@noy-db/to-aws-dynamo 0.1.0-pre.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vLannaAi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# @noy-db/to-aws-dynamo
+
+> AWS DynamoDB adapter for [noy-db](https://github.com/vLannaAi/noy-db) — single-table design, zero-knowledge cloud sync.
+
+[![npm](https://img.shields.io/npm/v/@noy-db/to-aws-dynamo.svg)](https://www.npmjs.com/package/@noy-db/to-aws-dynamo)
+
+## Install
+
+```bash
+pnpm add @noy-db/hub @noy-db/to-aws-dynamo @aws-sdk/client-dynamodb @aws-sdk/lib-dynamodb
+```
+
+`@aws-sdk/*` packages are peer dependencies — install them in your app.
+
+## Usage
+
+```ts
+import { createNoydb } from '@noy-db/hub'
+import { dynamo } from '@noy-db/to-aws-dynamo'
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb'
+import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb'
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({ region: 'ap-southeast-1' }))
+
+const db = await createNoydb({
+  adapter: dynamo({ client, tableName: 'noydb-prod' }),
+  userId: 'alice',
+  passphrase: process.env.NOYDB_PASSPHRASE!,
+})
+```
+
+Uses a single-table design with composite keys `(PK=compartment, SK=collection#id)`. DynamoDB only ever sees encrypted envelopes — the ciphertext is useless without the user's passphrase.
+
+## DynamoDB table schema
+
+- Partition key: `PK` (String) — compartment name
+- Sort key: `SK` (String) — `collection#id`
+- Attributes: `_v`, `_ts`, `_iv`, `_data`, `_by` — the encrypted envelope
+
+## License
+
+MIT © vLannaAi — see the [noy-db repo](https://github.com/vLannaAi/noy-db) for full documentation.

package/dist/index.cjs

@@ -0,0 +1,226 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  dynamo: () => dynamo
+});
+module.exports = __toCommonJS(index_exports);
+var import_hub = require("@noy-db/hub");
+function dynamo(options) {
+  const { table } = options;
+  let clientPromise = null;
+  async function getClient() {
+    if (options.client) return options.client;
+    if (!clientPromise) {
+      clientPromise = (async () => {
+        const { DynamoDBClient } = await import("@aws-sdk/client-dynamodb");
+        const { DynamoDBDocumentClient } = await import("@aws-sdk/lib-dynamodb");
+        const config = {};
+        if (options.region) config["region"] = options.region;
+        if (options.endpoint) config["endpoint"] = options.endpoint;
+        const ddbClient = new DynamoDBClient(config);
+        return DynamoDBDocumentClient.from(ddbClient);
+      })();
+    }
+    return clientPromise;
+  }
+  function sk(collection, id) {
+    return `${collection}#${id}`;
+  }
+  function parseSk(sortKey) {
+    const idx = sortKey.indexOf("#");
+    return {
+      collection: sortKey.slice(0, idx),
+      id: sortKey.slice(idx + 1)
+    };
+  }
+  function itemToEnvelope(item) {
+    return {
+      _noydb: 1,
+      _v: item["_v"],
+      _ts: item["_ts"],
+      _iv: item["_iv"],
+      _data: item["_data"]
+    };
+  }
+  return {
+    name: "dynamo",
+    async get(vault, collection, id) {
+      const client = await getClient();
+      const { GetCommand } = await import("@aws-sdk/lib-dynamodb");
+      const result = await client.send(new GetCommand({
+        TableName: table,
+        Key: { pk: vault, sk: sk(collection, id) }
+      }));
+      if (!result.Item) return null;
+      return itemToEnvelope(result.Item);
+    },
+    async put(vault, collection, id, envelope, expectedVersion) {
+      const client = await getClient();
+      const { PutCommand } = await import("@aws-sdk/lib-dynamodb");
+      const item = {
+        pk: vault,
+        sk: sk(collection, id),
+        _noydb: envelope._noydb,
+        _v: envelope._v,
+        _ts: envelope._ts,
+        _iv: envelope._iv,
+        _data: envelope._data
+      };
+      const input = { TableName: table, Item: item };
+      if (expectedVersion !== void 0) {
+        input.ConditionExpression = "#v = :expected OR attribute_not_exists(pk)";
+        input.ExpressionAttributeNames = { "#v": "_v" };
+        input.ExpressionAttributeValues = { ":expected": expectedVersion };
+      }
+      try {
+        await client.send(new PutCommand(input));
+      } catch (err) {
+        if (err instanceof Error && err.name === "ConditionalCheckFailedException") {
+          const current = await this.get(vault, collection, id);
+          throw new import_hub.ConflictError(
+            current?._v ?? 0,
+            `Version conflict: expected ${expectedVersion}, found ${current?._v}`
+          );
+        }
+        throw err;
+      }
+    },
+    async delete(vault, collection, id) {
+      const client = await getClient();
+      const { DeleteCommand } = await import("@aws-sdk/lib-dynamodb");
+      await client.send(new DeleteCommand({
+        TableName: table,
+        Key: { pk: vault, sk: sk(collection, id) }
+      }));
+    },
+    async list(vault, collection) {
+      const client = await getClient();
+      const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+      const result = await client.send(new QueryCommand({
+        TableName: table,
+        KeyConditionExpression: "pk = :pk AND begins_with(sk, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": vault,
+          ":prefix": `${collection}#`
+        }
+      }));
+      return (result.Items ?? []).map((item) => {
+        const { id } = parseSk(item["sk"]);
+        return id;
+      });
+    },
+    async loadAll(vault) {
+      const client = await getClient();
+      const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+      const result = await client.send(new QueryCommand({
+        TableName: table,
+        KeyConditionExpression: "pk = :pk",
+        ExpressionAttributeValues: { ":pk": vault }
+      }));
+      const snapshot = {};
+      for (const item of result.Items ?? []) {
+        const sortKey = item["sk"];
+        const { collection, id } = parseSk(sortKey);
+        if (collection.startsWith("_")) continue;
+        if (!snapshot[collection]) {
+          snapshot[collection] = {};
+        }
+        snapshot[collection][id] = itemToEnvelope(item);
+      }
+      return snapshot;
+    },
+    async saveAll(vault, data) {
+      for (const [collName, records] of Object.entries(data)) {
+        for (const [id, envelope] of Object.entries(records)) {
+          await this.put(vault, collName, id, envelope);
+        }
+      }
+    },
+    async ping() {
+      try {
+        const client = await getClient();
+        const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+        await client.send(new QueryCommand({
+          TableName: table,
+          KeyConditionExpression: "pk = :pk",
+          ExpressionAttributeValues: { ":pk": "__ping__" }
+        }));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    /**
+     * Paginate over a collection using DynamoDB's native `LastEvaluatedKey`
+     * cursor. The cursor is base64-encoded JSON of the LastEvaluatedKey
+     * object so it round-trips through any caller transport.
+     *
+     * Each page is a single Query call against the partition key, so the
+     * read cost is `pageSize ÷ 4 KB` RCUs (eventually consistent) per page.
