@noy-db/to-smb 0.1.0-pre.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vLannaAi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,33 @@
+# @noy-db/to-smb
+
+[![npm](https://img.shields.io/npm/v/%40noy-db/to-smb.svg)](https://www.npmjs.com/package/@noy-db/to-smb)
+
+> SMB/CIFS network file store for noy-db. Works against Windows file servers, NAS devices (Synology/QNAP/Netgear), and corporate shared drives via NTLM or Kerberos auth
+
+Part of [**`@noy-db/hub`**](https://www.npmjs.com/package/@noy-db/hub) — the zero-knowledge, offline-first, encrypted document store.
+
+## Install
+
+```bash
+pnpm add @noy-db/hub @noy-db/to-smb
+```
+
+## What it is
+
+SMB/CIFS network file store for noy-db. Works against Windows file servers, NAS devices (Synology/QNAP/Netgear), and corporate shared drives via NTLM or Kerberos auth — no OS mount required.
+
+## Status
+
+**Pre-release** (`0.1.0-pre.1`). API may change before `1.0`.
+
+## Documentation
+
+See the [main repository](https://github.com/vLannaAi/noy-db#readme) for setup, examples, and the full subsystem catalog.
+
+- Source — [`packages/to-smb`](https://github.com/vLannaAi/noy-db/tree/main/packages/to-smb)
+- Issues — [github.com/vLannaAi/noy-db/issues](https://github.com/vLannaAi/noy-db/issues)
+- Spec — [`SPEC.md`](https://github.com/vLannaAi/noy-db/blob/main/SPEC.md)
+
+## License
+
+[MIT](./LICENSE) © vLannaAi

package/dist/index.cjs

@@ -0,0 +1,127 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  smb: () => smb
+});
+module.exports = __toCommonJS(index_exports);
+function join(...parts) {
+  return parts.filter((p) => p !== "").map((p) => p.replace(/^\/+|\/+$/g, "")).filter((p) => p !== "").join("/");
+}
+function decode(bytes) {
+  if (typeof Buffer !== "undefined" && bytes instanceof Buffer) return bytes.toString("utf-8");
+  return new TextDecoder().decode(bytes);
+}
+function smb(options) {
+  const { smb: client, remotePath = "noydb", name = "smb" } = options;
+  const root = remotePath.replace(/^\/+|\/+$/g, "");
+  const recordPath = (v, c, id) => join(root, v, c, `${id}.json`);
+  const collPath = (v, c) => join(root, v, c);
+  const vaultPath = (v) => join(root, v);
+  async function ensureDir(path) {
+    const parts = path.split("/").filter(Boolean);
+    let cur = "";
+    for (const seg of parts) {
+      cur = cur ? `${cur}/${seg}` : seg;
+      try {
+        await client.mkdir(cur);
+      } catch {
+      }
+    }
+  }
+  async function safeReaddir(path) {
+    try {
+      return await client.readdir(path);
+    } catch {
+      return [];
+    }
+  }
+  const store = {
+    name,
+    async get(vault, collection, id) {
+      const bytes = await client.readFile(recordPath(vault, collection, id));
+      if (bytes === null) return null;
+      return JSON.parse(decode(bytes));
+    },
+    async put(vault, collection, id, envelope) {
+      const target = recordPath(vault, collection, id);
+      const tmp = `${target}.tmp`;
+      await ensureDir(collPath(vault, collection));
+      await client.writeFile(tmp, JSON.stringify(envelope));
+      await client.rename(tmp, target);
+    },
+    async delete(vault, collection, id) {
+      try {
+        await client.unlink(recordPath(vault, collection, id));
+      } catch {
+      }
+    },
+    async list(vault, collection) {
+      const entries = await safeReaddir(collPath(vault, collection));
+      return entries.filter((e) => e.endsWith(".json") && !e.endsWith(".tmp")).map((e) => e.slice(0, -".json".length)).sort();
+    },
+    async loadAll(vault) {
+      const snap = {};
+      const collections = await safeReaddir(vaultPath(vault));
+      for (const collection of collections) {
+        if (collection.startsWith("_")) continue;
+        const ids = await store.list(vault, collection);
+        const bucket = {};
+        for (const id of ids) {
+          const env = await store.get(vault, collection, id);
+          if (env) bucket[id] = env;
+        }
