@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-KXKLKJW4.js

@@ -1,49 +0,0 @@
-import {
-  openEnvelopeJson
-} from "./chunk-XHD3L3JO.js";
-import {
-  encrypt
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-
-// src/with-shape/persisted-schemas/storage.ts
-var SCHEMAS_COLLECTION = "_schemas";
-async function loadPersistedSchemaEntry(store, vault, collection, dek) {
-  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection);
-  if (!envelope) return { version: 0, payload: void 0 };
-  const version = envelope._v;
-  try {
-    const plaintext = await openEnvelopeJson(envelope, dek);
-    const parsed = JSON.parse(plaintext);
-    if (parsed._noydb_schema !== 1) return { version, payload: void 0 };
-    return { version, payload: parsed };
-  } catch {
-    return { version, payload: void 0 };
-  }
-}
-async function loadPersistedSchema(store, vault, collection, dek) {
-  return (await loadPersistedSchemaEntry(store, vault, collection, dek)).payload;
-}
-async function savePersistedSchema(store, vault, collection, dek, payload, expectedVersion) {
-  const json = JSON.stringify(payload);
-  const { iv, data } = await encrypt(json, dek);
-  const baseVersion = expectedVersion ?? (await store.get(vault, SCHEMAS_COLLECTION, collection))?._v ?? 0;
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: baseVersion + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data
-  };
-  await store.put(vault, SCHEMAS_COLLECTION, collection, env, expectedVersion);
-}
-
-export {
-  SCHEMAS_COLLECTION,
-  loadPersistedSchemaEntry,
-  loadPersistedSchema,
-  savePersistedSchema
-};
-//# sourceMappingURL=chunk-KXKLKJW4.js.map

package/dist/chunk-KYC4LIEU.js

@@ -1,123 +0,0 @@
-import {
-  IllegalTransitionError,
-  RecordLockedError,
-  ValidationError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-audit/guards/with-guard.ts
-function withGuard(strategy) {
-  if (!strategy.collection || strategy.collection.length === 0) {
-    throw new ValidationError("withGuard: collection name is required");
-  }
-  return {
-    __noydb_strategy: "guard",
-    spec: strategy
-  };
-}
-
-// src/with-audit/guards/immutable-guard.ts
-function recordId(record) {
-  const id = record?.id;
-  return typeof id === "string" ? id : "";
-}
-function immutableGuard(config) {
-  const { collection, after, appendOnly, amendmentRoles, amendmentInvariant } = config;
-  if (appendOnly && after !== void 0) {
-    throw new ValidationError("immutableGuard: `after` and `appendOnly` are mutually exclusive");
-  }
-  if (!appendOnly && after === void 0) {
-    throw new ValidationError("immutableGuard: provide `after` or `appendOnly: true`");
-  }
-  const isImmutable = appendOnly ? () => true : after;
-  const reason = appendOnly ? "append-only collection" : "record is immutable after issue";
-  const spec = {
-    collection,
-    // Block updates to an already-immutable record. Inserts (existing
-    // null) and the transition write that first makes the record
-    // immutable are allowed — `after` reads the prior state.
-    check: (incoming, ctx) => {
-      if (ctx.existing !== null && isImmutable(ctx.existing)) {
-        throw new RecordLockedError(collection, recordId(incoming), reason);
-      }
-    },
-    // Block deletes of an immutable record.
-    onDelete: (existing) => {
-      if (isImmutable(existing)) {
-        throw new RecordLockedError(collection, recordId(existing), reason);
-      }
-    },
-    // The authorized override: inside an amendment transaction the
-    // check/onDelete are skipped and the change is ledgered. By default
-    // there is no extra invariant — the amendment itself is the
-    // sanctioned exception. Callers may supply `amendmentInvariant` to
-    // keep a constraint inviolable even under amendment (e.g. forbid
-    // deletes, or preserve a cross-record sum); a throw reverts the
-    // amendment and surfaces as `InvariantError`.
-    amendment: {
-      roles: amendmentRoles ?? ["admin", "owner"],
-      invariant: amendmentInvariant ?? (() => {
-      })
-    }
-  };
-  return withGuard(spec);
-}
-
-// src/with-audit/guards/transition-guard.ts
-function recordId2(record) {
-  const id = record?.id;
-  return typeof id === "string" ? id : "";
-}
-function stateOf(record, field) {
-  const v = record[field];
-  return typeof v === "string" ? v : String(v);
-}
-function transitionGuard(config) {
-  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config;
-  const allowIdempotent = config.allowIdempotent ?? true;
-  if (!field) {
-    throw new ValidationError("transitionGuard: `field` is required");
-  }
-  if (transitions === void 0 || typeof transitions !== "object") {
-    throw new ValidationError("transitionGuard: `transitions` must be a state\u2192states map");
-  }
-  const spec = {
-    collection,
-    check: (incoming, ctx) => {
-      const rec = incoming;
-      const to = stateOf(rec, field);
-      if (ctx.existing === null) {
-        if (initial !== void 0 && !initial.includes(to)) {
-          throw new IllegalTransitionError(collection, recordId2(rec), "(none)", to);
-        }
-        return;
-      }
-      const from = stateOf(ctx.existing, field);
-      if (from === to) {
-        if (allowIdempotent) return;
-        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
-      }
-      const allowed = transitions[from] ?? [];
-      if (!allowed.includes(to)) {
-        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
-      }
-    },
-    // The authorized override: inside an amendment transaction the check
-    // is skipped and the change is ledgered. By default no extra invariant
-    // — the amendment itself is the sanctioned exception. Callers may
-    // supply `amendmentInvariant` to keep a constraint inviolable even
-    // under amendment; a throw reverts the amendment as `InvariantError`.
-    amendment: {
-      roles: amendmentRoles ?? ["admin", "owner"],
-      invariant: amendmentInvariant ?? (() => {
-      })
-    }
-  };
-  return withGuard(spec);
-}
-
-export {
-  withGuard,
-  immutableGuard,
-  transitionGuard
-};
-//# sourceMappingURL=chunk-KYC4LIEU.js.map

