@noy-db/hub 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/{ulid-CiM2OAeM.d.ts → decrypt-partition-CXS5KopB.d.ts}

@@ -1,4 +1,4 @@
-import { ba as PublicEnvelope, bb as SealingKeyProvider, bc as BundleRecipient, bd as RecipientSealer, be as RecipientHint, bf as Vault } from './types-D9eB0Rvh.js';
+import { bc as PublicEnvelope, bd as SealingKeyProvider, be as BundleRecipient, bf as RecipientSealer, bg as RecipientHint, bh as Vault } from './index-DHn9lEP0.js';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.
@@ -124,7 +124,7 @@ interface NoydbBundleHeader {
      */
     readonly publicEnvelope?: PublicEnvelope;
     /**
-     * Auto-unlock material indicator (#197). When present, the bundle
+     * Auto-unlock material indicator. When present, the bundle
      * body wraps the dump JSON in a structure carrying per-user
      * passphrases — either plaintext (`'unsealed'`, public-by-design)
      * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
@@ -136,17 +136,17 @@ interface NoydbBundleHeader {
      * (sealed).
      *
      * Absent → the body is a raw `vault.dump()` JSON string (the
-     * pre-#197 shape; back-compatible).
+     * the legacy shape; back-compatible).
      */
     readonly autoUnlock?: 'unsealed' | 'sealed';
     /**
-     * Bundle's role in the source → destination lifecycle (#203).
+     * Bundle's role in the source → destination lifecycle.
      *   - omitted / 'snapshot' (default): backup/copy of an existing vault.
      *   - 'extracted-partition': re-keyed projection awaiting adoption.
      */
     readonly bundleKind?: 'snapshot' | 'extracted-partition';
     /**
-     * Transfer-seal INDICATOR (#206) — metadata only, no payload (the
+     * Transfer-seal INDICATOR — metadata only, no payload (the
      * sealed DEKs live in the body). Present iff
      * bundleKind === 'extracted-partition'.
      */
@@ -248,7 +248,7 @@ interface AutoCredential {
  * - `compression: 'gzip'` — force gzip
  * - `compression: 'none'` — no compression (round-trip testing only)
  *
- * **Slice filtering** (added in ):
+ * **Slice filtering:**
  * - `collections` — allowlist of collection names to include. Internal
  *   collections (keyrings, ledger) and excluded user collections are
  *   dropped from the bundle. Records inside included collections are
@@ -311,7 +311,7 @@ interface WriteNoydbBundleOptions {
      */
     readonly recipients?: readonly BundleRecipient[];
     /**
-     * Auto-unlock — unsealed per-user credentials (#215).
+     * Auto-unlock — unsealed per-user credentials.
      *
      * Generalises `autoPassphrases` to support any bundleable credential
      * kind (`passphrase` | `password` | `pin`).
@@ -333,7 +333,7 @@ interface WriteNoydbBundleOptions {
     };
     /**
      * Auto-unlock — per-user credentials sealed under a
-     * {@link SealingKeyProvider} (#215).
+     * {@link SealingKeyProvider}.
      *
      * Generalises `sealedPassphrases` to support any bundleable
      * credential kind (`passphrase` | `password` | `pin`).
@@ -369,9 +369,9 @@ interface WriteNoydbBundleOptions {
         }>;
     };
     /**
-     * @deprecated Use `autoCredentials` instead (#215).
+     * @deprecated Use `autoCredentials` instead.
      *
-     * Auto-unlock — unsealed per-user passphrases (#197 slice 1).
+     * Auto-unlock — unsealed per-user passphrases.
      *
      * Public-by-design: anyone holding the bundle bytes can read these
      * plaintext credentials. Use for demo data, sample vaults,
@@ -389,10 +389,10 @@ interface WriteNoydbBundleOptions {
         readonly perUser: Record<string, string>;
     };
     /**
-     * @deprecated Use `sealedCredentials` instead (#215).
+     * @deprecated Use `sealedCredentials` instead.
      *
      * Auto-unlock — per-user passphrases sealed under a
-     * {@link SealingKeyProvider} (#197 slice 1, self-target only).
+     * {@link SealingKeyProvider} (self-target only).
      *
      * The hub seals each user's plaintext passphrase under `provider`
      * and embeds the resulting sealed envelopes in the bundle. The
@@ -424,7 +424,7 @@ interface NoydbBundleReadResult {
     readonly header: NoydbBundleHeader;
     readonly dumpJson: string;
     /**
-     * Auto-unlock material (#197, widened in #215). Present only when
+     * Auto-unlock material. Present only when
      * the header's `autoUnlock` flag is set AND the body's wrapped
      * structure survived parsing. Values are typed credentials — either
      * delivered plain (`kind: 'unsealed'`) or unsealed at read time
@@ -444,9 +444,9 @@ interface NoydbBundleReadResult {
     };
 }
 /**
- * Options accepted by {@link readNoydbBundle} for the #197
- * auto-unlock paths. Without these the reader behaves exactly as
- * pre-#197 (header parsed; body returned as `dumpJson`).
+ * Options accepted by {@link readNoydbBundle} for the
+ * auto-unlock paths. Without these the reader behaves exactly as before
+ * (header parsed; body returned as `dumpJson`).
  */
 interface ReadNoydbBundleOptions {
     /**
@@ -469,10 +469,10 @@ interface ReadNoydbBundleOptions {
     readonly attemptUnsealAcrossProviders?: boolean;
 }
 /**
- * Transfer-seal payload (#206). The destination DEKs, exported to raw
+ * Transfer-seal payload. The destination DEKs, exported to raw
  * bytes and AES-256-GCM-sealed *as a set* under the one-time transfer
- * key. `adoptPartition` (#207) unseals this; `createOwnerOnAdoptedPartition`
- * (#208) re-wraps the raw DEKs under the recipient's KEK.
+ * key. `adoptPartition` unseals this; `createOwnerOnAdoptedPartition`
+ * re-wraps the raw DEKs under the recipient's KEK.
  */
 interface TransferSealPayload {
     readonly v: 1;
@@ -535,69 +535,24 @@ declare function readNoydbBundlePublicEnvelope(bytes: Uint8Array, opts?: {
  */
 declare function readNoydbBundle(bytes: Uint8Array, opts?: ReadNoydbBundleOptions): Promise<NoydbBundleReadResult>;
 