+        if (Object.keys(bucket).length > 0) snap[collection] = bucket;
+      }
+      return snap;
+    },
+    async saveAll(vault, data) {
+      const existing = await safeReaddir(vaultPath(vault));
+      for (const collection of existing) {
+        const ids = await safeReaddir(collPath(vault, collection));
+        for (const fname of ids) {
+          await client.unlink(join(root, vault, collection, fname)).catch(() => void 0);
+        }
+      }
+      for (const [collection, recs] of Object.entries(data)) {
+        await ensureDir(collPath(vault, collection));
+        for (const [id, envelope] of Object.entries(recs)) {
+          await store.put(vault, collection, id, envelope);
+        }
+      }
+    },
+    async ping() {
+      if (client.ping) return client.ping();
+      try {
+        await client.readdir(root);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  return store;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  smb
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/to-smb** — SMB / CIFS network file store for noy-db.\n *\n * Works against Windows file servers, NAS devices (Synology, QNAP,\n * Netgear), and corporate shared drives. Unlike pointing\n * `@noy-db/to-file` at an OS-mounted path, this package speaks SMB\n * directly — no mount step, explicit credential handling, richer\n * reconnection semantics.\n *\n * ## Driver — bring your own\n *\n * Any SMB2/3 client with a promise-style API works. Ready-made: the\n * `smb2` or `@marsaud/smb2` packages on npm. A duck-typed handle is\n * the injection seam — pass a connected client in, noy-db talks to it.\n *\n * ## Auth\n *\n * - **NTLM** — `username` + `password` (+ optional `domain`). Typical\n *   for workgroup NAS.\n * - **Kerberos** — domain-joined environments, ticket from the OS\n *   cache. Setting `authKind: 'kerberos'` tells the driver to leave\n *   password empty and defer to `kinit`.\n *\n * Credentials never hit disk through this adapter — the caller is\n * responsible for sourcing them from a secrets manager. For\n * long-lived integrations, stash them in the vault's encrypted\n * `_sync_credentials` collection and pass them at open time.\n *\n * ## Atomicity\n *\n * SMB has rename but no atomic CAS — same caveat as WebDAV. Per-record\n * writes go through `{id}.json.tmp` + rename, avoiding the partial-write\n * failure mode. For multi-writer CAS, pair with a primary store that\n * implements it.\n *\n * @packageDocumentation\n */\n\nimport type { NoydbStore, EncryptedEnvelope, VaultSnapshot } from '@noy-db/hub'\n\n/**\n * Duck-typed SMB client. Compatible with `smb2` / `@marsaud/smb2`\n * promise wrappers. File paths use Windows-style forward slashes\n * (the SMB client translates to backslashes on the wire).\n */\nexport interface SmbHandle {\n  readFile(path: string): Promise<Uint8Array | Buffer | null>\n  writeFile(path: string, data: Uint8Array | Buffer | string): Promise<void>\n  unlink(path: string): Promise<void>\n  mkdir(path: string): Promise<void>\n  rename(from: string, to: string): Promise<void>\n  readdir(path: string): Promise<string[]>\n  /** Optional liveness check — returns true on a reachable share. */\n  ping?(): Promise<boolean>\n}\n\nexport interface SmbStoreOptions {\n  /** Connected SMB client — consumer supplies this. */\n  readonly smb: SmbHandle\n  /** Relative subdirectory within the share. Default `'noydb'`. */\n  readonly remotePath?: string\n  /** Diagnostic name. Default `'smb'`. */\n  readonly name?: string\n}\n\nfunction join(...parts: string[]): string {\n  return parts\n    .filter(p => p !== '')\n    .map(p => p.replace(/^\\/+|\\/+$/g, ''))\n    .filter(p => p !== '')\n    .join('/')\n}\n\nfunction decode(bytes: Uint8Array | Buffer): string {\n  if (typeof Buffer !