package/dist/chunk-LEOXZY36.js

@@ -1,130 +0,0 @@
-import {
-  linkCollectionName,
-  linkRowKey
-} from "./chunk-PEDZFFKW.js";
-import {
-  openEnvelopeJson
-} from "./chunk-XHD3L3JO.js";
-import {
-  encrypt
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-import {
-  NoydbError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-shape/links/link-set.ts
-var LinkSet = class {
-  constructor(adapter, vault, name, spec, encrypted, getDEK, actor, emitter, endpointExists) {
-    this.adapter = adapter;
-    this.vault = vault;
-    this.name = name;
-    this.spec = spec;
-    this.encrypted = encrypted;
-    this.getDEK = getDEK;
-    this.actor = actor;
-    this.emitter = emitter;
-    this.endpointExists = endpointExists;
-    this.collName = linkCollectionName(name);
-  }
-  adapter;
-  vault;
-  name;
-  spec;
-  encrypted;
-  getDEK;
-  actor;
-  emitter;
-  endpointExists;
-  collName;
-  dekPromise = null;
-  dek() {
-    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
-    return this.dekPromise;
-  }
-  async encryptEntry(entry, version) {
-    const json = JSON.stringify(entry);
-    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
-    if (!this.encrypted) return { ...base, _iv: "", _data: json };
-    const { iv, data } = await encrypt(json, await this.dek());
-    return { ...base, _iv: iv, _data: data };
-  }
-  async decryptEntry(env) {
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
-    return JSON.parse(json);
-  }
-  async connect(aId, bId, meta) {
-    if (!await this.endpointExists(this.spec.a, aId)) {
-      throw new LinkEndpointError(this.name, this.spec.a, aId);
-    }
-    if (!await this.endpointExists(this.spec.b, bId)) {
-      throw new LinkEndpointError(this.name, this.spec.b, bId);
-    }
-    const key = linkRowKey(aId, bId);
-    const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
-    const existing = await this.adapter.get(this.vault, this.collName, key);
-    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
-    await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
-    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
-  }
-  async disconnect(aId, bId) {
-    const key = linkRowKey(aId, bId);
-    const existing = await this.adapter.get(this.vault, this.collName, key);
-    if (!existing) return;
-    await this.adapter.delete(this.vault, this.collName, key);
-    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "delete" });
-  }
-  async has(aId, bId) {
-    return await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId)) !== null;
-  }
-  async of(id) {
-    const rows = await this.list();
-    return rows.filter((r) => r.a === id || r.b === id);
-  }
-  async list() {
-    const keys = await this.adapter.list(this.vault, this.collName);
-    const out = [];
-    for (const key of keys) {
-      const env = await this.adapter.get(this.vault, this.collName, key);
-      if (!env) continue;
-      const e = await this.decryptEntry(env);
-      out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
-    }
-    return out;
-  }
-  // ── Vault-internal cascade helpers ──────────────────────────────────
-  /** @internal — rows where the deleted endpoint id matches the relevant slot. */
-  async _rowsTouchingEndpoint(collection, id) {
-    const rows = await this.list();
-    return rows.filter(
-      (r) => this.spec.a === collection && r.a === id || this.spec.b === collection && r.b === id
-    );
-  }
-  /** @internal — the storage collection name (for tx pre-image capture). */
-  get _collectionName() {
-    return this.collName;
-  }
-};
-var LinkEndpointError = class extends NoydbError {
-  link;
-  endpoint;
-  missingId;
-  constructor(link, endpoint, missingId) {
-    super(
-      "LINK_ENDPOINT",
-      `link("${link}").connect: endpoint "${endpoint}" has no record "${missingId}".`
-    );
-    this.name = "LinkEndpointError";
-    this.link = link;
-    this.endpoint = endpoint;
-    this.missingId = missingId;
-  }
-};
-
-export {
-  LinkSet,
-  LinkEndpointError
-};
-//# sourceMappingURL=chunk-LEOXZY36.js.map

