@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-NNWK3PSY.js

@@ -1,135 +0,0 @@
-import {
-  freezeSnapshotOnly
-} from "./chunk-GX2BYNCT.js";
-import {
-  resolveManagedSecret
-} from "./chunk-CJEMA2Z6.js";
-import {
-  createOwnerKeyring
-} from "./chunk-6CU3FN74.js";
-import {
-  wrapKey
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-import {
-  PermissionDeniedError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-party/team/deed.ts
-var DEED_RECORD_ID = "deed";
-async function createDeedOwner(store, vault, ownerUserId, sealing) {
-  const passphrase = await resolveManagedSecret(store, vault, sealing);
-  const keyring = await createOwnerKeyring(store, vault, ownerUserId, passphrase);
-  await saveDeedMarker(store, vault, {
-    ownerUserId,
-    sealedUnder: sealing.id,
-    latent: true,
-    issuedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  return keyring;
-}
-async function loadDeedMarker(store, vault) {
-  const envelope = await store.get(vault, "_meta", DEED_RECORD_ID);
-  if (!envelope) return null;
-  let payload;
-  try {
-    payload = JSON.parse(envelope._data);
-  } catch {
-    return null;
-  }
-  if (typeof payload !== "object" || payload === null) return null;
-  const r = payload;
-  if (r._noydb_deed !== 1) return null;
-  if (typeof r.ownerUserId !== "string" || typeof r.sealedUnder !== "string" || r.latent !== true || typeof r.issuedAt !== "string") {
-    return null;
-  }
-  const marker = {
-    ownerUserId: r.ownerUserId,
-    sealedUnder: r.sealedUnder,
-    latent: true,
-    issuedAt: r.issuedAt,
-    ...typeof r.liberatedAt === "string" ? { liberatedAt: r.liberatedAt } : {}
-  };
-  return marker;
-}
-async function isDeedVault(store, vault) {
-  return await loadDeedMarker(store, vault) !== null;
-}
-async function saveDeedMarker(store, vault, marker) {
-  const persisted = { _noydb_deed: 1, ...marker };
-  const prior = await store.get(vault, "_meta", DEED_RECORD_ID);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    // AES-GCM bypassed — the marker is plaintext audit metadata.
-    _iv: "",
-    _data: JSON.stringify(persisted)
-  };
-  await store.put(vault, "_meta", DEED_RECORD_ID, env);
-}
-
-// src/with-party/custody/liberate.ts
-async function liberateVault(vault, opts) {
-  await vault.noydb.checkGate(vault.name, "liberate-vault", opts.factors);
-  const { name: vaultName, adapter, keyring } = vault._introspectState();
-  if (keyring.role !== "custodian") {
-    throw new PermissionDeniedError(
-      "liberation is claimed only by the custodian (the de-facto authority holding the DEKs)"
-    );
-  }
-  const existing = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
-  if (existing) {
-    throw new PermissionDeniedError(
-      `liberateVault: newOwnerId "${opts.newOwnerId}" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`
-    );
-  }
-  const collections = await listOperationalCollections(vault);
-  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId });
-  const newOwner = await createOwnerKeyring(adapter, vaultName, opts.newOwnerId, opts.newOwnerPassphrase);
-  if (!newOwner.kek) {
-    throw new PermissionDeniedError(
-      `new owner keyring for "${opts.newOwnerId}" has no KEK to re-wrap the incumbent DEKs under`
-    );
-  }
-  const env = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
-  if (!env) {
-    throw new PermissionDeniedError(`new owner keyring for "${opts.newOwnerId}" did not persist`);
-  }
-  const keyringFile = JSON.parse(env._data);
-  const mergedDeks = { ...keyringFile.deks };
-  for (const [collection, dek] of keyring.deks) {
-    mergedDeks[collection] = await wrapKey(dek, newOwner.kek);
-  }
-  const mergedFile = { ...keyringFile, deks: mergedDeks };
-  await adapter.put(vaultName, "_keyring", opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) });
-  await vault._getLedgerOrNull()?.append({
-    op: "lifecycle",
-    collection: "",
-    id: "",
-    version: 0,
-    actor: opts.newOwnerId,
-    payloadHash: "",
-    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`
-  });
-  const marker = await loadDeedMarker(adapter, vaultName);
-  if (marker) {
-    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  }
-  return { snapshot };
-}
-async function listOperationalCollections(vault) {
-  const { keyring } = vault._introspectState();
-  return [...keyring.deks.keys()].filter((c) => !c.startsWith("_"));
-}
-
-export {
-  DEED_RECORD_ID,
-  createDeedOwner,
-  loadDeedMarker,
-  isDeedVault,
-  liberateVault
-};
-//# sourceMappingURL=chunk-NNWK3PSY.js.map

