@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-HG76BZ6G.js

@@ -0,0 +1,188 @@
+import {
+  putDerivedOutput
+} from "./chunk-R3NHNVS5.js";
+import {
+  wrapDbWithPredicates
+} from "./chunk-XJ47GS53.js";
+import {
+  canonicalGroupKey,
+  groupAndReduce
+} from "./chunk-EVHBK7BN.js";
+import {
+  applyI18nLocale
+} from "./chunk-VCUQR6ZL.js";
+import {
+  LocaleNotSpecifiedError,
+  MaterializedViewTooLargeError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-formula/materialized-views/executor.ts
+var DEFAULT_MAX_ROWS = 1e5;
+async function materializeQueryResult(q, mvName, i18nLocale, i18nFields) {
+  if (typeof q?.toArray === "function") {
+    return await q.toArray();
+  }
+  if (typeof q?.run === "function") {
+    const runOpts = i18nLocale !== void 0 ? { locale: i18nLocale, i18nFields } : void 0;
+    const result = await Promise.resolve(q.run(runOpts));
+    if (Array.isArray(result)) {
+      return result;
+    }
+    return [result];
+  }
+  throw new Error(
+    `MV "${mvName}": query() must return a Query<T>, Aggregation, or GroupedAggregation. Got something without a .toArray() or .run() terminal.`
+  );
+}
+async function materializeUnionResult(spec, db) {
+  const unified = [];
+  for (const arm of spec.unionSources) {
+    const coll = db.collection(arm.collection);
+    let q = coll.query();
+    if (arm.join?.length) {
+      for (const leg of arm.join) {
+        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy });
+      }
+    }
+    const sourceRows = q.toArray();
+    for (const r of sourceRows) {
+      const mapped = arm.map(r);
+      if (mapped == null) continue;
+      unified.push(mapped);
+    }
+  }
+  if (!spec.groupBy) return unified;
+  const groupFields = typeof spec.groupBy === "string" ? [spec.groupBy] : spec.groupBy;
+  if (spec.i18nLocale !== void 0 && spec.i18nFields !== void 0) {
+    const groupI18n = {};
+    for (const f of groupFields) {
+      const d = spec.i18nFields[f];
+      if (d !== void 0) groupI18n[f] = d;
+    }
+    if (Object.keys(groupI18n).length > 0) {
+      for (let i = 0; i < unified.length; i++) {
+        unified[i] = applyI18nLocale(unified[i], groupI18n, spec.i18nLocale, void 0, "mv");
+      }
+    }
+  }
+  for (const f of groupFields) {
+    for (const row of unified) {
+      const v = row[f];
+      if (v !== null && typeof v === "object") {
+        throw new LocaleNotSpecifiedError(
+          f,
+          `Materialized view "${spec.name}" groups by "${f}", whose value is a raw i18n locale map \u2014 an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`
+        );
+      }
+    }
+  }
+  if (!spec.aggregate) {
+    const seen = /* @__PURE__ */ new Map();
+    for (const row of unified) {
+      const k = canonicalGroupKey(groupFields, row);
+      if (!seen.has(k)) seen.set(k, row);
+    }
+    return [...seen.values()];
+  }
+  return groupAndReduce(unified, groupFields, spec.aggregate, spec.moneyFields);
+}
+var MaterializedViewExecutor = {
+  async refresh(reg, accessor) {
+    const spec = reg.spec;
+    const outputColl = accessor.getCollection(reg.outputCollection);
+    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS;
+    const onEmpty = spec.onEmpty ?? "delete";
+    const strict = spec.strict ?? false;
+    const baseCtx = accessor.getQueryContext();
+    const ctxForQuery = spec.predicates ? wrapDbWithPredicates(baseCtx, spec.predicates) : baseCtx;
+    let rows;
+    if (spec.unionSources) {
+      rows = await materializeUnionResult(spec, ctxForQuery);
+    } else {
+      const q = spec.query(ctxForQuery);
+      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields);
+    }
+    if (rows.length > maxRows) {
+      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows);
+    }
+    const txCtx = accessor.getActiveTxContext();
+    const adapter = outputColl.adapter;
+    const vaultName = outputColl.vault;
+    const newIds = /* @__PURE__ */ new Set();
+    const enrichedRows = [];
+    for (const row of rows) {
+      const id = spec.rowKey(row);
+      newIds.add(id);
+      const meta = {
+        mvName: spec.name,
+        queryHash: reg.queryHash,
+        sourceVersions: {},
+        materializedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } });
+    }
+    let written = 0;
+    let failed = 0;
+    for (const { id, record } of enrichedRows) {
+      try {
+        if (txCtx !== null) {
+          const prior = await adapter.get(vaultName, reg.outputCollection, id);
+          txCtx._executed.push({
+            op: { type: "put", vaultName, collectionName: reg.outputCollection, id },
+            priorEnvelope: prior
+          });
+        }
+        if (accessor.dispatchCtx) {
+          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === "written") written++;
+        } else {
+          await outputColl.put(id, record);
+          written++;
+        }
+      } catch (err) {
+        failed++;
+        if (strict) throw err;
+        console.warn(`[mv] "${spec.name}" row write failed:`, err);
+      }
+    }
+    let deleted = 0;
+    if (onEmpty === "delete") {
+      const priorIds = await listOutputIds(outputColl);
+      for (const priorId of priorIds) {
+        if (newIds.has(priorId)) continue;
+        try {
+          const outAny = outputColl;
+          if (typeof outAny._internalDelete === "function") {
+            await outAny._internalDelete(priorId, txCtx);
+            deleted++;
+          } else {
+            await outputColl.delete(priorId);
+            deleted++;
+          }
+        } catch (err) {
+          failed++;
+          if (strict) throw err;
+          console.warn(`[mv] "${spec.name}" tombstone failed for id="${priorId}":`, err);
+        }
+      }
+    }
+    return { written, deleted, failed };
+  }
+};
+async function listOutputIds(outputColl) {
+  const cAny = outputColl;
+  const adapter = cAny.adapter;
+  const vault = cAny.vault;
+  const name = cAny.name;
+  if (typeof adapter?.list !== "function") return [];
+  try {
+    const ids = await adapter.list(vault, name);
+    return [...ids];
+  } catch {
+    return [];
+  }
+}
+
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=chunk-HG76BZ6G.js.map

