@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-RZ5SVOYR.js

@@ -0,0 +1,155 @@
+import {
+  ConflictError,
+  PodVersionConflictError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-pod/pod-store.ts
+var BUNDLE_STORE_VERSION = 1;
+var MAX_CONFLICT_RETRIES = 3;
+function wrapPodStore(bundle, options) {
+  const autoFlush = options?.autoFlush !== false;
+  const snapshots = /* @__PURE__ */ new Map();
+  const versions = /* @__PURE__ */ new Map();
+  const loaded = /* @__PURE__ */ new Set();
+  let batchDepth = 0;
+  async function load(vault) {
+    if (loaded.has(vault)) return snapshots.get(vault);
+    const result = await bundle.readBundle(vault);
+    if (result) {
+      const text = new TextDecoder().decode(result.bytes);
+      const format = JSON.parse(text);
+      snapshots.set(vault, format.data);
+      versions.set(vault, result.version);
+    } else {
+      snapshots.set(vault, {});
+      versions.set(vault, null);
+    }
+    loaded.add(vault);
+    return snapshots.get(vault);
+  }
+  async function flush(vault) {
+    const snapshot = snapshots.get(vault) ?? {};
+    const format = {
+      _noydb_bundle_store: BUNDLE_STORE_VERSION,
+      vault,
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      data: snapshot
+    };
+    const bytes = new TextEncoder().encode(JSON.stringify(format));
+    const expectedVersion = versions.get(vault) ?? null;
+    for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {
+      try {
+        const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion);
+        versions.set(vault, newVersion);
+        return;
+      } catch (err) {
+        if (err instanceof PodVersionConflictError && attempt < MAX_CONFLICT_RETRIES - 1) {
+          const remote = await bundle.readBundle(vault);
+          if (remote) {
+            const remoteText = new TextDecoder().decode(remote.bytes);
+            const remoteFormat = JSON.parse(remoteText);
+            const localSnap = snapshots.get(vault) ?? {};
+            const mergedSnap = mergeSnapshots(remoteFormat.data, localSnap);
+            snapshots.set(vault, mergedSnap);
+            versions.set(vault, remote.version);
+          }
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+  async function maybeFlush(vault) {
+    if (autoFlush && batchDepth === 0) {
+      await flush(vault);
+    }
+  }
+  const store = {
+    name: bundle.name ?? "bundle",
+    async flush(vaultId) {
+      await flush(vaultId);
+    },
+    async batch(vaultId, fn) {
+      await load(vaultId);
+      batchDepth++;
+      try {
+        await fn();
+      } finally {
+        batchDepth--;
+      }
+      await flush(vaultId);
+    },
+    async get(vault, collection, id) {
+      const snap = await load(vault);
+      return snap[collection]?.[id] ?? null;
+    },
+    async put(vault, collection, id, envelope, expectedVersion) {
+      const snap = await load(vault);
+      if (expectedVersion !== void 0) {
+        const current = snap[collection]?.[id];
+        const currentVersion = current?._v ?? 0;
+        if (currentVersion !== expectedVersion) {
+          throw new ConflictError(
+            currentVersion,
+            `Expected version ${expectedVersion} but found ${currentVersion} on ${collection}/${id}`
+          );
+        }
+      }
+      snap[collection] ??= {};
+      snap[collection][id] = envelope;
+      await maybeFlush(vault);
+    },
+    async delete(vault, collection, id) {
+      const snap = await load(vault);
+      if (snap[collection]) {
+        delete snap[collection][id];
+        await maybeFlush(vault);
+      }
+    },
+    async list(vault, collection) {
+      const snap = await load(vault);
+      return Object.keys(snap[collection] ?? {});
+    },
+    async loadAll(vault) {
+      return await load(vault);
+    },
+    async saveAll(vault, data) {
+      snapshots.set(vault, data);
+      loaded.add(vault);
+      await flush(vault);
+    }
+  };
+  return store;
+}
+function mergeSnapshots(remote, local) {
+  const merged = {};
+  for (const [coll, records] of Object.entries(remote)) {
+    merged[coll] = { ...records };
+  }
+  for (const [coll, records] of Object.entries(local)) {
+    if (!merged[coll]) {
+      merged[coll] = { ...records };
+      continue;
+    }
+    for (const [id, envelope] of Object.entries(records)) {
+      const existing = merged[coll][id];
+      if (!existing || envelope._ts >= existing._ts) {
+        merged[coll][id] = envelope;
+      }
+    }
+  }
+  return merged;
+}
+function createPodStore(factory) {
+  return factory;
+}
+var wrapBundleStore = wrapPodStore;
+var createBundleStore = createPodStore;
+
+export {
+  wrapPodStore,
+  createPodStore,
+  wrapBundleStore,
+  createBundleStore
+};
+//# sourceMappingURL=chunk-RZ5SVOYR.js.map

