@noy-db/hub 0.5.0 → 0.6.0-pre.0

package/dist/{chunk-KDWBVCIX.js → chunk-EK7DT5BT.js}

@@ -1,19 +1,20 @@
 import {
   pickLocale
-} from "./chunk-FHK6WWUE.js";
+} from "./chunk-CYQOUTMY.js";
 import {
   sha256Hex
-} from "./chunk-RPWMDIGK.js";
+} from "./chunk-VCETL77O.js";
 import {
   BundleIntegrityError,
   BundleSealMismatchError,
   ValidationError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-pod/format.ts
 var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
 var NOYDB_BUNDLE_PREFIX_BYTES = 10;
 var NOYDB_BUNDLE_FORMAT_VERSION = 1;
+var NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2;
 var FLAG_COMPRESSED = 1;
 var FLAG_HAS_INTEGRITY_HASH = 2;
 var COMPRESSION_NONE = 0;
@@ -27,7 +28,40 @@ var ALLOWED_HEADER_KEYS = /* @__PURE__ */ new Set([
   "publicEnvelope",
   "autoUnlock",
   "bundleKind",
-  "transferSeal"
+  "transferSeal",
+  "sig",
+  "keyId",
+  "sigAlg",
+  "engineRange",
+  "unlockMethods",
+  "hasApp",
+  "species",
+  "pointerMode",
+  "redirect"
+]);
+var UNLOCK_METHODS = /* @__PURE__ */ new Set([
+  "password",
+  "webauthn",
+  "oidc",
+  "totp",
+  "email-otp",
+  "magic-link",
+  "pin",
+  "recovery",
+  "shamir"
+]);
+var POD_SPECIES = /* @__PURE__ */ new Set([
+  "full",
+  "connection",
+  "snapshot",
+  "redirect",
+  "group"
+]);
+var REDIRECT_REASONS = /* @__PURE__ */ new Set([
+  "moved",
+  "release",
+  "tombstone",
+  "repoint"
 ]);
 function validateBundleHeader(parsed) {
   if (parsed === null || typeof parsed !== "object") {
@@ -43,9 +77,9 @@ function validateBundleHeader(parsed) {
     }
   }
   const h = parsed;
-  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION) {
+  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
+      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION} or ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
     );
   }
   if (typeof h["handle"] !== "string" || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(h["handle"])) {
@@ -114,6 +148,99 @@ function validateBundleHeader(parsed) {
       throw new Error(`.noydb bundle header.transferSeal.sealId must be a non-empty string, got ${String(t["sealId"])}.`);
     }
   }
+  if (h["keyId"] !== void 0) {
+    if (typeof h["keyId"] !== "string" || !/^[0-9a-f]{16}$/.test(h["keyId"])) {
+      throw new Error(
+        `.noydb bundle header.keyId must be a 16-character lowercase hex fingerprint, got ${typeof h["keyId"] === "string" ? `"${h["keyId"]}"` : typeof h["keyId"]}.`
+      );
+    }
+  }
+  if (h["sig"] !== void 0) {
+    if (typeof h["sig"] !== "string" || h["sig"].length === 0 || !/^[A-Za-z0-9_-]+$/.test(h["sig"])) {
+      throw new Error(
+        `.noydb bundle header.sig must be a non-empty base64url string, got ${typeof h["sig"] === "string" ? `"${h["sig"]}"` : typeof h["sig"]}.`
+      );
+    }
+  }
+  if (h["sigAlg"] !== void 0) {
+    if (h["sigAlg"] !== "ed25519") {
+      const got = typeof h["sigAlg"] === "string" ? `"${h["sigAlg"]}"` : typeof h["sigAlg"];
+      throw new Error(`.noydb bundle header.sigAlg must be 'ed25519' when present, got ${got}.`);
+    }
+  }
+  if (h["engineRange"] !== void 0) {
+    if (typeof h["engineRange"] !== "string" || h["engineRange"].length === 0) {
+      throw new Error(
+        `.noydb bundle header.engineRange must be a string when present, got ${typeof h["engineRange"]}.`
+      );
+    }
+  }
+  if (h["unlockMethods"] !== void 0) {
+    const methods = h["unlockMethods"];
+    if (!Array.isArray(methods)) {
+      throw new Error(
+        `.noydb bundle header.unlockMethods must be an array when present, got ${typeof methods}.`
+      );
+    }
+    for (let i = 0; i < methods.length; i++) {
+      if (!UNLOCK_METHODS.has(methods[i])) {
+        throw new Error(
+          `.noydb bundle header.unlockMethods[${i}] must be one of: ${[...UNLOCK_METHODS].join(", ")}, got ${String(methods[i])}.`
+        );
+      }
+    }
+  }
+  if (h["hasApp"] !== void 0) {
+    if (typeof h["hasApp"] !== "boolean") {
