@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-RNYDHIQL.js

@@ -1,367 +0,0 @@
-import {
-  generateULID
-} from "./chunk-ZJADGNYF.js";
-import {
-  base64ToBuffer,
-  bufferToBase64
-} from "./chunk-5HZULLHE.js";
-import {
-  SessionExpiredError,
-  SessionNotFoundError,
-  SessionPolicyError,
-  ValidationError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-party/session/session.ts
-var subtle = globalThis.crypto.subtle;
-var DEFAULT_TTL_MS = 60 * 60 * 1e3;
-var sessionKeyStore = /* @__PURE__ */ new Map();
-async function createSession(keyring, vault, options = {}) {
-  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-  const sessionId = generateULID();
-  const expiresAt = new Date(Date.now() + ttlMs).toISOString();
-  const sessionKey = await subtle.generateKey(
-    { name: "AES-GCM", length: 256 },
-    false,
-    // non-extractable — this is the tab-scope security invariant
-    ["encrypt", "decrypt"]
-  );
-  const dekMap = {};
-  for (const [collName, dek] of keyring.deks) {
-    const raw = await subtle.exportKey("raw", dek);
-    dekMap[collName] = bufferToBase64(raw);
-  }
-  const payload = JSON.stringify({
-    userId: keyring.userId,
-    displayName: keyring.displayName,
-    role: keyring.role,
-    permissions: keyring.permissions,
-    deks: dekMap,
-    salt: bufferToBase64(keyring.salt)
-  });
-  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
-  const encrypted = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    sessionKey,
-    new TextEncoder().encode(payload)
-  );
-  const token = {
-    _noydb_session: 1,
-    sessionId,
-    userId: keyring.userId,
-    vault,
-    role: keyring.role,
-    expiresAt,
-    wrappedKek: bufferToBase64(encrypted),
-    kekIv: bufferToBase64(iv)
-  };
-  sessionKeyStore.set(sessionId, sessionKey);
-  return { token, sessionId };
-}
-async function resolveSession(token) {
-  if (Date.now() > new Date(token.expiresAt).getTime()) {
-    sessionKeyStore.delete(token.sessionId);
-    throw new SessionExpiredError(token.sessionId);
-  }
-  const sessionKey = sessionKeyStore.get(token.sessionId);
-  if (!sessionKey) {
-    throw new SessionNotFoundError(token.sessionId);
-  }
-  const iv = base64ToBuffer(token.kekIv);
-  const ciphertext = base64ToBuffer(token.wrappedKek);
-  let plaintext;
-  try {
-    plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      sessionKey,
-      ciphertext
-    );
-  } catch {
-    throw new SessionNotFoundError(token.sessionId);
-  }
-  const payload = JSON.parse(new TextDecoder().decode(plaintext));
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collName, rawBase64] of Object.entries(payload.deks)) {
-    const dek = await subtle.importKey(
-      "raw",
-      base64ToBuffer(rawBase64),
-      { name: "AES-GCM", length: 256 },
-      true,
-      ["encrypt", "decrypt"]
-    );
-    deks.set(collName, dek);
-  }
-  return {
-    userId: payload.userId,
-    displayName: payload.displayName,
-    role: payload.role,
-    permissions: payload.permissions,
-    deks,
-    kek: null,
-    // KEK not available in session context
-    salt: base64ToBuffer(payload.salt),
-    authenticators: []
-  };
-}
-function revokeSession(sessionId) {
-  sessionKeyStore.delete(sessionId);
-}
-function isSessionAlive(token) {
-  if (Date.now() > new Date(token.expiresAt).getTime()) return false;
-  return sessionKeyStore.has(token.sessionId);
-}
-function revokeAllSessions() {
-  sessionKeyStore.clear();
-}
-function activeSessionCount() {
-  return sessionKeyStore.size;
-}
-
-// src/with-party/session/session-policy.ts
-var PolicyEnforcer = class {
-  policy;
-  sessionId;
-  onRevoke;
-  createdAt;
-  lastActivityAt;
-  idleTimer = null;
-  absoluteTimer = null;
-  visibilityHandler = null;
-  constructor(opts) {
-    this.policy = opts.policy;
-    this.sessionId = opts.sessionId;
-    this.onRevoke = opts.onRevoke;
-    this.createdAt = Date.now();
-    this.lastActivityAt = Date.now();
-    this.scheduleIdleTimer();
-    this.scheduleAbsoluteTimer();
-    this.registerBackgroundLock();
-  }
-  /**
-   * Record an activity timestamp and reset the idle timer.
