@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/chunk-5PFOMHTB.js

@@ -0,0 +1,135 @@
+import {
+  freezeSnapshotOnly
+} from "./chunk-JFCV5QIK.js";
+import {
+  resolveManagedSecret
+} from "./chunk-RFI7GGFO.js";
+import {
+  createOwnerKeyring
+} from "./chunk-554KLAAN.js";
+import {
+  wrapKey
+} from "./chunk-HOONYZY2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-VCTXU4AT.js";
+import {
+  PermissionDeniedError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-party/team/deed.ts
+var DEED_RECORD_ID = "deed";
+async function createDeedOwner(store, vault, ownerUserId, sealing) {
+  const passphrase = await resolveManagedSecret(store, vault, sealing);
+  const keyring = await createOwnerKeyring(store, vault, ownerUserId, passphrase);
+  await saveDeedMarker(store, vault, {
+    ownerUserId,
+    sealedUnder: sealing.id,
+    latent: true,
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return keyring;
+}
+async function loadDeedMarker(store, vault) {
+  const envelope = await store.get(vault, "_meta", DEED_RECORD_ID);
+  if (!envelope) return null;
+  let payload;
+  try {
+    payload = JSON.parse(envelope._data);
+  } catch {
+    return null;
+  }
+  if (typeof payload !== "object" || payload === null) return null;
+  const r = payload;
+  if (r._noydb_deed !== 1) return null;
+  if (typeof r.ownerUserId !== "string" || typeof r.sealedUnder !== "string" || r.latent !== true || typeof r.issuedAt !== "string") {
+    return null;
+  }
+  const marker = {
+    ownerUserId: r.ownerUserId,
+    sealedUnder: r.sealedUnder,
+    latent: true,
+    issuedAt: r.issuedAt,
+    ...typeof r.liberatedAt === "string" ? { liberatedAt: r.liberatedAt } : {}
+  };
+  return marker;
+}
+async function isDeedVault(store, vault) {
+  return await loadDeedMarker(store, vault) !== null;
+}
+async function saveDeedMarker(store, vault, marker) {
+  const persisted = { _noydb_deed: 1, ...marker };
+  const prior = await store.get(vault, "_meta", DEED_RECORD_ID);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the marker is plaintext audit metadata.
+    _iv: "",
+    _data: JSON.stringify(persisted)
+  };
+  await store.put(vault, "_meta", DEED_RECORD_ID, env);
+}
+
+// src/with-party/custody/liberate.ts
+async function liberateVault(vault, opts) {
+  await vault.noydb.checkGate(vault.name, "liberate-vault", opts.factors);
+  const { name: vaultName, adapter, keyring } = vault._introspectState();
+  if (keyring.role !== "custodian") {
+    throw new PermissionDeniedError(
+      "liberation is claimed only by the custodian (the de-facto authority holding the DEKs)"
+    );
+  }
+  const existing = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
+  if (existing) {
+    throw new PermissionDeniedError(
+      `liberateVault: newOwnerId "${opts.newOwnerId}" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`
+    );
+  }
+  const collections = await listOperationalCollections(vault);
+  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId });
+  const newOwner = await createOwnerKeyring(adapter, vaultName, opts.newOwnerId, opts.newOwnerPassphrase);
+  if (!newOwner.kek) {
+    throw new PermissionDeniedError(
+      `new owner keyring for "${opts.newOwnerId}" has no KEK to re-wrap the incumbent DEKs under`
+    );
+  }
+  const env = await adapter.get(vaultName, "_keyring", opts.newOwnerId);
+  if (!env) {
+    throw new PermissionDeniedError(`new owner keyring for "${opts.newOwnerId}" did not persist`);
+  }
+  const keyringFile = JSON.parse(env._data);
+  const mergedDeks = { ...keyringFile.deks };
+  for (const [collection, dek] of keyring.deks) {
+    mergedDeks[collection] = await wrapKey(dek, newOwner.kek);
+  }
+  const mergedFile = { ...keyringFile, deks: mergedDeks };
+  await adapter.put(vaultName, "_keyring", opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) });
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: opts.newOwnerId,
+    payloadHash: "",
+    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`
+  });
+  const marker = await loadDeedMarker(adapter, vaultName);
+  if (marker) {
+    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  return { snapshot };
+}
+async function listOperationalCollections(vault) {
+  const { keyring } = vault._introspectState();
+  return [...keyring.deks.keys()].filter((c) => !c.startsWith("_"));
+}
+
+export {
+  DEED_RECORD_ID,
+  createDeedOwner,
+  loadDeedMarker,
+  isDeedVault,
+  liberateVault
+};
+//# sourceMappingURL=chunk-5PFOMHTB.js.map

