safebyok-convex 0.0.0 → 0.1.0

package/README.md

@@ -5,8 +5,14 @@ bundle and lockboxes, ciphertext and public fields only, in tables of its own, a
 **`convexVaultDB`**, the client side a vault stores through. Your Convex backend never sees a
 whisper, a passphrase, or any key that opens one.
 
-A workspace package, source-exported (`exports` points at `src/`) while the interface settles;
-not yet built or published. `convex` is a peer dependency.
+## Install
+
+```sh
+pnpm add safebyok safebyok-convex convex
+```
+
+`safebyok` and `convex` are peer dependencies: your app installs them itself, so the adapter and
+your app share one copy of each, and a `VaultError` from one is a `VaultError` to the other.
 
 ## What your app adds to its `convex/` directory
 
@@ -58,7 +64,7 @@ has. Hand it to `openVault`:
 ```ts
 import { ConvexClient } from 'convex/browser'
 import { openVault } from 'safebyok'
-import { idbDeviceDB } from 'safebyok/idb'
+import { browserOpts } from 'safebyok/browser'
 import { convexVaultDB } from 'safebyok-convex'
 import { api } from '../convex/_generated/api'
 
@@ -68,7 +74,7 @@ convex.setAuth(fetchToken) // your auth provider's token, as for any Convex call
 const vault = await openVault({
   applabel: 'acme', userId, vaultlabel: 'main',
   vaultDB:  convexVaultDB(convex, api.safebyok),
-  deviceDB: idbDeviceDB(),
+  ...browserOpts(), // the key deriver and device store a browser wants
 })
 ```
 
@@ -91,7 +97,8 @@ socket and its signed-in user. `safebyok-convex` itself imports nothing of React
   Convex resends a mutation when it reconnects, so a write may land after any timeout you set:
   show progress, but don't report it failed.
 * A record holds at most 1 MiB, Convex's document limit; `openVault` keeps `maxWhisperBytes`
-  under half of it.
+  under half of it. A vault holds at most 8 MiB in all (`maxVaultBytes`; see *How big a vault
+  can be*).
 
 ## What is stored
 
@@ -113,10 +120,14 @@ Two tables, inside the component, beside nothing of your app's:
 * `user_id` leads both indexes, so one user's rows are one range of each.
 
 **How big a vault can be.** Listing a vault, watching it and erasing it each read the whole vault
-in one Convex transaction, which may read 16 MiB; erasing reads it twice. A lockbox at the
-largest whisper a vault stores by default is about 54 KB, so about 150 of those; a lockbox
-holding an API key is about 1 KB, so thousands. Each record must also fit Convex's 1 MiB document
-limit, which the core's `maxWhisperBytes` keeps well inside.
+in one Convex transaction, which may read 16 MiB; erasing reads it twice, so `convexVaultDB`
+declares a `maxVaultBytes` of 8 MiB. A vault holds 100 lockboxes by default, raised with
+`maxLockboxes` as far as `maxVaultBytes` allows: `openVault` refuses, with kind `bad_option`, a
+`maxLockboxes` whose lockboxes at `maxWhisperBytes` each might not fit, and its message says how
+many would. At the default `maxWhisperBytes` (40444) that is at most 101; at a `maxWhisperBytes`
+of 2048, ample for API keys, it is 1365. A store past the limit is refused with kind
+`vault_full`, until a lockbox is erased. Each record must also fit Convex's 1 MiB document limit,
+which the core's `maxWhisperBytes` keeps well inside.
 
 ## The functions
 
@@ -152,10 +163,12 @@ register(t)
 
 ## Developing this package
 
-`pnpm justify` here runs its lint, typecheck and tests: `convex-test` under the edge runtime,
-in memory, with no deployment. The tests and typecheck resolve `safebyok` through its built
-`dist/`, as a consumer's would, and make real vaults with the core's own code; each script builds
-the core first by itself (`pnpm build:deps`), so a fresh clone needs no prebuild step.
+`pnpm justify` here runs its lint, typecheck, tests -- `convex-test` under the edge runtime,
+in memory, with no deployment -- and the build with its publint and arethetypeswrong checks. The typecheck and lint read `safebyok` from its source, through
+the workspace's `@safebyok/source` export condition, so they need no build. The tests resolve it
+through its built `dist/`, as a consumer's would, and make real vaults with the core's own code;
+they build the core first by themselves (`pnpm build:deps`), so a fresh clone needs no prebuild
+step.
 