package/dist/chunk-HGAB325C.js

@@ -0,0 +1,38 @@
+import {
+  NoydbError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-formula/computed/index.ts
+var ComputedFieldError = class extends NoydbError {
+  constructor(field, id, cause) {
+    super(
+      "COMPUTED_FIELD",
+      `computed field "${field}" threw for record "${id}": ` + (cause instanceof Error ? cause.message : String(cause))
+    );
+    this.field = field;
+    this.id = id;
+    this.cause = cause;
+    this.name = "ComputedFieldError";
+  }
+  field;
+  id;
+  cause;
+};
+function evalComputedFields(record, computed, id) {
+  const out = { ...record };
+  for (const [field, entry] of Object.entries(computed)) {
+    const fn = typeof entry === "function" ? entry : entry.fn;
+    try {
+      out[field] = fn(out);
+    } catch (cause) {
+      throw new ComputedFieldError(field, id, cause);
+    }
+  }
+  return out;
+}
+
+export {
+  ComputedFieldError,
+  evalComputedFields
+};
+//# sourceMappingURL=chunk-HGAB325C.js.map

package/dist/chunk-HIOLCOK3.js

@@ -0,0 +1,30 @@
+import {
+  BrokerNotEnabledError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/port/with/broker-strategy.ts
+var NO_BROKER = {
+  async enroll() {
+    throw new BrokerNotEnabledError();
+  },
+  async rotate() {
+    throw new BrokerNotEnabledError();
+  },
+  credentialSource() {
+    throw new BrokerNotEnabledError();
+  }
+};
+function buildCredentialBrokerHandle(strategy, store, vault, getKeyring) {
+  const ctx = () => ({ store, vault, keyring: getKeyring() });
+  return {
+    enroll: () => strategy.enroll(ctx()),
+    rotate: () => strategy.rotate(ctx()),
+    credentialSource: (profile) => strategy.credentialSource(ctx(), profile)
+  };
+}
+
+export {
+  NO_BROKER,
+  buildCredentialBrokerHandle
+};
+//# sourceMappingURL=chunk-HIOLCOK3.js.map

package/dist/chunk-HIOLCOK3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAkFO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AACzD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/chunk-HK4XTXO4.js

@@ -0,0 +1,49 @@
+import {
+  openEnvelopeJson
+} from "./chunk-HA6ZQWA2.js";
+import {
+  encrypt
+} from "./chunk-37WOJQWY.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+
+// src/with-shape/persisted-schemas/storage.ts
+var SCHEMAS_COLLECTION = "_schemas";
+async function loadPersistedSchemaEntry(store, vault, collection, dek) {
+  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection);
+  if (!envelope) return { version: 0, payload: void 0 };
+  const version = envelope._v;
+  try {
+    const plaintext = await openEnvelopeJson(envelope, dek);
+    const parsed = JSON.parse(plaintext);
+    if (parsed._noydb_schema !== 1) return { version, payload: void 0 };
+    return { version, payload: parsed };
+  } catch {
+    return { version, payload: void 0 };
+  }
+}
+async function loadPersistedSchema(store, vault, collection, dek) {
+  return (await loadPersistedSchemaEntry(store, vault, collection, dek)).payload;
+}
+async function savePersistedSchema(store, vault, collection, dek, payload, expectedVersion) {
+  const json = JSON.stringify(payload);
+  const { iv, data } = await encrypt(json, dek);
+  const baseVersion = expectedVersion ?? (await store.get(vault, SCHEMAS_COLLECTION, collection))?._v ?? 0;
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: baseVersion + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data
+  };
+  await store.put(vault, SCHEMAS_COLLECTION, collection, env, expectedVersion);
+}
+
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchemaEntry,
+  loadPersistedSchema,
+  savePersistedSchema
+};
+//# sourceMappingURL=chunk-HK4XTXO4.js.map

