@xnetjs/data 2.5.0 → 3.0.0

package/dist/{moderation-HRMMBFVH.js → moderation-5Z4LKOKN.js}

@@ -10,8 +10,9 @@ import {
   PolicySubscriptionSchema,
   PublicInteractionPolicySchema,
   QualitySignalSchema,
-  ReviewTaskSchema
-} from "./chunk-CY6EJUNV.js";
+  ReviewTaskSchema,
+  publicInteractionPolicyId
+} from "./chunk-S7SEN4LH.js";
 import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {
@@ -26,5 +27,6 @@ export {
   PolicySubscriptionSchema,
   PublicInteractionPolicySchema,
   QualitySignalSchema,
-  ReviewTaskSchema
+  ReviewTaskSchema,
+  publicInteractionPolicyId
 };

package/dist/{page-MADZ5OHM.js → page-W4G6433H.js}

@@ -1,6 +1,6 @@
 import {
   PageSchema
-} from "./chunk-JF4VCZER.js";
+} from "./chunk-WSINZHSR.js";
 import "./chunk-RLRAWZJE.js";
 import "./chunk-GSLOK5KV.js";
 import "./chunk-NH6OLO3X.js";

package/dist/portability/index.d.ts

@@ -0,0 +1,330 @@
+import { a1 as NodePayload, s as NodeChange } from '../types-gws1tSf-.js';
+import { N as NodeStore } from '../store-D1oiFQuF.js';
+import '@xnetjs/core';
+import '@xnetjs/crypto';
+import '@xnetjs/sqlite';
+import '@xnetjs/sync';
+
+/**
+ * Portability types — the `.xnetpack` bundle format (exploration 0344).
+ *
+ * A bundle is the sync protocol written to disk: an NDJSON stream of the
+ * signed, hash-chained change log plus optional content-addressed blobs and
+ * Yjs document states, indexed by a signed manifest. Export is
+ * "sync-to-disk"; import is verify-then-replay through the same apply path
+ * the sync layer uses, so a bundle behaves like a peer that happens to be a
+ * file.
+ *
+ * Bundle layout (a directory, or the same paths inside a zip):
+ *
+ *   manifest.json          — XnetpackManifest, signed by the exporting DID
+ *   changes.ndjson         — one PortableChangeRecord per line
+ *   blobs.ndjson           — one PortableBlobRecord per line (index)
+ *   blobs/<algo>/<hex>     — raw blob bytes, filename = content hash
+ *   yjs/docs.ndjson        — one PortableYjsDocRecord per line
+ */
+
+/** Format identifier + version for the bundle layout itself. */
+declare const XNETPACK_FORMAT_VERSION = "xnetpack/1";
+/** Entry paths within a bundle. */
+declare const BUNDLE_ENTRY: {
+    readonly manifest: "manifest.json";
+    readonly changes: "changes.ndjson";
+    /** Batch commits covering the owner's own changes (exploration 0357). */
+    readonly commits: "commits.ndjson";
+    readonly blobIndex: "blobs.ndjson";
+    readonly yjsDocs: "yjs/docs.ndjson";
+};
+/**
+ * A change serialized for the bundle. Mirrors the hub wire shape
+ * (`SerializedNodeChange`) minus the transport-only `room` field, so a
+ * bundle line and a relayed change are interchangeable representations of
+ * the same signed record.
+ */
+type PortableChangeRecord = {
+    id: string;
+    type: string;
+    hash: string;
+    nodeId: string;
+    schemaId?: string;
+    lamportTime: number;
+    authorDid: string;
+    wallTime: number;
+    parentHash: string | null;
+    payload: NodePayload;
+    signatureB64: string;
+    protocolVersion?: number;
+    batchId?: string;
+    batchIndex?: number;
+    batchSize?: number;
+};
+/** Blob index line: metadata for a `blobs/<algo>/<hex>` entry. */
+type PortableBlobRecord = {
+    cid: string;
+    /** Entry path within the bundle holding the raw bytes. */
+    path: string;
+    size: number;
+    mimeType?: string;
+};
+/** Yjs doc line: the full doc state as a single Yjs update (base64). */
+type PortableYjsDocRecord = {
+    nodeId: string;
+    updateB64: string;
+};
+/** What to export. */
+type BundleScope = {
+    kind: 'full';
+} | {
+    kind: 'nodes';