package/dist/chunk-5WZXVULX.js

@@ -0,0 +1,209 @@
+import {
+  OverlayIdMismatchError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-formula/overlay-views/virtual-collection.ts
+var OverlayedCollection = class {
+  constructor(spec, baseCollection, overlayCollection, baseRowKey) {
+    this.spec = spec;
+    this.baseCollection = baseCollection;
+    this.overlayCollection = overlayCollection;
+    this.baseRowKey = baseRowKey;
+  }
+  spec;
+  baseCollection;
+  overlayCollection;
+  baseRowKey;
+  /**
+   * Convenience accessors for advanced callers that need to bypass the
+   * virtual layer (bulk imports, direct overlay queries). Mirrors the
+   * spec's "direct writes to the underlying overlay collection skip
+   * the validation" escape hatch.
+   */
+  overlay = {
+    rowKey: (row) => {
+      if (!this.baseRowKey) {
+        throw new Error(
+          `Overlay "${this.spec.name}": base "${this.spec.base}" is not an MV \u2014 cannot auto-derive id from the row. Use \`put(id, record)\` instead.`
+        );
+      }
+      return this.baseRowKey(row);
+    }
+  };
+  /** Get the merged row by id. */
+  async get(id) {
+    const overlayRow = await this.overlayCollection.get(id);
+    const baseRow = await this.baseCollection.get(id);
+    return this.mergeRows(overlayRow, baseRow);
+  }
+  /** List union of base + overlay ids, applying the merge per row. */
+  async list() {
+    const baseRows = await this.baseCollection.list();
+    const overlayRows = await this.overlayCollection.list();
+    const idOf = (row) => {
+      if (this.baseRowKey) return this.baseRowKey(row);
+      const idField = row.id;
+      return typeof idField === "string" ? idField : "";
+    };
+    const baseById = /* @__PURE__ */ new Map();
+    const overlayById = /* @__PURE__ */ new Map();
+    for (const row of baseRows) {
+      const id = idOf(row);
+      if (id) baseById.set(id, row);
+    }
+    for (const row of overlayRows) {
+      const id = idOf(row);
+      if (id) overlayById.set(id, row);
+    }
+    const out = [];
+    for (const id of /* @__PURE__ */ new Set([...baseById.keys(), ...overlayById.keys()])) {
+      const merged = this.mergeRows(overlayById.get(id) ?? null, baseById.get(id) ?? null);
+      if (merged !== null) out.push(merged);
+    }
+    return out;
+  }
+  /**
+   * Write to the overlay. Two forms:
+   * - `put(record)`: id is derived via the base MV's `rowKey(record)`.
+   *   Throws if the base isn't an MV.
+   * - `put(id, record)`: validates `id === rowKey(record)`; throws
+   *   `OverlayIdMismatchError` on mismatch.
+   */
+  async put(idOrRecord, maybeRecord) {
+    let id;
+    let record;
+    if (maybeRecord === void 0) {
+      record = idOrRecord;
+      if (!this.baseRowKey) {
+        throw new Error(
+          `Overlay "${this.spec.name}".put(record): base "${this.spec.base}" is not an MV. Use put(id, record) explicitly.`
+        );
+      }
+      id = this.baseRowKey(record);
+    } else {
+      id = idOrRecord;
+      record = maybeRecord;
+      if (this.baseRowKey) {
+        const expected = this.baseRowKey(record);
+        if (id !== expected) {
+          throw new OverlayIdMismatchError(id, expected);
+        }
+      }
+    }
+    await this.overlayCollection.put(id, record);
+  }
+  /**
+   * Remove the overlay row only. Idempotent (no-op on absent).
+   * The base row is untouched — if a base row exists for `id`,
+   * subsequent reads return it.
+   */
+  async delete(id) {
+    await this.overlayCollection.delete(id);
+  }
+  /**
+   * Merge a single id's overlay + base rows into the visible row.
+   *
+   * Priority (first match wins):
+   *  1. Binary shadow win — overlay present AND
+   *     `overlay[shadowField] === shadowValue` → return the overlay row
+   *     entirely. This stays FIRST so the original binary behaviour is
+   *     unchanged whether or not `mergeMode` is configured.
+   *  2. Field-level merge — overlay present, `mergeMode` configured,
+   *     and a rule whose `whenStatus` equals `overlay[shadowField]`.
+   *     The matched rule pulls its `overlayFields` (those present on
+   *     the overlay row) on top of the base row. With no base row, the
+   *     overlay row is returned as-is.
+   *  3. Fallback — return the base row (possibly `null`). An
