@noy-db/in-relay 0.8.0-pre.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 vLannaAi
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1 @@
+noy-db — Copyright 2026 vLannaAi

package/README.md

@@ -0,0 +1,64 @@
+# @noy-db/in-relay
+
+> The relay server half for [noy-db](https://github.com/noy-db/core) — a frame dispatcher over a **narrowed** store profile.
+
+A relay hosts vaults it cannot read and must not be able to overwrite. This package serves the granular store methods and **structurally omits two**:
+
+| omitted | why |
+|---|---|
+| `saveAll` | whole-vault replace — a rollback superweapon aimed at the hosts trusting the relay |
+| `listVaults` | enumeration is an existence leak; a relay serves vaults the caller already names |
+
+## Why a narrowed TYPE rather than a runtime allowlist
+
+`@noy-db/in-rest` types its `store` as a full `NoydbStore` and gates dispatch with an `allow` set. That is right for `in-rest`, whose job is to serve a whole store. Building a relay that way means handing the handler an object that **carries** `saveAll` and trusting a `Set` not to call it — structural absence downgraded to a runtime allowlist.
+
+Here the store is a `NoydbRelayStore` (`@noy-db/hub/to`), so the excluded members are not on the type and no frame can reach them.
+
+```ts
+import { createRelayHandler } from '@noy-db/in-relay'
+import type { NoydbRelayStore } from '@noy-db/hub/to'
+
+const handle = createRelayHandler({ store: myStore satisfies NoydbRelayStore })
+const result = await handle({ id: '1', method: 'get', args: ['vault', 'invoices', 'inv-1'] })
+```
+
+Passing an ordinary full store is fine — it satisfies the narrowed type structurally, and the handler still cannot call what it does not name.
+
+## Unknown, not forbidden
+
+An excluded method is refused as **unknown** (`400`), never as forbidden (`403`). A 403 would confirm the method exists and is merely disallowed here, naming the excluded surface to anyone probing. An excluded name and a name that never existed are indistinguishable in the response.
+
+## Transport-neutral
+
+`createRelayHandler` takes a decoded frame and returns a decoded result, so it can be served over HTTP, a WebSocket, or QUIC without this package knowing which.
+
+## The notify frame — server push, beside the request frame
+
+Every transport in this family is client-pull; a hosted store that knows a record changed had no way to say so. The relay's one server-initiated sentence is a **notify frame**, and it is deliberately small:
+
+```ts
+import { createRelayHandler, createRelayNotifier } from '@noy-db/in-relay'
+import type { NoydbRelayStore, EncryptedEnvelope } from '@noy-db/hub/to'
+
+const notify = createRelayNotifier()
+const handle = createRelayHandler({ store: myStore satisfies NoydbRelayStore, notify })
+
+// Your transport, when an AUTHENTICATED session asks to watch one vault:
+const off = notify.subscribe('vault', (frame) => session.send(JSON.stringify(frame)))
+// frame: { t: 'notify', seq: 1, vault: 'vault', collection: 'invoices', id: 'inv-1', op: 'put', ts: '…' }
+```
+
+| question | answer |
+|---|---|
+| a third encoding of the store contract? | no — a notification is not a method call; the wire carries requests (`method`), results (`ok`) and this (`t: 'notify'`) |
+| what is `seq`? | a **per-subscription** sequence, contiguous from 1 — a gap is detectable; a late joiner starts at 1 |
+| what does it carry? | the **address** (`vault/collection/id`), the op, and the envelope's `_ts` (relay clock for a delete). **Never the envelope** — a push is not a write path |
+| delivery guarantee? | at-most-once, in order per subscription. On a gap, reconcile with `listSince(vault, collection, lastTs)` — the frame makes polling unnecessary; it is not the source of truth |
+| auth? | a subscription names **one vault** (no enumeration by the back door); binding it to an authenticated session is the transport's job |
+
+A failed mutation publishes nothing; a `tx` publishes one frame per op only after the whole batch committed; a subscriber that throws is skipped for that frame and never breaks the write.
+
+## License
+
+MIT © vLannaAi

package/dist/index.d.ts

@@ -0,0 +1,167 @@
+import { NoydbRelayStore } from '@noy-db/hub/to';
+
+/**
+ * **@noy-db/in-relay** — the relay server half (#1237).
+ *
+ * A frame dispatcher over a store whose profile EXCLUDES whole-vault replace
+ * and vault enumeration. The exclusions are structural, not configured.
+ *
+ * ## Why this is not `in-rest` with a narrower `allow` set
+ *
+ * `in-rest` types its `store` as a full `NoydbStore` and gates dispatch with a
+ * runtime `Set`. That is correct for `in-rest`, whose job is to serve a whole
+ * store. Building a relay that way means handing the handler an object that
+ * CARRIES `saveAll` and trusting the `Set` not to call it — structural absence
+ * downgraded to a runtime allowlist, which is the one property a relay exists
+ * to have. Here the store is a {@link NoydbRelayStore}, so the excluded members
+ * cannot be called because they are not on the type.
+ *
+ * ## Two exclusions, two different reasons
+ *
+ * - `saveAll` — whole-vault replace. A relay that can be asked to overwrite a
+ *   vault wholesale is a rollback superweapon aimed at the hosts trusting it.
+ * - `listVaults` — enumeration is an existence leak. A relay serves vaults the
+ *   caller already names; it never answers "what else is here".
+ *
+ * ## Unknown-method, not forbidden-method
+ *
+ * An excluded method is refused as **unknown** (400), never as forbidden (403).