+    nodeIds: readonly string[];
+} | {
+    kind: 'schemas';
+    schemaIds: readonly string[];
+} | {
+    kind: 'space';
+    spaceId: string;
+};
+/**
+ * A position in the change log: the highest Lamport time in the exported
+ * set plus the hashes of the changes at that frontier. A later incremental
+ * export passes a previous manifest's `frontier` as `since`; it becomes the
+ * new bundle's `prerequisites` (git-bundle semantics: the importer must
+ * already hold these heads).
+ */
+type BundleFrontier = {
+    lamport: number;
+    /** Hashes of exported changes at `lamport` (capped sample). */
+    heads: string[];
+    changeCount: number;
+};
+type XnetpackManifest = {
+    formatVersion: typeof XNETPACK_FORMAT_VERSION;
+    /** Protocol versions the records were produced under. */
+    protocolVersion: {
+        change: number;
+    };
+    ownerDid: string;
+    scope: BundleScope;
+    createdAt: number;
+    frontier: BundleFrontier;
+    /** Present on incremental bundles: the frontier this bundle starts after. */
+    prerequisites?: BundleFrontier;
+    counts: {
+        changes: number;
+        blobs: number;
+        yjsDocs: number;
+        commits?: number;
+    };
+    /**
+     * Digest over every non-manifest entry (see `digestEntries`): detects a
+     * bundle whose entries were swapped or truncated after manifest signing.
+     */
+    contentDigest: string;
+    /** Ed25519 signature by `ownerDid` over the canonical unsigned manifest. */
+    signatureB64?: string;
+};
+/**
+ * Where a bundle is written. Implementations: in-memory (tests, zip
+ * assembly in the browser), a directory on disk (CLI/hub), a streaming zip.
+ */
+interface BundleSink {
+    writeEntry(path: string, data: Uint8Array): Promise<void> | void;
+}
+/** Where a bundle is read from. */
+interface BundleSource {
+    /** Returns null when the entry does not exist. */
+    readEntry(path: string): Promise<Uint8Array | null>;
+    /** Stream the lines of an NDJSON entry (without trailing newlines). */
+    readLines(path: string): AsyncIterable<string>;
+    /** List entry paths under a prefix (used for `blobs/`). */
+    listEntries(prefix: string): Promise<string[]>;
+}
+interface BundleBlobPort {
+    list(): AsyncIterable<{
+        cid: string;
+        bytes: Uint8Array;
+        mimeType?: string;
+    }>;
+    has(cid: string): Promise<boolean>;
+    put(bytes: Uint8Array, meta?: {
+        cid?: string;
+        mimeType?: string;
+    }): Promise<void>;
+}
+interface BundleYjsPort {
+    /** Yield each doc's full state as one Yjs update. */
+    list(): AsyncIterable<{
+        nodeId: string;
+        update: Uint8Array;
+    }>;
+    /**
+     * Merge an update into the node's doc. Implementations use Yjs
+     * `applyUpdate`, which merges by state vector — re-importing a doc the
+     * store already has must not duplicate content.
+     */
+    apply(nodeId: string, update: Uint8Array): Promise<void>;
+}
+type BundleVerifyIssue = {
+    severity: 'error' | 'warning';
+    code: 'unknown-format' | 'future-protocol' | 'manifest-unsigned' | 'manifest-signature-invalid' | 'content-digest-mismatch' | 'count-mismatch' | 'change-hash-invalid' | 'change-signature-invalid' | 'change-unparseable' | 'blob-digest-mismatch' | 'dangling-parent';
+    detail: string;
+    /** For per-record issues: the change hash / blob cid / line number. */
+    subject?: string;
+};
+type BundleVerifyReport = {
+    ok: boolean;
+    manifest: XnetpackManifest | null;
+    issues: BundleVerifyIssue[];
+    /** Changes whose parentHash is neither in the bundle nor a prerequisite head. */