+/** One decrypted record from an extracted-partition compartment. */
+interface DecryptedRecord {
+    readonly id: string;
+    readonly record: Record<string, unknown>;
+    /** Source envelope write timestamp (ISO) — for last-write-wins merges. */
+    readonly ts: string;
+    /** Source envelope version. */
+    readonly version: number;
+    /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */
+    readonly source?: string;
+    /** ISO-8601 timestamp the provenance source was recorded (FR-5). */
+    readonly sourceTs?: string;
+}
 /**
- * Minimal ULID generator — zero dependencies, Web Crypto API only.
- *
- *. Used by the bundle writer to generate stable opaque
- * handles for `.noydb` containers.
- *
- * **What's a ULID?** A 128-bit identifier encoded as 26 Crockford
- * base32 characters. Layout:
- *
- * ```
- *   01HYABCDEFGHJKMNPQRSTVWXYZ
- *   |--------||---------------|
- *    48-bit     80-bit
- *    timestamp  randomness
- * ```
- *
- * The first 10 chars encode a millisecond Unix timestamp (so ULIDs
- * sort lexicographically by creation time), and the remaining 16
- * chars are random. Crockford base32 omits I/L/O/U to avoid
- * ambiguity in handwriting and URLs.
- *
- * **Why hand-roll instead of pulling in `ulid`?** The package adds
- * a dep, the implementation is ~30 lines, and the bundle module
- * is the only consumer. Adding `ulid` would also drag in its own
- * crypto polyfill that we don't need on Node 18+ or modern
- * browsers.
- *
- * **Privacy consideration:** the timestamp prefix is observable in
- * the bundle header. This is a deliberate trade-off:
- *   - Pro: lexicographic sortability lets bundle adapters list
- *     newest-first without an extra index.
- *   - Con: a casual observer can read the bundle's creation time
- *     from the handle. They cannot read it from any OTHER field
- *     (the header explicitly forbids `_exported_at`), and a
- *     creation timestamp is the same kind of metadata that
- *     filesystem mtime would already expose for a downloaded
- *     bundle. The leak is therefore equivalent to what's already
- *     visible from the file's mtime — not a new exposure.
- *
- * If a future use case needs timestamp-free handles, a v2 of the
- * format could specify "use the random portion only" without a
- * format break — `validateBundleHeader` only checks the regex
- * shape, not the encoded timestamp.
- */
-/**
- * Generate a fresh ULID. Uses `crypto.getRandomValues` for the
- * randomness portion — same Web Crypto API the rest of the
- * codebase uses for IVs and salt.
- *
- * Returns a 26-character string. Calling twice in the same
- * millisecond produces two distinct ULIDs (the random portion
- * differs); ULIDs from the same millisecond are NOT guaranteed
- * to be monotonically ordered relative to each other, only
- * relative to ULIDs from a different millisecond. The bundle
- * format never relies on intra-millisecond ordering.
- */
-declare function generateULID(): string;
-/**
- * Validate that a string is a syntactically well-formed ULID. Used
- * by the bundle header validator. Does NOT verify that the
- * timestamp portion decodes to a sensible date — the format only
- * cares about the encoding shape.
+ * Decrypt every record of an extracted-partition bundle to plaintext,
+ * grouped by collection. Throws if the bundle isn't an
+ * extracted-partition or the transfer key is wrong.
  */
-declare function isULID(value: string): boolean;
+declare function decryptExtractedPartition(bundleBytes: Uint8Array, transferKey: Uint8Array): Promise<Record<string, DecryptedRecord[]>>;
 