== 'undefined' && bytes instanceof Buffer) return bytes.toString('utf-8')\n  return new TextDecoder().decode(bytes)\n}\n\nexport function smb(options: SmbStoreOptions): NoydbStore {\n  const { smb: client, remotePath = 'noydb', name = 'smb' } = options\n  const root = remotePath.replace(/^\\/+|\\/+$/g, '')\n\n  const recordPath = (v: string, c: string, id: string): string => join(root, v, c, `${id}.json`)\n  const collPath = (v: string, c: string): string => join(root, v, c)\n  const vaultPath = (v: string): string => join(root, v)\n\n  async function ensureDir(path: string): Promise<void> {\n    // SMB mkdir is not always recursive — walk parents.\n    const parts = path.split('/').filter(Boolean)\n    let cur = ''\n    for (const seg of parts) {\n      cur = cur ? `${cur}/${seg}` : seg\n      try {\n        await client.mkdir(cur)\n      } catch {\n        // Exists or race — continue.\n      }\n    }\n  }\n\n  async function safeReaddir(path: string): Promise<string[]> {\n    try {\n      return await client.readdir(path)\n    } catch {\n      return []\n    }\n  }\n\n  const store: NoydbStore = {\n    name,\n\n    async get(vault, collection, id) {\n      const bytes = await client.readFile(recordPath(vault, collection, id))\n      if (bytes === null) return null\n      return JSON.parse(decode(bytes)) as EncryptedEnvelope\n    },\n\n    async put(vault, collection, id, envelope) {\n      // casAtomic: false — expectedVersion ignored.\n      const target = recordPath(vault, collection, id)\n      const tmp = `${target}.tmp`\n      await ensureDir(collPath(vault, collection))\n      await client.writeFile(tmp, JSON.stringify(envelope))\n      await client.rename(tmp, target)\n    },\n\n    async delete(vault, collection, id) {\n      try {\n        await client.unlink(recordPath(vault, collection, id))\n      } catch {\n        /* idempotent */\n      }\n    },\n\n    async list(vault, collection) {\n      const entries = await safeReaddir(collPath(vault, collection))\n      return entries\n        .filter(e => e.endsWith('.json') && !e.endsWith('.tmp'))\n        .map(e => e.slice(0, -'.json'.length))\n        .sort()\n    },\n\n    async loadAll(vault) {\n      const snap: VaultSnapshot = {}\n      const collections = await safeReaddir(vaultPath(vault))\n      for (const collection of collections) {\n        if (collection.startsWith('_')) continue\n        const ids = await store.list(vault, collection)\n        const bucket: Record<string, EncryptedEnvelope> = {}\n        for (const id of ids) {\n          const env = await store.get(vault, collection, id)\n          if (env) bucket[id] = env\n        }\n        if (Object.keys(bucket).length > 0) snap[collection] = bucket\n      }\n      return snap\n    },\n\n    async saveAll(vault, data) {\n      const existing = await safeReaddir(vaultPath(vault))\n      for (const collection of existing) {\n        const ids = await safeReaddir(collPath(vault, collection))\n        for (const fname of ids) {\n          await client.unlink(join(root, vault, collection, fname)).catch(() => undefined)\n        }\n      }\n      for (const [collection, recs] of Object.entries(data)) {\n        await ensureDir(collPath(vault, collection))\n        for (const [id, envelope] of Object.entries(recs)) {\n          await store.put(vault, collection, id, envelope)\n        }\n      }\n    },\n\n    async ping() {\n      if (client.ping) return client.ping()\n      try {\n        await client.readdir(root)\n        return true\n      } catch {\n        return false\n      }\n    },\n  }\n\n  return store\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiEA,SAAS,QAAQ,OAAyB;AACxC,SAAO,MACJ,OAAO,OAAK,MAAM,EAAE,EACpB,IAAI,OAAK,EAAE,QAAQ,cAAc,EAAE,CAAC,EACpC,OAAO,OAAK,MAAM,EAAE,EACpB,KAAK,GAAG;AACb;AAEA,SAAS,OAAO,OAAoC;AAClD,MAAI,OAAO,WAAW,eAAe,iBAAiB,OAAQ,QAAO,MAAM,SAAS,OAAO;AAC3F,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAEO,SAAS,IAAI,SAAsC;AACxD,QAAM,EAAE,KAAK,QAAQ,aAAa,SAAS,OAAO,MAAM,IAAI;AAC5D,QAAM,OAAO,WAAW,QAAQ,cAAc,EAAE;AAEhD,QAAM,aAAa,CAAC,GAAW,GAAW,OAAuB,KAAK,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO;AAC9F,QAAM,WAAW,CAAC,GAAW,MAAsB,KAAK,MAAM,GAAG,CAAC;AAClE,QAAM,YAAY,CAAC,MAAsB,KAAK,MAAM,CAAC;AAErD,iBAAe,UAAU,MAA6B;AAEpD,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC5C,QAAI,MAAM;AACV,eAAW,OAAO,OAAO;AACvB,YAAM,MAAM,GAAG,GAAG,IAAI,GAAG,KAAK;AAC9B,UAAI;AACF,cAAM,OAAO,MAAM,GAAG;AAAA,MACxB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,YAAY,MAAiC;AAC1D,QAAI;AACF,aAAO,MAAM,OAAO,QAAQ,IAAI;AAAA,IAClC,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAEA,QAAM,QAAoB;AAAA,IACxB;AAAA,IAEA,MAAM,IAAI,OAAO,YAAY,IAAI;AAC/B,YAAM,QAAQ,MAAM,OAAO,SAAS,WAAW,OAAO,YAAY,EAAE,CAAC;AACrE,UAAI,UAAU,KAAM,QAAO;AAC3B,aAAO,KAAK,MAAM,OAAO,KAAK,CAAC;AAAA,IACjC;AAAA,IAEA,MAAM,IAAI,OAAO,YAAY,IAAI,UAAU;AAEzC,YAAM,SAAS,WAAW,OAAO,YAAY,EAAE;AAC/C,YAAM,MAAM,GAAG,MAAM;AACrB,YAAM,UAAU,SAAS,OAAO,UAAU,CAAC;AAC3C,YAAM,OAAO,UAAU,KAAK,KAAK,UAAU,QAAQ,CAAC;AACpD,YAAM,OAAO,OAAO,KAAK,MAAM;AAAA,IACjC;AAAA,IAEA,MAAM,OAAO,OAAO,YAAY,IAAI;AAClC,UAAI;AACF,cAAM,OAAO,OAAO,WAAW,OAAO,YAAY,EAAE,CAAC;AAAA,MACvD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,OAAO,YAAY;AAC5B,YAAM,UAAU,MAAM,YAAY,SAAS,OAAO,UAAU,CAAC;AAC7D,aAAO,QACJ,OAAO,OAAK,EAAE,SAAS,OAAO,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,EACtD,IAAI,OAAK,EAAE,MAAM,GAAG,CAAC,QAAQ,MAAM,CAAC,EACpC,KAAK;AAAA,IACV;AAAA,IAEA,MAAM,QAAQ,OAAO;AACnB,YAAM,OAAsB,CAAC;AAC7B,YAAM,cAAc,MAAM,YAAY,UAAU,KAAK,CAAC;AACtD,iBAAW,cAAc,aAAa;AACpC,YAAI,WAAW,WAAW,GAAG,EAAG;AAChC,cAAM,MAAM,MAAM,MAAM,KAAK,OAAO,UAAU;AAC9C,cAAM,SAA4C,CAAC;AACnD,mBAAW,MAAM,KAAK;AACpB,gBAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,cAAI,IAAK,QAAO,EAAE,IAAI;AAAA,QACxB;AACA,YAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,MAAK,UAAU,IAAI;AAAA,MACzD;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAO,MAAM;AACzB,YAAM,WAAW,MAAM,YAAY,UAAU,KAAK,CAAC;AACnD,iBAAW,cAAc,UAAU;AACjC,cAAM,MAAM,MAAM,YAAY,SAAS,OAAO,UAAU,CAAC;AACzD,mBAAW,SAAS,KAAK;AACvB,gBAAM,OAAO,OAAO,KAAK,MAAM,OAAO,YAAY,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QACjF;AAAA,MACF;AACA,iBAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,IAAI,GAAG;AACrD,cAAM,UAAU,SAAS,OAAO,UAAU,CAAC;AAC3C,mBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,IAAI,GAAG;AACjD,gBAAM,MAAM,IAAI,OAAO,YAAY,IAAI,QAAQ;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAO;AACX,UAAI,OAAO,KAAM,QAAO,OAAO,KAAK;AACpC,UAAI;AACF,cAAM,OAAO,QAAQ,IAAI;AACzB,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,66 @@
+import { NoydbStore } from '@noy-db/hub';
+
+/**
+ * **@noy-db/to-smb** — SMB / CIFS network file store for noy-db.
+ *
+ * Works against Windows file servers, NAS devices (Synology, QNAP,
+ * Netgear), and corporate shared drives. Unlike pointing
+ * `@noy-db/to-file` at an OS-mounted path, this package speaks SMB
+ * directly — no mount step, explicit credential handling, richer
+ * reconnection semantics.
+ *
+ * ## Driver — bring your own
+ *
+ * Any SMB2/3 client with a promise-style API works. Ready-made: the
+ * `smb2` or `@marsaud/smb2` packages on npm. A duck-typed handle is
+ * the injection seam — pass a connected client in, noy-db talks to it.
+ *
+ * ## Auth
+ *
+ * - **NTLM** — `username` + `password` (+ optional `domain`). Typical
+ *   for workgroup NAS.
+ * - **Kerberos** — domain-joined environments, ticket from the OS
+ *   cache. Setting `authKind: 'kerberos'` tells the driver to leave
+ *   password empty and defer to `kinit`.
+ *
+ * Credentials never hit disk through this adapter — the caller is
+ * responsible for sourcing them from a secrets manager. For
+ * long-lived integrations, stash them in the vault's encrypted
+ * `_sync_credentials` collection and pass them at open time.
+ *
+ * ## Atomicity
+ *
+ * SMB has rename but no atomic CAS — same caveat as WebDAV. Per-record
+ * writes go through `{id}.json.tmp` + rename, avoiding the partial-write
+ * failure mode. For multi-writer CAS, pair with a primary store that
+ * implements it.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Duck-typed SMB client. Compatible with `smb2` / `@marsaud/smb2`
+ * promise wrappers. File paths use Windows-style forward slashes
+ * (the SMB client translates to backslashes on the wire).
