@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/{chunk-N5DNADLQ.js → chunk-JA25QG5M.js}

@@ -1,37 +1,36 @@
 import {
   SyncScheduler
-} from "./chunk-T7IR4N2S.js";
+} from "./chunk-JBMMWYOH.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-FW22ZCXT.js";
+} from "./chunk-6WS35E6X.js";
 import {
-  envelopeBodySize
-} from "./chunk-KJFW62P4.js";
+  parseKeyringEnvelope
+} from "./chunk-45VHWE4C.js";
 import {
   buildRecordEnvelope,
-  isDeleteMarker,
-  isTombstoneShape
-} from "./chunk-SEE332EV.js";
-import {
   decrypt,
   derivePresenceKey,
-  encrypt
-} from "./chunk-UYB234ZR.js";
+  derivePresenceTagKey,
+  encrypt,
+  envelopeBodySize,
+  hmacSignHex,
+  isDeleteMarker,
+  isTombstoneShape
+} from "./chunk-4J3MNVVX.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-ODVPTDPK.js";
+} from "./chunk-2ELOCEXE.js";
 import {
   ValidationError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-sync/presence.ts
-var subtle = globalThis.crypto.subtle;
-var PRESENCE_TAG_KEY_DOMAIN = "noydb.presence.tag.v1";
 var PresenceHandle = class {
   adapter;
   syncAdapter;
@@ -124,10 +123,10 @@ var PresenceHandle = class {
   /**
    * Derive (and cache) the presence-tag key — a non-extractable, sign-only
    * HMAC-SHA256 key HKDF-derived from the collection DEK, domain-separated
-   * from the presence payload key by {@link PRESENCE_TAG_KEY_DOMAIN}.
-   * Mirrors `deriveClassifyIndexKey` (kernel/enclave/classify/bidx.ts). No
-   * PBKDF2 stretch — the adapter never holds this key, so a plain keyed HMAC
-   * tag is sufficient and deterministic. Returns `null` when unencrypted
+   * from the presence payload key by the enclave's `derivePresenceTagKey`
+   * domain. Mirrors `deriveClassifyIndexKey` (capsule/enclave-aes/classify/bidx.ts).
+   * No PBKDF2 stretch — the adapter never holds this key, so a plain keyed
+   * HMAC tag is sufficient and deterministic. Returns `null` when unencrypted
    * (no DEK to derive from).
    */
   async getPresenceTagKey() {
@@ -135,12 +134,7 @@ var PresenceHandle = class {
     if (!this.presenceTagKey) {
       try {
         const dek = await this.getDEK(this.collectionName);
-        const rawDek = await subtle.exportKey("raw", dek);
-        const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-        const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN);
-        const info = new TextEncoder().encode(this.collectionName);
-        const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
-        this.presenceTagKey = await subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        this.presenceTagKey = await derivePresenceTagKey(dek, this.collectionName);
       } catch {
       }
     }
@@ -151,17 +145,11 @@ var PresenceHandle = class {
    * storage-poll record id in encrypted mode so the adapter never sees the
    * userId. Falls back to the raw `userId` when unencrypted (no key exists
    * to tag with — see {@link PresenceHandleOpts.userId}).
-   *
-   * Signs directly via `subtle.sign` (like `bidx.ts`'s `mintAt`) rather than
-   * the barrel's `hmacSha256Hex` helper: that helper re-exports its key
-   * argument's raw bytes internally, which only works for extractable keys
-   * (e.g. an AES-GCM DEK) — `presenceTagKey` is deliberately non-extractable.
