captures intent. The
+        // verifyBackupIntegrity data-cross-check skips delete
+        // entries entirely (the live record is gone), but the
+        // chain still benefits from a stable non-empty hash.
+        payloadHash: await envelopePayloadHash(existing)
+      });
+    }
+  }
+  /**
+   * Rename a dictionary key — the only sanctioned mass-mutation path.
+   *
+   * Atomically:
+   * 1. Adds the new key with the same labels as the old key.
+   * 2. Updates every registered record that stores the old key to
+   *    store the new key instead.
+   * 3. Deletes the old key.
+   * 4. Appends a single ledger entry recording the rename.
+   *
+   * Respects ACL: throws `PermissionDeniedError` before any mutation
+   * if the caller can't write. The cascade is best-effort atomic
+   * within this call — no two-phase commit across adapter calls.
+   *
+   * Cascade-on-delete is NOT supported. Use `rename()` when you need
+   * to change a key that records reference.
+   */
+  async rename(oldKey, newKey) {
+    this.requireWriteAccess();
+    const existing = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      oldKey
+    );
+    if (!existing || isDeleteMarker(existing)) {
+      throw new DictKeyMissingError(this.dictionaryName, oldKey);
+    }
+    const oldEntry = await this.decryptEntry(existing);
+    const newEntry = { key: newKey, labels: oldEntry.labels };
+    const newEnvelope = await this.encryptEntry(newEntry, 1);
+    await this.adapter.put(
+      this.compartmentName,
+      this.collName,
+      newKey,
+      newEnvelope
+    );
+    this._syncCache.set(newKey, newEntry);
+    if (this.findAndUpdateReferences) {
+      await this.findAndUpdateReferences(this.dictionaryName, oldKey, newKey);
+    }
+    const oldKeyNextVersion = existing._v + 1;
+    if (this.onDirty) {
+      await this.adapter.put(this.compartmentName, this.collName, oldKey, this.buildDeleteMarker(oldKeyNextVersion, this.keyring.userId));
+    } else {
+      await this.adapter.delete(this.compartmentName, this.collName, oldKey);
+    }
+    this._syncCache.delete(oldKey);
+    await this.onDirty?.(this.collName, oldKey, "put", oldKeyNextVersion);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: oldKey,
+      action: "delete"
+    });
+    await this.onRecordMutated?.(this.collName, oldKey, "delete", oldKeyNextVersion);
+    await this.onDirty?.(this.collName, newKey, "put", 1);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: newKey,
+      action: "put"
+    });
+    await this.onRecordMutated?.(this.collName, newKey, "put", 1);
+    if (this.ledger) {
+      await this.ledger.append({
+        op: "delete",
+        collection: this.collName,
+        id: oldKey,
+        version: existing._v,
+        actor: this.keyring.userId,
+        payloadHash: await envelopePayloadHash(existing)
+      });
+      await this.ledger.append({
+        op: "put",
+        collection: this.collName,
+        id: newKey,
+        version: 1,
+        actor: this.keyring.userId,
+        payloadHash: await envelopePayloadHash(newEnvelope)
+      });
+    }
+  }
+  /**
+   * List all entries in this dictionary.
+   *
+   * @returns Array of `{ key, labels }` objects.
+   */
+  async list() {
+    const keys = await this.adapter.list(this.compartmentName, this.collName);
+    const entries = [];
+    for (const key of keys) {
+      const envelope = await this.adapter.get(
+        this.compartmentName,
+        this.collName,
+        key
+      );
+      if (!envelope || isDeleteMarker(envelope)) {
+        this._syncCache.delete(key);
+        continue;
+      }
+      const entry = await this.decryptEntry(envelope);
+      entries.push(entry);
+      this._syncCache.set(key, entry);
+    }
+    return entries;
+  }
+  /**
+   * Resolve a key to its label for the given locale.
+   *
+   * Used by the collection's locale-aware read path to populate
+   * `<field>Label` virtual fields. Returns `undefined` when the
+   * key doesn't exist or has no label for the requested locale
+   * (after exhausting the fallback chain).