+      throw new Error(
+        `.noydb bundle header.hasApp must be a boolean when present, got ${typeof h["hasApp"]}.`
+      );
+    }
+  }
+  if (h["species"] !== void 0) {
+    if (!POD_SPECIES.has(h["species"])) {
+      const got = typeof h["species"] === "string" ? `"${h["species"]}"` : typeof h["species"];
+      throw new Error(
+        `.noydb bundle header.species must be one of: ${[...POD_SPECIES].join(", ")}, got ${got}.`
+      );
+    }
+  }
+  if (h["pointerMode"] !== void 0) {
+    if (h["pointerMode"] !== "public" && h["pointerMode"] !== "private") {
+      const got = typeof h["pointerMode"] === "string" ? `"${h["pointerMode"]}"` : typeof h["pointerMode"];
+      throw new Error(`.noydb bundle header.pointerMode must be 'public' or 'private' when present, got ${got}.`);
+    }
+  }
+  if (h["redirect"] !== void 0) {
+    const r = h["redirect"];
+    if (r === null || typeof r !== "object" || Array.isArray(r)) {
+      throw new Error(`.noydb bundle header.redirect must be a JSON object when present, got ${typeof r}.`);
+    }
+    const rec = r;
+    if (rec["v"] !== 1) {
+      throw new Error(`.noydb bundle header.redirect.v must be 1, got ${String(rec["v"])}.`);
+    }
+    if (typeof rec["target"] !== "string" || rec["target"].length === 0) {
+      throw new Error(
+        `.noydb bundle header.redirect.target must be a non-empty string, got ${String(rec["target"])}.`
+      );
+    }
+    if (!REDIRECT_REASONS.has(rec["reason"])) {
+      throw new Error(
+        `.noydb bundle header.redirect.reason must be one of: ${[...REDIRECT_REASONS].join(", ")}, got ${String(rec["reason"])}.`
+      );
+    }
+    if (typeof rec["issuedBy"] !== "string" || !/^[0-9a-f]{16}$/.test(rec["issuedBy"])) {
+      throw new Error(
+        `.noydb bundle header.redirect.issuedBy must be a 16-character lowercase hex fingerprint, got ${typeof rec["issuedBy"] === "string" ? `"${rec["issuedBy"]}"` : typeof rec["issuedBy"]}.`
+      );
+    }
+    if (typeof rec["sig"] !== "string" || rec["sig"].length === 0 || !/^[A-Za-z0-9_-]+$/.test(rec["sig"])) {
+      throw new Error(
+        `.noydb bundle header.redirect.sig must be a non-empty base64url string, got ${typeof rec["sig"] === "string" ? `"${rec["sig"]}"` : typeof rec["sig"]}.`
+      );
+    }
+  }
   const isExtracted = h["bundleKind"] === "extracted-partition";
   const hasSeal = h["transferSeal"] !== void 0;
   if (hasSeal && !isExtracted) {
@@ -131,6 +258,17 @@ function validateBundleHeader(parsed) {
       `.noydb bundle header cannot carry both autoUnlock and bundleKind === 'extracted-partition' \u2014 an extracted partition is unlocked via its transfer seal, not an auto-credential.`
     );
   }
+  const sigFieldsPresent = [h["sig"], h["keyId"], h["sigAlg"]].filter((v) => v !== void 0).length;
+  if (sigFieldsPresent > 0 && sigFieldsPresent < 3) {
+    throw new Error(
+      `.noydb bundle header.sig, .keyId, and .sigAlg must be present together or not at all (got ${sigFieldsPresent} of 3).`
+    );
+  }
+  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+    throw new Error(
+      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
+    );
+  }
 }
 function encodeBundleHeader(header) {
   validateBundleHeader(header);
@@ -142,7 +280,20 @@ function encodeBundleHeader(header) {
     ...header.publicEnvelope !== void 0 ? { publicEnvelope: header.publicEnvelope } : {},
     ...header.autoUnlock !== void 0 ? { autoUnlock: header.autoUnlock } : {},
     ...header.bundleKind !== void 0 ? { bundleKind: header.bundleKind } : {},
-    ...header.transferSeal !== void 0 ? { transferSeal: header.transferSeal } : {}
+    ...header.transferSeal !== void 0 ? { transferSeal: header.transferSeal } : {},
+    // Encode order here is the WIRE-byte contract only — it does NOT
+    // affect the signature. The signer (Task 4/5) signs the header
+    // object via canonicalJson, which re-sorts keys independent of
+    // this insertion order.