    */
   async presenceTag(userId) {
     const tagKey = await this.getPresenceTagKey();
     if (!tagKey) return userId;
-    const mac = await subtle.sign("HMAC", tagKey, new TextEncoder().encode(userId));
-    return Array.from(new Uint8Array(mac)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    return hmacSignHex(tagKey, new TextEncoder().encode(userId));
   }
   getPubSubAdapter() {
     if (this.syncAdapter?.presencePublish) return this.syncAdapter;
@@ -262,7 +250,7 @@ var PresenceHandle = class {
         const envelope = await storeAdapter.get(this.vault, this.storageCollection, id);
         if (!envelope) continue;
         try {
-          const record = JSON.parse(envelope._data);
+          const record = JSON.parse(envelope._data ?? "");
           if (record.lastSeen < cutoff) continue;
           let peerUserId;
           let peerPayload;
@@ -288,6 +276,90 @@ var PresenceHandle = class {
   }
 };
 
+// src/with-sync/reserved-mirror.ts
+var KEYRING_COLLECTION = "_keyring";
+function keyringEpoch(envelope) {
+  if (!envelope) return void 0;
+  try {
+    const epoch = parseKeyringEnvelope(envelope).roster_epoch;
+    return typeof epoch === "number" ? epoch : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function keyringSupersedes(candidate, current) {
+  if (!current) return true;
+  const c = keyringEpoch(candidate);
+  const k = keyringEpoch(current);
+  if (c === void 0) return false;
+  if (k === void 0) return true;
+  return c > k;
+}
+function versionSupersedes(candidate, current) {
+  if (!current) return true;
+  return candidate._v > current._v;
+}
+var RESERVED_REPLICATION = [
+  { collection: KEYRING_COLLECTION, supersedes: keyringSupersedes, propagateDeletes: true },
+  { collection: "_meta", idPrefix: "invite-audit-", supersedes: versionSupersedes, propagateDeletes: false },
+  { collection: "_users", supersedes: versionSupersedes, propagateDeletes: true },
+  { collection: "_delegations", supersedes: versionSupersedes, propagateDeletes: true }
+];
+function inScope(rule, id) {
+  return rule.idPrefix === void 0 || id.startsWith(rule.idPrefix);
+}
+async function mirrorRule(rule, from, to, vault, fromIds) {
+  const copied = [];
+  for (const id of fromIds ?? await from.list(vault, rule.collection)) {
+    if (!inScope(rule, id)) continue;
+    const candidate = await from.get(vault, rule.collection, id);
+    if (!candidate) continue;
+    const current = await to.get(vault, rule.collection, id);
+    if (!rule.supersedes(candidate, current)) continue;
+    await to.put(vault, rule.collection, id, candidate);
+    copied.push(id);
+  }
+  return copied;
+}
+async function pushReserved(local, remote, vault) {
+  let copied = 0;
+  let keyringsCopied = [];
+  for (const rule of RESERVED_REPLICATION) {
+    const ids = await mirrorRule(rule, local, remote, vault);
+    copied += ids.length;
+    if (rule.collection === KEYRING_COLLECTION) keyringsCopied = ids;
+  }
+  return { copied, deleted: 0, keyringsCopied };
+}
+async function pullReserved(remote, local, vault, protectedIds) {
+  const localKeyrings = await local.list(vault, KEYRING_COLLECTION);
+  if (localKeyrings.length === 0) return { copied: 0, deleted: 0, keyringsCopied: [] };
+  let copied = 0;
+  let deleted = 0;
+  let keyringsCopied = [];
+  for (const rule of RESERVED_REPLICATION) {
+    const remoteIds = (await remote.list(vault, rule.collection)).filter((id) => inScope(rule, id));
+    const ids = await mirrorRule(rule, remote, local, vault, remoteIds);
+    copied += ids.length;
+    if (rule.collection === KEYRING_COLLECTION) keyringsCopied = ids;
+    if (!rule.propagateDeletes || remoteIds.length === 0) continue;
+    const remoteSet = new Set(remoteIds);
+    const protectedSet = protectedIds.get(rule.collection);
+    const localIds = rule.collection === KEYRING_COLLECTION ? localKeyrings : await local.list(vault, rule.collection);
+    for (const id of localIds) {
+      if (!inScope(rule, id) || remoteSet.has(id) || protectedSet?.has(id)) continue;
+      await local.delete(vault, rule.collection, id);
+      deleted++;
+    }
+  }
+  return { copied, deleted, keyringsCopied };
+}
+async function bootstrapKeyrings(local, peer, vault) {
+  if (!peer) return;
+  if ((await local.list(vault, KEYRING_COLLECTION)).length > 0) return;
+  await mirrorRule(RESERVED_REPLICATION[0], peer, local, vault);
+}
+
 // src/with-sync/period-scope.ts
 var PERIOD_SUMMARY_COLLECTIONS = [
   PERIODS_COLLECTION,
@@ -418,11 +490,37 @@ var SyncEngine = class {
   setPeriodPullSource(source) {
     this.periodPullSource = source;
   }
+  /** core#82 — when a pull replaces the caller's OWN keyring file, the vault reloads it in place. */
+  rosterReload;