+   *     overlay-only row that qualifies under neither (1) nor (2) and
+   *     has no base is therefore NOT surfaced.
+   */
+  mergeRows(overlayRow, baseRow) {
+    const shadowField = this.spec.shadowField;
+    if (overlayRow !== null && overlayRow[shadowField] === this.spec.shadowValue) {
+      return overlayRow;
+    }
+    if (overlayRow !== null && this.spec.mergeMode) {
+      const status = overlayRow[shadowField];
+      const rule = this.spec.mergeMode.rules.find((r) => r.whenStatus === status);
+      if (rule) {
+        if (baseRow === null) return overlayRow;
+        const overlaySrc = overlayRow;
+        const picked = {};
+        for (const field of rule.overlayFields) {
+          if (field in overlaySrc) picked[field] = overlaySrc[field];
+        }
+        return { ...baseRow, ...picked };
+      }
+    }
+    return baseRow;
+  }
+  // ─── Throw-stubs for the unimplemented Collection<T> surface ───────
+  //
+  // `Vault.collection(name)` widens the return type to `Collection<T>`
+  // for the overlay intercept, but `OverlayedCollection` doesn't
+  // implement the full surface. These stubs catch the common
+  // reactive / chainable APIs with a clear "not yet implemented"
+  // error pointing at the relevant issue — so consumers don't hit a
+  // cryptic `undefined is not a function` runtime crash.
+  //
+  // Throw-stubs so consumers get actionable errors rather than cryptic crashes.
+  /** @throws — chainable Query<T> over a virtual collection is deferred. */
+  query() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".query() is not yet implemented for overlay views (#154). Use \`list()\` + filter for now, or read from the underlying \`${this.spec.base}\` / \`${this.spec.overlay}\` collections directly. Reactive APIs land in a future MV sub-issue.`
+    );
+  }
+  /** @throws — change-stream subscription over a virtual collection is deferred. */
+  subscribe() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".subscribe() is not yet implemented for overlay views (#154). Subscribe to the underlying \`${this.spec.base}\` / \`${this.spec.overlay}\` collections individually for now. Merged change-stream lands in a future MV sub-issue.`
+    );
+  }
+  /** @throws — live query over a virtual collection is deferred. */
+  live() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".live() is not yet implemented for overlay views (#154). Reactive APIs land in a future MV sub-issue.`
+    );
+  }
+  /** @throws — async iteration over a virtual collection is deferred. */
+  scan() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".scan() is not yet implemented for overlay views (#154). Use \`list()\` for now (no row-count ceiling at niwat scale), or scan the underlying collections directly.`
+    );
+  }
+  /** @throws — lazy-mode query is not applicable to virtual collections. */
+  lazyQuery() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".lazyQuery() is not supported. Virtual collections always materialize through base + overlay reads \u2014 lazy-mode indexed lookups don't apply.`
+    );
+  }
+  /** @throws — bulk-atomic put is deferred to a future MV sub-issue. */
+  putManyAtomic() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".putManyAtomic() is not yet implemented for overlay views (#154). Use sequential \`.put(record)\` calls for now, or write to \`${this.spec.overlay}\` directly.`
+    );
+  }
+  /** @throws — bulk delete is deferred to a future MV sub-issue. */
+  deleteMany() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".deleteMany() is not yet implemented for overlay views (#154). Use sequential \`.delete(id)\` calls for now, or operate on \`${this.spec.overlay}\` directly.`
+    );
+  }
+  /** @throws — `.first()` over a virtual collection is deferred. */
+  first() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".first() is not yet implemented for overlay views (#154). Use \`(await list())[0]\` for now.`
+    );
+  }
+  /** @throws — `.count()` over a virtual collection is deferred. */
+  count() {
+    throw new Error(
+      `OverlayedCollection "${this.spec.name}".count() is not yet implemented for overlay views (#154). Use \`(await list()).length\` for now.`
+    );
+  }
+};
+
+export {
+  OverlayedCollection
+};
+//# sourceMappingURL=chunk-5WZXVULX.js.map