package/dist/chunk-M5I354EE.js

@@ -1,235 +0,0 @@
-import {
-  resolveManagedSecret
-} from "./chunk-CJEMA2Z6.js";
-import {
-  parseExtractedPartitionBody,
-  readPod,
-  readPodHeader
-} from "./chunk-Q2KVKTC2.js";
-import {
-  createOwnerKeyring
-} from "./chunk-6CU3FN74.js";
-import {
-  LedgerStore
-} from "./chunk-WNA6T3MA.js";
-import {
-  LEDGER_COLLECTION
-} from "./chunk-I7FD46FF.js";
-import {
-  openEnvelopeJson
-} from "./chunk-XHD3L3JO.js";
-import {
-  base64ToBuffer,
-  wrapKey
-} from "./chunk-AUR7MRHA.js";
-import {
-  AdoptionStateError,
-  TransferSealError,
-  ValidationError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-cargo/adopt-partition.ts
-async function unsealDeks(seal, transferKey) {
-  if (transferKey.byteLength !== 32) {
-    throw new TransferSealError(
-      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
-    );
-  }
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
-  const raw = base64ToBuffer(seal.payload);
-  let plaintext;
-  try {
-    plaintext = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: raw.slice(0, 12) },
-      key,
-      raw.slice(12)
-    );
-  } catch {
-    throw new TransferSealError(
-      "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
-    );
-  }
-  let dekMap;
-  try {
-    dekMap = JSON.parse(new TextDecoder().decode(plaintext));
-  } catch {
-    throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
-  }
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collection, b64] of Object.entries(dekMap)) {
-    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
-    deks.set(collection, dek);
-  }
-  return deks;
-}
-async function adoptPartition(bundleBytes, opts) {
-  const { transferKey, destinationStore, vaultName } = opts;
-  const header = readPodHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new ValidationError(
-      "adoptPartition requires an extracted-partition bundle with a transfer seal. For ordinary backups use readPod + vault.load."
-    );
-  }
-  const { dumpJson } = await readPod(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  await unsealDeks(seal, transferKey);
-  const existing = await destinationStore.get(vaultName, "_meta", "adoption");
-  if (existing) {
-    const prior = JSON.parse(existing._data);
-    if (prior.sealId === seal.sealId) {
-      throw new AdoptionStateError(
-        `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
-      );
-    }
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds an adopted partition (sealId ${prior.sealId}); adopting a different partition (sealId ${seal.sealId}) here would overwrite it. Adopt into a fresh vaultName instead.`
-    );
-  }
-  const existingKeyring = await destinationStore.list(vaultName, "_keyring");
-  if (existingKeyring.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds a keyring (an unrelated owner exists at this slot); adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`
-    );
-  }
-  const backup = JSON.parse(dump);
-  await destinationStore.saveAll(vaultName, backup.collections);
-  if (backup._internal) {
-    for (const [collection, records] of Object.entries(backup._internal)) {
-      for (const [id, envelope] of Object.entries(records)) {
-        await destinationStore.put(vaultName, collection, id, envelope);
-      }
-    }
-  }
-  const adoptedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true, transferSeal: seal };
-  await destinationStore.put(vaultName, "_meta", "adoption", {
-    _noydb: 1,
-    _v: 1,
-    _ts: adoptedAt,
-    _iv: "",
-    _data: JSON.stringify(adoption)
-  });
-  return { vaultName, needsOwner: true, sealId: seal.sealId };
-}
-function isManaged(o) {
-  return "passphraseMode" in o && o.passphraseMode === "managed";
-}
-async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
-  const { userId, transferKey } = opts;
-  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === "shamir")) {
-    throw new AdoptionStateError(
-      "managed-mode adoption requires at least one strong (shamir) recovery profile in `recovery` \u2014 paper alone is not strong when there is no user passphrase to fall back on."