+ */
+interface SmbHandle {
+    readFile(path: string): Promise<Uint8Array | Buffer | null>;
+    writeFile(path: string, data: Uint8Array | Buffer | string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    mkdir(path: string): Promise<void>;
+    rename(from: string, to: string): Promise<void>;
+    readdir(path: string): Promise<string[]>;
+    /** Optional liveness check — returns true on a reachable share. */
+    ping?(): Promise<boolean>;
+}
+interface SmbStoreOptions {
+    /** Connected SMB client — consumer supplies this. */
+    readonly smb: SmbHandle;
+    /** Relative subdirectory within the share. Default `'noydb'`. */
+    readonly remotePath?: string;
+    /** Diagnostic name. Default `'smb'`. */
+    readonly name?: string;
+}
+declare function smb(options: SmbStoreOptions): NoydbStore;
+
+export { type SmbHandle, type SmbStoreOptions, smb };

package/dist/index.d.ts

@@ -0,0 +1,66 @@
+import { NoydbStore } from '@noy-db/hub';
+
+/**
+ * **@noy-db/to-smb** — SMB / CIFS network file store for noy-db.
+ *
+ * Works against Windows file servers, NAS devices (Synology, QNAP,
+ * Netgear), and corporate shared drives. Unlike pointing
+ * `@noy-db/to-file` at an OS-mounted path, this package speaks SMB
+ * directly — no mount step, explicit credential handling, richer
+ * reconnection semantics.
+ *
+ * ## Driver — bring your own
+ *
+ * Any SMB2/3 client with a promise-style API works. Ready-made: the
+ * `smb2` or `@marsaud/smb2` packages on npm. A duck-typed handle is
+ * the injection seam — pass a connected client in, noy-db talks to it.
+ *
+ * ## Auth
+ *
+ * - **NTLM** — `username` + `password` (+ optional `domain`). Typical
+ *   for workgroup NAS.
+ * - **Kerberos** — domain-joined environments, ticket from the OS
+ *   cache. Setting `authKind: 'kerberos'` tells the driver to leave
+ *   password empty and defer to `kinit`.
+ *
+ * Credentials never hit disk through this adapter — the caller is
+ * responsible for sourcing them from a secrets manager. For
+ * long-lived integrations, stash them in the vault's encrypted
+ * `_sync_credentials` collection and pass them at open time.
+ *
+ * ## Atomicity
+ *
+ * SMB has rename but no atomic CAS — same caveat as WebDAV. Per-record
+ * writes go through `{id}.json.tmp` + rename, avoiding the partial-write
+ * failure mode. For multi-writer CAS, pair with a primary store that
+ * implements it.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Duck-typed SMB client. Compatible with `smb2` / `@marsaud/smb2`
+ * promise wrappers. File paths use Windows-style forward slashes
+ * (the SMB client translates to backslashes on the wire).
+ */
+interface SmbHandle {
+    readFile(path: string): Promise<Uint8Array | Buffer | null>;
+    writeFile(path: string, data: Uint8Array | Buffer | string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    mkdir(path: string): Promise<void>;
+    rename(from: string, to: string): Promise<void>;
+    readdir(path: string): Promise<string[]>;
+    /** Optional liveness check — returns true on a reachable share. */
+    ping?(): Promise<boolean>;
+}
+interface SmbStoreOptions {
+    /** Connected SMB client — consumer supplies this. */
+    readonly smb: SmbHandle;
+    /** Relative subdirectory within the share. Default `'noydb'`. */
+    readonly remotePath?: string;
+    /** Diagnostic name. Default `'smb'`. */
+    readonly name?: string;
+}
+declare function smb(options: SmbStoreOptions): NoydbStore;
+
+export { type SmbHandle, type SmbStoreOptions, smb };

package/dist/index.js

@@ -0,0 +1,102 @@
+// src/index.ts
+function join(...parts) {
+  return parts.filter((p) => p !== "").map((p) => p.replace(/^\/+|\/+$/g, "")).filter((p) => p !== "").join("/");
+}
+function decode(bytes) {
+  if (typeof Buffer !== "undefined" && bytes instanceof Buffer) return bytes.toString("utf-8");
+  return new TextDecoder().decode(bytes);
+}
+function smb(options) {
+  const { smb: client, remotePath = "noydb", name = "smb" } = options;
+  const root = remotePath.replace(/^\/+|\/+$/g, "");
+  const recordPath = (v, c, id) => join(root, v, c, `${id}.json`);
+  const collPath = (v, c) => join(root, v, c);
+  const vaultPath = (v) => join(root, v);
+  async function ensureDir(path) {