package/dist/chunk-NSZ6J5DF.js

@@ -1,59 +0,0 @@
-import {
-  openEnvelopeJson
-} from "./chunk-XHD3L3JO.js";
-import {
-  encrypt
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-import {
-  ConflictError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-audit/attestation/signer.ts
-import { generateDocSigningKeyPair } from "@noy-db/attestation";
-var ATTESTATIONS_COLLECTION = "_attestations";
-var SIGNER_RECORD_ID = "_signer";
-var REVOKED_RECORD_ID = "_revoked";
-async function loadSigner(store, vault, getDEK) {
-  const existing = await store.get(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID);
-  if (!existing) return null;
-  const dek = await getDEK(ATTESTATIONS_COLLECTION);
-  const json = await openEnvelopeJson(existing, dek);
-  return JSON.parse(json);
-}
-async function loadOrCreateSigner(store, vault, getDEK) {
-  const existing = await loadSigner(store, vault, getDEK);
-  if (existing) return existing;
-  const dek = await getDEK(ATTESTATIONS_COLLECTION);
-  const signer = await generateDocSigningKeyPair();
-  const { iv, data } = await encrypt(JSON.stringify(signer), dek);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data
-  };
-  try {
-    await store.put(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID, env, 0);
-    return signer;
-  } catch (e) {
-    if (!(e instanceof ConflictError)) throw e;
-    const winner = await loadSigner(store, vault, getDEK);
-    if (!winner) {
-      throw new ConflictError(0, "loadOrCreateSigner: signer mint lost a concurrent race but the winning record could not be re-read.");
-    }
-    return winner;
-  }
-}
-
-export {
-  ATTESTATIONS_COLLECTION,
-  SIGNER_RECORD_ID,
-  REVOKED_RECORD_ID,
-  loadSigner,
-  loadOrCreateSigner
-};
-//# sourceMappingURL=chunk-NSZ6J5DF.js.map

package/dist/chunk-NUEFXLZU.js

@@ -1,59 +0,0 @@
-import {
-  ATTESTATIONS_COLLECTION,
-  loadOrCreateSigner
-} from "./chunk-NSZ6J5DF.js";
-import {
-  generateULID
-} from "./chunk-ZJADGNYF.js";
-import {
-  encrypt
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-import {
-  AttestationError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-audit/attestation/issue.ts
-import {
-  computeFieldHashes,
-  signPayloadCore,
-  encodeQr,
-  bytesToB64url
-} from "@noy-db/attestation";
-async function issueAttestationCore(ctx, args) {
-  if (ctx.role !== "owner") {
-    throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`);
-  }
-  const src = await ctx.readRecord(args.collection, args.id);
-  if (!src) throw new AttestationError(`issueAttestation: source record '${args.collection}/${args.id}' not found.`);
-  const dek = await ctx.getDEK();
-  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => Promise.resolve(dek));
-  const saltB64 = bytesToB64url(crypto.getRandomValues(new Uint8Array(16)));
-  let fieldHashes;
-  try {
-    fieldHashes = await computeFieldHashes(saltB64, args.fieldSchema, src.record);
-  } catch (e) {
-    throw new AttestationError(`issueAttestation: ${e.message}`);
-  }
-  const docId = generateULID();
-  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64);
-  const payload = { v: 1, docId, salt: saltB64, alg: "ed25519", keyId: signer.keyId, fieldHashes, sig };
-  const index = {
-    docId,
-    issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    keyId: signer.keyId,
-    fieldPaths: args.fieldSchema.fields.map((f) => f.path),
-    sourceRefs: [{ collection: args.collection, id: args.id, version: src.version }]
-  };
-  const { iv, data } = await encrypt(JSON.stringify(index), dek);
-  const env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: index.issuedAt, _iv: iv, _data: data };
-  await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, docId, env);
-  return { docId, qr: encodeQr(payload), payload, keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
-}
-
-export {
-  issueAttestationCore
-};
-//# sourceMappingURL=chunk-NUEFXLZU.js.map

