@noy-db/hub 0.2.0-pre.2 → 0.2.0-pre.21

package/dist/{ulid-BmBgooGm.d.ts → ulid-B2L_aqVA.d.ts}

@@ -1,4 +1,4 @@
-import { ba as PublicEnvelope, bb as SealingKeyProvider, bc as BundleRecipient, bd as RecipientSealer, be as RecipientHint, bf as Vault } from './types-BoFFiskX.js';
+import { bc as PublicEnvelope, bd as SealingKeyProvider, be as BundleRecipient, bf as RecipientSealer, bg as RecipientHint, bh as Vault } from './types-DLfWFr6U.js';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.
@@ -124,7 +124,7 @@ interface NoydbBundleHeader {
      */
     readonly publicEnvelope?: PublicEnvelope;
     /**
-     * Auto-unlock material indicator (#197). When present, the bundle
+     * Auto-unlock material indicator. When present, the bundle
      * body wraps the dump JSON in a structure carrying per-user
      * passphrases — either plaintext (`'unsealed'`, public-by-design)
      * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
@@ -136,17 +136,17 @@ interface NoydbBundleHeader {
      * (sealed).
      *
      * Absent → the body is a raw `vault.dump()` JSON string (the
-     * pre-#197 shape; back-compatible).
+     * the legacy shape; back-compatible).
      */
     readonly autoUnlock?: 'unsealed' | 'sealed';
     /**
-     * Bundle's role in the source → destination lifecycle (#203).
+     * Bundle's role in the source → destination lifecycle.
      *   - omitted / 'snapshot' (default): backup/copy of an existing vault.
      *   - 'extracted-partition': re-keyed projection awaiting adoption.
      */
     readonly bundleKind?: 'snapshot' | 'extracted-partition';
     /**
-     * Transfer-seal INDICATOR (#206) — metadata only, no payload (the
+     * Transfer-seal INDICATOR — metadata only, no payload (the
      * sealed DEKs live in the body). Present iff
      * bundleKind === 'extracted-partition'.
      */
@@ -248,7 +248,7 @@ interface AutoCredential {
  * - `compression: 'gzip'` — force gzip
  * - `compression: 'none'` — no compression (round-trip testing only)
  *
- * **Slice filtering** (added in ):
+ * **Slice filtering:**
  * - `collections` — allowlist of collection names to include. Internal
  *   collections (keyrings, ledger) and excluded user collections are
  *   dropped from the bundle. Records inside included collections are
@@ -311,7 +311,7 @@ interface WriteNoydbBundleOptions {
      */
     readonly recipients?: readonly BundleRecipient[];
     /**
-     * Auto-unlock — unsealed per-user credentials (#215).
+     * Auto-unlock — unsealed per-user credentials.
      *
      * Generalises `autoPassphrases` to support any bundleable credential
      * kind (`passphrase` | `password` | `pin`).
@@ -333,7 +333,7 @@ interface WriteNoydbBundleOptions {
     };
     /**
      * Auto-unlock — per-user credentials sealed under a
-     * {@link SealingKeyProvider} (#215).
+     * {@link SealingKeyProvider}.
      *
      * Generalises `sealedPassphrases` to support any bundleable
      * credential kind (`passphrase` | `password` | `pin`).
@@ -369,9 +369,9 @@ interface WriteNoydbBundleOptions {
         }>;
     };
     /**
-     * @deprecated Use `autoCredentials` instead (#215).
+     * @deprecated Use `autoCredentials` instead.
      *
-     * Auto-unlock — unsealed per-user passphrases (#197 slice 1).
+     * Auto-unlock — unsealed per-user passphrases.
      *
      * Public-by-design: anyone holding the bundle bytes can read these
      * plaintext credentials. Use for demo data, sample vaults,
@@ -389,10 +389,10 @@ interface WriteNoydbBundleOptions {
         readonly perUser: Record<string, string>;
     };
     /**
-     * @deprecated Use `sealedCredentials` instead (#215).
+     * @deprecated Use `sealedCredentials` instead.
      *
      * Auto-unlock — per-user passphrases sealed under a
-     * {@link SealingKeyProvider} (#197 slice 1, self-target only).
+     * {@link SealingKeyProvider} (self-target only).
      *
      * The hub seals each user's plaintext passphrase under `provider`
      * and embeds the resulting sealed envelopes in the bundle. The
@@ -424,7 +424,7 @@ interface NoydbBundleReadResult {
     readonly header: NoydbBundleHeader;
     readonly dumpJson: string;
     /**
-     * Auto-unlock material (#197, widened in #215). Present only when
+     * Auto-unlock material. Present only when
      * the header's `autoUnlock` flag is set AND the body's wrapped
      * structure survived parsing. Values are typed credentials — either
      * delivered plain (`kind: 'unsealed'`) or unsealed at read time
@@ -444,9 +444,9 @@ interface NoydbBundleReadResult {
     };
 }
 /**
- * Options accepted by {@link readNoydbBundle} for the #197
- * auto-unlock paths. Without these the reader behaves exactly as
- * pre-#197 (header parsed; body returned as `dumpJson`).
+ * Options accepted by {@link readNoydbBundle} for the
+ * auto-unlock paths. Without these the reader behaves exactly as before
+ * (header parsed; body returned as `dumpJson`).
  */
 interface ReadNoydbBundleOptions {
     /**
@@ -469,10 +469,10 @@ interface ReadNoydbBundleOptions {
     readonly attemptUnsealAcrossProviders?: boolean;
 }
 /**
- * Transfer-seal payload (#206). The destination DEKs, exported to raw
+ * Transfer-seal payload. The destination DEKs, exported to raw
  * bytes and AES-256-GCM-sealed *as a set* under the one-time transfer
- * key. `adoptPartition` (#207) unseals this; `createOwnerOnAdoptedPartition`
- * (#208) re-wraps the raw DEKs under the recipient's KEK.
+ * key. `adoptPartition` unseals this; `createOwnerOnAdoptedPartition`
+ * re-wraps the raw DEKs under the recipient's KEK.
  */
 interface TransferSealPayload {
     readonly v: 1;