 The client's tests run the real `ConvexClient` and `ConvexReactClient` against
 `tests/fake-deployment.ts`: a fake WebSocket that answers the sync protocol's query and mutation
@@ -163,6 +176,12 @@ messages from `convex-test`. It runs one call at a time, reruns every watched qu
 mutation, and signs each socket in as one user from the start; its doc block says what that
 cannot prove.
 
+The build follows Convex's component template: ESM only, unbundled, so each of the component's
+modules keeps its own file under `dist/component/`, beside its `convex.config.js` and
+`_generated/`, for a host's Convex CLI to bundle at deploy. `safebyok-convex/test` alone ships as
+source, `src/test.ts`, since its `import.meta.glob` must find the component's `.ts` modules; a
+test runner that resolves as a bundler does (vitest) loads it.
+
 `src/component/_generated/` holds Convex's codegen output for the component, written by the
 templates of the installed `convex` and never edited by hand. Codegen for a component needs a
 Convex deployment, so until one has run it holds only the files Convex writes without one

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll };

package/dist/component/_generated/api.d.ts

@@ -0,0 +1,7 @@
+import { AnyApi, AnyComponents } from "convex/server";
+//#region src/component/_generated/api.d.ts
+export declare const api: AnyApi;
+export declare const internal: AnyApi;
+export declare const components: AnyComponents;
+//#endregion
+//# sourceMappingURL=api.d.ts.map

package/dist/component/_generated/api.js

@@ -0,0 +1,9 @@
+import { anyApi, componentsGeneric } from "convex/server";
+//#region src/component/_generated/api.ts
+const api = anyApi;
+const internal = anyApi;
+const components = componentsGeneric();
+//#endregion
+export { api, components, internal };
+
+//# sourceMappingURL=api.js.map

package/dist/component/_generated/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","names":[],"sources":["../../../src/component/_generated/api.ts"],"sourcesContent":["/* eslint-disable */\n/**\n * Generated `api` utility.\n *\n * THIS CODE IS AUTOMATICALLY GENERATED.\n *\n * To regenerate, run `npx convex dev`.\n * @module\n */\n\nimport type { AnyApi, AnyComponents } from \"convex/server\";\nimport { anyApi, componentsGeneric } from \"convex/server\";\n\nexport const api: AnyApi = anyApi;\nexport const internal: AnyApi = anyApi;\nexport const components: AnyComponents = componentsGeneric();\n"],"mappings":";;AAaA,MAAa,MAAc;AAC3B,MAAa,WAAmB;AAChC,MAAa,aAA4B,kBAAkB"}

package/dist/component/_generated/dataModel.d.ts

@@ -0,0 +1,40 @@
+import _default from "../schema.js";
+import { DataModelFromSchemaDefinition, DocumentByName, SystemTableNames, TableNamesInDataModel } from "convex/server";
+import { GenericId } from "convex/values";
+//#region src/component/_generated/dataModel.d.ts
+/**
+ * The names of all of your Convex tables.
+ */
+export type TableNames = TableNamesInDataModel<DataModel>;
+/**
+ * The type of a document stored in Convex.
+ *
+ * @typeParam TableName - A string literal type of the table name (like "users").
+ */
+export type Doc<TableName extends TableNames> = DocumentByName<DataModel, TableName>;
+/**
+ * An identifier for a document in Convex.
+ *
+ * Convex documents are uniquely identified by their `Id`, which is accessible
+ * on the `_id` field. To learn more, see [Document IDs](https://docs.convex.dev/using/document-ids).
+ *
+ * Documents can be loaded using `db.get(tableName, id)` in query and mutation functions.
+ *
+ * IDs are just strings at runtime, but this type can be used to distinguish them from other
+ * strings when type checking.
+ *
+ * @typeParam TableName - A string literal type of the table name (like "users").
+ */
+export type Id<TableName extends TableNames | SystemTableNames> = GenericId<TableName>;
+/**
+ * A type describing your Convex data model.
+ *
+ * This type includes information about what tables you have, the type of
+ * documents stored in those tables, and the indexes defined on them.
+ *
+ * This type is used to parameterize methods like `queryGeneric` and
+ * `mutationGeneric` to make them type-safe.
+ */
+export type DataModel = DataModelFromSchemaDefinition<typeof _default>;
+//#endregion
+//# sourceMappingURL=dataModel.d.ts.map