+     */
+    async listPage(vault, collection, cursor, limit = 100) {
+      const client = await getClient();
+      const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+      const input = {
+        TableName: table,
+        KeyConditionExpression: "pk = :pk AND begins_with(sk, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": vault,
+          ":prefix": `${collection}#`
+        },
+        Limit: limit
+      };
+      if (cursor) {
+        input.ExclusiveStartKey = JSON.parse(b64decode(cursor));
+      }
+      const result = await client.send(new QueryCommand(input));
+      const items = [];
+      for (const item of result.Items ?? []) {
+        const { id } = parseSk(item["sk"]);
+        items.push({ id, envelope: itemToEnvelope(item) });
+      }
+      const nextCursor = result.LastEvaluatedKey ? b64encode(JSON.stringify(result.LastEvaluatedKey)) : null;
+      return { items, nextCursor };
+    }
+  };
+}
+function b64encode(input) {
+  return btoa(unescape(encodeURIComponent(input)));
+}
+function b64decode(input) {
+  return decodeURIComponent(escape(atob(input)));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  dynamo
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/to-aws-dynamo** — DynamoDB single-table store for NOYDB.\n *\n * Uses a single DynamoDB table with a composite key:\n * - **`pk`** (partition key, String) — vault name.\n * - **`sk`** (sort key, String) — `{collection}#{id}`.\n *\n * This layout keeps every record of a vault in one partition, making\n * `loadAll()` a single `Query` call with no scatter-gather. Individual\n * reads and writes use `GetItem` / `PutItem` with optional\n * `ConditionExpression` for atomic compare-and-swap.\n *\n * ## When to use\n *\n * - **Cloud-synced vaults** — DynamoDB's per-item CAS\n *   (`casAtomic: true`) is safe under concurrent writes from multiple\n *   clients (multi-user, multi-tab).\n * - **Serverless / Lambda** — no connection pool to manage; each\n *   invocation opens fresh HTTP connections via the AWS SDK.\n * - **Pair with S3 for blobs** — keep structured records in DynamoDB\n *   and route binary attachments to `@noy-db/to-aws-s3` via `routeStore`.\n *\n * ## IAM minimum permissions\n *\n * ```json\n * { \"Action\": [\"dynamodb:GetItem\", \"dynamodb:PutItem\",\n *              \"dynamodb:DeleteItem\", \"dynamodb:Query\"] }\n * ```\n *\n * ## Capabilities\n *\n * | Capability | Value |\n * |---|---|\n * | `casAtomic` | `true` — DynamoDB `ConditionExpression` on `_v` |\n * | `ping` | ✓ — `DescribeTable` |\n *\n * @packageDocumentation\n */\n\nimport type { NoydbStore, EncryptedEnvelope, VaultSnapshot } from '@noy-db/hub'\nimport { ConflictError } from '@noy-db/hub'\n\n/**\n * Options for `dynamo()`.\n *\n * The adapter uses a single-table design with a composite primary key\n * `pk = {vault}` (partition) and `sk = {collection}#{id}` (sort). This keeps\n * all records for a vault in a single DynamoDB partition for efficient\n * `loadAll()` via a single Query. For DynamoDB Local development, set\n * `endpoint: 'http://localhost:8000'`.\n */\nexport interface DynamoOptions {\n  /** DynamoDB table name. */\n  table: string\n  /** AWS region. Default: 'us-east-1'. */\n  region?: string\n  /** Custom endpoint (e.g., 'http://localhost:8000' for DynamoDB Local). */\n  endpoint?: string\n  /** DynamoDB document client instance (for advanced configuration). */\n  client?: DynamoDocClient\n}\n\n/**\n * Minimal interface for DynamoDB document client operations.\n * Compatible with @aws-sdk/lib-dynamodb's DynamoDBDocumentClient.\n */\nexport interface DynamoDocClient {\n  send(command: unknown): Promise<unknown>\n}\n\n// Command types matching @aws-sdk/lib-dynamodb\ninterface GetCommandInput { TableName: string; Key: Record<string, unknown> }\ninterface PutCommandInput { TableName: string; Item: Record<string, unknown>; ConditionExpression?: string; ExpressionAttributeNames?: Record<string, string>; ExpressionAttributeValues?: Record<string, unknown> }\ninterface DeleteCommandInput { TableName: string; Key: Record<string, unknown> }\ninterface QueryCommandInput {\n  TableName: string\n  KeyConditionExpression: string\n  ExpressionAttributeNames?: Record<string, string>\n  ExpressionAttributeValues?: Record<string, unknown>\n  Limit?: number\n  ExclusiveStartKey?: Record<string, unknown>\n}\n\n/**\n * Create a DynamoDB adapter using single-table design.\n *\n * Table schema:\n * - pk (String, partition key): vault name\n * - sk (String, sort key): `{collection}#{id}` or `_keyring#{userId}` or `_sync#meta`\n * - _v (Number): record version\n * - _ts (String): timestamp\n * - _iv (String): base64 IV\n * - _data (String): base64 ciphertext\n */\nexport function dynamo(options: DynamoOptions): NoydbStore {\n  const { table } = options\n\n  // Lazy client initialization — only creates the client when first used\n  let clientPromise: Promise<DynamoDocClient> | null = null\n\n  async function getClient(): Promise<DynamoDocClient> {\n    if (options.client) return options.client\n\n    if (!clientPromise) {\n      clientPromise = (async () => {\n        // Dynamic import to keep @aws-sdk as a peer dep\n        const { DynamoDBClient } = await import('@aws-sdk/client-dynamodb') as { DynamoDBClient: new (config: Record<string, unknown>) => unknown }\n        const { DynamoDBDocumentClient } = await import('@aws-sdk/lib-dynamodb') as { DynamoDBDocumentClient: { from: (client: unknown) => DynamoDocClient } }\n\n        const config: Record<string, unknown> = {}\n        if (options.region) config['region'] = options.region\n        if (options.endpoint) config['endpoint'] = options.endpoint\n\n        const ddbClient = new DynamoDBClient(config)\n        return DynamoDBDocumentClient.from(ddbClient)\n      })()\n    }\n\n    return clientPromise\n  }\n\n  function sk(collection: string, id: string): string {\n    return `${collection}#${id}`\n  }\n\n  function parseSk(sortKey: string): { collection: string; id: string } {\n    const idx = sortKey.indexOf('#')\n    return {\n      collection: sortKey.slice(0, idx),\n      id: sortKey.slice(idx + 1),\n    }\n  }\n\n  function itemToEnvelope(item: Record<string, unknown>): EncryptedEnvelope {\n    return {\n      _noydb: 1,\n      _v: item['_v'] as number,\n      _ts: item['_ts'] as string,\n      _iv: item['_iv'] as string,\n      _data: item['_data'] as string,\n    }\n  }\n\n  return {\n    name: 'dynamo',\n\n    async get(vault, collection, id) {\n      const client = await getClient()\n      const { GetCommand } = await import('@aws-sdk/lib-dynamodb') as { GetCommand: new (input: GetCommandInput) => unknown }\n\n      const result = await client.send(new GetCommand({\n        TableName: table,\n        Key: { pk: vault, sk: sk(collection, id) },\n      })) as { Item?: Record<string, unknown> }\n\n      if (!result.Item) return null\n      return itemToEnvelope(result.Item)\n    },\n\n    async put(vault, collection, id, envelope, expectedVersion) {\n      const client = await getClient()\n      const { PutCommand } = await import('@aws-sdk/lib-dynamodb') as { PutCommand: new (input: PutCommandInput) => unknown }\n\n      const item: Record<string, unknown> = {\n        pk: vault,\n        sk: sk(collection, id),\n        _noydb: envelope._noydb,\n        _v: envelope._v,\n        _ts: envelope._ts,\n        _iv: envelope._iv,\n        _data: envelope._data,\n      }\n\n      const input: PutCommandInput = { TableName: table, Item: item }\n\n      if (expectedVersion !