+    danglingParents: number;
+};
+type QuarantinedRecord = {
+    kind: 'change' | 'blob' | 'yjs-doc';
+    subject: string;
+    reason: string;
+};
+type BundleApplyReport = {
+    applied: number;
+    /** Changes the store already held (idempotent redelivery). */
+    duplicates: number;
+    quarantined: QuarantinedRecord[];
+    blobsInstalled: number;
+    yjsDocsApplied: number;
+    /** Prerequisite heads the store did not hold (empty when none missing). */
+    missingPrerequisites: string[];
+};
+type ApplyBundleOptions = {
+    /** DID of the identity performing the import. */
+    importerDid: string;
+    /**
+     * Import a bundle whose ownerDid differs from importerDid. Off by
+     * default: importing someone else's bundle is a grant-shaped decision
+     * (ATProto learned this the hard way — bluesky-social/atproto#4067).
+     */
+    allowForeignOwner?: boolean;
+    /** Accept a bundle with no manifest signature (default false). */
+    allowUnsigned?: boolean;
+    /** Continue even when prerequisite heads are missing (default false). */
+    ignoreMissingPrerequisites?: boolean;
+    blobPort?: BundleBlobPort;
+    yjsPort?: BundleYjsPort;
+    onQuarantine?: (record: QuarantinedRecord) => void;
+};
+type WriteBundleOptions = {
+    ownerDid: string;
+    /**
+     * Signs the canonical unsigned manifest bytes. Wire this to the
+     * identity's Ed25519 key (`sign` from @xnetjs/crypto) or a WebCrypto /
+     * remote signer. When omitted the manifest is unsigned and import
+     * requires `allowUnsigned`.
+     */
+    manifestSigner?: (bytes: Uint8Array) => Promise<Uint8Array> | Uint8Array;
+    /**
+     * Signs the UTF-8 bytes of a batch commit's hash, enabling one signature to
+     * cover up to 1000 of the owner's changes on import (exploration 0357).
+     * Same key as `manifestSigner`; omit to emit a bundle with no commits
+     * (every change is then verified individually, as before).
+     */
+    commitSigner?: (bytes: Uint8Array) => Promise<Uint8Array> | Uint8Array;
+    /** Export only changes after this frontier (becomes `prerequisites`). */
+    since?: BundleFrontier;
+    blobPort?: BundleBlobPort;
+    yjsPort?: BundleYjsPort;
+};
+/** Hash of a change at the frontier — capped to keep manifests small. */
+declare const FRONTIER_HEADS_CAP = 32;
+
+/**
+ * Bundle serialization helpers: change ↔ NDJSON line, canonical manifest
+ * bytes, and the chunked entry digest (exploration 0344).
+ */
+
+/** Serialize a signed change to its bundle-line form. */
+declare function toPortableChangeRecord(change: NodeChange): PortableChangeRecord;
+/** Rehydrate a bundle line into a signed change. */
+declare function fromPortableChangeRecord(record: PortableChangeRecord): NodeChange;
+/**
+ * The bytes the manifest signature covers: canonical JSON of the manifest
+ * with `signatureB64` removed.
+ */
+declare function canonicalManifestBytes(manifest: XnetpackManifest): Uint8Array;
+
+/**
+ * writeBundle — export a scope of the store as an `.xnetpack` bundle
+ * (exploration 0344). Export is sync-to-disk: the entries are the same
+ * signed records the sync layer ships, so the bundle needs no bespoke
+ * parser on the other side.
+ */
+
+/** `cid:<algo>:<hex>` → bundle entry path; opaque cids go under blobs/raw/. */
+declare function blobEntryPath(cid: string): string;
+declare function writeBundle(store: NodeStore, scope: BundleScope, sink: BundleSink, options: WriteBundleOptions): Promise<XnetpackManifest>;
+
+/**
+ * verifyBundle — read-only integrity check of an `.xnetpack` bundle
+ * (exploration 0344). git-bundle-verify semantics: report everything wrong