+    const parts = path.split("/").filter(Boolean);
+    let cur = "";
+    for (const seg of parts) {
+      cur = cur ? `${cur}/${seg}` : seg;
+      try {
+        await client.mkdir(cur);
+      } catch {
+      }
+    }
+  }
+  async function safeReaddir(path) {
+    try {
+      return await client.readdir(path);
+    } catch {
+      return [];
+    }
+  }
+  const store = {
+    name,
+    async get(vault, collection, id) {
+      const bytes = await client.readFile(recordPath(vault, collection, id));
+      if (bytes === null) return null;
+      return JSON.parse(decode(bytes));
+    },
+    async put(vault, collection, id, envelope) {
+      const target = recordPath(vault, collection, id);
+      const tmp = `${target}.tmp`;
+      await ensureDir(collPath(vault, collection));
+      await client.writeFile(tmp, JSON.stringify(envelope));
+      await client.rename(tmp, target);
+    },
+    async delete(vault, collection, id) {
+      try {
+        await client.unlink(recordPath(vault, collection, id));
+      } catch {
+      }
+    },
+    async list(vault, collection) {
+      const entries = await safeReaddir(collPath(vault, collection));
+      return entries.filter((e) => e.endsWith(".json") && !e.endsWith(".tmp")).map((e) => e.slice(0, -".json".length)).sort();
+    },
+    async loadAll(vault) {
+      const snap = {};
+      const collections = await safeReaddir(vaultPath(vault));
+      for (const collection of collections) {
+        if (collection.startsWith("_")) continue;
+        const ids = await store.list(vault, collection);
+        const bucket = {};
+        for (const id of ids) {
+          const env = await store.get(vault, collection, id);
+          if (env) bucket[id] = env;
+        }
+        if (Object.keys(bucket).length > 0) snap[collection] = bucket;
+      }
+      return snap;
+    },
+    async saveAll(vault, data) {
+      const existing = await safeReaddir(vaultPath(vault));
+      for (const collection of existing) {
+        const ids = await safeReaddir(collPath(vault, collection));
+        for (const fname of ids) {
+          await client.unlink(join(root, vault, collection, fname)).catch(() => void 0);
+        }
+      }
+      for (const [collection, recs] of Object.entries(data)) {
+        await ensureDir(collPath(vault, collection));
+        for (const [id, envelope] of Object.entries(recs)) {
+          await store.put(vault, collection, id, envelope);
+        }
+      }
+    },
+    async ping() {
+      if (client.ping) return client.ping();
+      try {
+        await client.readdir(root);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  return store;
+}
+export {
+  smb
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/to-smb** — SMB / CIFS network file store for noy-db.\n *\n * Works against Windows file servers, NAS devices (Synology, QNAP,\n * Netgear), and corporate shared drives. Unlike pointing\n * `@noy-db/to-file` at an OS-mounted path, this package speaks SMB\n * directly — no mount step, explicit credential handling, richer\n * reconnection semantics.\n *\n * ## Driver — bring your own\n *\n * Any SMB2/3 client with a promise-style API works. Ready-made: the\n * `smb2` or `@marsaud/smb2` packages on npm. A duck-typed handle is\n * the injection seam — pass a connected client in, noy-db talks to it.\n *\n * ## Auth\n *\n * - **NTLM** — `username` + `password` (+ optional `domain`). Typical\n *   for workgroup NAS.\n * - **Kerberos** — domain-joined environments, ticket from the OS\n *   cache. Setting `authKind: 'kerberos'` tells the driver to leave\n *   password empty and defer to `kinit`.\n *\n * Credentials never hit disk through this adapter — the caller is\n * responsible for sourcing them from a secrets manager. For\n * long-lived integrations, stash them in the vault's encrypted\n * `_sync_credentials` collection and pass them at open time.\n *\n * ## Atomicity\n *\n * SMB has rename but no atomic CAS — same caveat as WebDAV. Per-record\n * writes go through `{id}.json.tmp` + rename, avoiding the partial-write\n * failure mode. For multi-writer CAS, pair with a primary store that\n * implements it.