@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-IL6POWCW.js

@@ -0,0 +1,130 @@
+import {
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-JZUV47FZ.js";
+import {
+  openEnvelopeJson
+} from "./chunk-XDYREZWE.js";
+import {
+  encrypt
+} from "./chunk-CIE2BASH.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JNAI2HN2.js";
+import {
+  NoydbError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-shape/links/link-set.ts
+var LinkSet = class {
+  constructor(adapter, vault, name, spec, encrypted, getDEK, actor, emitter, endpointExists) {
+    this.adapter = adapter;
+    this.vault = vault;
+    this.name = name;
+    this.spec = spec;
+    this.encrypted = encrypted;
+    this.getDEK = getDEK;
+    this.actor = actor;
+    this.emitter = emitter;
+    this.endpointExists = endpointExists;
+    this.collName = linkCollectionName(name);
+  }
+  adapter;
+  vault;
+  name;
+  spec;
+  encrypted;
+  getDEK;
+  actor;
+  emitter;
+  endpointExists;
+  collName;
+  dekPromise = null;
+  dek() {
+    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
+    return this.dekPromise;
+  }
+  async encryptEntry(entry, version) {
+    const json = JSON.stringify(entry);
+    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
+    if (!this.encrypted) return { ...base, _iv: "", _data: json };
+    const { iv, data } = await encrypt(json, await this.dek());
+    return { ...base, _iv: iv, _data: data };
+  }
+  async decryptEntry(env) {
+    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+    return JSON.parse(json);
+  }
+  async connect(aId, bId, meta) {
+    if (!await this.endpointExists(this.spec.a, aId)) {
+      throw new LinkEndpointError(this.name, this.spec.a, aId);
+    }
+    if (!await this.endpointExists(this.spec.b, bId)) {
+      throw new LinkEndpointError(this.name, this.spec.b, bId);
+    }
+    const key = linkRowKey(aId, bId);
+    const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
+    const existing = await this.adapter.get(this.vault, this.collName, key);
+    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
+    await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
+    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
+  }
+  async disconnect(aId, bId) {
+    const key = linkRowKey(aId, bId);
+    const existing = await this.adapter.get(this.vault, this.collName, key);
+    if (!existing) return;
+    await this.adapter.delete(this.vault, this.collName, key);
+    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "delete" });
+  }
+  async has(aId, bId) {
+    return await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId)) !== null;
+  }
+  async of(id) {
+    const rows = await this.list();
+    return rows.filter((r) => r.a === id || r.b === id);
+  }
+  async list() {
+    const keys = await this.adapter.list(this.vault, this.collName);
+    const out = [];
+    for (const key of keys) {
+      const env = await this.adapter.get(this.vault, this.collName, key);
+      if (!env) continue;
+      const e = await this.decryptEntry(env);
+      out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
+    }
+    return out;
+  }
+  // ── Vault-internal cascade helpers ──────────────────────────────────
+  /** @internal — rows where the deleted endpoint id matches the relevant slot. */
+  async _rowsTouchingEndpoint(collection, id) {
+    const rows = await this.list();
+    return rows.filter(
+      (r) => this.spec.a === collection && r.a === id || this.spec.b === collection && r.b === id
+    );
+  }
+  /** @internal — the storage collection name (for tx pre-image capture). */
+  get _collectionName() {
+    return this.collName;
+  }
+};
+var LinkEndpointError = class extends NoydbError {
+  link;
+  endpoint;
+  missingId;
+  constructor(link, endpoint, missingId) {
+    super(
+      "LINK_ENDPOINT",
+      `link("${link}").connect: endpoint "${endpoint}" has no record "${missingId}".`
+    );
+    this.name = "LinkEndpointError";
+    this.link = link;
+    this.endpoint = endpoint;
+    this.missingId = missingId;
+  }
+};
+
+export {
+  LinkSet,
+  LinkEndpointError
+};
+//# sourceMappingURL=chunk-IL6POWCW.js.map

package/dist/chunk-IU6SNYX6.js

@@ -0,0 +1,117 @@
+import {
+  buildAccessibleBundle,
+  resolveAccessibleCollections
+} from "./chunk-F64IRYG3.js";
+import {
+  sha256Hex
+} from "./chunk-CIE2BASH.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JNAI2HN2.js";
+import {
+  ReadOnlyError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-audit/portability/withdraw-accessible.ts
+var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
+var ENC = new TextEncoder();
+function randomId() {
+  const b = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+}
+async function freezeSnapshotOnly(vault, collections, opts) {
+  const { name: vaultName, adapter } = vault._introspectState();
+  const closure = [];
+  for (const c of collections) {
+    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id });
+  }
+  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`;
+  const snap = {};
+  for (const { collection, id } of closure) {
+    const env = await adapter.get(vaultName, collection, id);
+    if (env) (snap[collection] ??= {})[id] = env;
+  }
+  const frozenAt = (/* @__PURE__ */ new Date()).toISOString();
+  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap });
+  const sha = await sha256Hex(ENC.encode(body));
+  await adapter.put(
+    vaultName,
+    FROZEN_SNAPSHOTS_COLLECTION,
+    withdrawalId,
+    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: "", _data: body, _by: opts.actorUserId },
+    0
+  );
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: opts.actorUserId,
+    payloadHash: "",
+    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`
+  });
+  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt };
+}
+async function freezeAndDeleteClosure(vault, collections, opts) {
+  const snapshot = opts.disposition === "freeze" ? await freezeSnapshotOnly(vault, collections, {
+    actorUserId: opts.actorUserId,
+    ...opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}
+  }) : void 0;
+  const { name: vaultName, adapter } = vault._introspectState();
+  for (const c of collections) {
+    for (const id of await adapter.list(vaultName, c)) {
+      await vault.collection(c).delete(id);
+    }
+  }
+  return snapshot;
+}
+async function withdrawAccessibleData(vault, opts) {
+  const { keyring } = vault._introspectState();
+  const disposition = opts.disposition ?? "delete";
+  if (keyring.role === "owner" || keyring.role === "admin") {
+    throw new ReadOnlyError(
+      "unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition"
+    );
+  }
+  if (keyring.role === "custodian") {
+    throw new ReadOnlyError(
+      "a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim"
+    );
+  }
+  if (keyring.role === "client" || keyring.role === "viewer") {
+    throw new ReadOnlyError(
+      "read-only role cannot self-serve a destructive withdrawal \u2014 use requestWithdrawal (two-party)"
+    );
+  }
+  const collections = resolveAccessibleCollections(keyring, opts.scope, true);
+  if (!collections || collections.length === 0) {
+    throw new ReadOnlyError(
+      "unilateralWithdrawal requires rw access on the withdrawn collections \u2014 use requestWithdrawal for read-only scope"
+    );
+  }
+  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey);
+  const snapshot = await freezeAndDeleteClosure(vault, collections, {
+    disposition,
+    actorUserId: keyring.userId,
+    ...opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}
+  });
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: keyring.userId,
+    payloadHash: "",
+    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`
+  });
+  return snapshot ? { bundle, snapshot } : { bundle };
+}
+
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  randomId,
+  freezeSnapshotOnly,
+  freezeAndDeleteClosure,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=chunk-IU6SNYX6.js.map