+   */
+  async resolveLabel(key, locale, fallback) {
+    const labels = await this.get(key);
+    if (!labels) return void 0;
+    if (labels[locale] !== void 0) return labels[locale];
+    const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
+    for (const fb of chain) {
+      if (fb === "any") {
+        const any = Object.values(labels)[0];
+        if (any !== void 0) return any;
+      } else if (labels[fb] !== void 0) {
+        return labels[fb];
+      }
+    }
+    return void 0;
+  }
+};
+
+export {
+  DICT_COLLECTION_PREFIX,
+  dictCollectionName,
+  LookupHandle
+};
+//# sourceMappingURL=chunk-F44XWXOA.js.map

package/dist/chunk-FF7S3XDW.js

@@ -0,0 +1,230 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+
+// src/with-party/team/managed-passphrase.ts
+var MemorySealingKeyProvider = class {
+  id;
+  fingerprint;
+  keyBytes;
+  constructor(opts) {
+    this.id = opts.id;
+    const encoded = new TextEncoder().encode(opts.id);
+    let h = 0;
+    for (let i = 0; i < encoded.length; i++) {
+      h = h * 31 + encoded[i] >>> 0;
+    }
+    this.fingerprint = new Uint8Array([
+      h >>> 24 & 255,
+      h >>> 16 & 255,
+      h >>> 8 & 255,
+      h & 255
+    ]);
+    this.keyBytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++) {
+      this.keyBytes[i] = this.fingerprint[i % 4] ^ i * 17;
+    }
+  }
+  async seal(passphrase) {
+    const out = new Uint8Array(4 + passphrase.length);
+    out.set(this.fingerprint, 0);
+    for (let i = 0; i < passphrase.length; i++) {
+      out[4 + i] = passphrase[i] ^ this.keyBytes[i % 16];
+    }
+    return out;
+  }
+  async unseal(sealed) {
+    if (sealed.length < 4) {
+      throw new Error("MemorySealingKeyProvider: sealed input too short");
+    }
+    for (let i = 0; i < 4; i++) {
+      if (sealed[i] !== this.fingerprint[i]) {
+        throw new Error(
+          `MemorySealingKeyProvider("${this.id}"): provider-id mismatch on unseal (sealed bytes were produced by a different provider)`
+        );
+      }
+    }
+    const body = sealed.subarray(4);
+    const out = new Uint8Array(body.length);
+    for (let i = 0; i < body.length; i++) {
+      out[i] = body[i] ^ this.keyBytes[i % 16];
+    }
+    return out;
+  }
+};
+async function sealRsaOaepTlv(plaintext, publicKeyPem) {
+  const b64 = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----/, "").replace(/-----END PUBLIC KEY-----/, "").replace(/\s+/g, "");
+  const spki = base64ToBytes(b64);
+  const recipientPub = await crypto.subtle.importKey(
+    "spki",
+    spki,
+    { name: "RSA-OAEP", hash: "SHA-256" },
+    false,
+    ["encrypt"]
+  );
+  const cekBytes = crypto.getRandomValues(new Uint8Array(32));
+  const cek = await crypto.subtle.importKey("raw", cekBytes, "AES-GCM", false, ["encrypt"]);
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, cek, plaintext));
+  const wrapped = new Uint8Array(await crypto.subtle.encrypt({ name: "RSA-OAEP" }, recipientPub, cekBytes));
+  cekBytes.fill(0);
+  if (wrapped.length !== 256) {
+    throw new Error(`sealRsaOaepTlv: expected 256-byte RSA-OAEP wrap, got ${wrapped.length}`);
+  }
+  const out = new Uint8Array(1 + 256 + 12 + ct.length);
+  out[0] = 1;
+  out.set(wrapped, 1);
+  out.set(iv, 1 + 256);
+  out.set(ct, 1 + 256 + 12);
+  return out;
+}
+function parseRsaOaepTlv(bytes) {
+  if (bytes.length < 1 + 256 + 12 + 16) {
+    throw new Error("parseRsaOaepTlv: sealed input too short");
+  }
+  if (bytes[0] !== 1) {
+    throw new Error(`parseRsaOaepTlv: unknown TLV version ${bytes[0]}`);
+  }
+  return {
+    wrapped: bytes.subarray(1, 1 + 256),
+    iv: bytes.subarray(1 + 256, 1 + 256 + 12),
+    ct: bytes.subarray(1 + 256 + 12)
+  };
+}
+async function aesGcmOpen(cekBytes, iv, ct) {
+  const cek = await crypto.subtle.importKey("raw", cekBytes, "AES-GCM", false, ["decrypt"]);
+  return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv }, cek, ct));
+}
+var MemoryRecipientSealer = class {
+  id;
+  keypair;
+  constructor(opts) {
+    this.id = opts.id;
+    this.keypair = crypto.subtle.generateKey(