package/dist/chunk-6HPG2YNX.js

@@ -0,0 +1,38 @@
+import {
+  NoydbError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-formula/computed/index.ts
+var ComputedFieldError = class extends NoydbError {
+  constructor(field, id, cause) {
+    super(
+      "COMPUTED_FIELD",
+      `computed field "${field}" threw for record "${id}": ` + (cause instanceof Error ? cause.message : String(cause))
+    );
+    this.field = field;
+    this.id = id;
+    this.cause = cause;
+    this.name = "ComputedFieldError";
+  }
+  field;
+  id;
+  cause;
+};
+function evalComputedFields(record, computed, id) {
+  const out = { ...record };
+  for (const [field, entry] of Object.entries(computed)) {
+    const fn = typeof entry === "function" ? entry : entry.fn;
+    try {
+      out[field] = fn(out);
+    } catch (cause) {
+      throw new ComputedFieldError(field, id, cause);
+    }
+  }
+  return out;
+}
+
+export {
+  ComputedFieldError,
+  evalComputedFields
+};
+//# sourceMappingURL=chunk-6HPG2YNX.js.map

package/dist/chunk-6HY2X62D.js

@@ -0,0 +1,69 @@
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  bufferToBase64
+} from "./chunk-HOONYZY2.js";
+
+// src/kernel/enclave/classify/bidx.ts
+var subtle = globalThis.crypto.subtle;
+var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+var COST_BYTE_V1 = 1;
+var CURRENT_COST_BYTE = COST_BYTE_V1;
+function iterationsForCostByte(b) {
+  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
+  return null;
+}
+async function deriveClassifyIndexKey(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function deriveClassifyIndexSalt(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function mintAt(normalized, dek, collection, field, costByte) {
+  const iterations = iterationsForCostByte(costByte);
+  if (iterations == null) {
+    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
+  }
+  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
+  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
+  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
+  const mac = await subtle.sign("HMAC", kIdx, inner);
+  const tag = new Uint8Array(1 + 32);
+  tag[0] = costByte;
+  tag.set(new Uint8Array(mac), 1);
+  return bufferToBase64(tag);
+}
+async function mintBidxTag(normalized, dek, collection, field) {
+  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
+}
+
+// src/kernel/enclave/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+export {
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag,
+  computeBidxTarget
+};
+//# sourceMappingURL=chunk-6HY2X62D.js.map