-export { type AutoCredential as A, COMPRESSION_BROTLI as C, FLAG_COMPRESSED as F, NOYDB_BUNDLE_FORMAT_VERSION as N, type ReadNoydbBundleOptions as R, type TransferSealPayload as T, type WriteNoydbBundleOptions as W, COMPRESSION_GZIP as a, COMPRESSION_NONE as b, type CompressionAlgo as c, FLAG_HAS_INTEGRITY_HASH as d, NOYDB_BUNDLE_MAGIC as e, NOYDB_BUNDLE_PREFIX_BYTES as f, type NoydbBundleHeader as g, type NoydbBundleReadResult as h, encodeBundleHeader as i, generateULID as j, isULID as k, readNoydbBundleHeader as l, resetBrotliSupportCache as m, type AutoCredentialKind as n, hasNoydbBundleMagic as o, readNoydbBundlePublicEnvelope as p, readNoydbBundle as r, validateBundleHeader as v, writeNoydbBundle as w };
+export { type AutoCredential as A, COMPRESSION_BROTLI as C, type DecryptedRecord as D, FLAG_COMPRESSED as F, NOYDB_BUNDLE_FORMAT_VERSION as N, type ReadNoydbBundleOptions as R, type TransferSealPayload as T, type WriteNoydbBundleOptions as W, COMPRESSION_GZIP as a, COMPRESSION_NONE as b, type CompressionAlgo as c, FLAG_HAS_INTEGRITY_HASH as d, NOYDB_BUNDLE_MAGIC as e, NOYDB_BUNDLE_PREFIX_BYTES as f, type NoydbBundleHeader as g, type NoydbBundleReadResult as h, decryptExtractedPartition as i, encodeBundleHeader as j, readNoydbBundleHeader as k, resetBrotliSupportCache as l, type AutoCredentialKind as m, hasNoydbBundleMagic as n, readNoydbBundlePublicEnvelope as o, readNoydbBundle as r, validateBundleHeader as v, writeNoydbBundle as w };

package/dist/{delegation-QSC7G5QC.js → delegation-BQTRJATI.js}

@@ -3,15 +3,16 @@ import {
   issueDelegation,
   loadActiveDelegations,
   revokeDelegation
-} from "./chunk-YK72A4IT.js";
-import "./chunk-6S3LLAQ5.js";
+} from "./chunk-LBILABKZ.js";
+import "./chunk-MSMDDDDJ.js";
 import "./chunk-FZU343FL.js";
-import "./chunk-UOF74WQY.js";
-import "./chunk-YDLAFP36.js";
+import "./chunk-E2MDPPOC.js";
+import "./chunk-JZ5DS4DP.js";
+import "./chunk-PZ5AY32C.js";
 export {
   DELEGATIONS_COLLECTION,
   issueDelegation,
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-QSC7G5QC.js.map
+//# sourceMappingURL=delegation-BQTRJATI.js.map