== undefined) {\n        input.ConditionExpression = '#v = :expected OR attribute_not_exists(pk)'\n        input.ExpressionAttributeNames = { '#v': '_v' }\n        input.ExpressionAttributeValues = { ':expected': expectedVersion }\n      }\n\n      try {\n        await client.send(new PutCommand(input))\n      } catch (err: unknown) {\n        if (err instanceof Error && err.name === 'ConditionalCheckFailedException') {\n          // Fetch current version for error\n          const current = await this.get(vault, collection, id)\n          throw new ConflictError(\n            current?._v ?? 0,\n            `Version conflict: expected ${expectedVersion}, found ${current?._v}`,\n          )\n        }\n        throw err\n      }\n    },\n\n    async delete(vault, collection, id) {\n      const client = await getClient()\n      const { DeleteCommand } = await import('@aws-sdk/lib-dynamodb') as { DeleteCommand: new (input: DeleteCommandInput) => unknown }\n\n      await client.send(new DeleteCommand({\n        TableName: table,\n        Key: { pk: vault, sk: sk(collection, id) },\n      }))\n    },\n\n    async list(vault, collection) {\n      const client = await getClient()\n      const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n      const result = await client.send(new QueryCommand({\n        TableName: table,\n        KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',\n        ExpressionAttributeValues: {\n          ':pk': vault,\n          ':prefix': `${collection}#`,\n        },\n      })) as { Items?: Record<string, unknown>[] }\n\n      return (result.Items ?? []).map(item => {\n        const { id } = parseSk(item['sk'] as string)\n        return id\n      })\n    },\n\n    async loadAll(vault) {\n      const client = await getClient()\n      const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n      const result = await client.send(new QueryCommand({\n        TableName: table,\n        KeyConditionExpression: 'pk = :pk',\n        ExpressionAttributeValues: { ':pk': vault },\n      })) as { Items?: Record<string, unknown>[] }\n\n      const snapshot: VaultSnapshot = {}\n\n      for (const item of result.Items ?? []) {\n        const sortKey = item['sk'] as string\n        const { collection, id } = parseSk(sortKey)\n\n        if (collection.startsWith('_')) continue // skip _keyring, _sync\n\n        if (!snapshot[collection]) {\n          snapshot[collection] = {}\n        }\n        snapshot[collection][id] = itemToEnvelope(item)\n      }\n\n      return snapshot\n    },\n\n    async saveAll(vault, data) {\n      // Use individual puts (DynamoDB batch write has limitations with conditions)\n      for (const [collName, records] of Object.entries(data)) {\n        for (const [id, envelope] of Object.entries(records)) {\n          await this.put(vault, collName, id, envelope)\n        }\n      }\n    },\n\n    async ping() {\n      try {\n        const client = await getClient()\n        const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n        await client.send(new QueryCommand({\n          TableName: table,\n          KeyConditionExpression: 'pk = :pk',\n          ExpressionAttributeValues: { ':pk': '__ping__' },\n        }))\n        return true\n      } catch {\n        return false\n      }\n    },\n\n    /**\n     * Paginate over a collection using DynamoDB's native `LastEvaluatedKey`\n     * cursor. The cursor is base64-encoded JSON of the LastEvaluatedKey\n     * object so it round-trips through any caller transport.\n     *\n     * Each page is a single Query call against the partition key, so the\n     * read cost is `pageSize ÷ 4 KB` RCUs (eventually consistent) per page.\n     */\n    async listPage(vault, collection, cursor, limit = 100) {\n      const client = await getClient()\n      const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n      const input: QueryCommandInput = {\n        TableName: table,\n        KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',\n        ExpressionAttributeValues: {\n          ':pk': vault,\n          ':prefix': `${collection}#`,\n        },\n        Limit: limit,\n      }\n      if (cursor) {\n        input.ExclusiveStartKey = JSON.parse(b64decode(cursor)) as Record<string, unknown>\n      }\n\n      const result = await client.send(new QueryCommand(input)) as {\n        Items?: Record<string, unknown>[]\n        LastEvaluatedKey?: Record<string, unknown>\n      }\n\n      const items: Array<{ id: string; envelope: EncryptedEnvelope }> = []\n      for (const item of result.Items ?? []) {\n        const { id } = parseSk(item['sk'] as string)\n        items.push({ id, envelope: itemToEnvelope(item) })\n      }\n\n      const nextCursor = result.LastEvaluatedKey\n        ? b64encode(JSON.stringify(result.LastEvaluatedKey))\n        : null\n\n      return { items, nextCursor }\n    },\n  }\n}\n\n/**\n * Tiny base64 helpers that work in both Node 20+ and any modern browser\n * without pulling in @types/node or relying on a Buffer polyfill. The\n * dynamo adapter has zero non-AWS dependencies and we want to keep it\n * that way — listPage cursors are short JSON blobs so the per-call cost\n * of these helpers is negligible.\n */\nfunction b64encode(input: string): string {\n  // btoa expects a Latin-1 string; encodeURIComponent + unescape is the\n  // canonical trick for utf-8 → btoa-safe payloads.