package/dist/chunk-HYG32HCM.js

@@ -0,0 +1,14 @@
+// src/with-cargo/active.ts
+function withCargo() {
+  return {
+    async extractPartition(vault, opts) {
+      const { extractPartitionCore } = await import("./extract-partition-ZHQ4RGGM.js");
+      return extractPartitionCore(vault, opts);
+    }
+  };
+}
+
+export {
+  withCargo
+};
+//# sourceMappingURL=chunk-HYG32HCM.js.map

package/dist/chunk-ILF5GARW.js

@@ -0,0 +1,135 @@
+import {
+  freezeSnapshotOnly
+} from "./chunk-NEYKOESM.js";
+import {
+  resolveManagedSecret
+} from "./chunk-FF7S3XDW.js";
+import {
+  createOwnerKeyring
+} from "./chunk-CCIR2OJH.js";
+import {
+  wrapKey
+} from "./chunk-37WOJQWY.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+import {
+  PermissionDeniedError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-party/team/deed.ts
+var DEED_RECORD_ID = "deed";
+async function createDeedOwner(store, vault, ownerUserId, sealing) {
+  const passphrase = await resolveManagedSecret(store, vault, sealing);
+  const keyring = await createOwnerKeyring(store, vault, ownerUserId, passphrase);
+  await saveDeedMarker(store, vault, {
+    ownerUserId,
+    sealedUnder: sealing.id,
+    latent: true,
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return keyring;
+}
+async function loadDeedMarker(store, vault) {
+  const envelope = await store.get(vault, "_meta", DEED_RECORD_ID);
+  if (!envelope) return null;
+  let payload;
+  try {
+    payload = JSON.parse(envelope._data);
+  } catch {
+    return null;
+  }
+  if (typeof payload !== "object" || payload === null) return null;
+  const r = payload;
+  if (r._noydb_deed !== 1) return null;
+  if (typeof r.ownerUserId !== "string" || typeof r.sealedUnder !== "string" || r.latent !== true || typeof r.issuedAt !== "string") {
+    return null;
+  }
+  const marker = {
+    ownerUserId: r.ownerUserId,
+    sealedUnder: r.sealedUnder,
+    latent: true,
+    issuedAt: r.issuedAt,
+    ...typeof r.liberatedAt === "string" ? { liberatedAt: r.liberatedAt } : {}
+  };
+  return marker;
+}
+async function isDeedVault(store, vault) {
+  return await loadDeedMarker(store, vault) !== null;
+}
+async function saveDeedMarker(store, vault, marker) {
+  const persisted = { _noydb_deed: 1, ...marker };
+  const prior = await store.get(vault, "_meta", DEED_RECORD_ID);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the marker is plaintext audit metadata.
+    _iv: "",
+    _data: JSON.stringify(persisted)
+  };
+  await store.put(vault, "_meta", DEED_RECORD_ID, env);
+}
+
+// src/with-party/custody/liberate.ts
+async function liberateVault(vault, opts) {
+  await vault.noydb.checkGate(vault.name, "liberate-vault", opts.factors);
+  const { name: vaultName, adapter, keyring } = vault._introspectState();
+  if (keyring.role !== "custodian") {
+    throw new PermissionDeniedError(
+      "liberation is claimed only by the custodian (the de-facto authority holding the DEKs)"
+    );
+  }
+  const existing = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
+  if (existing) {
+    throw new PermissionDeniedError(
+      `liberateVault: newOwnerId "${opts.newOwnerId}" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`
+    );
+  }
+  const collections = await listOperationalCollections(vault);
+  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId });
+  const newOwner = await createOwnerKeyring(adapter, vaultName, opts.newOwnerId, opts.newOwnerPassphrase);
+  if (!newOwner.kek) {
+    throw new PermissionDeniedError(
+      `new owner keyring for "${opts.newOwnerId}" has no KEK to re-wrap the incumbent DEKs under`
+    );
+  }
+  const env = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
+  if (!env) {
+    throw new PermissionDeniedError(`new owner keyring for "${opts.newOwnerId}" did not persist`);
+  }
+  const keyringFile = JSON.parse(env._data);
+  const mergedDeks = { ...keyringFile.deks };
+  for (const [collection, dek] of keyring.deks) {
+    mergedDeks[collection] = await wrapKey(dek, newOwner.kek);
+  }
+  const mergedFile = { ...keyringFile, deks: mergedDeks };
+  await adapter.put(vaultName, "_keyring", opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) });
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: opts.newOwnerId,
+    payloadHash: "",
+    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`
+  });
+  const marker = await loadDeedMarker(adapter, vaultName);
+  if (marker) {
+    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  return { snapshot };
+}
+async function listOperationalCollections(vault) {
+  const { keyring } = vault._introspectState();
+  return [...keyring.deks.keys()].filter((c) => !c.startsWith("_"));
+}
+
+export {
+  DEED_RECORD_ID,
+  createDeedOwner,
+  loadDeedMarker,
+  isDeedVault,
+  liberateVault
+};
+//# sourceMappingURL=chunk-ILF5GARW.js.map