+ * A 403 would confirm the method exists and is merely disallowed here, which
+ * names the excluded surface to anyone probing. Matching `@doi-db/daemon`,
+ * which reached the same conclusion independently in its native implementation.
+ *
+ * @module
+ */
+
+/**
+ * The relay's method vocabulary.
+ *
+ * `saveAll` and `listVaults` are absent because they are absent from
+ * {@link NoydbRelayStore} — adding either here would not compile a call.
+ *
+ * ⚠️ That is NOT sufficient on its own, and the first version of this comment
+ * claimed it was: it said the list "cannot drift away from the type it
+ * dispatches to", and it had already drifted by FOUR members
+ * (`listPage`, `getStoreTime`, `presencePublish`, `presenceSubscribe`).
+ * Omission is silent in the direction the type cannot catch — a member present
+ * on the type and missing here is simply unreachable, and `listPage` being
+ * unreachable means clients fall back to `loadAll`, which is the regression
+ * pagination exists to prevent.
+ *
+ * So the invariant is now ENFORCED rather than asserted: {@link NOT_RELAYED}
+ * names every deliberate exclusion, and a compile-time check below fails if
+ * some method of {@link NoydbRelayStore} appears in neither list. Adding a
+ * method to the store contract forces a decision here instead of a silent drop.
+ */
+declare const RELAY_METHODS: readonly ["get", "put", "delete", "list", "loadAll", "ping", "listSince", "listPage", "getStoreTime", "presencePublish", "estimateUsage", "tx"];
+type RelayMethod = (typeof RELAY_METHODS)[number];
+/**
+ * Members of {@link NoydbRelayStore} deliberately NOT dispatched, with reasons.
+ *
+ * - `presenceSubscribe` — returns an unsubscribe FUNCTION. A frame carries
+ *   JSON, so this is not merely unimplemented, it is unrepresentable in a
+ *   request/response shape. Server-initiated delivery is what the notify frame
+ *   is for ({@link RelayNotifyFrame}, #1238), not a return value.
+ * - `presignUrl` — hands the caller a time-limited URL that fetches the
+ *   envelope **directly from the backing object store**, around this relay.
+ *   That defeats the reason a relay exists: it is the mediating point, so a
+ *   presigned URL survives revocation, escapes metering, and is unobservable
+ *   here. Excluded on the security argument, not on serialisability — it would
+ *   marshal perfectly, which is what makes it worth stating.
+ */
+declare const NOT_RELAYED: readonly ["presenceSubscribe", "presignUrl"];
+/** One request frame. Identical shape to `in-rest`'s, deliberately — see the module docs. */
+interface RelayFrame {
+    readonly id: string;
+    readonly method: string;
+    readonly args: readonly unknown[];
+}
+/** A frame result: either a value, or an error with a status a transport can map. */
+type RelayResult = {
+    readonly ok: true;
+    readonly id: string;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly id: string;
+    readonly status: 400 | 500 | 501;
+    readonly error: {
+        readonly name: string;
+        readonly message: string;
+    };
+};
+interface RelayHandlerOptions {
+    /**
+     * The store this relay serves. Typed as the NARROWED profile: a store may
+     * carry `saveAll`, but this handler structurally cannot reach it.
+     */
+    readonly store: NoydbRelayStore;
+    /**
+     * Where successful mutations are announced (#1238). Omit it and the handler
+     * behaves exactly as before — pull-only.
+     */
+    readonly notify?: RelayNotifier;
+}
+/** Server-push frame: one successful mutation, by address. See the block above. */
+interface RelayNotifyFrame {
+    readonly t: 'notify';
+    /** Per-subscription, contiguous from 1. A gap means frames were missed: reconcile with `listSince`. */
+    readonly seq: number;
+    readonly vault: string;
+    readonly collection: string;
+    readonly id: string;
+    readonly op: 'put' | 'delete';
+    /** The envelope's `_ts` for a put; the relay's clock for a delete. Feed it to `listSince`. */
+    readonly ts: string;
+}
+/** A change as the handler reports it, before any subscriber's `seq` is stamped. */
+type RelayChange = Omit<RelayNotifyFrame, 't' | 'seq'>;
+interface RelayNotifier {
+    /**
+     * Deliver every subsequent change in `vault` to `deliver`, each stamped with
+     * this subscription's own `seq`. Returns an unsubscribe. Late joiners start
+     * at 1 — the sequence is the subscription's, not the server's history.
+     */
+    subscribe(vault: string, deliver: (frame: RelayNotifyFrame) => void): () => void;
+    /** Called by the handler after a mutation LANDED. Not for transports to call. */
+    publish(change: RelayChange): void;
+}
+/**
+ * The in-process fan-out. One per relay; a transport calls `subscribe` when an
+ * authenticated session asks to watch a vault and forwards each frame on that
+ * session's wire.
+ */
+declare function createRelayNotifier(): RelayNotifier;
+/** Thrown for a method this relay does not implement — including excluded ones. */
+declare class UnknownRelayMethodError extends Error {
+    constructor(method: string);
+}
+/**
+ * Thrown when the relay KNOWS a method but the backing store does not
+ * implement it (the optional members of the store contract).
+ *
+ * ⚠️ Deliberately distinct from {@link UnknownRelayMethodError}, and the first
+ * version of this package collapsed them: an absent optional method threw
+ * `UnknownRelayMethodError` from inside dispatch, which the catch-all reported
+ * as **500**. That misattributes a store CAPABILITY GAP as a server fault —
+ * two states warranting opposite responses (the client should degrade
+ * gracefully vs. the operator should investigate) rendered identically.