\n  return btoa(unescape(encodeURIComponent(input)))\n}\n\nfunction b64decode(input: string): string {\n  return decodeURIComponent(escape(atob(input)))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCA,iBAA8B;AAsDvB,SAAS,OAAO,SAAoC;AACzD,QAAM,EAAE,MAAM,IAAI;AAGlB,MAAI,gBAAiD;AAErD,iBAAe,YAAsC;AACnD,QAAI,QAAQ,OAAQ,QAAO,QAAQ;AAEnC,QAAI,CAAC,eAAe;AAClB,uBAAiB,YAAY;AAE3B,cAAM,EAAE,eAAe,IAAI,MAAM,OAAO,0BAA0B;AAClE,cAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uBAAuB;AAEvE,cAAM,SAAkC,CAAC;AACzC,YAAI,QAAQ,OAAQ,QAAO,QAAQ,IAAI,QAAQ;AAC/C,YAAI,QAAQ,SAAU,QAAO,UAAU,IAAI,QAAQ;AAEnD,cAAM,YAAY,IAAI,eAAe,MAAM;AAC3C,eAAO,uBAAuB,KAAK,SAAS;AAAA,MAC9C,GAAG;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,GAAG,YAAoB,IAAoB;AAClD,WAAO,GAAG,UAAU,IAAI,EAAE;AAAA,EAC5B;AAEA,WAAS,QAAQ,SAAqD;AACpE,UAAM,MAAM,QAAQ,QAAQ,GAAG;AAC/B,WAAO;AAAA,MACL,YAAY,QAAQ,MAAM,GAAG,GAAG;AAAA,MAChC,IAAI,QAAQ,MAAM,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF;AAEA,WAAS,eAAe,MAAkD;AACxE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI,KAAK,IAAI;AAAA,MACb,KAAK,KAAK,KAAK;AAAA,MACf,KAAK,KAAK,KAAK;AAAA,MACf,OAAO,KAAK,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IAEN,MAAM,IAAI,OAAO,YAAY,IAAI;AAC/B,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,uBAAuB;AAE3D,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,WAAW;AAAA,QAC9C,WAAW;AAAA,QACX,KAAK,EAAE,IAAI,OAAO,IAAI,GAAG,YAAY,EAAE,EAAE;AAAA,MAC3C,CAAC,CAAC;AAEF,UAAI,CAAC,OAAO,KAAM,QAAO;AACzB,aAAO,eAAe,OAAO,IAAI;AAAA,IACnC;AAAA,IAEA,MAAM,IAAI,OAAO,YAAY,IAAI,UAAU,iBAAiB;AAC1D,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,uBAAuB;AAE3D,YAAM,OAAgC;AAAA,QACpC,IAAI;AAAA,QACJ,IAAI,GAAG,YAAY,EAAE;AAAA,QACrB,QAAQ,SAAS;AAAA,QACjB,IAAI,SAAS;AAAA,QACb,KAAK,SAAS;AAAA,QACd,KAAK,SAAS;AAAA,QACd,OAAO,SAAS;AAAA,MAClB;AAEA,YAAM,QAAyB,EAAE,WAAW,OAAO,MAAM,KAAK;AAE9D,UAAI,oBAAoB,QAAW;AACjC,cAAM,sBAAsB;AAC5B,cAAM,2BAA2B,EAAE,MAAM,KAAK;AAC9C,cAAM,4BAA4B,EAAE,aAAa,gBAAgB;AAAA,MACnE;AAEA,UAAI;AACF,cAAM,OAAO,KAAK,IAAI,WAAW,KAAK,CAAC;AAAA,MACzC,SAAS,KAAc;AACrB,YAAI,eAAe,SAAS,IAAI,SAAS,mCAAmC;AAE1E,gBAAM,UAAU,MAAM,KAAK,IAAI,OAAO,YAAY,EAAE;AACpD,gBAAM,IAAI;AAAA,YACR,SAAS,MAAM;AAAA,YACf,8BAA8B,eAAe,WAAW,SAAS,EAAE;AAAA,UACrE;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO,YAAY,IAAI;AAClC,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAuB;AAE9D,YAAM,OAAO,KAAK,IAAI,cAAc;AAAA,QAClC,WAAW;AAAA,QACX,KAAK,EAAE,IAAI,OAAO,IAAI,GAAG,YAAY,EAAE,EAAE;AAAA,MAC3C,CAAC,CAAC;AAAA,IACJ;AAAA,IAEA,MAAM,KAAK,OAAO,YAAY;AAC5B,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,aAAa;AAAA,QAChD,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,2BAA2B;AAAA,UACzB,OAAO;AAAA,UACP,WAAW,GAAG,UAAU;AAAA,QAC1B;AAAA,MACF,CAAC,CAAC;AAEF,cAAQ,OAAO,SAAS,CAAC,GAAG,IAAI,UAAQ;AACtC,cAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAW;AAC3C,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,QAAQ,OAAO;AACnB,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,aAAa;AAAA,QAChD,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,2BAA2B,EAAE,OAAO,MAAM;AAAA,MAC5C,CAAC,CAAC;AAEF,YAAM,WAA0B,CAAC;AAEjC,iBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,cAAM,UAAU,KAAK,IAAI;AACzB,cAAM,EAAE,YAAY,GAAG,IAAI,QAAQ,OAAO;AAE1C,YAAI,WAAW,WAAW,GAAG,EAAG;AAEhC,YAAI,CAAC,SAAS,UAAU,GAAG;AACzB,mBAAS,UAAU,IAAI,CAAC;AAAA,QAC1B;AACA,iBAAS,UAAU,EAAE,EAAE,IAAI,eAAe,IAAI;AAAA,MAChD;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAO,MAAM;AAEzB,iBAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,IAAI,GAAG;AACtD,mBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,gBAAM,KAAK,IAAI,OAAO,UAAU,IAAI,QAAQ;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAO;AACX,UAAI;AACF,cAAM,SAAS,MAAM,UAAU;AAC/B,cAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,cAAM,OAAO,KAAK,IAAI,aAAa;AAAA,UACjC,WAAW;AAAA,UACX,wBAAwB;AAAA,UACxB,2BAA2B,EAAE,OAAO,WAAW;AAAA,QACjD,CAAC,CAAC;AACF,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,MAAM,SAAS,OAAO,YAAY,QAAQ,QAAQ,KAAK;AACrD,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,YAAM,QAA2B;AAAA,QAC/B,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,2BAA2B;AAAA,UACzB,OAAO;AAAA,UACP,WAAW,GAAG,UAAU;AAAA,QAC1B;AAAA,QACA,OAAO;AAAA,MACT;AACA,UAAI,QAAQ;AACV,cAAM,oBAAoB,KAAK,MAAM,UAAU,MAAM,CAAC;AAAA,MACxD;AAEA,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,aAAa,KAAK,CAAC;AAKxD,YAAM,QAA4D,CAAC;AACnE,iBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,cAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAW;AAC3C,cAAM,KAAK,EAAE,IAAI,UAAU,eAAe,IAAI,EAAE,CAAC;AAAA,MACnD;AAEA,YAAM,aAAa,OAAO,mBACtB,UAAU,KAAK,UAAU,OAAO,gBAAgB,CAAC,IACjD;AAEJ,aAAO,EAAE,OAAO,WAAW;AAAA,IAC7B;AAAA,EACF;AACF;AASA,SAAS,UAAU,OAAuB;AAGxC,SAAO,KAAK,SAAS,mBAAmB,KAAK,CAAC,CAAC;AACjD;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,mBAAmB,OAAO,KAAK,KAAK,CAAC,CAAC;AAC/C;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,81 @@
+import { NoydbStore } from '@noy-db/hub';
+
+/**
+ * **@noy-db/to-aws-dynamo** — DynamoDB single-table store for NOYDB.
+ *
+ * Uses a single DynamoDB table with a composite key:
+ * - **`pk`** (partition key, String) — vault name.
+ * - **`sk`** (sort key, String) — `{collection}#{id}`.
+ *
+ * This layout keeps every record of a vault in one partition, making
+ * `loadAll()` a single `Query` call with no scatter-gather. Individual
+ * reads and writes use `GetItem` / `PutItem` with optional
+ * `ConditionExpression` for atomic compare-and-swap.
+ *
+ * ## When to use
+ *
+ * - **Cloud-synced vaults** — DynamoDB's per-item CAS
+ *   (`casAtomic: true`) is safe under concurrent writes from multiple
+ *   clients (multi-user, multi-tab).
+ * - **Serverless / Lambda** — no connection pool to manage; each
+ *   invocation opens fresh HTTP connections via the AWS SDK.
+ * - **Pair with S3 for blobs** — keep structured records in DynamoDB
+ *   and route binary attachments to `@noy-db/to-aws-s3` via `routeStore`.
+ *
+ * ## IAM minimum permissions
+ *
+ * ```json
+ * { "Action": ["dynamodb:GetItem", "dynamodb:PutItem",
+ *              "dynamodb:DeleteItem", "dynamodb:Query"] }
+ * ```
+ *
+ * ## Capabilities
+ *
+ * | Capability | Value |
+ * |---|---|
+ * | `casAtomic` | `true` — DynamoDB `ConditionExpression` on `_v` |
+ * | `ping` | ✓ — `DescribeTable` |
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Options for `dynamo()`.
+ *
+ * The adapter uses a single-table design with a composite primary key
+ * `pk = {vault}` (partition) and `sk = {collection}#{id}` (sort). This keeps
+ * all records for a vault in a single DynamoDB partition for efficient
+ * `loadAll()` via a single Query. For DynamoDB Local development, set
+ * `endpoint: 'http://localhost:8000'`.
+ */
+interface DynamoOptions {
+    /** DynamoDB table name. */
+    table: string;
+    /** AWS region. Default: 'us-east-1'. */
+    region?: string;
+    /** Custom endpoint (e.g., 'http://localhost:8000' for DynamoDB Local). */
+    endpoint?: string;
+    /** DynamoDB document client instance (for advanced configuration). */
+    client?: DynamoDocClient;
+}
+/**
+ * Minimal interface for DynamoDB document client operations.
+ * Compatible with @aws-sdk/lib-dynamodb's DynamoDBDocumentClient.
+ */
+interface DynamoDocClient {
+    send(command: unknown): Promise<unknown>;
+}
+/**
+ * Create a DynamoDB adapter using single-table design.
