@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-S7TAPIRS.js

@@ -0,0 +1,205 @@
+import {
+  derivePassphraseKey
+} from "./chunk-37WOJQWY.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+
+// src/with-party/team/wrapped-deks.ts
+var PBKDF2_ITERATIONS = 6e5;
+var SALT_BYTES = 32;
+var IV_BYTES = 12;
+var subtle = globalThis.crypto.subtle;
+async function mintWrappedDeksBlob(deks, credential) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const wrappingKey = await deriveWrappingKey(credential, salt);
+  const exported = {};
+  for (const [coll, dek] of deks) {
+    const raw = await subtle.exportKey("raw", dek);
+    exported[coll] = bytesToBase64(new Uint8Array(raw));
+  }
+  const plaintext = new TextEncoder().encode(JSON.stringify({ deks: exported }));
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    wrappingKey,
+    plaintext
+  );
+  return {
+    salt: bytesToBase64(salt),
+    iv: bytesToBase64(iv),
+    wrappedDeks: bytesToBase64(new Uint8Array(ciphertext))
+  };
+}
+async function unwrapDeksFromBlob(blob, credential) {
+  const wrappingKey = await deriveWrappingKey(credential, base64ToBytes(blob.salt));
+  const plaintext = await subtle.decrypt(
+    { name: "AES-GCM", iv: base64ToBytes(blob.iv) },
+    wrappingKey,
+    base64ToBytes(blob.wrappedDeks)
+  );
+  const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+  const deks = /* @__PURE__ */ new Map();
+  for (const [coll, b64] of Object.entries(parsed.deks)) {
+    const raw = base64ToBytes(b64);
+    const key = await subtle.importKey(
+      "raw",
+      raw,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    deks.set(coll, key);
+  }
+  return deks;
+}
+async function deriveWrappingKey(credential, salt) {
+  return derivePassphraseKey(credential, salt, { iterations: PBKDF2_ITERATIONS, keyUsage: "aes-gcm" });
+}
+function bytesToBase64(b) {
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s);
+}
+function base64ToBytes(b64) {
+  const s = atob(b64);
+  const out = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+  return out;
+}
+
+// src/with-party/team/recovery.ts
+var PAPER_DOC_ID = "recovery-paper";
+async function loadPaperRecoveryEntries(store, vault) {
+  const env = await store.get(vault, "_meta", PAPER_DOC_ID);
+  if (!env) return [];
+  try {
+    const doc = JSON.parse(env._data);
+    if (doc.profile !== "paper" || !Array.isArray(doc.entries)) return [];
+    return doc.entries;
+  } catch {
+    return [];
+  }
+}
+async function savePaperRecoveryEntries(store, vault, entries) {
+  const doc = {
+    _noydb_recovery: 1,
+    profile: "paper",
+    entries
+  };
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(doc)
+  };
+  await store.put(vault, "_meta", PAPER_DOC_ID, envelope);
+}
+async function burnPaperRecoveryEntry(store, vault, codeId) {
+  const entries = await loadPaperRecoveryEntries(store, vault);
+  const remaining = entries.filter((e) => e.codeId !== codeId);
+  await savePaperRecoveryEntries(store, vault, remaining);