package/dist/{ulid-C7ms9oli.d.cts → ulid-LaxfH2tK.d.cts}

@@ -1,4 +1,4 @@
-import { ba as PublicEnvelope, bb as SealingKeyProvider, bc as BundleRecipient, bd as RecipientSealer, be as RecipientHint, bf as Vault } from './types-DJG8HG6F.cjs';
+import { bc as PublicEnvelope, bd as SealingKeyProvider, be as BundleRecipient, bf as RecipientSealer, bg as RecipientHint, bh as Vault } from './types-DyOI6XZ_.cjs';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.
@@ -124,7 +124,7 @@ interface NoydbBundleHeader {
      */
     readonly publicEnvelope?: PublicEnvelope;
     /**
-     * Auto-unlock material indicator (#197). When present, the bundle
+     * Auto-unlock material indicator. When present, the bundle
      * body wraps the dump JSON in a structure carrying per-user
      * passphrases — either plaintext (`'unsealed'`, public-by-design)
      * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
@@ -136,17 +136,17 @@ interface NoydbBundleHeader {
      * (sealed).
      *
      * Absent → the body is a raw `vault.dump()` JSON string (the
-     * pre-#197 shape; back-compatible).
+     * the legacy shape; back-compatible).
      */
     readonly autoUnlock?: 'unsealed' | 'sealed';
     /**
-     * Bundle's role in the source → destination lifecycle (#203).
+     * Bundle's role in the source → destination lifecycle.
      *   - omitted / 'snapshot' (default): backup/copy of an existing vault.
      *   - 'extracted-partition': re-keyed projection awaiting adoption.
      */
     readonly bundleKind?: 'snapshot' | 'extracted-partition';
     /**
-     * Transfer-seal INDICATOR (#206) — metadata only, no payload (the
+     * Transfer-seal INDICATOR — metadata only, no payload (the
      * sealed DEKs live in the body). Present iff
      * bundleKind === 'extracted-partition'.
      */
@@ -248,7 +248,7 @@ interface AutoCredential {
  * - `compression: 'gzip'` — force gzip
  * - `compression: 'none'` — no compression (round-trip testing only)
  *
- * **Slice filtering** (added in ):
+ * **Slice filtering:**
  * - `collections` — allowlist of collection names to include. Internal
  *   collections (keyrings, ledger) and excluded user collections are
  *   dropped from the bundle. Records inside included collections are
@@ -311,7 +311,7 @@ interface WriteNoydbBundleOptions {
      */
     readonly recipients?: readonly BundleRecipient[];
     /**
-     * Auto-unlock — unsealed per-user credentials (#215).
+     * Auto-unlock — unsealed per-user credentials.
      *
      * Generalises `autoPassphrases` to support any bundleable credential
      * kind (`passphrase` | `password` | `pin`).
@@ -333,7 +333,7 @@ interface WriteNoydbBundleOptions {
     };
     /**
      * Auto-unlock — per-user credentials sealed under a
-     * {@link SealingKeyProvider} (#215).
+     * {@link SealingKeyProvider}.
      *
      * Generalises `sealedPassphrases` to support any bundleable
      * credential kind (`passphrase` | `password` | `pin`).
@@ -369,9 +369,9 @@ interface WriteNoydbBundleOptions {
         }>;
     };
     /**
-     * @deprecated Use `autoCredentials` instead (#215).
