@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/guards/index.d.ts

@@ -1,35 +0,0 @@
-export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from '../transition-guard-D5RLJv8S.js';
-import { bR as GuardStrategy, bS as GuardChange, bT as GuardContext } from '../index-Dn5GzPg_.js';
-export { bU as AmendmentForbiddenError, bV as FieldFrozenError, bW as GuardRegistry, bX as GuardStrategyHandle, bY as IllegalTransitionError, bZ as InvariantError, b_ as ReadOnlyVaultFacade, b$ as RecordLockedError } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Pure functions that execute the work declared by a `GuardStrategy`.
- * Stateless — `GuardRegistry` decides when to call these.
- *
- * @internal
- */
-declare const GuardExecutor: {
-    /**
-     * Compare existing vs incoming for each `frozenFields.fields` entry
-     * when `frozenFields.when(existing)` is true. Throws
-     * `FieldFrozenError` listing every changed frozen field.
-     *
-     * @param skipFields — field names that are schema-owned computed fields.
-     *   These are excluded from the comparison because `incoming` carries the
-     *   raw user input (computed fields not yet evaluated), so comparing
-     *   `existing[field]` vs `incoming[field]` would always look like a
-     *   change even when the computed result is unchanged.
-     */
-    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T, skipFields?: ReadonlySet<string>): Promise<void>;
-    /**
-     * Run a single guard's invariant over its slice of the change-set.
-     * Any throw is converted to `InvariantError` unless it already is one.
-     */
-    runInvariant<T extends Record<string, unknown>>(guard: GuardStrategy<T>, changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>): Promise<void>;
-};
-
-export { GuardChange, GuardContext, GuardExecutor, GuardStrategy };

package/dist/hash-CwHnoKyW.d.ts

@@ -1,72 +0,0 @@
-import { d1 as EncryptedEnvelope } from './index-Dn5GzPg_.js';
-
-/**
- * Ledger storage constants — pinned in their own leaf module so
- * always-on core code (vault.ts, dictionary.ts) can import them
- * without dragging the `LedgerStore` class into the bundle.
- *
- * `splitting: true` in tsup is not enough on its own: when a
- * source file exports both pure constants and a heavyweight class,
- * the bundler keeps the entire chunk reachable from any importer.
- * Extracting the constants lets the floor scenario import them
- * without paying for the class.
- *
- * @internal
- */
-/** The internal collection name used for ledger entry storage. */
-declare const LEDGER_COLLECTION = "_ledger";
-/**
- * The internal collection name used for delta payload storage.
- *
- * Deltas live in a sibling collection (not inside `_ledger`) for two
- * reasons:
- *
- *   1. **Listing efficiency.** `ledger.loadAllEntries()` calls
- *      `adapter.list(_ledger)` which would otherwise return every
- *      delta key alongside every entry key. Splitting them keeps the
- *      list small (one key per ledger entry) and the delta reads
- *      keyed by the entry's index.
- *
- *   2. **Prune-friendliness.** A future `pruneHistory()` will delete
- *      old deltas while keeping the ledger chain intact (folding old
- *      deltas into a base snapshot). Separating the storage makes
- *      that deletion a targeted operation on one collection instead
- *      of a filter across a mixed list.
- *
- * Both collections share the same ledger DEK — one DEK, two
- * internal collections, same zero-knowledge guarantees.
- */
-declare const LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
-
-/**
- * Envelope payload hash — pinned in its own leaf module so consumers
- * (DictionaryHandle, the active history strategy) can import it
- * without dragging in the `LedgerStore` class.
- *
- * see `constants.ts` for the broader rationale.
- *
- * @internal
- */
-
-/**
- * Compute the `payloadHash` value for an encrypted envelope. Used by
- * `LedgerStore.append` for both put (hash the new envelope) and
- * delete (hash the previous envelope) paths, and by
- * `DictionaryHandle` so its ledger entries match the same contract.
- *
- * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext
- * map (`_sealed`) when a record carries one — so the ledger attests to
- * both the open body AND every sealed value … and the verify-digest
- * ciphertext map (`_vdig`), each bound only when present — the `_vdig`
- * binding is the temporal-rollback detector for the C1 splice class.
- * `rotateRecordCek` rewrites `_vdig` with no ledger entry, the same
- * pre-existing rotation property `_sealed`/`_cek` already have
- * (`verifyBackupIntegrity` flags rotated records until re-anchored).
- *
- * Returns the empty string when there is no envelope (delete of a
- * never-existed record). The empty string tolerated by the ledger
- * entry's `payloadHash` field as the canonical "nothing here" value.
- */
-declare function envelopePayloadHash(envelope: EncryptedEnvelope | null): Promise<string>;
-
-export { LEDGER_COLLECTION as L, LEDGER_DELTAS_COLLECTION as a, envelopePayloadHash as e };