-   * Call this at the top of every Noydb public method.
-   */
-  touch() {
-    this.lastActivityAt = Date.now();
-    this.scheduleIdleTimer();
-  }
-  /**
-   * Check whether the given operation is allowed under the active policy.
-   * Throws `SessionPolicyError` if the operation requires re-authentication.
-   * Throws `SessionExpiredError` if the absolute timeout has been exceeded
-   * (defensive check in case the timer fired before the call arrived).
-   *
-   * This is a synchronous check — callers don't await it.
-   */
-  checkOperation(op) {
-    const { absoluteTimeoutMs } = this.policy;
-    if (absoluteTimeoutMs !== void 0 && Date.now() - this.createdAt >= absoluteTimeoutMs) {
-      this.expire("absolute");
-      throw new SessionExpiredError(this.sessionId);
-    }
-    const required = this.policy.requireReAuthFor ?? [];
-    if (required.includes(op)) {
-      throw new SessionPolicyError(op);
-    }
-  }
-  /**
-   * Tear down timers and background-lock listener. Call from `Noydb.close()`
-   * and whenever the session is revoked externally.
-   */
-  destroy() {
-    if (this.idleTimer) {
-      clearTimeout(this.idleTimer);
-      this.idleTimer = null;
-    }
-    if (this.absoluteTimer) {
-      clearTimeout(this.absoluteTimer);
-      this.absoluteTimer = null;
-    }
-    if (this.visibilityHandler && typeof document !== "undefined") {
-      document.removeEventListener("visibilitychange", this.visibilityHandler);
-      this.visibilityHandler = null;
-    }
-  }
-  /** How long since the last activity, in ms. */
-  get idleMs() {
-    return Date.now() - this.lastActivityAt;
-  }
-  /** How long since session creation, in ms. */
-  get ageMs() {
-    return Date.now() - this.createdAt;
-  }
-  // ── Private ──────────────────────────────────────────────────────────
-  scheduleIdleTimer() {
-    const { idleTimeoutMs } = this.policy;
-    if (!idleTimeoutMs) return;
-    if (this.idleTimer) clearTimeout(this.idleTimer);
-    this.idleTimer = setTimeout(() => {
-      this.expire("idle");
-    }, idleTimeoutMs);
-  }
-  scheduleAbsoluteTimer() {
-    const { absoluteTimeoutMs } = this.policy;
-    if (!absoluteTimeoutMs) return;
-    if (this.absoluteTimer) clearTimeout(this.absoluteTimer);
-    this.absoluteTimer = setTimeout(() => {
-      this.expire("absolute");
-    }, absoluteTimeoutMs);
-  }
-  registerBackgroundLock() {
-    if (!this.policy.lockOnBackground) return;
-    if (typeof document === "undefined") return;
-    this.visibilityHandler = () => {
-      if (document.hidden) {
-        this.expire("background");
-      }
-    };
-    document.addEventListener("visibilitychange", this.visibilityHandler);
-  }
-  expire(reason) {
-    this.destroy();
-    revokeSession(this.sessionId);
-    this.onRevoke(reason);
-  }
-};
-function createEnforcer(opts) {
-  return new PolicyEnforcer(opts);
-}
-function validateSessionPolicy(policy) {
-  const { idleTimeoutMs, absoluteTimeoutMs } = policy;
-  if (idleTimeoutMs !== void 0 && (typeof idleTimeoutMs !== "number" || idleTimeoutMs <= 0)) {
-    throw new Error(`SessionPolicy.idleTimeoutMs must be a positive number, got ${idleTimeoutMs}`);
-  }
-  if (absoluteTimeoutMs !== void 0 && (typeof absoluteTimeoutMs !== "number" || absoluteTimeoutMs <= 0)) {
-    throw new Error(`SessionPolicy.absoluteTimeoutMs must be a positive number, got ${absoluteTimeoutMs}`);
-  }
-  if (idleTimeoutMs !== void 0 && absoluteTimeoutMs !== void 0 && idleTimeoutMs >= absoluteTimeoutMs) {
-    throw new Error(
-      `SessionPolicy.idleTimeoutMs (${idleTimeoutMs}ms) must be less than absoluteTimeoutMs (${absoluteTimeoutMs}ms)`
-    );
-  }
-}
-
-// src/with-party/session/dev-unlock.ts
-var REQUIRED_ACKNOWLEDGE = "I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY";
-var STORAGE_PREFIX = "noydb:dev-unlock:";
-function assertDevEnvironment() {
-  if (typeof process !== "undefined" && process.env.NODE_ENV === "production") {
-    throw new ValidationError(
-      'devUnlock is not available in production builds. process.env.NODE_ENV is "production".'