package/dist/chunk-6NQMXTYC.js

@@ -0,0 +1,123 @@
+import {
+  IllegalTransitionError,
+  RecordLockedError,
+  ValidationError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-audit/guards/with-guard.ts
+function withGuard(strategy) {
+  if (!strategy.collection || strategy.collection.length === 0) {
+    throw new ValidationError("withGuard: collection name is required");
+  }
+  return {
+    __noydb_strategy: "guard",
+    spec: strategy
+  };
+}
+
+// src/with-audit/guards/immutable-guard.ts
+function recordId(record) {
+  const id = record?.id;
+  return typeof id === "string" ? id : "";
+}
+function immutableGuard(config) {
+  const { collection, after, appendOnly, amendmentRoles, amendmentInvariant } = config;
+  if (appendOnly && after !== void 0) {
+    throw new ValidationError("immutableGuard: `after` and `appendOnly` are mutually exclusive");
+  }
+  if (!appendOnly && after === void 0) {
+    throw new ValidationError("immutableGuard: provide `after` or `appendOnly: true`");
+  }
+  const isImmutable = appendOnly ? () => true : after;
+  const reason = appendOnly ? "append-only collection" : "record is immutable after issue";
+  const spec = {
+    collection,
+    // Block updates to an already-immutable record. Inserts (existing
+    // null) and the transition write that first makes the record
+    // immutable are allowed — `after` reads the prior state.
+    check: (incoming, ctx) => {
+      if (ctx.existing !== null && isImmutable(ctx.existing)) {
+        throw new RecordLockedError(collection, recordId(incoming), reason);
+      }
+    },
+    // Block deletes of an immutable record.
+    onDelete: (existing) => {
+      if (isImmutable(existing)) {
+        throw new RecordLockedError(collection, recordId(existing), reason);
+      }
+    },
+    // The authorized override: inside an amendment transaction the
+    // check/onDelete are skipped and the change is ledgered. By default
+    // there is no extra invariant — the amendment itself is the
+    // sanctioned exception. Callers may supply `amendmentInvariant` to
+    // keep a constraint inviolable even under amendment (e.g. forbid
+    // deletes, or preserve a cross-record sum); a throw reverts the
+    // amendment and surfaces as `InvariantError`.
+    amendment: {
+      roles: amendmentRoles ?? ["admin", "owner"],
+      invariant: amendmentInvariant ?? (() => {
+      })
+    }
+  };
+  return withGuard(spec);
+}
+
+// src/with-audit/guards/transition-guard.ts
+function recordId2(record) {
+  const id = record?.id;
+  return typeof id === "string" ? id : "";
+}
+function stateOf(record, field) {
+  const v = record[field];
+  return typeof v === "string" ? v : String(v);
+}
+function transitionGuard(config) {
+  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config;
+  const allowIdempotent = config.allowIdempotent ?? true;
+  if (!field) {
+    throw new ValidationError("transitionGuard: `field` is required");
+  }
+  if (transitions === void 0 || typeof transitions !== "object") {
+    throw new ValidationError("transitionGuard: `transitions` must be a state\u2192states map");
+  }
+  const spec = {
+    collection,
+    check: (incoming, ctx) => {
+      const rec = incoming;
+      const to = stateOf(rec, field);
+      if (ctx.existing === null) {
+        if (initial !== void 0 && !initial.includes(to)) {
+          throw new IllegalTransitionError(collection, recordId2(rec), "(none)", to);
+        }
+        return;
+      }
+      const from = stateOf(ctx.existing, field);
+      if (from === to) {
+        if (allowIdempotent) return;
+        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
+      }
+      const allowed = transitions[from] ?? [];
+      if (!allowed.includes(to)) {
+        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
+      }
+    },
+    // The authorized override: inside an amendment transaction the check
+    // is skipped and the change is ledgered. By default no extra invariant
+    // — the amendment itself is the sanctioned exception. Callers may
+    // supply `amendmentInvariant` to keep a constraint inviolable even
+    // under amendment; a throw reverts the amendment as `InvariantError`.
+    amendment: {
+      roles: amendmentRoles ?? ["admin", "owner"],
+      invariant: amendmentInvariant ?? (() => {
+      })
+    }
+  };
+  return withGuard(spec);
+}
+
+export {
+  withGuard,
+  immutableGuard,
+  transitionGuard
+};
+//# sourceMappingURL=chunk-6NQMXTYC.js.map