+}
+async function hasRecoveryEnrolled(store, vault) {
+  const paper = await loadPaperRecoveryEntries(store, vault);
+  if (paper.length > 0) return true;
+  const shamir = await loadShamirRecoveryEntries(store, vault);
+  return shamir.length > 0;
+}
+async function hasStrongRecoveryEnrolled(store, vault) {
+  const shamir = await loadShamirRecoveryEntries(store, vault);
+  return shamir.length > 0;
+}
+var SHAMIR_DOC_ID = "recovery-shamir";
+async function loadShamirRecoveryEntries(store, vault) {
+  const env = await store.get(vault, "_meta", SHAMIR_DOC_ID);
+  if (!env) return [];
+  try {
+    const doc = JSON.parse(env._data);
+    if (doc.profile !== "shamir" || !Array.isArray(doc.entries)) return [];
+    return doc.entries;
+  } catch {
+    return [];
+  }
+}
+async function saveShamirRecoveryEntries(store, vault, entries) {
+  const doc = {
+    _noydb_recovery: 1,
+    profile: "shamir",
+    entries
+  };
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(doc)
+  };
+  await store.put(vault, "_meta", SHAMIR_DOC_ID, envelope);
+}
+async function mintShamirRecoveryEntry(provider, deks, entryId, k, n, label) {
+  const recoverySecret = crypto.getRandomValues(new Uint8Array(32));
+  try {
+    const credential = bytesToBase642(recoverySecret);
+    const blob = await mintWrappedDeksBlob(deks, credential);
+    const shareStrings = provider.splitToShares(recoverySecret, k, n);
+    const entry = {
+      ...blob,
+      entryId,
+      k,
+      n,
+      enrolledAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...label !== void 0 && { label }
+    };
+    return { entry, shareStrings };
+  } finally {
+    recoverySecret.fill(0);
+  }
+}
+async function unwrapDeksFromShamirEntry(provider, entry, shareStrings) {
+  if (shareStrings.length < entry.k) {
+    throw new Error(
+      `Insufficient shares: this Shamir entry needs ${entry.k} of ${entry.n}, but ${shareStrings.length} were provided.`
+    );
+  }
+  const secret = provider.combineShares(shareStrings);
+  try {
+    return await unwrapDeksFromBlob(entry, bytesToBase642(secret));
+  } finally {
+    secret.fill(0);
+  }
+}
+function bytesToBase642(b) {
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s);
+}
+async function mintPaperRecoveryEntry(deks, code, codeId) {
+  const blob = await mintWrappedDeksBlob(deks, code);
+  return {
+    ...blob,
+    codeId,
+    enrolledAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function unwrapDeksFromPaperEntry(entry, code) {
+  return unwrapDeksFromBlob(entry, code);
+}
+
+export {
+  mintWrappedDeksBlob,
+  unwrapDeksFromBlob,
+  loadPaperRecoveryEntries,
+  savePaperRecoveryEntries,
+  burnPaperRecoveryEntry,
+  hasRecoveryEnrolled,
+  hasStrongRecoveryEnrolled,
+  loadShamirRecoveryEntries,
+  saveShamirRecoveryEntries,
+  mintShamirRecoveryEntry,
+  unwrapDeksFromShamirEntry,
+  mintPaperRecoveryEntry,
+  unwrapDeksFromPaperEntry
+};
+//# sourceMappingURL=chunk-S7TAPIRS.js.map

