@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/index-B9QdHytu.d.ts

@@ -1,123 +0,0 @@
-/**
- * Hub-level write lifecycle hooks. `onBeforeWrite` may abort (throw);
- * `onAfterWrite` is awaited and its errors are warned, not thrown. A
- * re-entrancy flag suppresses nested firing so a handler that writes can't
- * loop. Held on the Noydb instance, threaded into every Collection.
- */
-interface WriteEvent {
-    readonly op: 'create' | 'update' | 'delete';
-    readonly vault: string;
-    readonly collection: string;
-    readonly docId: string;
-    readonly before: unknown;
-    readonly after: unknown;
-    readonly baseVersion: number;
-    readonly version: number;
-    readonly userId: string;
-    readonly timestamp: number;
-    readonly txId: string;
-}
-type WriteHook = (event: WriteEvent) => void | Promise<void>;
-type Unsubscribe = () => void;
-declare class WriteHookRegistry {
-    #private;
-    /** True while handlers are running — used by the write path to skip nested firing. */
-    get suppressed(): boolean;
-    /** True when any hook is registered (cheap gate for the write path). */
-    get hasHandlers(): boolean;
-    onBeforeWrite(handler: WriteHook): Unsubscribe;
-    onAfterWrite(handler: WriteHook): Unsubscribe;
-    /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
-    runBefore(event: WriteEvent): Promise<void>;
-    /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
-    runAfter(event: WriteEvent): Promise<void>;
-}
-
-/**
- * Kernel coordination port — the injected `CoordinationProvider` seam for the
- * schema-fence drain-barrier.
- *
- * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
- * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)
- * drives it through the `Noydb` handle without ever naming a `by-*` package.
- * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.
- *
- * This module carries only the port TYPES plus two pure-ish helpers:
- * {@link isQuorum} (a pure quorum predicate extracted from the legacy
- * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol
- * the migration cutover and klum both call).
- *
- * @module
- */
-
-/** Vault fence state (the existing FenceDoc shape). */
-interface FenceState {
-    readonly currentSchemaVersion: number;
-    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
-}
-/** A writer's presence + ack, tagged with the session that owns it. */
-interface WriterPresence {
-    /** = today's clientId (one per tab/peer). */
-    readonly writerId: string;
-    /** Groups one user's writers across vaults (consolidation is klum's job). */
-    readonly sessionId: string;
-    readonly lastSeen: number;
-    readonly quiescedAtVersion: number | null;
-}
-/** Session-addressable drain-barrier coordination transport. Per-vault ops. */
-interface CoordinationProvider {
-    /** orchestrator → all writers */
-    setFence(vault: string, fence: FenceState): Promise<void>;
-    /**
-     * Fresh one-shot fence read for the write-path gate (`assertWritable`).
-     * A direct read (not a cached `observeFence` snapshot) avoids a staleness
-     * window and keeps the timing-sensitive cutover gate exact. The store
-     * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
-     */
-    readFence(vault: string): Promise<FenceState>;
-    /** writer observes fence changes (default: poll-emit; by-*: push) */
-    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
-    /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
-    reportPresence(vault: string, p: WriterPresence): Promise<void>;
-    /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
-    observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe;
-    /** orchestrator one-shot snapshot of reachable writers (quorum input) */
-    reachableWriters(vault: string, o: {
-        staleMs: number;
-        now: number;
-    }): Promise<readonly WriterPresence[]>;
-}
-/**
- * Pure quorum predicate: true when every writer (other than `excludeWriterId`)
- * has acked at exactly `generation`. An empty set is trivially a quorum.
- *
- * Extracted from the legacy `activeQuiesced` store-polling check so the
- * migration cutover, the store default provider, and `by-*` real-time
- * providers all share one definition of "everyone has drained".
- */
-declare function isQuorum(writers: readonly WriterPresence[], generation: number, excludeWriterId?: string): boolean;
-/** Inputs for {@link runDrainBarrier}. */
-interface DrainBarrierOptions {
-    readonly vault: string;
-    readonly generation: number;
-    readonly writerId: string;
-    readonly onFlush: () => Promise<void>;
-    readonly staleMs: number;
-    readonly quiesceTimeoutMs: number;
-    readonly now: () => number;
-    /** Optional seam (mainly for deterministic tests) run before each poll tick. */
-    readonly onPoll?: () => Promise<void>;
-}
-/**
- * The reusable drain-barrier protocol shared by the migration cutover and klum:
- *
- *   drain self → setFence(draining) → await quorum (presence push + isQuorum,
- *   polling as a fallback, or timeout) → run() → release-by-caller.
- *
- * Resolves once every reachable writer (excluding `writerId`) has quiesced at
- * `generation`, at which point `run` is invoked exactly once. Rejects with
- * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
- */
-declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;
-
-export { type CoordinationProvider as C, type DrainBarrierOptions as D, type FenceState as F, type Unsubscribe as U, type WriteEvent as W, type WriteHook as a, WriteHookRegistry as b, type WriterPresence as c, isQuorum as i, runDrainBarrier as r };