+      { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  }
+  async publishRecipientHint() {
+    const { publicKey } = await this.keypair;
+    const spki = await crypto.subtle.exportKey("spki", publicKey);
+    const pem = "-----BEGIN PUBLIC KEY-----\n" + bytesToBase64(new Uint8Array(spki)).match(/.{1,64}/g).join("\n") + "\n-----END PUBLIC KEY-----\n";
+    return { v: 1, pid: this.id, alg: "rsa-oaep-sha256", material: { publicKeyPem: pem } };
+  }
+  async sealForRecipient(plaintext, hint) {
+    if (hint.v !== 1) {
+      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`);
+    }
+    if (hint.alg !== "rsa-oaep-sha256") {
+      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`);
+    }
+    const pem = hint.material["publicKeyPem"];
+    if (typeof pem !== "string") {
+      throw new Error("MemoryRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string");
+    }
+    return sealRsaOaepTlv(plaintext, pem);
+  }
+  async seal(plaintext) {
+    const hint = await this.publishRecipientHint();
+    return this.sealForRecipient(plaintext, hint);
+  }
+  async unseal(bytes) {
+    const { wrapped, iv, ct } = parseRsaOaepTlv(bytes);
+    const { privateKey } = await this.keypair;
+    const cekBytes = new Uint8Array(await crypto.subtle.decrypt({ name: "RSA-OAEP" }, privateKey, wrapped));
+    const pt = await aesGcmOpen(cekBytes, iv, ct);
+    cekBytes.fill(0);
+    return pt;
+  }
+};
+var SEALED_PASSPHRASE_RECORD_ID = "sealed-passphrase";
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+function base64ToBytes(b64) {
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function parseSealedEnvelope(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const r = raw;
+  if (r._noydb_sealed !== 1) return void 0;
+  if (r.v === 1 && typeof r.pid === "string" && typeof r.payload === "string") {
+    return {
+      _noydb_sealed: 1,
+      providerId: r.pid,
+      sealed: base64ToBytes(r.payload)
+    };
+  }
+  if (typeof r.providerId === "string" && typeof r.sealed === "string") {
+    return {
+      _noydb_sealed: 1,
+      providerId: r.providerId,
+      sealed: base64ToBytes(r.sealed)
+    };
+  }
+  return void 0;
+}
+async function saveSealedPassphrase(store, vault, payload) {
+  const persisted = {
+    v: 1,
+    _noydb_sealed: 1,
+    pid: payload.providerId,
+    payload: bytesToBase64(payload.sealed)
+  };
+  const prior = await store.get(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the sealing layer is the security boundary.
+    _iv: "",
+    _data: JSON.stringify(persisted)
+  };
+  await store.put(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID, env);
+}
+async function loadSealedPassphrase(store, vault) {
+  const envelope = await store.get(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID);
+  if (!envelope) return void 0;
+  try {
+    return parseSealedEnvelope(JSON.parse(envelope._data));
+  } catch {
+    return void 0;
+  }
+}
+async function resolveManagedSecret(store, vault, provider) {
+  const existing = await loadSealedPassphrase(store, vault);
+  if (existing) {
+    if (existing.providerId !== provider.id) {
+      throw new Error(
+        `Managed-mode vault "${vault}" was sealed under provider id "${existing.providerId}" but the current SealingKeyProvider is "${provider.id}". Pass the same provider that originally enrolled the vault, or treat this as a fresh enrollment and clear \`_meta/sealed-passphrase\` first.`
+      );
+    }
+    const plaintext = await provider.unseal(existing.sealed);
+    return bytesToBase64(plaintext);
+  }
+  const random = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(random);
+  const sealed = await provider.seal(random);
+  await saveSealedPassphrase(store, vault, { providerId: provider.id, sealed });
+  return bytesToBase64(random);
+}
+
+export {
+  MemorySealingKeyProvider,
+  sealRsaOaepTlv,
+  parseRsaOaepTlv,
+  aesGcmOpen,
+  MemoryRecipientSealer,
+  SEALED_PASSPHRASE_RECORD_ID,
+  parseSealedEnvelope,
+  saveSealedPassphrase,
+  loadSealedPassphrase,
+  resolveManagedSecret
+};
+//# sourceMappingURL=chunk-FF7S3XDW.js.map