+  /** Wire the roster-reload seam (core#82). Same injection pattern as `setCacheInvalidator`. */
+  setRosterReload(seam) {
+    this.rosterReload = seam;
+  }
+  /** core#81 — the running sync's latest progress sample; `null` when idle. Read by `status()`. */
+  inFlight = null;
+  progressLastEmit = 0;
+  progressLastRecords = 0;
+  /** Emit `sync:progress` no more than every 25 records or ~250 ms; `force` for the final sample. */
+  progress(sample, force = false) {
+    this.inFlight = sample;
+    const now = Date.now();
+    if (!force && sample.records - this.progressLastRecords < 25 && now - this.progressLastEmit < 250) return;
+    this.progressLastEmit = now;
+    this.progressLastRecords = sample.records;
+    this.emitter.emit("sync:progress", sample);
+  }
+  progressDone() {
+    this.inFlight = null;
+    this.progressLastEmit = 0;
+    this.progressLastRecords = 0;
+  }
   /** #807: KPI accumulator `applyRemote` feeds during a period-scoped `pull()` — pointed at the
    *  active phase's counters (summaries → records) and cleared before pull returns. Approximate
    *  by design: a push interleaved mid-pull on the same engine would attribute its converge
    *  applies to the open phase; the counters are a download-budget KPI, not an audit source. */
   pullByteSink = null;
+  /** core#81 — ciphertext bytes applied by the running pull, for `sync:progress`. */
+  pullBytes = 0;
   constructor(opts) {
     this.local = opts.local;
     this.remote = opts.remote;
@@ -536,11 +634,14 @@ var SyncEngine = class {
     const completed = [];
     const expanded = options?.collections ? this.pairExpander?.(options.collections) ?? options.collections : null;
     const filter = expanded ? /* @__PURE__ */ new Set([...expanded, ...this.reservedDictExpander?.(expanded) ?? []]) : null;
+    const pushTotal = filter ? this.dirty.filter((d) => filter.has(d.collection)).length : this.dirty.length;
+    let pushBytes = 0;
     for (let i = 0; i < this.dirty.length; i++) {
       const entry = this.dirty[i];
       if (filter && !filter.has(entry.collection)) {
         continue;
       }
+      this.progress({ direction: "push", phase: "records", records: pushed, bytes: pushBytes, total: { records: pushTotal } });
       try {
         if (entry.action === "delete") {
           await this.remote.delete(this.vault, entry.collection, entry.id);
@@ -568,6 +669,7 @@ var SyncEngine = class {
             );
             completed.push(i);
             pushed++;
+            pushBytes += envelopeBodySize(envelope);
           } catch (err) {
             if (isConflictError(err)) {
               const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id);
@@ -624,6 +726,16 @@ var SyncEngine = class {
     for (const i of completed.sort((a, b) => b - a)) {
       this.dirty.splice(i, 1);
     }
+    if (!filter) {
+      this.progress({ direction: "push", phase: "reserved", records: pushed, bytes: pushBytes, total: { records: pushTotal } });
+      try {
+        await pushReserved(this.local, this.remote, this.vault);
+      } catch (err) {
+        errors.push(err instanceof Error ? err : new Error(String(err)));
+      }
+    }
+    this.progress({ direction: "push", phase: "records", records: pushed, bytes: pushBytes, total: { records: pushTotal } }, true);
+    this.progressDone();
     this.recordOutcome("push", errors);
     try {
       await this.persistMeta();
@@ -641,6 +753,25 @@ var SyncEngine = class {
     const conflicts = [];
     const erasures = [];
     const errors = [];
+    if (!options?.collections) {
+      this.progress({ direction: "pull", phase: "reserved", records: 0, bytes: 0 });
+      try {
+        const protectedIds = /* @__PURE__ */ new Map();
+        for (const d of this.dirty) {
+          if (d.action !== "put") continue;
+          let set = protectedIds.get(d.collection);
+          if (!set) {
+            set = /* @__PURE__ */ new Set();
+            protectedIds.set(d.collection, set);
+          }
+          set.add(d.id);
+        }
+        const { keyringsCopied } = await pullReserved(this.remote, this.local, this.vault, protectedIds);
+        if (this.rosterReload && keyringsCopied.includes(this.rosterReload.userId)) await this.rosterReload.reload();
+      } catch (err) {
+        errors.push(err instanceof Error ? err : new Error(String(err)));
+      }
+    }
     let periodScope = null;
     let phases = null;
     if (options?.periods !== void 0) {
@@ -687,11 +818,24 @@ var SyncEngine = class {
     const filter = expanded ? /* @__PURE__ */ new Set([...expanded, ...this.reservedDictExpander?.(expanded) ?? []]) : null;
     try {
       const remoteSnapshot = await this.remote.loadAll(this.vault);
+      let pullTotal = 0;