+     * @deprecated Use `autoCredentials` instead.
      *
-     * Auto-unlock — unsealed per-user passphrases (#197 slice 1).
+     * Auto-unlock — unsealed per-user passphrases.
      *
      * Public-by-design: anyone holding the bundle bytes can read these
      * plaintext credentials. Use for demo data, sample vaults,
@@ -389,10 +389,10 @@ interface WriteNoydbBundleOptions {
         readonly perUser: Record<string, string>;
     };
     /**
-     * @deprecated Use `sealedCredentials` instead (#215).
+     * @deprecated Use `sealedCredentials` instead.
      *
      * Auto-unlock — per-user passphrases sealed under a
-     * {@link SealingKeyProvider} (#197 slice 1, self-target only).
+     * {@link SealingKeyProvider} (self-target only).
      *
      * The hub seals each user's plaintext passphrase under `provider`
      * and embeds the resulting sealed envelopes in the bundle. The
@@ -424,7 +424,7 @@ interface NoydbBundleReadResult {
     readonly header: NoydbBundleHeader;
     readonly dumpJson: string;
     /**
-     * Auto-unlock material (#197, widened in #215). Present only when
+     * Auto-unlock material. Present only when
      * the header's `autoUnlock` flag is set AND the body's wrapped
      * structure survived parsing. Values are typed credentials — either
      * delivered plain (`kind: 'unsealed'`) or unsealed at read time
@@ -444,9 +444,9 @@ interface NoydbBundleReadResult {
     };
 }
 /**
- * Options accepted by {@link readNoydbBundle} for the #197
- * auto-unlock paths. Without these the reader behaves exactly as
- * pre-#197 (header parsed; body returned as `dumpJson`).
+ * Options accepted by {@link readNoydbBundle} for the
+ * auto-unlock paths. Without these the reader behaves exactly as before
+ * (header parsed; body returned as `dumpJson`).
  */
 interface ReadNoydbBundleOptions {
     /**
@@ -469,10 +469,10 @@ interface ReadNoydbBundleOptions {
     readonly attemptUnsealAcrossProviders?: boolean;
 }
 /**
- * Transfer-seal payload (#206). The destination DEKs, exported to raw
+ * Transfer-seal payload. The destination DEKs, exported to raw
  * bytes and AES-256-GCM-sealed *as a set* under the one-time transfer
- * key. `adoptPartition` (#207) unseals this; `createOwnerOnAdoptedPartition`
- * (#208) re-wraps the raw DEKs under the recipient's KEK.
+ * key. `adoptPartition` unseals this; `createOwnerOnAdoptedPartition`
+ * re-wraps the raw DEKs under the recipient's KEK.
  */
 interface TransferSealPayload {
     readonly v: 1;

package/dist/util/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/util/index.ts
 var util_exports = {};
 __export(util_exports, {
+  isDiscriminant: () => isDiscriminant,
   sanitizeFilename: () => sanitizeFilename
 });
 module.exports = __toCommonJS(util_exports);
@@ -223,8 +224,14 @@ function truncateToByteCap(s, max) {
   }
   return out;
 }
+
+// src/util/discriminant.ts
+function isDiscriminant(record, key, value) {
+  return record[key] === value;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  isDiscriminant,
   sanitizeFilename
 });
 //# sourceMappingURL=index.cjs.map