+    ...header.sig !== void 0 ? { sig: header.sig } : {},
+    ...header.keyId !== void 0 ? { keyId: header.keyId } : {},
+    ...header.sigAlg !== void 0 ? { sigAlg: header.sigAlg } : {},
+    ...header.engineRange !== void 0 ? { engineRange: header.engineRange } : {},
+    ...header.unlockMethods !== void 0 ? { unlockMethods: header.unlockMethods } : {},
+    ...header.hasApp !== void 0 ? { hasApp: header.hasApp } : {},
+    ...header.species !== void 0 ? { species: header.species } : {},
+    ...header.pointerMode !== void 0 ? { pointerMode: header.pointerMode } : {},
+    ...header.redirect !== void 0 ? { redirect: header.redirect } : {}
   });
   return new TextEncoder().encode(json);
 }
@@ -176,6 +327,19 @@ function hasNoydbBundleMagic(bytes) {
   return true;
 }
 
+// src/with-pod/signature.ts
+import { canonicalJson, ed25519Sign, ed25519Verify, utf8 } from "@noy-db/attestation";
+var POD_SIG_ALG = "ed25519";
+function signedBytes(payload) {
+  return utf8(canonicalJson(payload));
+}
+async function signRecord(privateKeyPkcs8B64, payload) {
+  return ed25519Sign(privateKeyPkcs8B64, signedBytes(payload));
+}
+async function verifyRecord(publicKeyB64, sig, payload) {
+  return ed25519Verify(publicKeyB64, sig, signedBytes(payload));
+}
+
 // src/with-pod/bundle.ts
 function toAutoCredentials(m) {
   return Object.fromEntries(
@@ -613,7 +777,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-6DVWST6U.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-U575NGSH.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -678,9 +842,20 @@ async function assembleBundleContainer(opts) {
     ...opts.headerExtras?.publicEnvelope !== void 0 ? { publicEnvelope: opts.headerExtras.publicEnvelope } : {},
     ...opts.headerExtras?.autoUnlock !== void 0 ? { autoUnlock: opts.headerExtras.autoUnlock } : {},
     ...opts.headerExtras?.bundleKind !== void 0 ? { bundleKind: opts.headerExtras.bundleKind } : {},
-    ...opts.headerExtras?.transferSeal !== void 0 ? { transferSeal: opts.headerExtras.transferSeal } : {}
+    ...opts.headerExtras?.transferSeal !== void 0 ? { transferSeal: opts.headerExtras.transferSeal } : {},
+    ...opts.headerExtras?.engineRange !== void 0 ? { engineRange: opts.headerExtras.engineRange } : {},
+    ...opts.headerExtras?.unlockMethods !== void 0 ? { unlockMethods: opts.headerExtras.unlockMethods } : {},
+    ...opts.headerExtras?.hasApp !== void 0 ? { hasApp: opts.headerExtras.hasApp } : {},
+    ...opts.headerExtras?.species !== void 0 ? { species: opts.headerExtras.species } : {},
+    ...opts.headerExtras?.pointerMode !== void 0 ? { pointerMode: opts.headerExtras.pointerMode } : {},
+    ...opts.headerExtras?.redirect !== void 0 ? { redirect: opts.headerExtras.redirect } : {}
   };
-  const headerBytes = encodeBundleHeader(header);
+  const signed = opts.signer === void 0 ? header : await (async (s) => {
+    const toSign = { ...header, formatVersion: NOYDB_BUNDLE_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
+    const sig = await signRecord(s.privateKeyPkcs8B64, toSign);
+    return { ...toSign, sig };
+  })(opts.signer);
+  const headerBytes = encodeBundleHeader(signed);
   const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES);
   prefix.set(NOYDB_BUNDLE_MAGIC, 0);
   prefix[4] = (streamFormat === null ? 0 : FLAG_COMPRESSED) | FLAG_HAS_INTEGRITY_HASH;
@@ -704,6 +879,7 @@ async function writePod(vault, opts = {}) {
   const filtered = applySliceFilters(plainFiltered, opts);
   const bodyJsonStr = normalizedAutoUnlock === null ? filtered : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock));
   const cover = await vault.getCover();
+  const signer = opts.sign === false ? void 0 : opts.sign !== void 0 ? opts.sign : await vault._loadPodSigner() ?? void 0;
   return assembleBundleContainer({
     handle,
     bodyJsonStr,
@@ -711,8 +887,16 @@ async function writePod(vault, opts = {}) {
     headerExtras: {
       // `publicEnvelope` is the frozen wire key for the cover (#799).