-    );
-  }
-  const adoptionEnv = await store.get(vaultName, "_meta", "adoption");
-  if (!adoptionEnv) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
-    );
-  }
-  const adoption = JSON.parse(adoptionEnv._data);
-  if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
-    );
-  }
-  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey);
-  const existingKeyring = await store.get(vaultName, "_keyring", userId);
-  const otherOwners = (await store.list(vaultName, "_keyring")).filter((u) => u !== userId);
-  if (otherOwners.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has a keyring for a different owner; cannot create owner "${userId}".`
-    );
-  }
-  const partitionCollections = [...partitionDeks.keys()];
-  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
-  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
-  if (!ownerMinted) {
-    const passphrase = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.passphrase;
-    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase);
-    const env = await store.get(vaultName, "_keyring", userId);
-    if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
-    const keyringFile = JSON.parse(env._data);
-    const kek = unlocked.kek;
-    if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
-    const mergedDeks = { ...keyringFile.deks };
-    for (const [collection, dek] of partitionDeks) {
-      mergedDeks[collection] = await wrapKey(dek, kek);
-    }
-    const mergedFile = { ...keyringFile, deks: mergedDeks };
-    await store.put(vaultName, "_keyring", userId, { ...env, _data: JSON.stringify(mergedFile) });
-  }
-  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION);
-  if (ledgerDek) {
-    const ledger = new LedgerStore({
-      adapter: store,
-      vault: vaultName,
-      encrypted: true,
-      getDEK: async () => ledgerDek,
-      actor: userId
-    });
-    const creationReason = `creation-of-new-owner:${userId}`;
-    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`;
-    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason));
-    if (!recordedReasons.has(creationReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: creationReason });
-    }
-    if (!recordedReasons.has(consumedReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: consumedReason });
-    }
-  }
-  if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-AMEOU456.js");
-    const db = await createNoydb({
-      store,
-      user: userId,
-      passphraseMode: "managed",
-      sealingKey: opts.sealingKey,
-      shamirRecovery: opts.shamirRecovery
-    });
-    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery });
-  }
-  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await store.put(vaultName, "_meta", "adoption", { ...adoptionEnv, _data: JSON.stringify(consumed) });
-  return { vaultName, userId };
-}
-
-// src/with-cargo/decrypt-partition.ts
-async function decryptExtractedPartition(bundleBytes, transferKey) {
-  const header = readPodHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new Error("decryptExtractedPartition: bundle is not an extracted-partition.");
-  }
-  const { dumpJson } = await readPod(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  const deks = await unsealDeks(seal, transferKey);
-  const backup = JSON.parse(dump);
-  const out = {};
-  for (const [collection, byId] of Object.entries(backup.collections)) {
-    const dek = deks.get(collection);
-    if (dek === void 0) continue;
-    const recs = [];
-    for (const [id, env] of Object.entries(byId)) {
-      const plaintext = await openEnvelopeJson(env, dek);
-      const body = JSON.parse(plaintext);
-      recs.push({
-        id,
-        record: { ...body, id },
-        ts: env._ts,
-        version: env._v,
-        ...env._source !== void 0 ? { source: env._source } : {},
-        ...env._sourceTs !== void 0 ? { sourceTs: env._sourceTs } : {}
-      });
-    }
-    out[collection] = recs;
-  }
-  return out;
-}
-
-export {
-  unsealDeks,
-  adoptPartition,
-  createOwnerOnAdoptedPartition,
-  decryptExtractedPartition
-};
-//# sourceMappingURL=chunk-M5I354EE.js.map