+ * before any write happens. A foreign bundle is hostile input; nothing here
+ * trusts a byte it hasn't re-hashed or re-verified.
+ */
+
+type VerifyBundleOptions = {
+    /**
+     * Verify each change's hash + Ed25519 signature (default true). The
+     * apply pipeline passes false: the manifest-signed content digest
+     * already proves bundle-level integrity here, and `applyRemoteChange`
+     * re-verifies every record individually before it is written — checking
+     * signatures twice doubles import time (~1.4ms/change) for no added
+     * safety.
+     */
+    verifyChangeSignatures?: boolean;
+};
+declare function verifyBundle(source: BundleSource, options?: VerifyBundleOptions): Promise<BundleVerifyReport>;
+
+/**
+ * applyBundle — import an `.xnetpack` bundle by replaying it through the
+ * store's remote-change apply path (exploration 0344). Import is
+ * sync-from-disk: every change goes through the exact verification,
+ * ledger-enforcement, authz, and LWW machinery a relayed change does, so a
+ * bundle can do nothing a hostile sync peer couldn't.
+ */
+
+/** Thrown when the bundle fails a pre-apply gate; nothing was written. */
+declare class BundleImportError extends Error {
+    readonly code: 'verify-failed' | 'unsigned-manifest' | 'foreign-owner' | 'missing-prerequisites';
+    constructor(message: string, code: 'verify-failed' | 'unsigned-manifest' | 'foreign-owner' | 'missing-prerequisites');
+}
+declare function applyBundle(store: NodeStore, source: BundleSource, options: ApplyBundleOptions): Promise<BundleApplyReport>;
+/** Convenience: parse a manifest without verifying (for UI preview). */
+declare function readBundleManifest(source: BundleSource): Promise<any>;
+
+/**
+ * In-memory bundle sink/source — the reference implementation used by
+ * tests, and by the browser to assemble a bundle before zipping/download.
+ */
+
+declare class MemoryBundleSink implements BundleSink {
+    readonly entries: Map<string, Uint8Array<ArrayBufferLike>>;
+    writeEntry(path: string, data: Uint8Array): void;
+    toSource(): MemoryBundleSource;
+}
+declare class MemoryBundleSource implements BundleSource {
+    private readonly entries;
+    constructor(entries: ReadonlyMap<string, Uint8Array>);
+    readEntry(path: string): Promise<Uint8Array | null>;
+    readLines(path: string): AsyncIterable<string>;
+    listEntries(prefix: string): Promise<string[]>;
+}
+
+/**
+ * A BundleYjsPort backed by the store's per-node CRDT document content
+ * (`yjs_state` via get/setDocumentContent) — exploration 0344.
+ *
+ * Import merges by Yjs state vector (never re-applies a rebuilt doc, which
+ * would duplicate blocks — see the seed runner's create-once rule). Stored
+ * content that is not a plain Yjs update (e.g. an encrypted snapshot
+ * wrapper) is transferred create-once and never merged blindly.
+ */
+
+declare function createStoreYjsPort(store: NodeStore): BundleYjsPort;
+
+export { type ApplyBundleOptions, BUNDLE_ENTRY, type BundleApplyReport, type BundleBlobPort, type BundleFrontier, BundleImportError, type BundleScope, type BundleSink, type BundleSource, type BundleVerifyIssue, type BundleVerifyReport, type BundleYjsPort, FRONTIER_HEADS_CAP, MemoryBundleSink, MemoryBundleSource, type PortableBlobRecord, type PortableChangeRecord, type PortableYjsDocRecord, type QuarantinedRecord, type VerifyBundleOptions, type WriteBundleOptions, XNETPACK_FORMAT_VERSION, type XnetpackManifest, applyBundle, blobEntryPath, canonicalManifestBytes, createStoreYjsPort, fromPortableChangeRecord, readBundleManifest, toPortableChangeRecord, verifyBundle, writeBundle };