+ *
+ * `501` matches `@noy-db/in-rest`, which maps its own `UnsupportedMethodError`
+ * to `501 NotImplemented`, and `@doi-db/daemon`, which reached 501
+ * independently. It leaks nothing about the relay's EXCLUSIONS: those are
+ * refused as 400-unknown before dispatch is reached.
+ */
+declare class UnsupportedRelayMethodError extends Error {
+    constructor(method: string);
+}
+/**
+ * Build a frame handler over a narrowed store.
+ *
+ * Transport-neutral by design: it takes a decoded frame and returns a decoded
+ * result, so a caller may serve it over HTTP, a WebSocket, or QUIC without this
+ * package knowing which.
+ */
+declare function createRelayHandler(options: RelayHandlerOptions): (frame: RelayFrame) => Promise<RelayResult>;
+
+export { NOT_RELAYED, RELAY_METHODS, type RelayChange, type RelayFrame, type RelayHandlerOptions, type RelayMethod, type RelayNotifier, type RelayNotifyFrame, type RelayResult, UnknownRelayMethodError, UnsupportedRelayMethodError, createRelayHandler, createRelayNotifier };

package/dist/index.js

@@ -0,0 +1,161 @@
+// src/index.ts
+var RELAY_METHODS = [
+  "get",
+  "put",
+  "delete",
+  "list",
+  "loadAll",
+  "ping",
+  "listSince",
+  "listPage",
+  "getStoreTime",
+  "presencePublish",
+  "estimateUsage",
+  "tx"
+];
+var NOT_RELAYED = ["presenceSubscribe", "presignUrl"];
+function createRelayNotifier() {
+  const byVault = /* @__PURE__ */ new Map();
+  return {
+    subscribe(vault, deliver) {
+      const sub = { deliver, seq: 0 };
+      let subs = byVault.get(vault);
+      if (!subs) byVault.set(vault, subs = /* @__PURE__ */ new Set());
+      subs.add(sub);
+      return () => {
+        subs.delete(sub);
+        if (subs.size === 0) byVault.delete(vault);
+      };
+    },
+    publish(change) {
+      const subs = byVault.get(change.vault);
+      if (!subs) return;
+      for (const sub of [...subs]) {
+        const frame = { t: "notify", seq: ++sub.seq, ...change };
+        try {
+          sub.deliver(frame);
+        } catch {
+        }
+      }
+    }
+  };
+}
+var UnknownRelayMethodError = class extends Error {
+  constructor(method) {
+    super(`Unknown method: ${method}`);
+    this.name = "UnknownRelayMethodError";
+  }
+};
+var UnsupportedRelayMethodError = class extends Error {
+  constructor(method) {
+    super(`Method not supported by this store: ${method}`);
+    this.name = "UnsupportedRelayMethodError";
+  }
+};
+function isRelayMethod(m) {
+  return RELAY_METHODS.includes(m);
+}
+async function dispatch(store, method, args) {
+  switch (method) {
+    case "get": {
+      const [vault, collection, id] = args;
+      return store.get(vault, collection, id);
+    }
+    case "put": {
+      const [vault, collection, id, envelope, expectedVersion] = args;
+      return store.put(vault, collection, id, envelope, expectedVersion);
+    }
+    case "delete": {
+      const [vault, collection, id] = args;
+      return store.delete(vault, collection, id);
+    }
+    case "list": {
+      const [vault, collection] = args;
+      return store.list(vault, collection);
+    }
+    case "loadAll": {
+      const [vault] = args;
+      return store.loadAll(vault);
+    }
+    case "ping": {
+      return store.ping?.() ?? true;
+    }
+    case "listSince": {
+      const [vault, collection, since] = args;
+      if (store.listSince === void 0) throw new UnsupportedRelayMethodError("listSince");
+      return store.listSince(vault, collection, since);
+    }
+    case "listPage": {
+      const [vault, collection, cursor, limit] = args;
+      if (store.listPage === void 0) throw new UnsupportedRelayMethodError("listPage");
+      return store.listPage(vault, collection, cursor, limit);
+    }
+    case "getStoreTime": {
+      if (store.getStoreTime === void 0) throw new UnsupportedRelayMethodError("getStoreTime");
+      return store.getStoreTime();
+    }
+    case "presencePublish": {
+      const [channel, payload] = args;
+      if (store.presencePublish === void 0) throw new UnsupportedRelayMethodError("presencePublish");
+      return store.presencePublish(channel, payload);
+    }
+    case "estimateUsage": {
+      if (store.estimateUsage === void 0) throw new UnsupportedRelayMethodError("estimateUsage");
+      return store.estimateUsage();
+    }
+    case "tx": {
+      const [ops] = args;
+      if (store.tx === void 0) throw new UnsupportedRelayMethodError("tx");
+      return store.tx(ops);
+    }
+  }
+}
+function changesOf(method, args) {
+  switch (method) {
+    case "put": {
+      const [vault, collection, id, envelope] = args;
+      return [{ vault, collection, id, op: "put", ts: envelope._ts }];
+    }
+    case "delete": {
+      const [vault, collection, id] = args;