+ *
+ * Table schema:
+ * - pk (String, partition key): vault name
+ * - sk (String, sort key): `{collection}#{id}` or `_keyring#{userId}` or `_sync#meta`
+ * - _v (Number): record version
+ * - _ts (String): timestamp
+ * - _iv (String): base64 IV
+ * - _data (String): base64 ciphertext
+ */
+declare function dynamo(options: DynamoOptions): NoydbStore;
+
+export { type DynamoDocClient, type DynamoOptions, dynamo };

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+import { NoydbStore } from '@noy-db/hub';
+
+/**
+ * **@noy-db/to-aws-dynamo** — DynamoDB single-table store for NOYDB.
+ *
+ * Uses a single DynamoDB table with a composite key:
+ * - **`pk`** (partition key, String) — vault name.
+ * - **`sk`** (sort key, String) — `{collection}#{id}`.
+ *
+ * This layout keeps every record of a vault in one partition, making
+ * `loadAll()` a single `Query` call with no scatter-gather. Individual
+ * reads and writes use `GetItem` / `PutItem` with optional
+ * `ConditionExpression` for atomic compare-and-swap.
+ *
+ * ## When to use
+ *
+ * - **Cloud-synced vaults** — DynamoDB's per-item CAS
+ *   (`casAtomic: true`) is safe under concurrent writes from multiple
+ *   clients (multi-user, multi-tab).
+ * - **Serverless / Lambda** — no connection pool to manage; each
+ *   invocation opens fresh HTTP connections via the AWS SDK.
+ * - **Pair with S3 for blobs** — keep structured records in DynamoDB
+ *   and route binary attachments to `@noy-db/to-aws-s3` via `routeStore`.
+ *
+ * ## IAM minimum permissions
+ *
+ * ```json
+ * { "Action": ["dynamodb:GetItem", "dynamodb:PutItem",
+ *              "dynamodb:DeleteItem", "dynamodb:Query"] }
+ * ```
+ *
+ * ## Capabilities
+ *
+ * | Capability | Value |
+ * |---|---|
+ * | `casAtomic` | `true` — DynamoDB `ConditionExpression` on `_v` |
+ * | `ping` | ✓ — `DescribeTable` |
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Options for `dynamo()`.
+ *
+ * The adapter uses a single-table design with a composite primary key
+ * `pk = {vault}` (partition) and `sk = {collection}#{id}` (sort). This keeps
+ * all records for a vault in a single DynamoDB partition for efficient
+ * `loadAll()` via a single Query. For DynamoDB Local development, set
+ * `endpoint: 'http://localhost:8000'`.
+ */
+interface DynamoOptions {
+    /** DynamoDB table name. */
+    table: string;
+    /** AWS region. Default: 'us-east-1'. */
+    region?: string;
+    /** Custom endpoint (e.g., 'http://localhost:8000' for DynamoDB Local). */
+    endpoint?: string;
+    /** DynamoDB document client instance (for advanced configuration). */
+    client?: DynamoDocClient;
+}
+/**
+ * Minimal interface for DynamoDB document client operations.
+ * Compatible with @aws-sdk/lib-dynamodb's DynamoDBDocumentClient.
+ */
+interface DynamoDocClient {
+    send(command: unknown): Promise<unknown>;
+}
+/**
+ * Create a DynamoDB adapter using single-table design.
+ *
+ * Table schema:
+ * - pk (String, partition key): vault name
+ * - sk (String, sort key): `{collection}#{id}` or `_keyring#{userId}` or `_sync#meta`
+ * - _v (Number): record version
+ * - _ts (String): timestamp
+ * - _iv (String): base64 IV
+ * - _data (String): base64 ciphertext
+ */
+declare function dynamo(options: DynamoOptions): NoydbStore;
+
+export { type DynamoDocClient, type DynamoOptions, dynamo };

package/dist/index.js

@@ -0,0 +1,191 @@
+// src/index.ts
+import { ConflictError } from "@noy-db/hub";
+function dynamo(options) {
+  const { table } = options;
+  let clientPromise = null;
+  async function getClient() {
+    if (options.client) return options.client;
+    if (!clientPromise) {
+      clientPromise = (async () => {
+        const { DynamoDBClient } = await import("@aws-sdk/client-dynamodb");
+        const { DynamoDBDocumentClient } = await import("@aws-sdk/lib-dynamodb");
+        const config = {};
+        if (options.region) config["region"] = options.region;
+        if (options.endpoint) config["endpoint"] = options.endpoint;
+        const ddbClient = new DynamoDBClient(config);
+        return DynamoDBDocumentClient.from(ddbClient);
+      })();
+    }
+    return clientPromise;
+  }
+  function sk(collection, id) {
+    return `${collection}#${id}`;
+  }
+  function parseSk(sortKey) {
+    const idx = sortKey.indexOf("#");
+    return {
+      collection: sortKey.slice(0, idx),
+      id: sortKey.slice(idx + 1)
+    };
+  }
+  function itemToEnvelope(item) {
+    return {
+      _noydb: 1,
+      _v: item["_v"],
+      _ts: item["_ts"],
+      _iv: item["_iv"],
+      _data: item["_data"]
+    };
+  }
+  return {
+    name: "dynamo",
+    async get(vault, collection, id) {
+      const client = await getClient();
+      const { GetCommand } = await import("@aws-sdk/lib-dynamodb");
+      const result = await client.send(new GetCommand({
+        TableName: table,
+        Key: { pk: vault, sk: sk(collection, id) }
+      }));
+      if (!result.Item) return null;
+      return itemToEnvelope(result.Item);
+    },
+    async put(vault, collection, id, envelope, expectedVersion) {
+      const client = await getClient();
+      const { PutCommand } = await import("@aws-sdk/lib-dynamodb");
+      const item = {
+        pk: vault,
+        sk: sk(collection, id),
+        _noydb: envelope._noydb,
+        _v: envelope._v,
+        _ts: envelope._ts,
+        _iv: envelope._iv,
+        _data: envelope._data
+      };
+      const input = { TableName: table, Item: item };
+      if (expectedVersion !== void 0) {
+        input.ConditionExpression = "#v = :expected OR attribute_not_exists(pk)";
+        input.ExpressionAttributeNames = { "#v": "_v" };
+        input.ExpressionAttributeValues = { ":expected": expectedVersion };
+      }
+      try {
+        await client.send(new PutCommand(input));
+      } catch (err) {
+        if (err instanceof Error && err.name === "ConditionalCheckFailedException") {
+          const current = await this.get(vault, collection, id);
+          throw new ConflictError(
+            current?._v ?? 0,
+            `Version conflict: expected ${expectedVersion}, found ${current?._v}`
+          );
+        }
+        throw err;
+      }
+    },
+    async delete(vault, collection, id) {
+      const client = await getClient();
+      const { DeleteCommand } = await import("@aws-sdk/lib-dynamodb");
+      await client.send(new DeleteCommand({
+        TableName: table,
+        Key: { pk: vault, sk: sk(collection, id) }
+      }));
+    },
+    async list(vault, collection) {
+      const client = await getClient();
+      const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+      const result = await client.send(new QueryCommand({
+        TableName: table,
+        KeyConditionExpression: "pk = :pk AND begins_with(sk, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": vault,
+          ":prefix": `${collection}#`
+        }
+      }));
+      return (result.Items ?? []).map((item) => {
+        const { id } = parseSk(item["sk"]);
+        return id;
+      });
+    },
+    async loadAll(vault) {
+      const client = await getClient();
+      const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+      const result = await client.send(new QueryCommand({
+        TableName: table,
+        KeyConditionExpression: "pk = :pk",
+        ExpressionAttributeValues: { ":pk": vault }
+      }));
+      const snapshot = {};
+      for (const item of result.Items ?? []) {
+        const sortKey = item["sk"];
+        const { collection, id } = parseSk(sortKey);
+        if (collection.startsWith("_")) continue;
+        if (!snapshot[collection]) {
+          snapshot[collection] = {};
+        }
+        snapshot[collection][id] = itemToEnvelope(item);
+      }
+      return snapshot;
+    },
+    async saveAll(vault, data) {
+      for (const [collName, records] of Object.entries(data)) {
+        for (const [id, envelope] of Object.entries(records)) {
+          await this.put(vault, collName, id, envelope);
+        }
+      }
+    },
+    async ping() {
+      try {
+        const client = await getClient();
+        const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+        await client.send(new QueryCommand({
+          TableName: table,
+          KeyConditionExpression: "pk = :pk",
+          ExpressionAttributeValues: { ":pk": "__ping__" }
+        }));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    /**
+     * Paginate over a collection using DynamoDB's native `LastEvaluatedKey`
+     * cursor. The cursor is base64-encoded JSON of the LastEvaluatedKey
+     * object so it round-trips through any caller transport.