package/dist/portability/index.js

@@ -0,0 +1,34 @@
+import {
+  BUNDLE_ENTRY,
+  BundleImportError,
+  FRONTIER_HEADS_CAP,
+  MemoryBundleSink,
+  MemoryBundleSource,
+  XNETPACK_FORMAT_VERSION,
+  applyBundle,
+  blobEntryPath,
+  canonicalManifestBytes,
+  createStoreYjsPort,
+  fromPortableChangeRecord,
+  readBundleManifest,
+  toPortableChangeRecord,
+  verifyBundle,
+  writeBundle
+} from "../chunk-N37U6ZPI.js";
+export {
+  BUNDLE_ENTRY,
+  BundleImportError,
+  FRONTIER_HEADS_CAP,
+  MemoryBundleSink,
+  MemoryBundleSource,
+  XNETPACK_FORMAT_VERSION,
+  applyBundle,
+  blobEntryPath,
+  canonicalManifestBytes,
+  createStoreYjsPort,
+  fromPortableChangeRecord,
+  readBundleManifest,
+  toPortableChangeRecord,
+  verifyBundle,
+  writeBundle
+};

package/dist/post-7IOO64MD.js

@@ -0,0 +1,14 @@
+import {
+  POST_SCHEMA_IRI,
+  PostSchema,
+  comparePostsForFeed
+} from "./chunk-KY62NUOI.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
+import "./chunk-D4LUUZYD.js";
+export {
+  POST_SCHEMA_IRI,
+  PostSchema,
+  comparePostsForFeed
+};

package/dist/{profile-5H6XWCK4.js → profile-KLHCAQY2.js}

@@ -2,7 +2,7 @@ import {
   ProfileSchema,
   didFromProfileNodeId,
   profileNodeId
-} from "./chunk-4HJZJMPI.js";
+} from "./chunk-TN7LGV66.js";
 import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {

package/dist/publication-3MN3WWKP.js

@@ -0,0 +1,10 @@
+import {
+  PublicationSchema
+} from "./chunk-NFPEFD2I.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
+import "./chunk-D4LUUZYD.js";
+export {
+  PublicationSchema
+};

package/dist/{query-ast-h31svZnG.d.ts → query-ast-DQJO7yRV.d.ts}

@@ -1,4 +1,4 @@
-import { S as SchemaIRI, c as SortDirection, N as NodeQueryPageCountMode, P as PropertyBuilder, I as InferCreateProps, D as DefinedSchema, d as SystemOrderField } from './types-Z9dUzbDF.js';
+import { S as SchemaIRI, c as SortDirection, N as NodeQueryPageCountMode, P as PropertyBuilder, I as InferCreateProps, D as DefinedSchema, d as SystemOrderField } from './types-gws1tSf-.js';
 
 /**
  * Canonical query AST for advanced Node reads.

package/dist/{registry-Dh4Kr3fo.d.ts → registry-C9IRLLeR.d.ts}

@@ -1,4 +1,4 @@
-import { P as PropertyBuilder, D as DefinedSchema, S as SchemaIRI, a as Schema, b as ParsedSchemaIRI } from './types-Z9dUzbDF.js';
+import { P as PropertyBuilder, D as DefinedSchema, S as SchemaIRI, a as Schema, b as ParsedSchemaIRI } from './types-gws1tSf-.js';
 
 /**
  * Schema Registry - Runtime lookup for schema definitions.