package/dist/history/index.d.ts

@@ -1,61 +0,0 @@
-import { c_ as HistoryStrategy, c$ as NoydbStore, d0 as HistoryOptions, d1 as EncryptedEnvelope, d2 as PruneOptions } from '../index-Dn5GzPg_.js';
-export { d3 as AppendInput, d4 as ChangeType, d5 as CollectionInstant, cM as DiffEntry, d6 as JsonPatch, d7 as JsonPatchOp, d8 as LedgerStore, d9 as VaultEngine, da as VaultInstant, db as VerifyResult, dc as applyPatch, dd as computePatch, de as diff, df as formatDiff } from '../index-Dn5GzPg_.js';
-export { L as LedgerEntry, d as canonicalJson, h as hashEntry, p as paddedIndex, e as parseIndex, s as sha256Hex } from '../subject-index-O75wKshW.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from '../hash-CwHnoKyW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active history strategy — `withHistory()` returns the real
- * implementation that wires per-record snapshots, the hash-chained
- * audit ledger, JSON-patch deltas, and time-machine reads into the
- * core write/read paths.
- *
- * Consumers opt in by:
- *
- * ```ts
- * import { createNoydb } from '@noy-db/hub'
- * import { withHistory } from '@noy-db/hub/history'
- *
- * const db = await createNoydb({
- *   store: ...,
- *   user: ...,
- *   historyStrategy: withHistory(),
- * })
- * ```
- *
- * The factory is a thin wrapper that delegates to the existing
- * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and
- * `time-machine.ts` modules. Splitting the import chain through this
- * file is what lets `tsup` tree-shake the heavy modules out of the
- * default `@noy-db/hub` bundle when no `withHistory()` import is
- * present in the consumer.
- *
- * @public
- */
-
-/**
- * Build the active history strategy. Today the factory takes no
- * options; per-collection retention tuning still flows through
- * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.
- *
- * Future option slots (kept off the LTS surface for now):
- *   - global maxVersions cap
- *   - global beforeDate prune cadence
- *   - ledger encryption toggle (today inferred from vault.encrypted)
- */
-declare function withHistory(): HistoryStrategy;
-
-/** Save a history entry (a complete encrypted envelope snapshot). */
-declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
-/** Get history entries for a record, sorted newest-first. */
-declare function getHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, options?: HistoryOptions): Promise<EncryptedEnvelope[]>;
-/** Get a specific version's envelope from history. */
-declare function getVersionEnvelope(adapter: NoydbStore, vault: string, collection: string, recordId: string, version: number): Promise<EncryptedEnvelope | null>;
-/** Prune history entries. Returns the number of entries deleted. */
-declare function pruneHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string | undefined, options: PruneOptions): Promise<number>;
-/** Clear all history for a vault, optionally scoped to a collection or record. */
-declare function clearHistory(adapter: NoydbStore, vault: string, collection?: string, recordId?: string): Promise<number>;
-
-export { HistoryStrategy, clearHistory, getHistory, getVersionEnvelope, pruneHistory, saveHistory, withHistory };