package/dist/component/_generated/server.d.ts

@@ -0,0 +1,127 @@
+import { DataModel } from "./dataModel.js";
+import { ActionBuilder, GenericActionCtx, GenericDatabaseReader, GenericDatabaseWriter, GenericMutationCtx, GenericQueryCtx, HttpActionBuilder, MutationBuilder, QueryBuilder } from "convex/server";
+//#region src/component/_generated/server.d.ts
+/**
+ * Typesafe environment variables.
+ *
+ * This includes platform-provided env vars and any variables declared in
+ * `convex.config.ts`.
+ */
+type Env = {
+  readonly CONVEX_CLOUD_URL: string;
+  readonly CONVEX_SITE_URL: string;
+};
+/**
+ * Define a query in this Convex app's public API.
+ *
+ * This function will be allowed to read your Convex database and will be accessible from the client.
+ *
+ * @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+ * @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+ */
+export declare const query: QueryBuilder<DataModel, "public">;
+/**
+ * Define a query that is only accessible from other Convex functions (but not from the client).
+ *
+ * This function will be allowed to read from your Convex database. It will not be accessible from the client.
+ *
+ * @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+ * @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+ */
+export declare const internalQuery: QueryBuilder<DataModel, "internal">;
+/**
+ * Define a mutation in this Convex app's public API.
+ *
+ * This function will be allowed to modify your Convex database and will be accessible from the client.
+ *
+ * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+ * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+ */
+export declare const mutation: MutationBuilder<DataModel, "public">;
+/**
+ * Define a mutation that is only accessible from other Convex functions (but not from the client).
+ *
+ * This function will be allowed to modify your Convex database. It will not be accessible from the client.
+ *
+ * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+ * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+ */
+export declare const internalMutation: MutationBuilder<DataModel, "internal">;
+/**
+ * Define an action in this Convex app's public API.
+ *
+ * An action is a function which can execute any JavaScript code, including non-deterministic
+ * code and code with side-effects, like calling third-party services.
+ * They can be run in Convex's JavaScript environment or in Node.js using the "use node" directive.
+ * They can interact with the database indirectly by calling queries and mutations using the {@link ActionCtx}.
+ *
+ * @param func - The action. It receives an {@link ActionCtx} as its first argument.
+ * @returns The wrapped action. Include this as an `export` to name it and make it accessible.
+ */
+export declare const action: ActionBuilder<DataModel, "public">;
+/**
+ * Define an action that is only accessible from other Convex functions (but not from the client).
+ *
+ * @param func - The function. It receives an {@link ActionCtx} as its first argument.
+ * @returns The wrapped function. Include this as an `export` to name it and make it accessible.
+ */
+export declare const internalAction: ActionBuilder<DataModel, "internal">;
+/**
+ * Define an HTTP action.
+ *
+ * The wrapped function will be used to respond to HTTP requests received
+ * by a Convex deployment if the requests matches the path and method where
+ * this action is routed. Be sure to route your httpAction in `convex/http.js`.
+ *
+ * @param func - The function. It receives an {@link ActionCtx} as its first argument
+ * and a Fetch API `Request` object as its second.
+ * @returns The wrapped function. Import this function from `convex/http.js` and route it to hook it up.
+ */
+export declare const httpAction: HttpActionBuilder;
+export declare const env: Env;
+/**
+ * A set of services for use within Convex query functions.
+ *
+ * The query context is passed as the first argument to any Convex query
+ * function run on the server.
+ *
+ * If you're using code generation, use the `QueryCtx` type in `convex/_generated/server.d.ts` instead.
+ */
+export type QueryCtx = GenericQueryCtx<DataModel>;
+/**
+ * A set of services for use within Convex mutation functions.
+ *
+ * The mutation context is passed as the first argument to any Convex mutation
+ * function run on the server.
+ *
+ * If you're using code generation, use the `MutationCtx` type in `convex/_generated/server.d.ts` instead.
+ */
+export type MutationCtx = GenericMutationCtx<DataModel>;
+/**
+ * A set of services for use within Convex action functions.
+ *
+ * The action context is passed as the first argument to any Convex action
+ * function run on the server.
+ */
+export type ActionCtx = GenericActionCtx<DataModel>;
+/**
+ * An interface to read from the database within Convex query functions.
+ *
+ * The two entry points are {@link DatabaseReader.get}, which fetches a single
+ * document by its {@link Id}, or {@link DatabaseReader.query}, which starts
+ * building a query.
+ */
+export type DatabaseReader = GenericDatabaseReader<DataModel>;
+/**
+ * An interface to read from and write to the database within Convex mutation
+ * functions.
+ *
+ * Convex guarantees that all writes within a single mutation are
+ * executed atomically, so you never have to worry about partial writes leaving
+ * your data in an inconsistent state. See [the Convex Guide](https://docs.convex.dev/understanding/convex-fundamentals/functions#atomicity-and-optimistic-concurrency-control)
+ * for the guarantees Convex provides your functions.
+ */
+export type DatabaseWriter = GenericDatabaseWriter<DataModel>;
+//#endregion
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/component/_generated/server.js