package/dist/chunk-NYVQCZ54.js

@@ -1,261 +0,0 @@
-import {
-  encrypt
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-
-// src/with-shape/blobs/export-blobs.ts
-var ExportBlobsAbortedError = class extends Error {
-  constructor(reason) {
-    super(`exportBlobs aborted: ${reason}`);
-    this.name = "ExportBlobsAbortedError";
-  }
-};
-var EXPORT_AUDIT_COLLECTION = "_export_audit";
-function createExportBlobsHandle(actor, listAccessibleCollections, getCollection, writeAudit, options) {
-  let aborted = false;
-  const abort = () => {
-    aborted = true;
-  };
-  if (options.signal) {
-    if (options.signal.aborted) aborted = true;
-    options.signal.addEventListener("abort", () => {
-      aborted = true;
-    });
-  }
-  function assertLive() {
-    if (aborted) throw new ExportBlobsAbortedError("aborted by caller");
-  }
-  const allowlist = options.collections ? new Set(options.collections) : null;
-  let auditPromise = null;
-  function writeAuditOnce() {
-    if (!auditPromise) {
-      auditPromise = writeAudit({
-        id: generateBatchId(),
-        mechanism: "exportBlobs",
-        actor,
-        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        collections: options.collections ?? null,
-        predicate: Boolean(options.where),
-        afterBlobId: options.afterBlobId ?? null
-      });
-    }
-    return auditPromise;
-  }
-  async function* generate() {
-    await writeAuditOnce();
-    assertLive();
-    const allCollections = await listAccessibleCollections();
-    const targets = allCollections.filter((name) => {
-      if (name.startsWith("_")) return false;
-      if (allowlist && !allowlist.has(name)) return false;
-      return true;
-    });
-    let resumeCursorHit = options.afterBlobId === void 0;
-    for (const collectionName of targets) {
-      if (aborted) return;
-      const coll = getCollection(collectionName);
-      const records = await coll.list().catch(() => []);
-      for (const record of records) {
-        if (aborted) return;
-        assertLive();
-        const idField = record.id;
-        if (typeof idField !== "string") continue;
-        if (options.where && !options.where(record, { collection: collectionName, id: idField })) continue;
-        const blobSet = coll.blob(idField);
-        const slots = await blobSet.list().catch(() => []);
-        for (const slot of slots) {
-          if (aborted) return;
-          if (!resumeCursorHit) {
-            if (slot.eTag === options.afterBlobId) {
-              resumeCursorHit = true;
-            }
-            continue;
-          }
-          const bytes = await blobSet.get(slot.name);
-          if (!bytes) continue;
-          const item = {
-            blobId: slot.eTag,
-            recordRef: { collection: collectionName, id: idField, slot: slot.name },
-            bytes,
-            meta: {
-              size: slot.size,
-              filename: slot.filename,
-              ...slot.mimeType !== void 0 && { mimeType: slot.mimeType },
-              ...slot.uploadedAt !== void 0 && { createdAt: slot.uploadedAt }
-            }
-          };
-          yield item;
-        }
-      }
-    }
-  }
-  const handle = {
-    abort,
-    get aborted() {
-      return aborted;
-    },
-    [Symbol.asyncIterator]: () => generate()
-  };
-  return handle;
-}
-function generateBatchId() {
-  const raw = globalThis.crypto.getRandomValues(new Uint8Array(16));
-  let s = "";
-  for (const b of raw) s += b.toString(16).padStart(2, "0");
-  return `batch-${Date.now().toString(36)}-${s.slice(0, 12)}`;
-}
-
-// src/with-shape/blobs/blob-compaction.ts
-var BLOB_EVICTION_AUDIT_COLLECTION = "_blob_eviction_audit";
-async function runCompaction(ctx, options = {}) {
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const maxEvictions = options.maxEvictions ?? Infinity;
-  const dryRun = options.dryRun === true;
-  const allCollections = await ctx.listCollections();
-  const byCollection = {};
-  let evicted = 0;
-  let records = 0;
-  let auditEntries = 0;
-  let held = 0;
-  let collectionsWithPolicy = 0;
-  outer: for (const collectionName of allCollections) {
-    if (collectionName.startsWith("_")) continue;
-    const config = ctx.getBlobFields(collectionName);
-    if (!config) continue;
-    const configuredSlots = Object.keys(config);
-    if (configuredSlots.length === 0) continue;
-    collectionsWithPolicy += 1;
-    byCollection[collectionName] = { records: 0, evicted: 0 };
-    const ids = await ctx.listRecords(collectionName);
-    for (const recordId of ids) {
-      if (evicted >= maxEvictions) break outer;
-      const record = await ctx.getRecord(collectionName, recordId).catch(() => null);
-      if (record === null) continue;
-      records += 1;
-      byCollection[collectionName].records += 1;
-      const slots = await ctx.listSlots(collectionName, recordId).catch(() => []);
-      for (const slot of slots) {
-        if (evicted >= maxEvictions) break outer;
-        const policy = config[slot.name];
-        if (!policy) continue;
-        const reason = evaluatePolicy(policy, record, slot, now);
-        if (!reason) continue;
-        if (isHeld(policy, record, now)) {
-          held += 1;
-          continue;
-        }
-        if (!dryRun) {
-          await ctx.deleteSlot(collectionName, recordId, slot.name);
-          await writeAuditEntry(ctx, {
-            id: generateEvictionId(collectionName, recordId, slot.name),
-            collection: collectionName,
-            recordId,
-            slotName: slot.name,
-            blobHash: slot.eTag,
-            reason,
-            evictedAt: now.toISOString(),
-            actor: ctx.actor
-          });
-          auditEntries += 1;
-        }
-        evicted += 1;
-        byCollection[collectionName].evicted += 1;
-      }
-    }
-  }
-  return {
-    evicted,
-    records,
-    collections: collectionsWithPolicy,
-    auditEntries,
-    held,
-    byCollection
-  };
-}
-function isHeld(policy, record, now) {
-  if (policy.legalHold) {
-    try {
-      if (policy.legalHold(record)) return true;
-    } catch {
-      return true;
-    }
-  }
-  if (policy.retainUntil) {
-    try {
-      const until = policy.retainUntil(record);
-      if (until !== null && until !== void 0) {
-        const t = until instanceof Date ? until.getTime() : typeof until === "number" ? until : Date.parse(String(until));
-        if (!Number.isFinite(t)) return true;
-        if (t > now.getTime()) return true;
-      }
-    } catch {
-      return true;
-    }
-  }
-  return false;
-}
-function evaluatePolicy(policy, record, slot, now) {
-  let ttlTriggered = false;
-  let predicateTriggered = false;
-  if (policy.retainDays !== void 0 && policy.retainDays > 0) {
-    const uploadedAt = Date.parse(slot.uploadedAt);
-    if (Number.isFinite(uploadedAt)) {
-      const ageMs = now.getTime() - uploadedAt;
-      const limitMs = policy.retainDays * 864e5;
-      if (ageMs > limitMs) ttlTriggered = true;
-    }
-  }
-  if (policy.evictWhen) {
-    try {
-      if (policy.evictWhen(record)) predicateTriggered = true;
-    } catch {
-    }
-  }
-  if (ttlTriggered && predicateTriggered) return "both";
-  if (ttlTriggered) return "ttl";
-  if (predicateTriggered) return "predicate";
-  return null;
-}
-function generateEvictionId(collection, recordId, slotName) {
-  const rand = globalThis.crypto.getRandomValues(new Uint8Array(8));
-  let suffix = "";
-  for (const b of rand) suffix += b.toString(16).padStart(2, "0");
-  return `${collection}__${recordId}__${slotName}__${suffix}`;
-}
-async function writeAuditEntry(ctx, entry) {
-  const json = JSON.stringify(entry);
-  let envelope;
-  if (ctx.encrypted) {
-    const dek = await ctx.getDEK(BLOB_EVICTION_AUDIT_COLLECTION);
-    const { iv, data } = await encrypt(json, dek);
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: 1,
-      _ts: entry.evictedAt,
-      _iv: iv,
-      _data: data,
-      _by: entry.actor
-    };
-  } else {
-    envelope = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: 1,
-      _ts: entry.evictedAt,
-      _iv: "",
-      _data: json,
-      _by: entry.actor
-    };
-  }
-  await ctx.adapter.put(ctx.vault, BLOB_EVICTION_AUDIT_COLLECTION, entry.id, envelope);
-}
-
-export {
-  ExportBlobsAbortedError,
-  EXPORT_AUDIT_COLLECTION,
-  createExportBlobsHandle,
-  BLOB_EVICTION_AUDIT_COLLECTION,
-  runCompaction
-};
-//# sourceMappingURL=chunk-NYVQCZ54.js.map