package/dist/index-CyclmyDr.d.ts

@@ -1,122 +0,0 @@
-import { c_ as NoydbStore, dn as SealingKeyProvider, c8 as UnlockedKeyring, eZ as CargoStrategy } from './index-DzhNI2vE.js';
-import './ulid-DRH25k3y.js';
-import './index-B9QdHytu.js';
-import './kernel/index.js';
-import './vault-diff-Dt9NkLzw.js';
-
-/**
- * Hub-core constants that must be referenceable without pulling any
- * service chunk. Kept import-free.
- */
-/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
-declare const STATE_VAULT_NAME = "__noydb_state__";
-/**
- * Soft cap on the JSON-serialized user-envelope payload size. Generous (a
- * typical profile + preferences + small app annex is ~1 KiB); rejects
- * accidental "stuff app state in here" anti-patterns.
- */
-declare const USER_ENVELOPE_MAX_BYTES: number;
-/**
- * Reserved store collection name for user envelopes. Starts with `_` so the
- * keyring grant machinery propagates the DEK to every granted user via the
- * existing system-collection DEK propagation path in `team/keyring.ts`.
- */
-declare const USER_ENVELOPE_COLLECTION = "_users";
-
-/**
- * FR-6 — Deed: sealed / hidden-owner provisioning.
- *
- * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
- * derives `KEK_owner`) is minted machine-side and sealed under a
- * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
- * the cryptographic *inalienability anchor*: whoever holds the
- * provider (the client / their KMS) is the only party that can ever
- * re-derive `KEK_owner`. A firm-side custodian operates the vault
- * fully but can never reach the owner key — there is deliberately NO
- * firm-controlled fallback.
- *
- * Provisioning reuses the managed-mode seam:
- *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
- *     subsequent open through the same provider).
- *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
- *
- * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
- * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
- * sealing boundary protects them, so it must be readable without
- * unlocking the vault (a custodian or auditor inspecting the vault must
- * be able to see "this is a Deed vault, owner = X, sealed under Y"
- * without any key). The marker itself is therefore never sealed; only
- * the owner *credential* is.
- *
- * @module
- */
-
-/** Reserved id for the Deed marker under `_meta`. */
-declare const DEED_RECORD_ID: "deed";
-/**
- * Plaintext metadata recording a vault's latent-owner Deed. Persisted
- * at `_meta/deed`. Readable without unlocking the vault by design — it
- * carries no secret material, only the identity of the latent owner
- * and the sealing boundary that anchors inalienability.
- */
-interface DeedMarker {
-    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
-    readonly ownerUserId: string;
-    /**
-     * The `SealingKeyProvider.id` the owner credential is sealed under.
-     * The inalienability anchor: only the holder of this (non-firm)
-     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
-     */
-    readonly sealedUnder: string;
-    /** Always `true` for a Deed — the owner never authenticates interactively. */
-    readonly latent: true;
-    /** ISO-8601 timestamp the Deed was issued. */
-    readonly issuedAt: string;
-    /**
-     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
-     * via the audited Liberate ceremony), if any. Absent until liberation.
-     */
-    readonly liberatedAt?: string;
-}
-/**
- * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
- * via {@link resolveManagedSecret}, derives the owner keyring via
- * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
- * marker. Returns the unlocked owner keyring.
- *
- * The returned keyring is the only in-memory window onto `KEK_owner`
- * for this call; the persistent re-entry point is the sealing provider
- * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
- *
- * There is deliberately no firm-controlled fallback: the marker's
- * `sealedUnder` is the single cryptographic anchor of ownership.
- */
-declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
-/**
- * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
- * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
- * unlocking required.
- */
-declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
-/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
-declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
-
-/**
- * Enable the cargo (partition extraction) capability.
- * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side
- * `extractPartition(vault, ...)` free function live. The extraction crypto
- * engine is dynamically imported here, so it stays out of the floor bundle
- * until opted in. The recipient-side `adoptPartition` /
- * `decryptExtractedPartition` free functions — and `diffVault` (shared
- * import/merge infra) — are ungated and unaffected.
- */
-
-declare function withCargo(): CargoStrategy;
-
-export { DEED_RECORD_ID as D, STATE_VAULT_NAME as S, USER_ENVELOPE_COLLECTION as U, type DeedMarker as a, USER_ENVELOPE_MAX_BYTES as b, createDeedOwner as c, isDeedVault as i, loadDeedMarker as l, withCargo as w };