package/dist/chunk-SAL5X5OK.js

@@ -0,0 +1,40 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+
+// src/with-shape/schema-update/fence.ts
+var FENCE_RECORD_ID = "schema-fence";
+var META_COLLECTION = "_meta";
+var DEFAULT_FENCE = { currentSchemaVersion: 0, fenceState: "normal" };
+async function loadFence(store, vault) {
+  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID);
+  if (!envelope) return DEFAULT_FENCE;
+  try {
+    const parsed = JSON.parse(envelope._data);
+    if (!isFenceDoc(parsed)) return DEFAULT_FENCE;
+    return parsed;
+  } catch {
+    return DEFAULT_FENCE;
+  }
+}
+async function saveFence(store, vault, fence) {
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(fence)
+  };
+  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope);
+}
+function isFenceDoc(x) {
+  if (x === null || typeof x !== "object") return false;
+  const o = x;
+  return typeof o["currentSchemaVersion"] === "number" && (o["fenceState"] === "normal" || o["fenceState"] === "draining" || o["fenceState"] === "migrating" || o["fenceState"] === "complete");
+}
+
+export {
+  loadFence,
+  saveFence
+};
+//# sourceMappingURL=chunk-SAL5X5OK.js.map

package/dist/chunk-SGJGWBSC.js

@@ -0,0 +1,85 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  loadOrCreateSigner
+} from "./chunk-NT2ZO4KI.js";
+import {
+  openEnvelopeJson
+} from "./chunk-HA6ZQWA2.js";
+import {
+  encrypt
+} from "./chunk-37WOJQWY.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+import {
+  AttestationError,
+  ConflictError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-audit/attestation/revoke.ts
+import { signRevocationList } from "@noy-db/attestation";
+function requireOwner(ctx, op) {
+  if (ctx.role !== "owner") {
+    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`);
+  }
+}
+async function readSet(store, vault, dek) {
+  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID);
+  if (!env) return { docIds: /* @__PURE__ */ new Set(), version: void 0 };
+  const set = JSON.parse(await openEnvelopeJson(env, dek));
+  return { docIds: new Set(set.docIds), version: env._v };
+}
+async function mutateSet(ctx, mutate) {
+  const dek = await ctx.getDEK();
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek);
+    mutate(docIds);
+    const payload = { docIds: [...docIds].sort(), updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const { iv, data } = await encrypt(JSON.stringify(payload), dek);
+    const expectedVersion = version ?? 0;
+    const env = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: expectedVersion + 1,
+      _ts: payload.updatedAt,
+      _iv: iv,
+      _data: data
+    };
+    try {
+      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion);
+      return;
+    } catch (e) {
+      if (e instanceof ConflictError && attempt === 0) continue;
+      throw e;
+    }
+  }
+}
+async function revokeDocCore(ctx, docId) {
+  requireOwner(ctx, "revokeAttestation");
+  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId);
+  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`);
+  await mutateSet(ctx, (ids) => ids.add(docId));
+}
+async function unrevokeDocCore(ctx, docId) {
+  requireOwner(ctx, "unrevokeAttestation");
+  await mutateSet(ctx, (ids) => ids.delete(docId));
+}
+async function getRevokedDocIdsCore(ctx) {
+  const dek = await ctx.getDEK();
+  const { docIds } = await readSet(ctx.store, ctx.vault, dek);
+  return [...docIds].sort();
+}
+async function publishRevocationListCore(ctx) {
+  requireOwner(ctx, "publishRevocationList");
+  const docIds = await getRevokedDocIdsCore(ctx);
+  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK());
+  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64);
+}
+
+export {
+  revokeDocCore,
+  unrevokeDocCore,
+  getRevokedDocIdsCore,
+  publishRevocationListCore
+};
+//# sourceMappingURL=chunk-SGJGWBSC.js.map

package/dist/chunk-SIAIYP6G.js

@@ -0,0 +1,50 @@
+import {
+  SatelliteConfigError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-shape/satellites/validate.ts
+function validateSatelliteDeclaration(input) {
+  if (input.baseIsSatellite) {
+    throw new SatelliteConfigError(
+      `R-S3: "${input.satellite}" declares satelliteOf "${input.satelliteOf}", which is itself a satellite \u2014 no satellite-of-satellite chains.`
+    );
+  }
+  if (input.crdtMode) {
+    throw new SatelliteConfigError(
+      `R-S8: crdtMode is refused on either member of a satellite pair in v1 (revert cannot compensate a merge).`
+    );
+  }
+  if (!input.fields || input.fields.length === 0) {
+    throw new SatelliteConfigError(`R-S5: satellite "${input.satellite}" must declare a non-empty fields list.`);
+  }
+  if (input.fields.includes("id")) {
+    throw new SatelliteConfigError(`R-S5: fields must not contain the shared key "id".`);
+  }
+  if (input.joined !== void 0 && (input.joined === input.satellite || input.joined === input.satelliteOf)) {
+    throw new SatelliteConfigError(`R-S5: joined name "${input.joined}" collides with a pair member.`);
+  }
+  if (input.joinedCollidesWithCollection) {
+    throw new SatelliteConfigError(`R-S5: joined name "${input.joined}" collides with an already-declared collection.`);
+  }
+  return Object.freeze({
+    base: input.satelliteOf,
+    satellite: input.satellite,
+    fields: Object.freeze([...input.fields]),
+    joined: input.joined
+  });
+}
+function hashFields(fields) {
+  const s = [...fields].sort().join("");
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h.toString(16);
+}
+
+export {
+  validateSatelliteDeclaration,
+  hashFields
+};
+//# sourceMappingURL=chunk-SIAIYP6G.js.map