package/dist/chunk-OQAODTYR.js

@@ -1,45 +0,0 @@
-import {
-  writePod
-} from "./chunk-Q2KVKTC2.js";
-
-// src/with-audit/portability/export-accessible.ts
-function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
-  let collections;
-  if (keyring.role === "operator" || keyring.role === "client") {
-    collections = Object.entries(keyring.permissions).filter(([, mode]) => !writableOnly || mode === "rw").map(([c]) => c);
-  }
-  if (scope?.collections) {
-    const allow = new Set(scope.collections);
-    collections = (collections ?? [...scope.collections]).filter((c) => allow.has(c));
-  }
-  return collections;
-}
-async function buildAccessibleBundle(vault, collections, reKey, compression = "auto") {
-  return writePod(vault, {
-    compression,
-    ...collections !== void 0 ? { collections } : {},
-    ...reKey ? { exportPassphrase: reKey.passphrase } : {}
-  });
-}
-async function exportAccessibleData(vault, opts = {}) {
-  const { keyring } = vault._introspectState();
-  const collections = resolveAccessibleCollections(keyring, opts.scope);
-  const bytes = await buildAccessibleBundle(vault, collections, opts.reKey, opts.compression ?? "auto");
-  await vault._getLedgerOrNull()?.append({
-    op: "lifecycle",
-    collection: "",
-    id: "",
-    version: 0,
-    actor: keyring.userId,
-    payloadHash: "",
-    reason: `user-export:${keyring.userId}`
-  });
-  return bytes;
-}
-
-export {
-  resolveAccessibleCollections,
-  buildAccessibleBundle,
-  exportAccessibleData
-};
-//# sourceMappingURL=chunk-OQAODTYR.js.map