+      return [{ vault, collection, id, op: "delete", ts: (/* @__PURE__ */ new Date()).toISOString() }];
+    }
+    case "tx": {
+      const [ops] = args;
+      return ops.map((op) => op.type === "put" ? { vault: op.vault, collection: op.collection, id: op.id, op: "put", ts: op.envelope._ts } : { vault: op.vault, collection: op.collection, id: op.id, op: "delete", ts: (/* @__PURE__ */ new Date()).toISOString() });
+    }
+    default:
+      return [];
+  }
+}
+function createRelayHandler(options) {
+  const { store, notify } = options;
+  return async (frame) => {
+    if (!isRelayMethod(frame.method)) {
+      return {
+        ok: false,
+        id: frame.id,
+        status: 400,
+        error: { name: "UnknownRelayMethodError", message: `Unknown method: ${frame.method}` }
+      };
+    }
+    try {
+      const value = await dispatch(store, frame.method, frame.args);
+      if (notify) for (const change of changesOf(frame.method, frame.args)) notify.publish(change);
+      return { ok: true, id: frame.id, value };
+    } catch (err) {
+      const e = err;
+      const status = e instanceof UnsupportedRelayMethodError ? 501 : 500;
+      return { ok: false, id: frame.id, status, error: { name: e.name, message: e.message } };
+    }
+  };
+}
+export {
+  NOT_RELAYED,
+  RELAY_METHODS,
+  UnknownRelayMethodError,
+  UnsupportedRelayMethodError,
+  createRelayHandler,
+  createRelayNotifier
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/in-relay** — the relay server half (#1237).\n *\n * A frame dispatcher over a store whose profile EXCLUDES whole-vault replace\n * and vault enumeration. The exclusions are structural, not configured.\n *\n * ## Why this is not `in-rest` with a narrower `allow` set\n *\n * `in-rest` types its `store` as a full `NoydbStore` and gates dispatch with a\n * runtime `Set`. That is correct for `in-rest`, whose job is to serve a whole\n * store. Building a relay that way means handing the handler an object that\n * CARRIES `saveAll` and trusting the `Set` not to call it — structural absence\n * downgraded to a runtime allowlist, which is the one property a relay exists\n * to have. Here the store is a {@link NoydbRelayStore}, so the excluded members\n * cannot be called because they are not on the type.\n *\n * ## Two exclusions, two different reasons\n *\n * - `saveAll` — whole-vault replace. A relay that can be asked to overwrite a\n *   vault wholesale is a rollback superweapon aimed at the hosts trusting it.\n * - `listVaults` — enumeration is an existence leak. A relay serves vaults the\n *   caller already names; it never answers \"what else is here\".\n *\n * ## Unknown-method, not forbidden-method\n *\n * An excluded method is refused as **unknown** (400), never as forbidden (403).\n * A 403 would confirm the method exists and is merely disallowed here, which\n * names the excluded surface to anyone probing. Matching `@doi-db/daemon`,\n * which reached the same conclusion independently in its native implementation.\n *\n * @module\n */\nimport type { NoydbRelayStore, EncryptedEnvelope, TxOp } from '@noy-db/hub/to'\n\n/**\n * The relay's method vocabulary.\n *\n * `saveAll` and `listVaults` are absent because they are absent from\n * {@link NoydbRelayStore} — adding either here would not compile a call.\n *\n * ⚠️ That is NOT sufficient on its own, and the first version of this comment\n * claimed it was: it said the list \"cannot drift away from the type it\n * dispatches to\", and it had already drifted by FOUR members\n * (`listPage`, `getStoreTime`, `presencePublish`, `presenceSubscribe`).\n * Omission is silent in the direction the type cannot catch — a member present\n * on the type and missing here is simply unreachable, and `listPage` being\n * unreachable means clients fall back to `loadAll`, which is the regression\n * pagination exists to prevent.\n *\n * So the invariant is now ENFORCED rather than asserted: {@link NOT_RELAYED}\n * names every deliberate exclusion, and a compile-time check below fails if\n * some method of {@link NoydbRelayStore} appears in neither list. Adding a\n * method to the store contract forces a decision here instead of a silent drop.\n */\nexport const RELAY_METHODS = [\n  'get', 'put', 'delete', 'list', 'loadAll',\n  'ping', 'listSince', 'listPage', 'getStoreTime', 'presencePublish',\n  'estimateUsage', 'tx',\n] as const\n\nexport type RelayMethod = (typeof RELAY_METHODS)[number]\n\n/**\n * Members of {@link NoydbRelayStore} deliberately NOT dispatched, with reasons.\n *\n * - `presenceSubscribe` — returns an unsubscribe FUNCTION. A frame carries\n *   JSON, so this is not merely unimplemented, it is unrepresentable in a\n *   request/response shape. Server-initiated delivery is what the notify frame\n *   is for ({@link RelayNotifyFrame}, #1238), not a return value.