package/dist/i18n/index.d.ts

@@ -1,37 +0,0 @@
-import { I as I18nStrategy } from '../index-Dn5GzPg_.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictKeyInUseError, d as DictKeyMissingError, e as DictionaryHandle, f as DictionaryOptions, g as I18nMap, h as I18nTextDescriptor, i as I18nTextOptions, L as Layer, j as LocaleNotSpecifiedError, M as MissingTranslationError, O as OnMissing, k as OnMissingPolicy, R as ReservedCollectionNameError, l as ResolveI18nOptions, S as ScriptViolationError, m as ScriptWarning, n as StaticDictDescriptor, o as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError, p as applyI18nLocale, q as dictCollectionName, r as dictKey, s as enforceScript, t as getAtPath, u as i18nText, v as inferScripts, w as isDictCollectionName, x as isDictKeyDescriptor, y as isI18nTextDescriptor, z as isStaticDictDescriptor, A as resolveI18nText, B as resolvePolicy, C as setAtPathInPlace, E as staticDict, F as stripI18nFilled, G as validateI18nTextValue } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active i18n strategy — `withI18n()` returns the real implementation
- * that wires multi-locale resolution, i18nText validation, and the
- * `DictionaryHandle` for `dictKey` fields into the core read/write
- * paths.
- *
- * Consumers opt in by:
- *
- * ```ts
- * import { createNoydb } from '@noy-db/hub'
- * import { withI18n } from '@noy-db/hub/i18n'
- *
- * const db = await createNoydb({
- *   store: ...,
- *   user: ...,
- *   i18nStrategy: withI18n(),
- * })
- * ```
- *
- * The factory delegates to the existing `core.ts` and `dictionary.ts`
- * modules. Splitting the import chain through this file is what lets
- * tsup tree-shake the `~854 LOC` of dictionary + locale resolution
- * out of the default bundle when no `withI18n()` import is present.
- *
- * @public
- */
-
-declare function withI18n(): I18nStrategy;
-
-export { I18nStrategy, withI18n };

package/dist/in/index.d.ts

@@ -1,5 +0,0 @@
-export { eY as ChangeEvent, cq as Collection, gI as LiveQuery, hi as Noydb, ef as Query, V as Vault } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';