package/dist/chunk-MK2BSS44.js

@@ -1,34 +0,0 @@
-import {
-  TierNotGrantedError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-party/team/tiers.ts
-function dekKey(collection, tier) {
-  if (tier <= 0) return collection;
-  return `${collection}#${tier}`;
-}
-function effectiveClearance(keyring, collection) {
-  let max = 0;
-  const prefix = `${collection}#`;
-  for (const key of keyring.deks.keys()) {
-    if (!key.startsWith(prefix)) continue;
-    const suffix = key.slice(prefix.length);
-    const n = Number.parseInt(suffix, 10);
-    if (Number.isFinite(n) && n > max) max = n;
-  }
-  return max;
-}
-function assertTierAccess(keyring, collection, tier) {
-  if (tier <= 0) return;
-  if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return;
-  if (!keyring.deks.has(dekKey(collection, tier))) {
-    throw new TierNotGrantedError(collection, tier);
-  }
-}
-
-export {
-  dekKey,
-  effectiveClearance,
-  assertTierAccess
-};
-//# sourceMappingURL=chunk-MK2BSS44.js.map

package/dist/chunk-MSVY7ULZ.js

@@ -1,70 +0,0 @@
-import {
-  envelopeBodyForHash
-} from "./chunk-XHD3L3JO.js";
-import {
-  sha256Hex
-} from "./chunk-AUR7MRHA.js";
-
-// src/with-commit/history/ledger/entry.ts
-function canonicalJson(value) {
-  if (value === null) return "null";
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new Error(
-        `canonicalJson: refusing to encode non-finite number ${String(value)}`
-      );
-    }
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string") return JSON.stringify(value);
-  if (typeof value === "bigint") {
-    throw new Error("canonicalJson: BigInt is not JSON-serializable");
-  }
-  if (typeof value === "undefined" || typeof value === "function") {
-    throw new Error(
-      `canonicalJson: refusing to encode ${typeof value} \u2014 include all fields explicitly`
-    );
-  }
-  if (Array.isArray(value)) {
-    return "[" + value.map((v) => canonicalJson(v)).join(",") + "]";
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    const parts = [];
-    for (const key of keys) {
-      parts.push(JSON.stringify(key) + ":" + canonicalJson(obj[key]));
-    }
-    return "{" + parts.join(",") + "}";
-  }
-  throw new Error(`canonicalJson: unexpected value type: ${typeof value}`);
-}
-async function sha256Hex2(input) {
-  return sha256Hex(new TextEncoder().encode(input));
-}
-async function hashEntry(entry) {
-  return sha256Hex2(canonicalJson(entry));
-}
-function paddedIndex(index) {
-  return String(index).padStart(10, "0");
-}
-function parseIndex(key) {
-  return Number.parseInt(key, 10);
-}
-
-// src/with-commit/history/ledger/hash.ts
-async function envelopePayloadHash(envelope) {
-  if (!envelope) return "";
-  return sha256Hex2(envelopeBodyForHash(envelope));
-}
-
-export {
-  canonicalJson,
-  sha256Hex2 as sha256Hex,
-  hashEntry,
-  paddedIndex,
-  parseIndex,
-  envelopePayloadHash
-};
-//# sourceMappingURL=chunk-MSVY7ULZ.js.map