       ...cover !== void 0 ? { publicEnvelope: cover } : {},
-      ...autoUnlockMode !== null ? { autoUnlock: autoUnlockMode } : {}
-    }
+      ...autoUnlockMode !== null ? { autoUnlock: autoUnlockMode } : {},
+      // Header L2 fields (#942) — passed through verbatim from opts.
+      ...opts.engineRange !== void 0 ? { engineRange: opts.engineRange } : {},
+      ...opts.unlockMethods !== void 0 ? { unlockMethods: opts.unlockMethods } : {},
+      ...opts.hasApp !== void 0 ? { hasApp: opts.hasApp } : {},
+      ...opts.species !== void 0 ? { species: opts.species } : {},
+      ...opts.pointerMode !== void 0 ? { pointerMode: opts.pointerMode } : {},
+      ...opts.redirect !== void 0 ? { redirect: opts.redirect } : {}
+    },
+    ...signer !== void 0 ? { signer } : {}
   });
 }
 var writeNoydbBundle = writePod;
@@ -749,6 +933,20 @@ function readPodHeader(bytes) {
   return parsePrefixAndHeader(bytes).header;
 }
 var readNoydbBundleHeader = readPodHeader;
+async function verifyPodHeader(bytes, trustedKeys) {
+  const { header } = parsePrefixAndHeader(bytes);
+  if (header.sig === void 0 || header.keyId === void 0 || header.sigAlg === void 0) {
+    return { status: "unsigned" };
+  }
+  const publicKeyB64 = trustedKeys[header.keyId];
+  if (publicKeyB64 === void 0) {
+    return { status: "untrusted", keyId: header.keyId };
+  }
+  const payload = { ...header };
+  delete payload["sig"];
+  const ok = await verifyRecord(publicKeyB64, header.sig, payload);
+  return { status: ok ? "verified" : "tampered", keyId: header.keyId };
+}
 function readPodCover(bytes, opts = {}) {
   const header = parsePrefixAndHeader(bytes).header;
   const env = header.publicEnvelope;
@@ -760,6 +958,9 @@ function readPodCover(bytes, opts = {}) {
     ...env.description !== void 0 ? { description: pickLocale(env.description, opts.locale, env.defaultLocale) } : {}
   };
 }
+function readPodRedirect(bytes) {
+  return parsePrefixAndHeader(bytes).header.redirect;
+}
 async function readPod(bytes, opts = {}) {
   const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes);
   const body = bytes.slice(bodyOffset);
@@ -809,6 +1010,10 @@ export {
   validateBundleHeader,
   encodeBundleHeader,
   hasNoydbBundleMagic,
+  POD_SIG_ALG,
+  signedBytes,
+  signRecord,
+  verifyRecord,
   buildExtractedPartitionWrapper,
   parseExtractedPartitionBody,
   resetBrotliSupportCache,
@@ -817,8 +1022,10 @@ export {
   writeNoydbBundle,
   readPodHeader,
   readNoydbBundleHeader,
+  verifyPodHeader,
   readPodCover,
+  readPodRedirect,
   readPod,
   readNoydbBundle
 };
-//# sourceMappingURL=chunk-KDWBVCIX.js.map
+//# sourceMappingURL=chunk-EK7DT5BT.js.map