package/dist/index-B9QdHytu.d.ts

@@ -1,123 +0,0 @@
-/**
- * Hub-level write lifecycle hooks. `onBeforeWrite` may abort (throw);
- * `onAfterWrite` is awaited and its errors are warned, not thrown. A
- * re-entrancy flag suppresses nested firing so a handler that writes can't
- * loop. Held on the Noydb instance, threaded into every Collection.
- */
-interface WriteEvent {
-    readonly op: 'create' | 'update' | 'delete';
-    readonly vault: string;
-    readonly collection: string;
-    readonly docId: string;
-    readonly before: unknown;
-    readonly after: unknown;
-    readonly baseVersion: number;
-    readonly version: number;
-    readonly userId: string;
-    readonly timestamp: number;
-    readonly txId: string;
-}
-type WriteHook = (event: WriteEvent) => void | Promise<void>;
-type Unsubscribe = () => void;
-declare class WriteHookRegistry {
-    #private;
-    /** True while handlers are running — used by the write path to skip nested firing. */
-    get suppressed(): boolean;
-    /** True when any hook is registered (cheap gate for the write path). */
-    get hasHandlers(): boolean;
-    onBeforeWrite(handler: WriteHook): Unsubscribe;
-    onAfterWrite(handler: WriteHook): Unsubscribe;
-    /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
-    runBefore(event: WriteEvent): Promise<void>;
-    /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
-    runAfter(event: WriteEvent): Promise<void>;
-}
-
-/**
- * Kernel coordination port — the injected `CoordinationProvider` seam for the
- * schema-fence drain-barrier.
- *
- * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
- * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)
- * drives it through the `Noydb` handle without ever naming a `by-*` package.
- * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.
- *
- * This module carries only the port TYPES plus two pure-ish helpers:
- * {@link isQuorum} (a pure quorum predicate extracted from the legacy
- * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol
- * the migration cutover and klum both call).
- *
- * @module
- */
-
-/** Vault fence state (the existing FenceDoc shape). */
-interface FenceState {
-    readonly currentSchemaVersion: number;
-    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
-}
-/** A writer's presence + ack, tagged with the session that owns it. */
-interface WriterPresence {
-    /** = today's clientId (one per tab/peer). */
-    readonly writerId: string;
-    /** Groups one user's writers across vaults (consolidation is klum's job). */
-    readonly sessionId: string;
-    readonly lastSeen: number;
-    readonly quiescedAtVersion: number | null;
-}
-/** Session-addressable drain-barrier coordination transport. Per-vault ops. */
-interface CoordinationProvider {
-    /** orchestrator → all writers */
-    setFence(vault: string, fence: FenceState): Promise<void>;
-    /**
-     * Fresh one-shot fence read for the write-path gate (`assertWritable`).
-     * A direct read (not a cached `observeFence` snapshot) avoids a staleness
-     * window and keeps the timing-sensitive cutover gate exact. The store
-     * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
-     */
-    readFence(vault: string): Promise<FenceState>;
-    /** writer observes fence changes (default: poll-emit; by-*: push) */
-    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
-    /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
-    reportPresence(vault: string, p: WriterPresence): Promise<void>;
-    /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
-    observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe;
-    /** orchestrator one-shot snapshot of reachable writers (quorum input) */
-    reachableWriters(vault: string, o: {
-        staleMs: number;
-        now: number;
-    }): Promise<readonly WriterPresence[]>;
-}
-/**
- * Pure quorum predicate: true when every writer (other than `excludeWriterId`)
- * has acked at exactly `generation`. An empty set is trivially a quorum.
- *
- * Extracted from the legacy `activeQuiesced` store-polling check so the
- * migration cutover, the store default provider, and `by-*` real-time
- * providers all share one definition of "everyone has drained".
- */
-declare function isQuorum(writers: readonly WriterPresence[], generation: number, excludeWriterId?: string): boolean;
-/** Inputs for {@link runDrainBarrier}. */
-interface DrainBarrierOptions {
-    readonly vault: string;
-    readonly generation: number;
-    readonly writerId: string;
-    readonly onFlush: () => Promise<void>;
-    readonly staleMs: number;
-    readonly quiesceTimeoutMs: number;
-    readonly now: () => number;
-    /** Optional seam (mainly for deterministic tests) run before each poll tick. */
-    readonly onPoll?: () => Promise<void>;
-}
-/**
- * The reusable drain-barrier protocol shared by the migration cutover and klum:
- *
- *   drain self → setFence(draining) → await quorum (presence push + isQuorum,
- *   polling as a fallback, or timeout) → run() → release-by-caller.
- *
- * Resolves once every reachable writer (excluding `writerId`) has quiesced at
- * `generation`, at which point `run` is invoked exactly once. Rejects with
- * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
- */
-declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;
-
-export { type CoordinationProvider as C, type DrainBarrierOptions as D, type FenceState as F, type Unsubscribe as U, type WriteEvent as W, type WriteHook as a, WriteHookRegistry as b, type WriterPresence as c, isQuorum as i, runDrainBarrier as r };