\n * - `presignUrl` — hands the caller a time-limited URL that fetches the\n *   envelope **directly from the backing object store**, around this relay.\n *   That defeats the reason a relay exists: it is the mediating point, so a\n *   presigned URL survives revocation, escapes metering, and is unobservable\n *   here. Excluded on the security argument, not on serialisability — it would\n *   marshal perfectly, which is what makes it worth stating.\n */\nexport const NOT_RELAYED = ['presenceSubscribe', 'presignUrl'] as const\n\n/**\n * Compile-time completeness check (#1237 follow-up). If a method exists on the\n * relay store type and is in neither list, `_exhaustive` errors — the drop is\n * caught at build time rather than becoming an unreachable method in a\n * published package.\n */\ntype StoreMethodNames = {\n  [K in keyof NoydbRelayStore]-?: NonNullable<NoydbRelayStore[K]> extends (...args: never[]) => unknown ? K : never\n}[keyof NoydbRelayStore]\ntype Accounted = RelayMethod | (typeof NOT_RELAYED)[number]\ntype Unaccounted = Exclude<StoreMethodNames, Accounted>\nconst _exhaustive: Unaccounted extends never ? true : ['unaccounted store methods', Unaccounted] = true\nvoid _exhaustive\n\n/** One request frame. Identical shape to `in-rest`'s, deliberately — see the module docs. */\nexport interface RelayFrame {\n  readonly id: string\n  readonly method: string\n  readonly args: readonly unknown[]\n}\n\n/** A frame result: either a value, or an error with a status a transport can map. */\nexport type RelayResult =\n  | { readonly ok: true; readonly id: string; readonly value: unknown }\n  | { readonly ok: false; readonly id: string; readonly status: 400 | 500 | 501; readonly error: { readonly name: string; readonly message: string } }\n\nexport interface RelayHandlerOptions {\n  /**\n   * The store this relay serves. Typed as the NARROWED profile: a store may\n   * carry `saveAll`, but this handler structurally cannot reach it.\n   */\n  readonly store: NoydbRelayStore\n  /**\n   * Where successful mutations are announced (#1238). Omit it and the handler\n   * behaves exactly as before — pull-only.\n   */\n  readonly notify?: RelayNotifier\n}\n\n// ─── The notify frame — BESIDE /rpc (#1238) ──────────────────────────────\n//\n// Every transport in this family is client-pull. A hosted store that knows a\n// record changed had no way to say so, so a client polled or learned on its\n// next read. This frame is the server's one sentence, and it is deliberately a\n// SMALL one. The shape questions the issue asked, answered here rather than\n// assumed:\n//\n// - **Not a third encoding of the store contract.** A request is still\n//   `{ id, method, args }`; a notification is not a method call and shares no\n//   vocabulary with one. There are exactly two things on a relay wire besides\n//   results: requests, discriminated by `method`, and this, discriminated by\n//   `t: 'notify'`.\n// - **Correlation id semantics.** `seq` is a per-SUBSCRIPTION sequence,\n//   contiguous from 1 — not a request correlation (there is no request) and\n//   not a subscription handle (that is the transport's business). A sequence\n//   lets a client detect a GAP; a handle would not. The client's recovery from\n//   a gap is `listSince(vault, collection, <last ts it applied>)`, which\n//   already exists and is the reconciliation path: the frame is a hint that\n//   makes polling unnecessary, never the source of truth.\n// - **What it carries.** The ADDRESS of the change (`vault/collection/id`),\n//   the op, and the envelope's own `_ts` (a delete has none, so the relay's\n//   clock stands in). **Never the envelope.** Carrying it would make the push a\n//   write path, with everything that implies for a fail-closed auth check and\n//   for a store that is untrusted by construction; the client fetches through\n//   the authenticated request path it already has.\n// - **Delivery guarantee: at-most-once, in order per subscription.** A dropped\n//   frame is recoverable by the gap + `listSince` rule above. A subscriber\n//   that throws is dropped for that frame and never breaks the write or its\n//   neighbours — the mutation already landed.\n// - **Auth.** A subscription is scoped to the ONE vault it named — a client\n//   never hears about a vault it did not already know, which keeps the\n//   `listVaults` exclusion honest. Binding a subscription to an authenticated\n//   session is the transport's job (this package is transport-neutral); the\n//   frame carries no secret and no content, so the failure mode of a mistake\n//   there is an existence leak, not a data leak — still a leak, still the\n//   transport's to close.