@@ -0,0 +1,74 @@
+import { actionGeneric, httpActionGeneric, internalActionGeneric, internalMutationGeneric, internalQueryGeneric, mutationGeneric, queryGeneric } from "convex/server";
+//#region src/component/_generated/server.ts
+/**
+* Define a query in this Convex app's public API.
+*
+* This function will be allowed to read your Convex database and will be accessible from the client.
+*
+* @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+* @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+*/
+const query = queryGeneric;
+/**
+* Define a query that is only accessible from other Convex functions (but not from the client).
+*
+* This function will be allowed to read from your Convex database. It will not be accessible from the client.
+*
+* @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+* @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+*/
+const internalQuery = internalQueryGeneric;
+/**
+* Define a mutation in this Convex app's public API.
+*
+* This function will be allowed to modify your Convex database and will be accessible from the client.
+*
+* @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+* @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+*/
+const mutation = mutationGeneric;
+/**
+* Define a mutation that is only accessible from other Convex functions (but not from the client).
+*
+* This function will be allowed to modify your Convex database. It will not be accessible from the client.
+*
+* @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+* @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+*/
+const internalMutation = internalMutationGeneric;
+/**
+* Define an action in this Convex app's public API.
+*
+* An action is a function which can execute any JavaScript code, including non-deterministic
+* code and code with side-effects, like calling third-party services.
+* They can be run in Convex's JavaScript environment or in Node.js using the "use node" directive.
+* They can interact with the database indirectly by calling queries and mutations using the {@link ActionCtx}.
+*
+* @param func - The action. It receives an {@link ActionCtx} as its first argument.
+* @returns The wrapped action. Include this as an `export` to name it and make it accessible.
+*/
+const action = actionGeneric;
+/**
+* Define an action that is only accessible from other Convex functions (but not from the client).
+*
+* @param func - The function. It receives an {@link ActionCtx} as its first argument.
+* @returns The wrapped function. Include this as an `export` to name it and make it accessible.
+*/
+const internalAction = internalActionGeneric;
+/**
+* Define an HTTP action.
+*
+* The wrapped function will be used to respond to HTTP requests received
+* by a Convex deployment if the requests matches the path and method where
+* this action is routed. Be sure to route your httpAction in `convex/http.js`.
+*
+* @param func - The function. It receives an {@link ActionCtx} as its first argument
+* and a Fetch API `Request` object as its second.
+* @returns The wrapped function. Import this function from `convex/http.js` and route it to hook it up.
+*/
+const httpAction = httpActionGeneric;
+const env = globalThis.process.env;
+//#endregion
+export { action, env, httpAction, internalAction, internalMutation, internalQuery, mutation, query };
+
+//# sourceMappingURL=server.js.map