package/dist/index-CTvUp94-.d.ts

@@ -1,123 +0,0 @@
-import { c$ as NoydbStore, dp as SealingKeyProvider, cN as UnlockedKeyring, eX as CargoStrategy } from './index-Dn5GzPg_.js';
-import './ulid-DRH25k3y.js';
-import './index-B9QdHytu.js';
-import './kernel/index.js';
-import './describe-C6iHNlqJ.js';
-import './vault-diff-_LSIcOMv.js';
-
-/**
- * Hub-core constants that must be referenceable without pulling any
- * service chunk. Kept import-free.
- */
-/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
-declare const STATE_VAULT_NAME = "__noydb_state__";
-/**
- * Soft cap on the JSON-serialized user-envelope payload size. Generous (a
- * typical profile + preferences + small app annex is ~1 KiB); rejects
- * accidental "stuff app state in here" anti-patterns.
- */
-declare const USER_ENVELOPE_MAX_BYTES: number;
-/**
- * Reserved store collection name for user envelopes. Starts with `_` so the
- * keyring grant machinery propagates the DEK to every granted user via the
- * existing system-collection DEK propagation path in `team/keyring.ts`.
- */
-declare const USER_ENVELOPE_COLLECTION = "_users";
-
-/**
- * FR-6 — Deed: sealed / hidden-owner provisioning.
- *
- * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
- * derives `KEK_owner`) is minted machine-side and sealed under a
- * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
- * the cryptographic *inalienability anchor*: whoever holds the
- * provider (the client / their KMS) is the only party that can ever
- * re-derive `KEK_owner`. A firm-side custodian operates the vault
- * fully but can never reach the owner key — there is deliberately NO
- * firm-controlled fallback.
- *
- * Provisioning reuses the managed-mode seam:
- *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
- *     subsequent open through the same provider).
- *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
- *
- * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
- * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
- * sealing boundary protects them, so it must be readable without
- * unlocking the vault (a custodian or auditor inspecting the vault must
- * be able to see "this is a Deed vault, owner = X, sealed under Y"
- * without any key). The marker itself is therefore never sealed; only
- * the owner *credential* is.
- *
- * @module
- */
-
-/** Reserved id for the Deed marker under `_meta`. */
-declare const DEED_RECORD_ID: "deed";
-/**
- * Plaintext metadata recording a vault's latent-owner Deed. Persisted
- * at `_meta/deed`. Readable without unlocking the vault by design — it
- * carries no secret material, only the identity of the latent owner
- * and the sealing boundary that anchors inalienability.
- */
-interface DeedMarker {
-    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
-    readonly ownerUserId: string;
-    /**
-     * The `SealingKeyProvider.id` the owner credential is sealed under.
-     * The inalienability anchor: only the holder of this (non-firm)
-     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
-     */
-    readonly sealedUnder: string;
-    /** Always `true` for a Deed — the owner never authenticates interactively. */
-    readonly latent: true;
-    /** ISO-8601 timestamp the Deed was issued. */
-    readonly issuedAt: string;
-    /**
-     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
-     * via the audited Liberate ceremony), if any. Absent until liberation.
-     */
-    readonly liberatedAt?: string;
-}
-/**
- * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
- * via {@link resolveManagedSecret}, derives the owner keyring via
- * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
- * marker. Returns the unlocked owner keyring.
- *
- * The returned keyring is the only in-memory window onto `KEK_owner`
- * for this call; the persistent re-entry point is the sealing provider
- * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
- *
- * There is deliberately no firm-controlled fallback: the marker's
- * `sealedUnder` is the single cryptographic anchor of ownership.
- */
-declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
-/**
- * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
- * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
- * unlocking required.
- */
-declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
-/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
-declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
-
-/**
- * Enable the cargo (partition extraction) capability.
- * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side
- * `extractPartition(vault, ...)` free function live. The extraction crypto
- * engine is dynamically imported here, so it stays out of the floor bundle
- * until opted in. The recipient-side `adoptPartition` /
- * `decryptExtractedPartition` free functions — and `diffVault` (shared
- * import/merge infra) — are ungated and unaffected.
- */
-
-declare function withCargo(): CargoStrategy;
-
-export { DEED_RECORD_ID as D, STATE_VAULT_NAME as S, USER_ENVELOPE_COLLECTION as U, type DeedMarker as a, USER_ENVELOPE_MAX_BYTES as b, createDeedOwner as c, isDeedVault as i, loadDeedMarker as l, withCargo as w };