\n\n/** Server-push frame: one successful mutation, by address. See the block above. */\nexport interface RelayNotifyFrame {\n  readonly t: 'notify'\n  /** Per-subscription, contiguous from 1. A gap means frames were missed: reconcile with `listSince`. */\n  readonly seq: number\n  readonly vault: string\n  readonly collection: string\n  readonly id: string\n  readonly op: 'put' | 'delete'\n  /** The envelope's `_ts` for a put; the relay's clock for a delete. Feed it to `listSince`. */\n  readonly ts: string\n}\n\n/** A change as the handler reports it, before any subscriber's `seq` is stamped. */\nexport type RelayChange = Omit<RelayNotifyFrame, 't' | 'seq'>\n\nexport interface RelayNotifier {\n  /**\n   * Deliver every subsequent change in `vault` to `deliver`, each stamped with\n   * this subscription's own `seq`. Returns an unsubscribe. Late joiners start\n   * at 1 — the sequence is the subscription's, not the server's history.\n   */\n  subscribe(vault: string, deliver: (frame: RelayNotifyFrame) => void): () => void\n  /** Called by the handler after a mutation LANDED. Not for transports to call. */\n  publish(change: RelayChange): void\n}\n\n/**\n * The in-process fan-out. One per relay; a transport calls `subscribe` when an\n * authenticated session asks to watch a vault and forwards each frame on that\n * session's wire.\n */\nexport function createRelayNotifier(): RelayNotifier {\n  type Sub = { deliver: (frame: RelayNotifyFrame) => void; seq: number }\n  const byVault = new Map<string, Set<Sub>>()\n  return {\n    subscribe(vault, deliver) {\n      const sub: Sub = { deliver, seq: 0 }\n      let subs = byVault.get(vault)\n      if (!subs) byVault.set(vault, (subs = new Set()))\n      subs.add(sub)\n      return () => {\n        subs.delete(sub)\n        if (subs.size === 0) byVault.delete(vault)\n      }\n    },\n    publish(change) {\n      const subs = byVault.get(change.vault)\n      if (!subs) return\n      for (const sub of [...subs]) {\n        const frame: RelayNotifyFrame = { t: 'notify', seq: ++sub.seq, ...change }\n        try {\n          sub.deliver(frame)\n        } catch {\n          // The write landed; a subscriber that cannot take the frame does not\n          // get to un-land it or starve the others. Its seq advanced, so it\n          // will see the gap and reconcile.\n        }\n      }\n    },\n  }\n}\n\n/** Thrown for a method this relay does not implement — including excluded ones. */\nexport class UnknownRelayMethodError extends Error {\n  constructor(method: string) {\n    super(`Unknown method: ${method}`)\n    this.name = 'UnknownRelayMethodError'\n  }\n}\n\n/**\n * Thrown when the relay KNOWS a method but the backing store does not\n * implement it (the optional members of the store contract).\n *\n * ⚠️ Deliberately distinct from {@link UnknownRelayMethodError}, and the first\n * version of this package collapsed them: an absent optional method threw\n * `UnknownRelayMethodError` from inside dispatch, which the catch-all reported\n * as **500**. That misattributes a store CAPABILITY GAP as a server fault —\n * two states warranting opposite responses (the client should degrade\n * gracefully vs. the operator should investigate) rendered identically.\n *\n * `501` matches `@noy-db/in-rest`, which maps its own `UnsupportedMethodError`\n * to `501 NotImplemented`, and `@doi-db/daemon`, which reached 501\n * independently. It leaks nothing about the relay's EXCLUSIONS: those are\n * refused as 400-unknown before dispatch is reached.\n */\nexport class UnsupportedRelayMethodError extends Error {\n  constructor(method: string) {\n    super(`Method not supported by this store: ${method}`)\n    this.name = 'UnsupportedRelayMethodError'\n  }\n}\n\nfunction isRelayMethod(m: string): m is RelayMethod {\n  return (RELAY_METHODS as readonly string[]).includes(m)\n}\n\nasync function dispatch(store: NoydbRelayStore, method: RelayMethod, args: readonly unknown[]): Promise<unknown> {\n  switch (method) {\n    case 'get': {\n      const [vault, collection, id] = args as [string, string, string]\n      return store.get(vault, collection, id)\n    }\n    case 'put': {\n      const [vault, collection, id, envelope, expectedVersion] = args as\n        [string, string, string, EncryptedEnvelope, number | undefined]\n      return store.put(vault, collection, id, envelope, expectedVersion)\n    }\n    case 'delete': {\n      const [vault, collection, id] = args as [string, string, string]\n      return store.delete(vault, collection, id)\n    }\n    case 'list': {\n      const [vault, collection] = args as [string, string]\n      return store.list(vault, collection)\n    }\n    case 'loadAll': {\n      const [vault] = args as [string]\n      return store.loadAll(vault)\n    }\n    case 'ping': {\n      return store.ping?.