package/dist/component/_generated/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","names":[],"sources":["../../../src/component/_generated/server.ts"],"sourcesContent":["/* eslint-disable */\n/**\n * Generated utilities for implementing server-side Convex query and mutation functions.\n *\n * THIS CODE IS AUTOMATICALLY GENERATED.\n *\n * To regenerate, run `npx convex dev`.\n * @module\n */\n\nimport type {\n  ActionBuilder,\n  HttpActionBuilder,\n  MutationBuilder,\n  QueryBuilder,\n  GenericActionCtx,\n  GenericMutationCtx,\n  GenericQueryCtx,\n  GenericDatabaseReader,\n  GenericDatabaseWriter,\n} from \"convex/server\";\nimport {\n  actionGeneric,\n  httpActionGeneric,\n  queryGeneric,\n  mutationGeneric,\n  internalActionGeneric,\n  internalMutationGeneric,\n  internalQueryGeneric,\n} from \"convex/server\";\nimport type { DataModel } from \"./dataModel.js\";\n\n/**\n * Typesafe environment variables.\n *\n * This includes platform-provided env vars and any variables declared in\n * `convex.config.ts`.\n */\ntype Env = {\n  readonly CONVEX_CLOUD_URL: string;\n  readonly CONVEX_SITE_URL: string;\n};\n\n/**\n * Define a query in this Convex app's public API.\n *\n * This function will be allowed to read your Convex database and will be accessible from the client.\n *\n * @param func - The query function. It receives a {@link QueryCtx} as its first argument.\n * @returns The wrapped query. Include this as an `export` to name it and make it accessible.\n */\nexport const query: QueryBuilder<DataModel, \"public\"> = queryGeneric;\n\n/**\n * Define a query that is only accessible from other Convex functions (but not from the client).\n *\n * This function will be allowed to read from your Convex database. It will not be accessible from the client.\n *\n * @param func - The query function. It receives a {@link QueryCtx} as its first argument.\n * @returns The wrapped query. Include this as an `export` to name it and make it accessible.\n */\nexport const internalQuery: QueryBuilder<DataModel, \"internal\"> =\n  internalQueryGeneric;\n\n/**\n * Define a mutation in this Convex app's public API.\n *\n * This function will be allowed to modify your Convex database and will be accessible from the client.\n *\n * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.\n * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.\n */\nexport const mutation: MutationBuilder<DataModel, \"public\"> = mutationGeneric;\n\n/**\n * Define a mutation that is only accessible from other Convex functions (but not from the client).\n *\n * This function will be allowed to modify your Convex database. It will not be accessible from the client.\n *\n * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.\n * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.\n */\nexport const internalMutation: MutationBuilder<DataModel, \"internal\"> =\n  internalMutationGeneric;\n\n/**\n * Define an action in this Convex app's public API.\n *\n * An action is a function which can execute any JavaScript code, including non-deterministic\n * code and code with side-effects, like calling third-party services.\n * They can be run in Convex's JavaScript environment or in Node.js using the \"use node\" directive.\n * They can interact with the database indirectly by calling queries and mutations using the {@link ActionCtx}.\n *\n * @param func - The action. It receives an {@link ActionCtx} as its first argument.\n * @returns The wrapped action. Include this as an `export` to name it and make it accessible.\n */\nexport const action: ActionBuilder<DataModel, \"public\"> = actionGeneric;\n\n/**\n * Define an action that is only accessible from other Convex functions (but not from the client).\n *\n * @param func - The function. It receives an {@link ActionCtx} as its first argument.\n * @returns The wrapped function. Include this as an `export` to name it and make it accessible.\n */\nexport const internalAction: ActionBuilder<DataModel, \"internal\"> =\n  internalActionGeneric;\n\n/**\n * Define an HTTP action.\n *\n * The wrapped function will be used to respond to HTTP requests received\n * by a Convex deployment if the requests matches the path and method where\n * this action is routed. Be sure to route your httpAction in `convex/http.js`.\n *\n * @param func - The function. It receives an {@link ActionCtx} as its first argument\n * and a Fetch API `Request` object as its second.\n * @returns The wrapped function. Import this function from `convex/http.js` and route it to hook it up.\n */\nexport const httpAction: HttpActionBuilder = httpActionGeneric;\nexport const env: Env = (globalThis as unknown as { process: { env: Env } })\n  .process.env;\n\n/**\n * A set of services for use within Convex query functions.\n *\n * The query context is passed as the first argument to any Convex query\n * function run on the server.\n *\n * If you're using code generation, use the `QueryCtx` type in `convex/_generated/server.d.ts` instead.\n */\nexport type QueryCtx = GenericQueryCtx<DataModel>;\n\n/**\n * A set of services for use within Convex mutation functions.\n *\n * The mutation context is passed as the first argument to any Convex mutation\n * function run on the server.\n *\n * If you're using code generation, use the `MutationCtx` type in `convex/_generated/server.d.ts` instead.\n */\nexport type MutationCtx = GenericMutationCtx<DataModel>;\n\n/**\n * A set of services for use within Convex action functions.\n *\n * The action context is passed as the first argument to any Convex action\n * function run on the server.\n */\nexport type ActionCtx = GenericActionCtx<DataModel>;\n\n/**\n * An interface to read from the database within Convex query functions.\n *\n * The two entry points are {@link DatabaseReader.get}, which fetches a single\n * document by its {@link Id}, or {@link DatabaseReader.query}, which starts\n * building a query.\n */\nexport type DatabaseReader = GenericDatabaseReader<DataModel>;\n\n/**\n * An interface to read from and write to the database within Convex mutation\n * functions.\n *\n * Convex guarantees that all writes within a single mutation are\n * executed atomically, so you never have to worry about partial writes leaving\n * your data in an inconsistent state. See [the Convex Guide](https://docs.convex.dev/understanding/convex-fundamentals/functions#atomicity-and-optimistic-concurrency-control)\n * for the guarantees Convex provides your functions.\n */\nexport type DatabaseWriter = GenericDatabaseWriter<DataModel>;\n"],"mappings":";;;;;;;;;;AAmDA,MAAa,QAA2C;;;;;;;;;AAUxD,MAAa,gBACX;;;;;;;;;AAUF,MAAa,WAAiD;;;;;;;;;AAU9D,MAAa,mBACX;;;;;;;;;;;;AAaF,MAAa,SAA6C;;;;;;;AAQ1D,MAAa,iBACX;;;;;;;;;;;;AAaF,MAAa,aAAgC;AAC7C,MAAa,MAAY,WACtB,QAAQ"}