\n *\n * @packageDocumentation\n */\n\nimport type { NoydbStore, EncryptedEnvelope, VaultSnapshot } from '@noy-db/hub'\n\n/**\n * Duck-typed SMB client. Compatible with `smb2` / `@marsaud/smb2`\n * promise wrappers. File paths use Windows-style forward slashes\n * (the SMB client translates to backslashes on the wire).\n */\nexport interface SmbHandle {\n  readFile(path: string): Promise<Uint8Array | Buffer | null>\n  writeFile(path: string, data: Uint8Array | Buffer | string): Promise<void>\n  unlink(path: string): Promise<void>\n  mkdir(path: string): Promise<void>\n  rename(from: string, to: string): Promise<void>\n  readdir(path: string): Promise<string[]>\n  /** Optional liveness check — returns true on a reachable share. */\n  ping?(): Promise<boolean>\n}\n\nexport interface SmbStoreOptions {\n  /** Connected SMB client — consumer supplies this. */\n  readonly smb: SmbHandle\n  /** Relative subdirectory within the share. Default `'noydb'`. */\n  readonly remotePath?: string\n  /** Diagnostic name. Default `'smb'`. */\n  readonly name?: string\n}\n\nfunction join(...parts: string[]): string {\n  return parts\n    .filter(p => p !== '')\n    .map(p => p.replace(/^\\/+|\\/+$/g, ''))\n    .filter(p => p !== '')\n    .join('/')\n}\n\nfunction decode(bytes: Uint8Array | Buffer): string {\n  if (typeof Buffer !== 'undefined' && bytes instanceof Buffer) return bytes.toString('utf-8')\n  return new TextDecoder().decode(bytes)\n}\n\nexport function smb(options: SmbStoreOptions): NoydbStore {\n  const { smb: client, remotePath = 'noydb', name = 'smb' } = options\n  const root = remotePath.replace(/^\\/+|\\/+$/g, '')\n\n  const recordPath = (v: string, c: string, id: string): string => join(root, v, c, `${id}.json`)\n  const collPath = (v: string, c: string): string => join(root, v, c)\n  const vaultPath = (v: string): string => join(root, v)\n\n  async function ensureDir(path: string): Promise<void> {\n    // SMB mkdir is not always recursive — walk parents.\n    const parts = path.split('/').filter(Boolean)\n    let cur = ''\n    for (const seg of parts) {\n      cur = cur ? `${cur}/${seg}` : seg\n      try {\n        await client.mkdir(cur)\n      } catch {\n        // Exists or race — continue.\n      }\n    }\n  }\n\n  async function safeReaddir(path: string): Promise<string[]> {\n    try {\n      return await client.readdir(path)\n    } catch {\n      return []\n    }\n  }\n\n  const store: NoydbStore = {\n    name,\n\n    async get(vault, collection, id) {\n      const bytes = await client.readFile(recordPath(vault, collection, id))\n      if (bytes === null) return null\n      return JSON.parse(decode(bytes)) as EncryptedEnvelope\n    },\n\n    async put(vault, collection, id, envelope) {\n      // casAtomic: false — expectedVersion ignored.\n      const target = recordPath(vault, collection, id)\n      const tmp = `${target}.tmp`\n      await ensureDir(collPath(vault, collection))\n      await client.writeFile(tmp, JSON.stringify(envelope))\n      await client.rename(tmp, target)\n    },\n\n    async delete(vault, collection, id) {\n      try {\n        await client.unlink(recordPath(vault, collection, id))\n      } catch {\n        /* idempotent */\n      }\n    },\n\n    async list(vault, collection) {\n      const entries = await safeReaddir(collPath(vault, collection))\n      return entries\n        .filter(e => e.endsWith('.json') && !e.endsWith('.tmp'))\n        .map(e => e.slice(0, -'.json'.length))\n        .sort()\n    },\n\n    async loadAll(vault) {\n      const snap: VaultSnapshot = {}\n      const collections = await safeReaddir(vaultPath(vault))\n      for (const collection of collections) {\n        if (collection.startsWith('_')) continue\n        const ids = await store.list(vault, collection)\n        const bucket: Record<string, EncryptedEnvelope> = {}\n        for (const id of ids) {\n          const env = await store.get(vault, collection, id)\n          if (env) bucket[id] = env\n        }\n        if (Object.keys(bucket).length > 0) snap[collection] = bucket\n      }\n      return snap\n    },\n\n    async saveAll(vault, data) {\n      const existing = await safeReaddir(vaultPath(vault))\n      for (const collection of existing) {\n        const ids = await safeReaddir(collPath(vault, collection))\n        for (const fname of ids) {\n          await