+     *
+     * Each page is a single Query call against the partition key, so the
+     * read cost is `pageSize ÷ 4 KB` RCUs (eventually consistent) per page.
+     */
+    async listPage(vault, collection, cursor, limit = 100) {
+      const client = await getClient();
+      const { QueryCommand } = await import("@aws-sdk/lib-dynamodb");
+      const input = {
+        TableName: table,
+        KeyConditionExpression: "pk = :pk AND begins_with(sk, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": vault,
+          ":prefix": `${collection}#`
+        },
+        Limit: limit
+      };
+      if (cursor) {
+        input.ExclusiveStartKey = JSON.parse(b64decode(cursor));
+      }
+      const result = await client.send(new QueryCommand(input));
+      const items = [];
+      for (const item of result.Items ?? []) {
+        const { id } = parseSk(item["sk"]);
+        items.push({ id, envelope: itemToEnvelope(item) });
+      }
+      const nextCursor = result.LastEvaluatedKey ? b64encode(JSON.stringify(result.LastEvaluatedKey)) : null;
+      return { items, nextCursor };
+    }
+  };
+}
+function b64encode(input) {
+  return btoa(unescape(encodeURIComponent(input)));
+}
+function b64decode(input) {
+  return decodeURIComponent(escape(atob(input)));
+}
+export {
+  dynamo
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/to-aws-dynamo** — DynamoDB single-table store for NOYDB.\n *\n * Uses a single DynamoDB table with a composite key:\n * - **`pk`** (partition key, String) — vault name.\n * - **`sk`** (sort key, String) — `{collection}#{id}`.\n *\n * This layout keeps every record of a vault in one partition, making\n * `loadAll()` a single `Query` call with no scatter-gather. Individual\n * reads and writes use `GetItem` / `PutItem` with optional\n * `ConditionExpression` for atomic compare-and-swap.\n *\n * ## When to use\n *\n * - **Cloud-synced vaults** — DynamoDB's per-item CAS\n *   (`casAtomic: true`) is safe under concurrent writes from multiple\n *   clients (multi-user, multi-tab).\n * - **Serverless / Lambda** — no connection pool to manage; each\n *   invocation opens fresh HTTP connections via the AWS SDK.\n * - **Pair with S3 for blobs** — keep structured records in DynamoDB\n *   and route binary attachments to `@noy-db/to-aws-s3` via `routeStore`.\n *\n * ## IAM minimum permissions\n *\n * ```json\n * { \"Action\": [\"dynamodb:GetItem\", \"dynamodb:PutItem\",\n *              \"dynamodb:DeleteItem\", \"dynamodb:Query\"] }\n * ```\n *\n * ## Capabilities\n *\n * | Capability | Value |\n * |---|---|\n * | `casAtomic` | `true` — DynamoDB `ConditionExpression` on `_v` |\n * | `ping` | ✓ — `DescribeTable` |\n *\n * @packageDocumentation\n */\n\nimport type { NoydbStore, EncryptedEnvelope, VaultSnapshot } from '@noy-db/hub'\nimport { ConflictError } from '@noy-db/hub'\n\n/**\n * Options for `dynamo()`.\n *\n * The adapter uses a single-table design with a composite primary key\n * `pk = {vault}` (partition) and `sk = {collection}#{id}` (sort). This keeps\n * all records for a vault in a single DynamoDB partition for efficient\n * `loadAll()` via a single Query. For DynamoDB Local development, set\n * `endpoint: 'http://localhost:8000'`.\n */\nexport interface DynamoOptions {\n  /** DynamoDB table name. */\n  table: string\n  /** AWS region. Default: 'us-east-1'. */\n  region?: string\n  /** Custom endpoint (e.g., 'http://localhost:8000' for DynamoDB Local). */\n  endpoint?: string\n  /** DynamoDB document client instance (for advanced configuration). */\n  client?: DynamoDocClient\n}\n\n/**\n * Minimal interface for DynamoDB document client operations.\n * Compatible with @aws-sdk/lib-dynamodb's DynamoDBDocumentClient.\n */\nexport interface DynamoDocClient {\n  send(command: unknown): Promise<unknown>\n}\n\n// Command types matching @aws-sdk/lib-dynamodb\ninterface GetCommandInput { TableName: string; Key: Record<string, unknown> }\ninterface PutCommandInput { TableName: string; Item: Record<string, unknown>; ConditionExpression?: string; ExpressionAttributeNames?: Record<string, string>; ExpressionAttributeValues?: Record<string, unknown> }\ninterface DeleteCommandInput { TableName: string; Key: Record<string, unknown> }\ninterface QueryCommandInput {\n  TableName: string\n  KeyConditionExpression: string\n  ExpressionAttributeNames?: Record<string, string>\n  ExpressionAttributeValues?: Record<string, unknown>\n  Limit?: number\n  ExclusiveStartKey?: Record<string, unknown>\n}\n\n/**\n * Create a DynamoDB adapter using single-table design.\n *\n * Table schema:\n * - pk (String, partition key): vault name\n * - sk (String, sort key): `{collection}#{id}` or `_keyring#{userId}` or `_sync#meta`\n * - _v (Number): record version\n * - _ts (String): timestamp\n * - _iv (String): base64 IV\n * - _data (String): base64 ciphertext\n */\nexport function dynamo(options: DynamoOptions): NoydbStore {\n  const { table } = options\n\n  // Lazy client initialization — only creates the client when first used\n  let clientPromise: Promise<DynamoDocClient> | null = null\n\n  async function getClient(): Promise<DynamoDocClient> {\n    if (options.client) return options.client\n\n    if (!clientPromise) {\n      clientPromise = (async () => {\n        // Dynamic import to keep @aws-sdk as a peer dep\n        const { DynamoDBClient } = await import('@aws-sdk/client-dynamodb') as { DynamoDBClient: new (config: Record<string, unknown>) => unknown }\n        const { DynamoDBDocumentClient } = await import('@aws-sdk/lib-dynamodb') as { DynamoDBDocumentClient: { from: (client: unknown) => DynamoDocClient } }\n\n        const config: Record<string, unknown> = {}\n        if (options.region) config['region'] = options.region\n        if (options.endpoint) config['endpoint'] = options.endpoint\n\n        const ddbClient = new DynamoDBClient(config)\n        return DynamoDBDocumentClient.from(ddbClient)\n      })()\n    }\n\n    return clientPromise\n  }\n\n  function sk(collection: string, id: string): string {\n    return `${collection}#${id}`\n  }\n\n  function parseSk(sortKey: string): { collection: string; id: string } {\n    const idx = sortKey.indexOf('#')\n    return {\n      collection: sortKey.slice(0, idx),\n      id: sortKey.slice(idx + 1),\n    }\n  }\n\n  