package/dist/component/convex.config.d.ts

@@ -0,0 +1,16 @@
+//#region src/component/convex.config.d.ts
+/**
+ * The safebyok component, as a host app installs it from its `convex/convex.config.ts`:
+ *
+ * @example
+ *   import { defineApp } from 'convex/server'
+ *   import safebyok from 'safebyok-convex/convex.config'
+ *
+ *   const app = defineApp()
+ *   app.use(safebyok)
+ *   export default app
+ */
+declare const _default: import("convex/server").ComponentDefinition<any, {}>;
+//#endregion
+export { _default as default };
+//# sourceMappingURL=convex.config.d.ts.map

package/dist/component/convex.config.js

@@ -0,0 +1,18 @@
+import { defineComponent } from "convex/server";
+//#region src/component/convex.config.ts
+/**
+* The safebyok component, as a host app installs it from its `convex/convex.config.ts`:
+*
+* @example
+*   import { defineApp } from 'convex/server'
+*   import safebyok from 'safebyok-convex/convex.config'
+*
+*   const app = defineApp()
+*   app.use(safebyok)
+*   export default app
+*/
+var convex_config_default = defineComponent("safebyok");
+//#endregion
+export { convex_config_default as default };
+
+//# sourceMappingURL=convex.config.js.map

package/dist/component/convex.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convex.config.js","names":[],"sources":["../../src/component/convex.config.ts"],"sourcesContent":["import { defineComponent } from 'convex/server'\n\n/**\n * The safebyok component, as a host app installs it from its `convex/convex.config.ts`:\n *\n * @example\n *   import { defineApp } from 'convex/server'\n *   import safebyok from 'safebyok-convex/convex.config'\n *\n *   const app = defineApp()\n *   app.use(safebyok)\n *   export default app\n */\nexport default defineComponent('safebyok')\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAA,wBAAe,gBAAgB,UAAU"}