client.unlink(join(root, vault, collection, fname)).catch(() => undefined)\n        }\n      }\n      for (const [collection, recs] of Object.entries(data)) {\n        await ensureDir(collPath(vault, collection))\n        for (const [id, envelope] of Object.entries(recs)) {\n          await store.put(vault, collection, id, envelope)\n        }\n      }\n    },\n\n    async ping() {\n      if (client.ping) return client.ping()\n      try {\n        await client.readdir(root)\n        return true\n      } catch {\n        return false\n      }\n    },\n  }\n\n  return store\n}\n"],"mappings":";AAiEA,SAAS,QAAQ,OAAyB;AACxC,SAAO,MACJ,OAAO,OAAK,MAAM,EAAE,EACpB,IAAI,OAAK,EAAE,QAAQ,cAAc,EAAE,CAAC,EACpC,OAAO,OAAK,MAAM,EAAE,EACpB,KAAK,GAAG;AACb;AAEA,SAAS,OAAO,OAAoC;AAClD,MAAI,OAAO,WAAW,eAAe,iBAAiB,OAAQ,QAAO,MAAM,SAAS,OAAO;AAC3F,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAEO,SAAS,IAAI,SAAsC;AACxD,QAAM,EAAE,KAAK,QAAQ,aAAa,SAAS,OAAO,MAAM,IAAI;AAC5D,QAAM,OAAO,WAAW,QAAQ,cAAc,EAAE;AAEhD,QAAM,aAAa,CAAC,GAAW,GAAW,OAAuB,KAAK,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO;AAC9F,QAAM,WAAW,CAAC,GAAW,MAAsB,KAAK,MAAM,GAAG,CAAC;AAClE,QAAM,YAAY,CAAC,MAAsB,KAAK,MAAM,CAAC;AAErD,iBAAe,UAAU,MAA6B;AAEpD,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC5C,QAAI,MAAM;AACV,eAAW,OAAO,OAAO;AACvB,YAAM,MAAM,GAAG,GAAG,IAAI,GAAG,KAAK;AAC9B,UAAI;AACF,cAAM,OAAO,MAAM,GAAG;AAAA,MACxB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,YAAY,MAAiC;AAC1D,QAAI;AACF,aAAO,MAAM,OAAO,QAAQ,IAAI;AAAA,IAClC,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAEA,QAAM,QAAoB;AAAA,IACxB;AAAA,IAEA,MAAM,IAAI,OAAO,YAAY,IAAI;AAC/B,YAAM,QAAQ,MAAM,OAAO,SAAS,WAAW,OAAO,YAAY,EAAE,CAAC;AACrE,UAAI,UAAU,KAAM,QAAO;AAC3B,aAAO,KAAK,MAAM,OAAO,KAAK,CAAC;AAAA,IACjC;AAAA,IAEA,MAAM,IAAI,OAAO,YAAY,IAAI,UAAU;AAEzC,YAAM,SAAS,WAAW,OAAO,YAAY,EAAE;AAC/C,YAAM,MAAM,GAAG,MAAM;AACrB,YAAM,UAAU,SAAS,OAAO,UAAU,CAAC;AAC3C,YAAM,OAAO,UAAU,KAAK,KAAK,UAAU,QAAQ,CAAC;AACpD,YAAM,OAAO,OAAO,KAAK,MAAM;AAAA,IACjC;AAAA,IAEA,MAAM,OAAO,OAAO,YAAY,IAAI;AAClC,UAAI;AACF,cAAM,OAAO,OAAO,WAAW,OAAO,YAAY,EAAE,CAAC;AAAA,MACvD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,OAAO,YAAY;AAC5B,YAAM,UAAU,MAAM,YAAY,SAAS,OAAO,UAAU,CAAC;AAC7D,aAAO,QACJ,OAAO,OAAK,EAAE,SAAS,OAAO,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,EACtD,IAAI,OAAK,EAAE,MAAM,GAAG,CAAC,QAAQ,MAAM,CAAC,EACpC,KAAK;AAAA,IACV;AAAA,IAEA,MAAM,QAAQ,OAAO;AACnB,YAAM,OAAsB,CAAC;AAC7B,YAAM,cAAc,MAAM,YAAY,UAAU,KAAK,CAAC;AACtD,iBAAW,cAAc,aAAa;AACpC,YAAI,WAAW,WAAW,GAAG,EAAG;AAChC,cAAM,MAAM,MAAM,MAAM,KAAK,OAAO,UAAU;AAC9C,cAAM,SAA4C,CAAC;AACnD,mBAAW,MAAM,KAAK;AACpB,gBAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,cAAI,IAAK,QAAO,EAAE,IAAI;AAAA,QACxB;AACA,YAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,MAAK,UAAU,IAAI;AAAA,MACzD;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAO,MAAM;AACzB,YAAM,WAAW,MAAM,YAAY,UAAU,KAAK,CAAC;AACnD,iBAAW,cAAc,UAAU;AACjC,cAAM,MAAM,MAAM,YAAY,SAAS,OAAO,UAAU,CAAC;AACzD,mBAAW,SAAS,KAAK;AACvB,gBAAM,OAAO,OAAO,KAAK,MAAM,OAAO,YAAY,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QACjF;AAAA,MACF;AACA,iBAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,IAAI,GAAG;AACrD,cAAM,UAAU,SAAS,OAAO,UAAU,CAAC;AAC3C,mBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,IAAI,GAAG;AACjD,gBAAM,MAAM,IAAI,OAAO,YAAY,IAAI,QAAQ;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAO;AACX,UAAI,OAAO,KAAM,QAAO,OAAO,KAAK;AACpC,UAAI;AACF,cAAM,OAAO,QAAQ,IAAI;AACzB,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@noy-db/to-smb",
+  "version": "0.1.0-pre.3",
+  "description": "SMB/CIFS network file store for noy-db. Works against Windows file servers, NAS devices (Synology/QNAP/Netgear), and corporate shared drives via NTLM or Kerberos auth — no OS mount required.",
+  "license": "MIT",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/to-smb#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "directory": "packages/to-smb"
+  },
+  "bugs": {
+    "url": "https://github.com/vLannaAi/noy-db/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "peerDependencies": {
+    "@noy-db/hub": "0.1.0-pre.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@noy-db/hub": "0.1.0-pre.3"
+  },
+  "keywords": [
+    "noy-db",
+    "to-smb",
+    "smb",
+    "cifs",
+    "nas",
+    "storage"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}