function itemToEnvelope(item: Record<string, unknown>): EncryptedEnvelope {\n    return {\n      _noydb: 1,\n      _v: item['_v'] as number,\n      _ts: item['_ts'] as string,\n      _iv: item['_iv'] as string,\n      _data: item['_data'] as string,\n    }\n  }\n\n  return {\n    name: 'dynamo',\n\n    async get(vault, collection, id) {\n      const client = await getClient()\n      const { GetCommand } = await import('@aws-sdk/lib-dynamodb') as { GetCommand: new (input: GetCommandInput) => unknown }\n\n      const result = await client.send(new GetCommand({\n        TableName: table,\n        Key: { pk: vault, sk: sk(collection, id) },\n      })) as { Item?: Record<string, unknown> }\n\n      if (!result.Item) return null\n      return itemToEnvelope(result.Item)\n    },\n\n    async put(vault, collection, id, envelope, expectedVersion) {\n      const client = await getClient()\n      const { PutCommand } = await import('@aws-sdk/lib-dynamodb') as { PutCommand: new (input: PutCommandInput) => unknown }\n\n      const item: Record<string, unknown> = {\n        pk: vault,\n        sk: sk(collection, id),\n        _noydb: envelope._noydb,\n        _v: envelope._v,\n        _ts: envelope._ts,\n        _iv: envelope._iv,\n        _data: envelope._data,\n      }\n\n      const input: PutCommandInput = { TableName: table, Item: item }\n\n      if (expectedVersion !== undefined) {\n        input.ConditionExpression = '#v = :expected OR attribute_not_exists(pk)'\n        input.ExpressionAttributeNames = { '#v': '_v' }\n        input.ExpressionAttributeValues = { ':expected': expectedVersion }\n      }\n\n      try {\n        await client.send(new PutCommand(input))\n      } catch (err: unknown) {\n        if (err instanceof Error && err.name === 'ConditionalCheckFailedException') {\n          // Fetch current version for error\n          const current = await this.get(vault, collection, id)\n          throw new ConflictError(\n            current?._v ?? 0,\n            `Version conflict: expected ${expectedVersion}, found ${current?._v}`,\n          )\n        }\n        throw err\n      }\n    },\n\n    async delete(vault, collection, id) {\n      const client = await getClient()\n      const { DeleteCommand } = await import('@aws-sdk/lib-dynamodb') as { DeleteCommand: new (input: DeleteCommandInput) => unknown }\n\n      await client.send(new DeleteCommand({\n        TableName: table,\n        Key: { pk: vault, sk: sk(collection, id) },\n      }))\n    },\n\n    async list(vault, collection) {\n      const client = await getClient()\n      const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n      const result = await client.send(new QueryCommand({\n        TableName: table,\n        KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',\n        ExpressionAttributeValues: {\n          ':pk': vault,\n          ':prefix': `${collection}#`,\n        },\n      })) as { Items?: Record<string, unknown>[] }\n\n      return (result.Items ?? []).map(item => {\n        const { id } = parseSk(item['sk'] as string)\n        return id\n      })\n    },\n\n    async loadAll(vault) {\n      const client = await getClient()\n      const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n      const result = await client.send(new QueryCommand({\n        TableName: table,\n        KeyConditionExpression: 'pk = :pk',\n        ExpressionAttributeValues: { ':pk': vault },\n      })) as { Items?: Record<string, unknown>[] }\n\n      const snapshot: VaultSnapshot = {}\n\n      for (const item of result.Items ?? []) {\n        const sortKey = item['sk'] as string\n        const { collection, id } = parseSk(sortKey)\n\n        if (collection.startsWith('_')) continue // skip _keyring, _sync\n\n        if (!snapshot[collection]) {\n          snapshot[collection] = {}\n        }\n        snapshot[collection][id] = itemToEnvelope(item)\n      }\n\n      return snapshot\n    },\n\n    async saveAll(vault, data) {\n      // Use individual puts (DynamoDB batch write has limitations with conditions)\n      for (const [collName, records] of Object.entries(data)) {\n        for (const [id, envelope] of Object.entries(records)) {\n          await this.put(vault, collName, id, envelope)\n        }\n      }\n    },\n\n    async ping() {\n      try {\n        const client = await getClient()\n        const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n        await client.send(new QueryCommand({\n          TableName: table,\n          KeyConditionExpression: 'pk = :pk',\n          ExpressionAttributeValues: { ':pk': '__ping__' },\n        }))\n        return true\n      } catch {\n        return false\n      }\n    },\n\n    /**\n     * Paginate over a collection using DynamoDB's native `LastEvaluatedKey`\n     * cursor. The cursor is base64-encoded JSON of the LastEvaluatedKey\n     * object so it round-trips through any caller transport.\n     *\n     * Each page is a single Query call against the partition key, so the\n     * read cost is `pageSize ÷ 4 KB` RCUs (eventually consistent) per page.\n     */\n    async listPage(vault, collection, cursor, limit = 100) {\n      const client = await getClient()\n      const { QueryCommand } = await import('@aws-sdk/lib-dynamodb') as { QueryCommand: new (input: QueryCommandInput) => unknown }\n\n      const input: QueryCommandInput = {\n        TableName: table,\n        KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',\n        ExpressionAttributeValues: {\n          ':pk': vault,\n          ':prefix': `${collection}#`,\n        },\n        Limit: limit,\n      }\n      if (cursor) {\n        input.ExclusiveStartKey = JSON.parse(b64decode(cursor)) as Record<string, unknown>\n      }\n\n      const result = await client.send(new QueryCommand(input)) as {\n        Items?: Record<string, unknown>[]\n        LastEvaluatedKey?: Record<string, unknown>\n      }\n\n      const items: Array<{ id: string; envelope: EncryptedEnvelope }> = []\n      for (const item of result.Items ?? []) {\n        const { id } = parseSk(item['sk'] as string)\n        items.push({ id, envelope: itemToEnvelope(item) })\n      }\n\n      const nextCursor = result.LastEvaluatedKey\n        ? b64encode(JSON.stringify(result.LastEvaluatedKey))\n        : null\n\n      return { items, nextCursor }\n    },\n  }\n}\n\n/**\n * Tiny base64 helpers that work in both Node 20+ and any modern browser\n * without pulling in @types/node or relying on a Buffer polyfill. The\n * dynamo adapter has zero non-AWS dependencies and we want to keep it\n * that way — listPage cursors are short JSON blobs so the per-call cost\n * of these helpers is negligible.