+      for (const [collName, records] of Object.entries(remoteSnapshot)) {
+        if (filter && !filter.has(collName)) continue;
+        pullTotal += Object.keys(records).length;
+      }
+      const pullSample = () => ({
+        direction: "pull",
+        phase: "records",
+        records: pulled,
+        bytes: this.pullBytes,
+        total: { records: pullTotal }
+      });
       for (const [collName, records] of Object.entries(remoteSnapshot)) {
         if (filter && !filter.has(collName)) {
           continue;
         }
         for (const [id, remoteEnvelope] of Object.entries(records)) {
+          this.progress(pullSample());
           if (options?.modifiedSince && remoteEnvelope._ts <= options.modifiedSince && !isTombstoneShape(remoteEnvelope) && !isDeleteMarker(remoteEnvelope)) {
             continue;
           }
@@ -796,6 +940,9 @@ var SyncEngine = class {
     } catch (err) {
       errors.push(err instanceof Error ? err : new Error(String(err)));
     }
+    this.progress({ direction: "pull", phase: "records", records: pulled, bytes: this.pullBytes, total: { records: pulled } }, true);
+    this.progressDone();
+    this.pullBytes = 0;
     this.recordOutcome("pull", errors);
     try {
       await this.persistMeta();
@@ -939,12 +1086,53 @@ var SyncEngine = class {
     else this.lastPull = at;
   }
   /** Get current sync status. */
+  /**
+   * core#82 — re-align a CORRUPTED local from the target. An ordinary pull
+   * cannot repair a damaged local envelope: it keeps its `_v`, so it wins
+   * (or ties) against the target's healthy copy. Here every local
+   * user-collection envelope is verified with the same `MergeAuthority`
+   * check pull runs on remote envelopes; one that fails is replaced by the
+   * target's copy when THAT verifies, and the dirty log is dropped (a dirty
+   * entry over a damaged record would push the damage). Records at a tier
+   * the caller holds no key for pass unverified, as in pull — this repairs
+   * what the caller can read. Requires a `MergeAuthority` (a vault-attached
+   * engine on an encrypted vault).
+   */
+  async realign() {
+    await this.ensureLoaded();
+    if (!this.mergeAuthority) throw new ValidationError("realign: requires a vault-attached engine on an encrypted vault (no MergeAuthority).");
+    const errors = [];
+    let checked = 0;
+    let replaced = 0;
+    let unrecoverable = 0;
+    const local = await this.local.loadAll(this.vault);
+    for (const [collection, records] of Object.entries(local)) {
+      for (const [id, envelope] of Object.entries(records)) {
+        checked++;
+        if (isTombstoneShape(envelope) || isDeleteMarker(envelope)) continue;
+        if (await this.mergeAuthority.verify(collection, id, envelope)) continue;
+        const remote = await this.remote.get(this.vault, collection, id);
+        if (remote && await this.mergeAuthority.verify(collection, id, remote)) {
+          await this.local.put(this.vault, collection, id, remote);
+          await this.cacheInvalidator?.(collection, id, "put");
+          replaced++;
+        } else {
+          unrecoverable++;
+          errors.push(new ValidationError(`realign: "${collection}/${id}" fails to authenticate locally and the target holds no healthy copy.`));
+        }
+      }
+    }
+    this.dirty = [];
+    await this.persistMeta();
+    return { checked, replaced, unrecoverable, errors };
+  }
   status() {
     const scheduled = this.scheduler?.status;
     return {
       dirty: this.dirty.length,
       lastPush: this.lastPush,
       lastPull: this.lastPull,
+      ...this.inFlight ? { inFlight: this.inFlight } : {},
       online: this.isOnline,
       ...this.lastError ? { lastError: this.lastError } : {},
       ...scheduled && scheduled.readiness.size > 0 ? { readiness: scheduled.readiness, phase: scheduled.phase } : {}
@@ -1034,6 +1222,7 @@ var SyncEngine = class {
       );
     }
     await this.local.put(this.vault, collection, id, envelope);
+    this.pullBytes += envelopeBodySize(envelope);
     if (this.pullByteSink !== null) {
       this.pullByteSink.records++;
       this.pullByteSink.bytes += envelopeBodySize(envelope);
@@ -1128,7 +1317,7 @@ var SyncEngine = class {
     if (this.loaded) return;
     const envelope = await this.local.get(this.vault, "_sync", "meta");
     if (envelope) {
-      const meta = JSON.parse(envelope._data);
+      const meta = JSON.parse(envelope._data ?? "");
       this.dirty = [...meta.dirty];
       this.lastPush = meta.last_push;
       this.lastPull = meta.last_pull;
@@ -1210,7 +1399,8 @@ var SyncTransaction = class {
 
 export {
   PresenceHandle,
+  bootstrapKeyrings,
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-N5DNADLQ.js.map
+//# sourceMappingURL=chunk-JA25QG5M.js.map