package/dist/chunk-SLFHQTTW.js

@@ -0,0 +1,99 @@
+import {
+  dekKey
+} from "./chunk-ZICD77GM.js";
+import {
+  generateULID
+} from "./chunk-ZJADGNYF.js";
+import {
+  openEnvelopeJson
+} from "./chunk-XDYREZWE.js";
+import {
+  encrypt,
+  unwrapKey,
+  wrapKey
+} from "./chunk-CIE2BASH.js";
+import {
+  DelegationTargetMissingError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-party/team/delegation.ts
+var DELEGATIONS_COLLECTION = "_delegations";
+async function issueDelegation(store, vault, grantor, targetKek, delegationsDek, opts) {
+  if (!targetKek) {
+    throw new DelegationTargetMissingError(opts.toUser);
+  }
+  const tier = opts.tier;
+  const collectionName = opts.collection ?? null;
+  const dekLookupCollection = collectionName ?? "";
+  const sourceDek = collectionName ? grantor.deks.get(dekKey(collectionName, tier)) : void 0;
+  if (!sourceDek) {
+    throw new DelegationTargetMissingError(
+      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || "(any)"}`
+    );
+  }
+  const wrappedDek = await wrapKey(sourceDek, targetKek);
+  const until = typeof opts.until === "string" ? opts.until : opts.until.toISOString();
+  const token = {
+    id: generateULID(),
+    toUser: opts.toUser,
+    fromUser: grantor.userId,
+    tier,
+    collection: collectionName,
+    ...opts.record && { record: opts.record },
+    until,
+    wrappedDek,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const plaintext = JSON.stringify(token);
+  const { iv, data } = await encrypt(plaintext, delegationsDek);
+  const envelope = {
+    _noydb: 1,
+    _v: 1,
+    _ts: token.createdAt,
+    _iv: iv,
+    _data: data,
+    _by: grantor.userId
+  };
+  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope);
+  return token;
+}
+async function loadActiveDelegations(store, vault, user, delegationsDek, now = /* @__PURE__ */ new Date()) {
+  const ids = await store.list(vault, DELEGATIONS_COLLECTION);
+  const merged = [];
+  const nowIso = now.toISOString();
+  for (const id of ids) {
+    const env = await store.get(vault, DELEGATIONS_COLLECTION, id);
+    if (!env) continue;
+    let token;
+    try {
+      const plaintext = await openEnvelopeJson(env, delegationsDek);
+      token = JSON.parse(plaintext);
+    } catch {
+      continue;
+    }
+    if (token.toUser !== user.userId) continue;
+    if (token.until <= nowIso) continue;
+    if (!user.kek) continue;
+    let dek;
+    try {
+      dek = await unwrapKey(token.wrappedDek, user.kek);
+    } catch {
+      continue;
+    }
+    const k = token.collection ? dekKey(token.collection, token.tier) : `__any#${token.tier}`;
+    user.deks.set(k, dek);
+    merged.push(token);
+  }
+  return merged;
+}
+async function revokeDelegation(store, vault, id) {
+  await store.delete(vault, DELEGATIONS_COLLECTION, id);
+}
+
+export {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+};
+//# sourceMappingURL=chunk-SLFHQTTW.js.map