-    );
-  }
-  if (typeof globalThis !== "undefined" && globalThis.__vite_is_production__ === true) {
-    throw new ValidationError("devUnlock is not available in production builds.");
-  }
-  if (typeof window !== "undefined" && typeof window.location !== "undefined") {
-    const host = window.location.hostname;
-    if (host !== "localhost" && host !== "127.0.0.1" && host !== "::1" && !host.endsWith(".local")) {
-      throw new ValidationError(
-        `devUnlock is only available on localhost. Current hostname: "${host}". Set NODE_ENV=development and run on localhost to use dev unlock.`
-      );
-    }
-  }
-}
-function storageKey(vault, userId) {
-  return `${STORAGE_PREFIX}${vault}:${userId}`;
-}
-function resolveStorage(persistAcrossTabs) {
-  if (typeof window === "undefined") {
-    throw new ValidationError("devUnlock requires a browser environment (window.sessionStorage / window.localStorage).");
-  }
-  return persistAcrossTabs ? window.localStorage : window.sessionStorage;
-}
-async function enableDevUnlock(vault, userId, keyring, options) {
-  if (options.acknowledge !== REQUIRED_ACKNOWLEDGE) {
-    throw new ValidationError(
-      `devUnlock requires acknowledge: '${REQUIRED_ACKNOWLEDGE}'. Got: '${options.acknowledge}'. This is intentional \u2014 the full string must appear in your source.`
-    );
-  }
-  assertDevEnvironment();
-  const storage = resolveStorage(options.persistAcrossTabs);
-  const dekMap = {};
-  for (const [collName, dek] of keyring.deks) {
-    const raw = await globalThis.crypto.subtle.exportKey("raw", dek);
-    dekMap[collName] = bufferToBase64(raw);
-  }
-  const payload = JSON.stringify({
-    _noydb_dev_unlock: 1,
-    userId: keyring.userId,
-    displayName: keyring.displayName,
-    role: keyring.role,
-    permissions: keyring.permissions,
-    deks: dekMap,
-    salt: bufferToBase64(keyring.salt)
-  });
-  storage.setItem(storageKey(vault, userId), payload);
-  console.warn(
-    "%c\u26A0\uFE0F NOYDB DEV UNLOCK ACTIVE \u26A0\uFE0F",
-    "color: red; font-size: 16px; font-weight: bold",
-    `
-
-Vault "${vault}" user "${userId}" is stored in ${options.persistAcrossTabs ? "localStorage" : "sessionStorage"} in PLAINTEXT DEKs.
-This is ONLY safe for local development. Never use in production.