\n */\nfunction b64encode(input: string): string {\n  // btoa expects a Latin-1 string; encodeURIComponent + unescape is the\n  // canonical trick for utf-8 → btoa-safe payloads.\n  return btoa(unescape(encodeURIComponent(input)))\n}\n\nfunction b64decode(input: string): string {\n  return decodeURIComponent(escape(atob(input)))\n}\n"],"mappings":";AAwCA,SAAS,qBAAqB;AAsDvB,SAAS,OAAO,SAAoC;AACzD,QAAM,EAAE,MAAM,IAAI;AAGlB,MAAI,gBAAiD;AAErD,iBAAe,YAAsC;AACnD,QAAI,QAAQ,OAAQ,QAAO,QAAQ;AAEnC,QAAI,CAAC,eAAe;AAClB,uBAAiB,YAAY;AAE3B,cAAM,EAAE,eAAe,IAAI,MAAM,OAAO,0BAA0B;AAClE,cAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uBAAuB;AAEvE,cAAM,SAAkC,CAAC;AACzC,YAAI,QAAQ,OAAQ,QAAO,QAAQ,IAAI,QAAQ;AAC/C,YAAI,QAAQ,SAAU,QAAO,UAAU,IAAI,QAAQ;AAEnD,cAAM,YAAY,IAAI,eAAe,MAAM;AAC3C,eAAO,uBAAuB,KAAK,SAAS;AAAA,MAC9C,GAAG;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,GAAG,YAAoB,IAAoB;AAClD,WAAO,GAAG,UAAU,IAAI,EAAE;AAAA,EAC5B;AAEA,WAAS,QAAQ,SAAqD;AACpE,UAAM,MAAM,QAAQ,QAAQ,GAAG;AAC/B,WAAO;AAAA,MACL,YAAY,QAAQ,MAAM,GAAG,GAAG;AAAA,MAChC,IAAI,QAAQ,MAAM,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF;AAEA,WAAS,eAAe,MAAkD;AACxE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI,KAAK,IAAI;AAAA,MACb,KAAK,KAAK,KAAK;AAAA,MACf,KAAK,KAAK,KAAK;AAAA,MACf,OAAO,KAAK,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IAEN,MAAM,IAAI,OAAO,YAAY,IAAI;AAC/B,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,uBAAuB;AAE3D,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,WAAW;AAAA,QAC9C,WAAW;AAAA,QACX,KAAK,EAAE,IAAI,OAAO,IAAI,GAAG,YAAY,EAAE,EAAE;AAAA,MAC3C,CAAC,CAAC;AAEF,UAAI,CAAC,OAAO,KAAM,QAAO;AACzB,aAAO,eAAe,OAAO,IAAI;AAAA,IACnC;AAAA,IAEA,MAAM,IAAI,OAAO,YAAY,IAAI,UAAU,iBAAiB;AAC1D,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,uBAAuB;AAE3D,YAAM,OAAgC;AAAA,QACpC,IAAI;AAAA,QACJ,IAAI,GAAG,YAAY,EAAE;AAAA,QACrB,QAAQ,SAAS;AAAA,QACjB,IAAI,SAAS;AAAA,QACb,KAAK,SAAS;AAAA,QACd,KAAK,SAAS;AAAA,QACd,OAAO,SAAS;AAAA,MAClB;AAEA,YAAM,QAAyB,EAAE,WAAW,OAAO,MAAM,KAAK;AAE9D,UAAI,oBAAoB,QAAW;AACjC,cAAM,sBAAsB;AAC5B,cAAM,2BAA2B,EAAE,MAAM,KAAK;AAC9C,cAAM,4BAA4B,EAAE,aAAa,gBAAgB;AAAA,MACnE;AAEA,UAAI;AACF,cAAM,OAAO,KAAK,IAAI,WAAW,KAAK,CAAC;AAAA,MACzC,SAAS,KAAc;AACrB,YAAI,eAAe,SAAS,IAAI,SAAS,mCAAmC;AAE1E,gBAAM,UAAU,MAAM,KAAK,IAAI,OAAO,YAAY,EAAE;AACpD,gBAAM,IAAI;AAAA,YACR,SAAS,MAAM;AAAA,YACf,8BAA8B,eAAe,WAAW,SAAS,EAAE;AAAA,UACrE;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO,YAAY,IAAI;AAClC,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAuB;AAE9D,YAAM,OAAO,KAAK,IAAI,cAAc;AAAA,QAClC,WAAW;AAAA,QACX,KAAK,EAAE,IAAI,OAAO,IAAI,GAAG,YAAY,EAAE,EAAE;AAAA,MAC3C,CAAC,CAAC;AAAA,IACJ;AAAA,IAEA,MAAM,KAAK,OAAO,YAAY;AAC5B,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,aAAa;AAAA,QAChD,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,2BAA2B;AAAA,UACzB,OAAO;AAAA,UACP,WAAW,GAAG,UAAU;AAAA,QAC1B;AAAA,MACF,CAAC,CAAC;AAEF,cAAQ,OAAO,SAAS,CAAC,GAAG,IAAI,UAAQ;AACtC,cAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAW;AAC3C,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,QAAQ,OAAO;AACnB,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,aAAa;AAAA,QAChD,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,2BAA2B,EAAE,OAAO,MAAM;AAAA,MAC5C,CAAC,CAAC;AAEF,YAAM,WAA0B,CAAC;AAEjC,iBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,cAAM,UAAU,KAAK,IAAI;AACzB,cAAM,EAAE,YAAY,GAAG,IAAI,QAAQ,OAAO;AAE1C,YAAI,WAAW,WAAW,GAAG,EAAG;AAEhC,YAAI,CAAC,SAAS,UAAU,GAAG;AACzB,mBAAS,UAAU,IAAI,CAAC;AAAA,QAC1B;AACA,iBAAS,UAAU,EAAE,EAAE,IAAI,eAAe,IAAI;AAAA,MAChD;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAO,MAAM;AAEzB,iBAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,IAAI,GAAG;AACtD,mBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,gBAAM,KAAK,IAAI,OAAO,UAAU,IAAI,QAAQ;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAO;AACX,UAAI;AACF,cAAM,SAAS,MAAM,UAAU;AAC/B,cAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,cAAM,OAAO,KAAK,IAAI,aAAa;AAAA,UACjC,WAAW;AAAA,UACX,wBAAwB;AAAA,UACxB,2BAA2B,EAAE,OAAO,WAAW;AAAA,QACjD,CAAC,CAAC;AACF,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,MAAM,SAAS,OAAO,YAAY,QAAQ,QAAQ,KAAK;AACrD,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAE7D,YAAM,QAA2B;AAAA,QAC/B,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,2BAA2B;AAAA,UACzB,OAAO;AAAA,UACP,WAAW,GAAG,UAAU;AAAA,QAC1B;AAAA,QACA,OAAO;AAAA,MACT;AACA,UAAI,QAAQ;AACV,cAAM,oBAAoB,KAAK,MAAM,UAAU,MAAM,CAAC;AAAA,MACxD;AAEA,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,aAAa,KAAK,CAAC;AAKxD,YAAM,QAA4D,CAAC;AACnE,iBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,cAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAW;AAC3C,cAAM,KAAK,EAAE,IAAI,UAAU,eAAe,IAAI,EAAE,CAAC;AAAA,MACnD;AAEA,YAAM,aAAa,OAAO,mBACtB,UAAU,KAAK,UAAU,OAAO,gBAAgB,CAAC,IACjD;AAEJ,aAAO,EAAE,OAAO,WAAW;AAAA,IAC7B;AAAA,EACF;AACF;AASA,SAAS,UAAU,OAAuB;AAGxC,SAAO,KAAK,SAAS,mBAAmB,KAAK,CAAC,CAAC;AACjD;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,mBAAmB,OAAO,KAAK,KAAK,CAAC,CAAC;AAC/C;","names":[]}

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@noy-db/to-aws-dynamo",
+  "version": "0.1.0-pre.3",
+  "description": "AWS DynamoDB adapter for noy-db — single-table design, zero-knowledge cloud sync",
+  "license": "MIT",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/to-aws-dynamo#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "directory": "packages/to-aws-dynamo"
+  },
+  "bugs": {
+    "url": "https://github.com/vLannaAi/noy-db/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-dynamodb": "^3.0.0",
+    "@aws-sdk/lib-dynamodb": "^3.0.0",
+    "@noy-db/hub": "0.1.0-pre.3"
+  },
+  "devDependencies": {
+    "@aws-sdk/client-dynamodb": "^3.0.0",
+    "@aws-sdk/lib-dynamodb": "^3.0.0",
+    "@noy-db/hub": "0.1.0-pre.3"
+  },
+  "keywords": [
+    "noy-db",
+    "adapter",
+    "dynamodb",
+    "aws",
+    "single-table",
+    "cloud",
+    "sync",
+    "encryption",
+    "zero-knowledge"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}