() ?? true\n    }\n    case 'listSince': {\n      const [vault, collection, since] = args as [string, string, string]\n      if (store.listSince === undefined) throw new UnsupportedRelayMethodError('listSince')\n      return store.listSince(vault, collection, since)\n    }\n    case 'listPage': {\n      // Absent from the first published vocabulary. Its absence is not neutral:\n      // a client with no pagination falls back to `loadAll`, which is the\n      // regression `listPage` exists to prevent.\n      const [vault, collection, cursor, limit] = args as [string, string, string | undefined, number | undefined]\n      if (store.listPage === undefined) throw new UnsupportedRelayMethodError('listPage')\n      return store.listPage(vault, collection, cursor, limit)\n    }\n    case 'getStoreTime': {\n      if (store.getStoreTime === undefined) throw new UnsupportedRelayMethodError('getStoreTime')\n      return store.getStoreTime()\n    }\n    case 'presencePublish': {\n      const [channel, payload] = args as [string, string]\n      if (store.presencePublish === undefined) throw new UnsupportedRelayMethodError('presencePublish')\n      return store.presencePublish(channel, payload)\n    }\n    case 'estimateUsage': {\n      if (store.estimateUsage === undefined) throw new UnsupportedRelayMethodError('estimateUsage')\n      return store.estimateUsage()\n    }\n    case 'tx': {\n      // Relayed: a native transaction is the store's own atomicity, and\n      // withholding it would silently downgrade a relayed vault to per-op\n      // writes — the CAS guarantees callers rely on would quietly weaken.\n      const [ops] = args as [readonly TxOp[]]\n      if (store.tx === undefined) throw new UnsupportedRelayMethodError('tx')\n      return store.tx(ops)\n    }\n  }\n}\n\n/** The changes a successful mutating frame implies; empty for a read. */\nfunction changesOf(method: RelayMethod, args: readonly unknown[]): RelayChange[] {\n  switch (method) {\n    case 'put': {\n      const [vault, collection, id, envelope] = args as [string, string, string, EncryptedEnvelope]\n      return [{ vault, collection, id, op: 'put', ts: envelope._ts }]\n    }\n    case 'delete': {\n      const [vault, collection, id] = args as [string, string, string]\n      return [{ vault, collection, id, op: 'delete', ts: new Date().toISOString() }]\n    }\n    case 'tx': {\n      const [ops] = args as [readonly TxOp[]]\n      return ops.map((op) => op.type === 'put'\n        ? { vault: op.vault, collection: op.collection, id: op.id, op: 'put' as const, ts: op.envelope!._ts }\n        : { vault: op.vault, collection: op.collection, id: op.id, op: 'delete' as const, ts: new Date().toISOString() })\n    }\n    default:\n      return []\n  }\n}\n\n/**\n * Build a frame handler over a narrowed store.\n *\n * Transport-neutral by design: it takes a decoded frame and returns a decoded\n * result, so a caller may serve it over HTTP, a WebSocket, or QUIC without this\n * package knowing which.\n */\nexport function createRelayHandler(options: RelayHandlerOptions): (frame: RelayFrame) => Promise<RelayResult> {\n  const { store, notify } = options\n  return async (frame: RelayFrame): Promise<RelayResult> => {\n    if (!isRelayMethod(frame.method)) {\n      // 400 unknown-method, NOT 403. Distinguishing would name the excluded\n      // members to a prober; to this relay they simply do not exist.\n      return {\n        ok: false, id: frame.id, status: 400,\n        error: { name: 'UnknownRelayMethodError', message: `Unknown method: ${frame.method}` },\n      }\n    }\n    try {\n      const value = await dispatch(store, frame.method, frame.args)\n      // Announce AFTER the store returned: a frame reports what landed, so a\n      // failed mutation publishes nothing and a tx publishes only once the\n      // whole batch committed (#1238).\n      if (notify) for (const change of changesOf(frame.method, frame.args)) notify.publish(change)\n      return { ok: true, id: frame.id, value }\n    } catch (err) {\n      const e = err as Error\n      // A store that does not implement an OPTIONAL method is a capability gap,\n      // not a server fault: 501, so a client can degrade rather than retry.\n      // Matches in-rest's UnsupportedMethodError -> 501 and @doi-db/daemon.\n      const status = e instanceof UnsupportedRelayMethodError ? 501 : 500\n      // The error's own name is forwarded so a client can re-hydrate a\n      // ConflictError by name — the seam contract in-rest and to-rest settled\n      // in #1218. Never `instanceof` across this boundary.