@syncular/server 0.0.6-95 → 0.1.0

package/dist/hono/audit-redaction.js

@@ -0,0 +1,85 @@
+import { parseJsonValue, SYNC_CRDT_CHECKPOINTS_TABLE, SYNC_CRDT_UPDATES_TABLE, } from '@syncular/server';
+export function summarizeAuditChange(args) {
+    const row = parseJsonRecord(args.rowJson);
+    const fields = Object.keys(row).sort();
+    const sensitiveFields = detectSensitiveFields(row);
+    return {
+        changeKind: classifyAuditChange({
+            table: args.table,
+            op: args.op,
+            row,
+            sensitiveFields,
+        }),
+        fields,
+        scopeFields: Object.keys(parseJsonRecord(args.scopes)).sort(),
+        sensitiveFields,
+        redaction: {
+            payload: 'omitted',
+            reason: 'audit_redacted_by_default',
+        },
+    };
+}
+function classifyAuditChange(args) {
+    if (args.table === SYNC_CRDT_UPDATES_TABLE) {
+        return 'encrypted_crdt_update';
+    }
+    if (args.table === SYNC_CRDT_CHECKPOINTS_TABLE) {
+        return 'encrypted_crdt_checkpoint';
+    }
+    if (args.op === 'delete') {
+        return 'delete';
+    }
+    if (args.sensitiveFields.some((field) => isEncryptedFieldName(field))) {
+        return 'encrypted_field_envelope';
+    }
+    if (args.sensitiveFields.length > 0) {
+        return 'blob_reference';
+    }
+    return 'app_row';
+}
+function detectSensitiveFields(row) {
+    const sensitive = new Set();
+    for (const [field, value] of Object.entries(row)) {
+        const parsed = parseJsonValue(value);
+        if (isEncryptedFieldName(field) || isEncryptedEnvelope(parsed)) {
+            sensitive.add(field);
+            continue;
+        }
+        if (isBlobRef(parsed)) {
+            sensitive.add(field);
+        }
+    }
+    return Array.from(sensitive).sort();
+}
+function parseJsonRecord(value) {
+    const parsed = parseJsonValue(value);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return {};
+    }
+    return parsed;
+}
+function isBlobRef(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    return (typeof record.hash === 'string' &&
+        record.hash.length > 0 &&
+        (typeof record.size === 'number' || typeof record.size === 'bigint'));
+}
+function isEncryptedEnvelope(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    return (typeof record.ciphertext === 'string' &&
+        (typeof record.key_id === 'string' || typeof record.keyId === 'string'));
+}
+function isEncryptedFieldName(field) {
+    return (field === 'ciphertext' ||
+        field === 'key_id' ||
+        field === 'keyId' ||
+        field.endsWith('_encrypted') ||
+        field.endsWith('_ciphertext'));
+}
+//# sourceMappingURL=audit-redaction.js.map

package/dist/hono/audit-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-redaction.js","sourceRoot":"","sources":["../../src/hono/audit-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAuB1B,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,eAAe,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEnD,OAAO;QACL,UAAU,EAAE,mBAAmB,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG;YACH,eAAe;SAChB,CAAC;QACF,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;QAC7D,eAAe;QACf,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,2BAA2B;SACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAK5B;IACC,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,2BAA2B,EAAE,CAAC;QAC/C,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA4B;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,CACL,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,OAAO;QACjB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC9B,CAAC;AACJ,CAAC"}

package/dist/hono/blobs.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @syncular/server/hono - Blob routes for media/binary handling
+ *
+ * Provides:
+ * - POST /blobs/upload - Initiate a blob upload (get presigned URL)
+ * - POST /blobs/:hash/complete - Complete a blob upload
+ * - GET /blobs/:hash/url - Get a presigned download URL
+ * - PUT /blobs/:hash/upload - Direct upload (for database adapter)
+ * - GET /blobs/:hash/download - Direct download (for database adapter)
+ */
+import type { BlobManager } from '@syncular/server';
+import { type BlobTokenSigner, type SyncBlobsDb } from '@syncular/server';
+import type { Context } from 'hono';
+import { Hono } from 'hono';
+import type { Kysely } from 'kysely';
+interface BlobAuthResult {
+    actorId: string;
+    partitionId?: string;
+}
+export interface CreateBlobRoutesOptions<DB extends SyncBlobsDb = SyncBlobsDb> {
+    /** Blob manager instance */
+    blobManager: BlobManager;
+    /** Authentication function */
+    authenticate: (c: Context) => Promise<BlobAuthResult | null>;
+    /**
+     * Token signer for database adapter direct uploads/downloads.
+     * Required if using the database blob storage adapter.
+     */
+    tokenSigner?: BlobTokenSigner;
+    /**
+     * Database instance for direct blob storage.
+     * Required if using the database blob storage adapter.
+     */
+    db?: Kysely<DB>;
+    /**
+     * Check whether an authenticated actor can access a blob hash.
+     * This must enforce your tenant or ownership model.
+     */
+    canAccessBlob: (args: {
+        actorId: string;
+        hash: string;
+        partitionId: string;
+    }) => Promise<boolean>;
+    /**
+     * Maximum upload size in bytes.
+     * Default: 100MB (104857600)
+     */
+    maxUploadSize?: number;
+}
+/**
+ * Create blob routes for Hono.
+ *
+ * @example
+ * ```typescript
+ * const blobRoutes = createBlobRoutes({
+ *   blobManager,
+ *   authenticate: async (c) => {
+ *     const token = c.req.header('Authorization')?.replace('Bearer ', '');
+ *     if (!token) return null;
+ *     const user = await verifyToken(token);
+ *     return user ? { actorId: user.id } : null;
+ *   },
+ *   canAccessBlob: async ({ actorId, hash, partitionId }) => {
+ *     // Enforce tenant/ownership permissions here.
+ *     // partitionId defaults to "default" when not provided by auth.
+ *     return true;
+ *   },
+ * });
+ *
+ * app.route('/api/sync', blobRoutes);
+ * ```
+ */
+export declare function createBlobRoutes<DB extends SyncBlobsDb>(options: CreateBlobRoutesOptions<DB>): Hono;
+export {};
+//# sourceMappingURL=blobs.d.ts.map

package/dist/hono/blobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../src/hono/blobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKrC,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB,CAAC,EAAE,SAAS,WAAW,GAAG,WAAW;IAC3E,4BAA4B;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,WAAW,EACrD,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC,GACnC,IAAI,CAghBN"}