package/dist/component/schema.d.ts

@@ -0,0 +1,98 @@
+//#region src/component/schema.d.ts
+/**
+ * The component's own tables, isolated from the host app's. Each row is a record as the core
+ * writes it, in typed columns: ciphertext and public fields only.
+ *
+ * `user_id` leads both indexes: every call is one user's, and an account's rows are one range.
+ */
+declare const _default: import("convex/server").SchemaDefinition<{
+  /** One VaultBundle per vault, as-is. */
+  safebyok_bundles: import("convex/server").TableDefinition<import("convex/values").VObject<{
+    format: "safebyok-vault-v1";
+    applabel: string;
+    user_id: string;
+    vaultlabel: string;
+    vault_id: string;
+    passphrase_epoch: number;
+    key_deriver_label: string;
+    passphrase_salt_b64: string;
+    vault_key_passphrase_wrapped: {
+      cipher_iv_b64: string;
+      ciphertext_b64: string;
+    };
+    created_at: string;
+    updated_at: string;
+  }, {
+    format: import("convex/values").VUnion<"safebyok-vault-v1", [import("convex/values").VLiteral<"safebyok-vault-v1", "required">], "required", never>;
+    applabel: import("convex/values").VString<string, "required">;
+    user_id: import("convex/values").VString<string, "required">;
+    vaultlabel: import("convex/values").VString<string, "required">;
+    vault_id: import("convex/values").VString<string, "required">;
+    passphrase_epoch: import("convex/values").VFloat64<number, "required">;
+    key_deriver_label: import("convex/values").VString<string, "required">;
+    passphrase_salt_b64: import("convex/values").VString<string, "required">;
+    vault_key_passphrase_wrapped: import("convex/values").VObject<{
+      cipher_iv_b64: string;
+      ciphertext_b64: string;
+    }, {
+      cipher_iv_b64: import("convex/values").VString<string, "required">;
+      ciphertext_b64: import("convex/values").VString<string, "required">;
+    }, "required", "cipher_iv_b64" | "ciphertext_b64">;
+    created_at: import("convex/values").VString<string, "required">;
+    updated_at: import("convex/values").VString<string, "required">;
+  }, "required", "format" | "applabel" | "user_id" | "vaultlabel" | "vault_id" | "passphrase_epoch" | "key_deriver_label" | "passphrase_salt_b64" | "vault_key_passphrase_wrapped" | "created_at" | "updated_at" | "vault_key_passphrase_wrapped.cipher_iv_b64" | "vault_key_passphrase_wrapped.ciphertext_b64">, {
+    by_scope: ["user_id", "applabel", "vaultlabel", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * One Lockbox per boxlabel, as-is, with its vault's scope columns beside it: added on write,
+   * stripped on read. `by_box` serves one box (all four fields) and a vault's boxes (the first three).
+   */
+  safebyok_lockboxes: import("convex/server").TableDefinition<import("convex/values").VObject<{
+    note?: string;
+    format: "safebyok-lockbox-v1";
+    created_at: string;
+    updated_at: string;
+    boxlabel: string;
+    revision_id: string;
+    lockbox_key_wrapped: {
+      cipher_iv_b64: string;
+      ciphertext_b64: string;
+    };
+    whisper_ciphered: {
+      cipher_iv_b64: string;
+      ciphertext_b64: string;
+    };
+    applabel: string;
+    user_id: string;
+    vaultlabel: string;
+  }, {
+    format: import("convex/values").VUnion<"safebyok-lockbox-v1", [import("convex/values").VLiteral<"safebyok-lockbox-v1", "required">], "required", never>;
+    boxlabel: import("convex/values").VString<string, "required">;
+    revision_id: import("convex/values").VString<string, "required">;
+    lockbox_key_wrapped: import("convex/values").VObject<{
+      cipher_iv_b64: string;
+      ciphertext_b64: string;
+    }, {
+      cipher_iv_b64: import("convex/values").VString<string, "required">;
+      ciphertext_b64: import("convex/values").VString<string, "required">;
+    }, "required", "cipher_iv_b64" | "ciphertext_b64">;
+    whisper_ciphered: import("convex/values").VObject<{
+      cipher_iv_b64: string;
+      ciphertext_b64: string;
+    }, {
+      cipher_iv_b64: import("convex/values").VString<string, "required">;
+      ciphertext_b64: import("convex/values").VString<string, "required">;
+    }, "required", "cipher_iv_b64" | "ciphertext_b64">;
+    note: import("convex/values").VString<string | undefined, "optional">;
+    created_at: import("convex/values").VString<string, "required">;
+    updated_at: import("convex/values").VString<string, "required">;
+    applabel: import("convex/values").VString<string, "required">;
+    user_id: import("convex/values").VString<string, "required">;
+    vaultlabel: import("convex/values").VString<string, "required">;
+  }, "required", "format" | "applabel" | "user_id" | "vaultlabel" | "created_at" | "updated_at" | "boxlabel" | "revision_id" | "lockbox_key_wrapped" | "whisper_ciphered" | "note" | "lockbox_key_wrapped.cipher_iv_b64" | "lockbox_key_wrapped.ciphertext_b64" | "whisper_ciphered.cipher_iv_b64" | "whisper_ciphered.ciphertext_b64">, {
+    by_box: ["user_id", "applabel", "vaultlabel", "boxlabel", "_creationTime"];
+  }, {}, {}>;
+}, true>;
+//#endregion
+export { _default as default };
+//# sourceMappingURL=schema.d.ts.map