\n      return { ok: false, id: frame.id, status, error: { name: e.name, message: e.message } }\n    }\n  }\n}\n"],"mappings":";AAsDO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EAAO;AAAA,EAAO;AAAA,EAAU;AAAA,EAAQ;AAAA,EAChC;AAAA,EAAQ;AAAA,EAAa;AAAA,EAAY;AAAA,EAAgB;AAAA,EACjD;AAAA,EAAiB;AACnB;AAkBO,IAAM,cAAc,CAAC,qBAAqB,YAAY;AA+GtD,SAAS,sBAAqC;AAEnD,QAAM,UAAU,oBAAI,IAAsB;AAC1C,SAAO;AAAA,IACL,UAAU,OAAO,SAAS;AACxB,YAAM,MAAW,EAAE,SAAS,KAAK,EAAE;AACnC,UAAI,OAAO,QAAQ,IAAI,KAAK;AAC5B,UAAI,CAAC,KAAM,SAAQ,IAAI,OAAQ,OAAO,oBAAI,IAAI,CAAE;AAChD,WAAK,IAAI,GAAG;AACZ,aAAO,MAAM;AACX,aAAK,OAAO,GAAG;AACf,YAAI,KAAK,SAAS,EAAG,SAAQ,OAAO,KAAK;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,QAAQ,QAAQ;AACd,YAAM,OAAO,QAAQ,IAAI,OAAO,KAAK;AACrC,UAAI,CAAC,KAAM;AACX,iBAAW,OAAO,CAAC,GAAG,IAAI,GAAG;AAC3B,cAAM,QAA0B,EAAE,GAAG,UAAU,KAAK,EAAE,IAAI,KAAK,GAAG,OAAO;AACzE,YAAI;AACF,cAAI,QAAQ,KAAK;AAAA,QACnB,QAAQ;AAAA,QAIR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,QAAgB;AAC1B,UAAM,mBAAmB,MAAM,EAAE;AACjC,SAAK,OAAO;AAAA,EACd;AACF;AAkBO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAY,QAAgB;AAC1B,UAAM,uCAAuC,MAAM,EAAE;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,GAA6B;AAClD,SAAQ,cAAoC,SAAS,CAAC;AACxD;AAEA,eAAe,SAAS,OAAwB,QAAqB,MAA4C;AAC/G,UAAQ,QAAQ;AAAA,IACd,KAAK,OAAO;AACV,YAAM,CAAC,OAAO,YAAY,EAAE,IAAI;AAChC,aAAO,MAAM,IAAI,OAAO,YAAY,EAAE;AAAA,IACxC;AAAA,IACA,KAAK,OAAO;AACV,YAAM,CAAC,OAAO,YAAY,IAAI,UAAU,eAAe,IAAI;AAE3D,aAAO,MAAM,IAAI,OAAO,YAAY,IAAI,UAAU,eAAe;AAAA,IACnE;AAAA,IACA,KAAK,UAAU;AACb,YAAM,CAAC,OAAO,YAAY,EAAE,IAAI;AAChC,aAAO,MAAM,OAAO,OAAO,YAAY,EAAE;AAAA,IAC3C;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,CAAC,OAAO,UAAU,IAAI;AAC5B,aAAO,MAAM,KAAK,OAAO,UAAU;AAAA,IACrC;AAAA,IACA,KAAK,WAAW;AACd,YAAM,CAAC,KAAK,IAAI;AAChB,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B;AAAA,IACA,KAAK,QAAQ;AACX,aAAO,MAAM,OAAO,KAAK;AAAA,IAC3B;AAAA,IACA,KAAK,aAAa;AAChB,YAAM,CAAC,OAAO,YAAY,KAAK,IAAI;AACnC,UAAI,MAAM,cAAc,OAAW,OAAM,IAAI,4BAA4B,WAAW;AACpF,aAAO,MAAM,UAAU,OAAO,YAAY,KAAK;AAAA,IACjD;AAAA,IACA,KAAK,YAAY;AAIf,YAAM,CAAC,OAAO,YAAY,QAAQ,KAAK,IAAI;AAC3C,UAAI,MAAM,aAAa,OAAW,OAAM,IAAI,4BAA4B,UAAU;AAClF,aAAO,MAAM,SAAS,OAAO,YAAY,QAAQ,KAAK;AAAA,IACxD;AAAA,IACA,KAAK,gBAAgB;AACnB,UAAI,MAAM,iBAAiB,OAAW,OAAM,IAAI,4BAA4B,cAAc;AAC1F,aAAO,MAAM,aAAa;AAAA,IAC5B;AAAA,IACA,KAAK,mBAAmB;AACtB,YAAM,CAAC,SAAS,OAAO,IAAI;AAC3B,UAAI,MAAM,oBAAoB,OAAW,OAAM,IAAI,4BAA4B,iBAAiB;AAChG,aAAO,MAAM,gBAAgB,SAAS,OAAO;AAAA,IAC/C;AAAA,IACA,KAAK,iBAAiB;AACpB,UAAI,MAAM,kBAAkB,OAAW,OAAM,IAAI,4BAA4B,eAAe;AAC5F,aAAO,MAAM,cAAc;AAAA,IAC7B;AAAA,IACA,KAAK,MAAM;AAIT,YAAM,CAAC,GAAG,IAAI;AACd,UAAI,MAAM,OAAO,OAAW,OAAM,IAAI,4BAA4B,IAAI;AACtE,aAAO,MAAM,GAAG,GAAG;AAAA,IACrB;AAAA,EACF;AACF;AAGA,SAAS,UAAU,QAAqB,MAAyC;AAC/E,UAAQ,QAAQ;AAAA,IACd,KAAK,OAAO;AACV,YAAM,CAAC,OAAO,YAAY,IAAI,QAAQ,IAAI;AAC1C,aAAO,CAAC,EAAE,OAAO,YAAY,IAAI,IAAI,OAAO,IAAI,SAAS,IAAI,CAAC;AAAA,IAChE;AAAA,IACA,KAAK,UAAU;AACb,YAAM,CAAC,OAAO,YAAY,EAAE,IAAI;AAChC,aAAO,CAAC,EAAE,OAAO,YAAY,IAAI,IAAI,UAAU,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,IAC/E;AAAA,IACA,KAAK,MAAM;AACT,YAAM,CAAC,GAAG,IAAI;AACd,aAAO,IAAI,IAAI,CAAC,OAAO,GAAG,SAAS,QAC/B,EAAE,OAAO,GAAG,OAAO,YAAY,GAAG,YAAY,IAAI,GAAG,IAAI,IAAI,OAAgB,IAAI,GAAG,SAAU,IAAI,IAClG,EAAE,OAAO,GAAG,OAAO,YAAY,GAAG,YAAY,IAAI,GAAG,IAAI,IAAI,UAAmB,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,IACpH;AAAA,IACA;AACE,aAAO,CAAC;AAAA,EACZ;AACF;AASO,SAAS,mBAAmB,SAA2E;AAC5G,QAAM,EAAE,OAAO,OAAO,IAAI;AAC1B,SAAO,OAAO,UAA4C;AACxD,QAAI,CAAC,cAAc,MAAM,MAAM,GAAG;AAGhC,aAAO;AAAA,QACL,IAAI;AAAA,QAAO,IAAI,MAAM;AAAA,QAAI,QAAQ;AAAA,QACjC,OAAO,EAAE,MAAM,2BAA2B,SAAS,mBAAmB,MAAM,MAAM,GAAG;AAAA,MACvF;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,SAAS,OAAO,MAAM,QAAQ,MAAM,IAAI;AAI5D,UAAI,OAAQ,YAAW,UAAU,UAAU,MAAM,QAAQ,MAAM,IAAI,EAAG,QAAO,QAAQ,MAAM;AAC3F,aAAO,EAAE,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,IAAI;AAIV,YAAM,SAAS,aAAa,8BAA8B,MAAM;AAIhE,aAAO,EAAE,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,EAAE;AAAA,IACxF;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@noy-db/in-relay",
+  "version": "0.8.0-pre.0",
+  "description": "Relay server half for noy-db — a frame dispatcher over a NARROWED store profile, where saveAll and listVaults are absent by construction",
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "peerDependencies": {
+    "@noy-db/hub": "^0.8.0-pre.0"
+  },
+  "devDependencies": {
+    "@noy-db/hub": "0.8.0-pre.0"
+  },
+  "license": "Apache-2.0",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/noy-db/core.git",
+    "directory": "packages/in-relay"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "keywords": [
+    "noy-db",
+    "in-rest",
+    "rest",
+    "http",
+    "api"
+  ],
+  "homepage": "https://github.com/noy-db/core/tree/main/packages/in-relay#readme",
+  "bugs": {
+    "url": "https://github.com/noy-db/core/issues"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}