-Call clearDevUnlock() to remove.`
-  );
-}
-async function loadDevUnlock(vault, userId, options = {}) {
-  if (typeof window === "undefined") return null;
-  const storage = resolveStorage(options.persistAcrossTabs);
-  const raw = storage.getItem(storageKey(vault, userId));
-  if (!raw) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (parsed._noydb_dev_unlock !== 1) return null;
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collName, rawBase64] of Object.entries(parsed.deks)) {
-    const dek = await globalThis.crypto.subtle.importKey(
-      "raw",
-      base64ToBuffer(rawBase64),
-      { name: "AES-GCM", length: 256 },
-      true,
-      ["encrypt", "decrypt"]
-    );
-    deks.set(collName, dek);
-  }
-  return {
-    userId: parsed.userId,
-    displayName: parsed.displayName,
-    role: parsed.role,
-    permissions: parsed.permissions,
-    deks,
-    kek: null,
-    salt: base64ToBuffer(parsed.salt),
-    authenticators: []
-  };
-}
-function clearDevUnlock(vault, userId, options = {}) {
-  if (typeof window === "undefined") return;
-  const storage = resolveStorage(options.persistAcrossTabs);
-  storage.removeItem(storageKey(vault, userId));
-}
-function isDevUnlockActive(vault, userId, options = {}) {
-  if (typeof window === "undefined") return false;
-  const storage = resolveStorage(options.persistAcrossTabs);
-  return storage.getItem(storageKey(vault, userId)) !== null;
-}
-
-export {
-  createSession,
-  resolveSession,
-  revokeSession,
-  isSessionAlive,
-  revokeAllSessions,
-  activeSessionCount,
-  PolicyEnforcer,
-  createEnforcer,
-  validateSessionPolicy,
-  enableDevUnlock,
-  loadDevUnlock,
-  clearDevUnlock,
-  isDevUnlockActive
-};
-//# sourceMappingURL=chunk-RNYDHIQL.js.map

package/dist/chunk-RUIMKQTA.js

@@ -1,23 +0,0 @@
-// src/with-audit/guards/read-only-facade.ts
-var ReadOnlyVaultFacade = class {
-  _vault;
-  _layer;
-  constructor(vault, layer = "read") {
-    this._vault = vault;
-    this._layer = layer;
-  }
-  collection(name) {
-    const c = this._vault.collection(name);
-    const layer = this._layer;
-    return {
-      get: (id) => c.get(id, { _layer: layer }),
-      list: () => c.list({ _layer: layer }),
-      query: () => c.query()
-    };
-  }
-};
-
-export {
-  ReadOnlyVaultFacade
-};
-//# sourceMappingURL=chunk-RUIMKQTA.js.map

package/dist/chunk-RUIMKQTA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/guards/read-only-facade.ts"],"sourcesContent":["import type { Vault } from '../../kernel/vault.js'\nimport type { Query } from '../../kernel/query/builder.js'\nimport type { Layer } from '../../with-shape/i18n/policy.js'\nimport type { ReadOnlyVaultFacade as ReadOnlyVaultFacadeContract } from './types.js'\n\n/**\n * Minimal read-only wrapper over a `Vault`. Used as `ctx.vault` inside\n * guard / derivation callbacks so they can fetch related records without\n * acquiring any write capability.\n *\n * The `layer` tags every `get`/`list` read with the resolution layer it\n * belongs to. A guard-seeded facade reads at `'guard'`, a\n * derivation-seeded one at `'derivation'`, so i18nText / dictKey fields\n * resolve under that layer's `onMissing` policy instead of the `'read'`\n * policy — e.g. a guard read can `substitute` a missing locale (lenient\n * default) while the same field `throw`s on an ordinary app read.\n *\n * `query()` is left untagged: the query/aggregate pipeline reads raw\n * `{locale}` maps (no resolution call site), so a layer tag there would be\n * inert. Routing `mv`/`join` resolution through the pipeline is tracked\n * separately.\n */\nexport class ReadOnlyVaultFacade implements ReadOnlyVaultFacadeContract {\n  private readonly _vault: Vault\n  private readonly _layer: Layer\n\n  constructor(vault: Vault, layer: Layer = 'read') {\n    this._vault = vault\n    this._layer = layer\n  }\n\n  collection<T = unknown>(name: string): {\n    get(id: string): Promise<T | null>\n    list(): Promise<T[]>\n    query(): Query<T>\n  } {\n    const c = this._vault.collection<T>(name)\n    const layer = this._layer\n    return {\n      get: (id: string) => c.get(id, { _layer: layer }),\n      list: () => c.list({ _layer: layer }),\n      query: () => c.query(),\n    }\n  }\n}\n"],"mappings":";AAsBO,IAAM,sBAAN,MAAiE;AAAA,EACrD;AAAA,EACA;AAAA,EAEjB,YAAY,OAAc,QAAe,QAAQ;AAC/C,SAAK,SAAS;AACd,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAwB,MAItB;AACA,UAAM,IAAI,KAAK,OAAO,WAAc,IAAI;AACxC,UAAM,QAAQ,KAAK;AACnB,WAAO;AAAA,MACL,KAAK,CAAC,OAAe,EAAE,IAAI,IAAI,EAAE,QAAQ,MAAM,CAAC;AAAA,MAChD,MAAM,MAAM,EAAE,KAAK,EAAE,QAAQ,MAAM,CAAC;AAAA,MACpC,OAAO,MAAM,EAAE,MAAM;AAAA,IACvB;AAAA,EACF;AACF;","names":[]}