package/dist/component/schema.js

@@ -0,0 +1,31 @@
+import { Lockbox, VaultBundle, VaultScope } from "./validators.js";
+import { defineSchema, defineTable } from "convex/server";
+//#region src/component/schema.ts
+/**
+* The component's own tables, isolated from the host app's. Each row is a record as the core
+* writes it, in typed columns: ciphertext and public fields only.
+*
+* `user_id` leads both indexes: every call is one user's, and an account's rows are one range.
+*/
+var schema_default = defineSchema({
+	/** One VaultBundle per vault, as-is. */
+	safebyok_bundles: defineTable(VaultBundle).index("by_scope", [
+		"user_id",
+		"applabel",
+		"vaultlabel"
+	]),
+	/**
+	* One Lockbox per boxlabel, as-is, with its vault's scope columns beside it: added on write,
+	* stripped on read. `by_box` serves one box (all four fields) and a vault's boxes (the first three).
+	*/
+	safebyok_lockboxes: defineTable(Lockbox.extend(VaultScope.fields)).index("by_box", [
+		"user_id",
+		"applabel",
+		"vaultlabel",
+		"boxlabel"
+	])
+});
+//#endregion
+export { schema_default as default };
+
+//# sourceMappingURL=schema.js.map

package/dist/component/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","names":[],"sources":["../../src/component/schema.ts"],"sourcesContent":["import { defineSchema, defineTable } from 'convex/server'\nimport { Lockbox, VaultBundle, VaultScope } from './validators'\n\n/**\n * The component's own tables, isolated from the host app's. Each row is a record as the core\n * writes it, in typed columns: ciphertext and public fields only.\n *\n * `user_id` leads both indexes: every call is one user's, and an account's rows are one range.\n */\nexport default defineSchema({\n  /** One VaultBundle per vault, as-is. */\n  safebyok_bundles: defineTable(VaultBundle)\n    .index('by_scope', ['user_id', 'applabel', 'vaultlabel']),\n  /**\n   * One Lockbox per boxlabel, as-is, with its vault's scope columns beside it: added on write,\n   * stripped on read. `by_box` serves one box (all four fields) and a vault's boxes (the first three).\n   */\n  safebyok_lockboxes: defineTable(Lockbox.extend(VaultScope.fields))\n    .index('by_box', ['user_id', 'applabel', 'vaultlabel', 'boxlabel']),\n})\n"],"mappings":";;;;;;;;;AASA,IAAA,iBAAe,aAAa;;CAE1B,kBAAkB,YAAY,WAAW,CAAC,CACvC,MAAM,YAAY;EAAC;EAAW;EAAY;CAAY,CAAC;;;;;CAK1D,oBAAoB,YAAY,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC,CAC/D,MAAM,UAAU;EAAC;EAAW;EAAY;EAAc;CAAU,CAAC;AACtE,CAAC"}