package/dist/derivations/index.d.ts

@@ -1,11 +1,13 @@
-export { w as withDerivation } from '../with-derivation-Bzpj6UTv.js';
-import { aw as DerivationStrategy, ax as DerivationContext } from '../types-D9eB0Rvh.js';
-export { ay as ArrayOutputSpec, az as DerivationRegistry, aA as DerivationStrategyHandle, aB as DerivedFromMeta, aC as OutputSpec, aD as RecordOutputSpec } from '../types-D9eB0Rvh.js';
-export { e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError } from '../index-BF1B2HB9.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+export { w as withDerivation, a as withRollup } from '../with-rollup-CbU-O4wP.js';
+import { aC as DerivationStrategy, aD as DerivationContext } from '../index-DHn9lEP0.js';
+export { aE as ArrayOutputSpec, aF as DerivationRegistry, aG as DerivationStrategyHandle, aH as DerivedFromMeta, aI as OutputSpec, aJ as RecordOutputSpec } from '../index-DHn9lEP0.js';
+export { i as DerivationCapExceededError, j as DerivationCycleError, k as DerivationDepthError, l as DerivationOutputShapeError, m as DerivationOutputUnknownError } from '../errors-BAWO5Z5a.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
 import '../strategy-BSxFXGzb.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 import '@noy-db/attestation';
 
 interface RunResult {
@@ -18,7 +20,7 @@ interface RunResult {
  *
  * - `record` — the existing v1 shape: one value (or a "skipped"
  *   marker if the output was optional and `derive` returned null).
- * - `array` — the #200 shape: a list of `(key, value)` entries.
+ * - `array` — a list of `(key, value)` entries.
  *   The caller diffs these against the previously-emitted key set
  *   (loaded from the fanout sidecar) to compute deletes + upserts.
  */
@@ -28,7 +30,7 @@ interface RecordOutputResult {
     value: Record<string, unknown>;
     ok: true;
     /**
-     * `true` when an optional output (#144) returned `null` /
+     * `true` when an optional output returned `null` /
      * `undefined`. The caller deletes any previously-emitted output at
      * the same id (mirrors "tombstone for derived data"); a never-emitted
      * output is a silent no-op. `ok: true` because skipping is a

package/dist/derivations/index.js

@@ -1,19 +1,21 @@
 import {
-  withDerivation
-} from "../chunk-EMEX37ZN.js";
+  withDerivation,
+  withRollup
+} from "../chunk-BEZ2EV43.js";
 import {
   DerivationRegistry
-} from "../chunk-GD3BGKAR.js";
+} from "../chunk-UBF5JEOJ.js";
 import {
   DerivationExecutor
-} from "../chunk-HGZ7DC5H.js";
+} from "../chunk-4L6N56B4.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-YDLAFP36.js";
+} from "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,
   DerivationCycleError,
@@ -22,6 +24,7 @@ export {
   DerivationOutputShapeError,
   DerivationOutputUnknownError,
   DerivationRegistry,
-  withDerivation
+  withDerivation,
+  withRollup
 };
 //# sourceMappingURL=index.js.map

package/dist/{dev-unlock-Cf2B7Kih.d.ts → dev-unlock-CnHTTVea.d.ts}

@@ -1,4 +1,4 @@
-import { aL as Role, aM as UnlockedKeyring } from './types-D9eB0Rvh.js';
+import { aT as Role, aU as UnlockedKeyring } from './index-DHn9lEP0.js';
 
 /**
  * Session tokens —

package/dist/discriminant-BN9REW3o.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Type-guard helper for narrowing discriminated-union records.
+ *
+ * `Collection<T>` correctly threads `T` through `get` / `query` / `scan`, but
+ * accessing member-specific fields after reading from a `Collection<Union>`
+ * still requires a narrowing step in application code. In regular `.ts` files
+ * a simple `if (r.kind === 'IV')` block narrows correctly; in vue-tsc /
+ * template contexts the inline comparison is sometimes not enough, and the
+ * helper below makes the guard portable and avoids `as unknown as …` casts.
+ *
+ * **Usage with Collection<T>**
+ *
+ * ```ts
+ * import { isDiscriminant } from '@noy-db/hub'
+ *
+ * type IV = { kind: 'IV'; invoiceNo: string; amount: number }
+ * type RE = { kind: 'RE'; receiptNo: string; paidAt: string }
+ * type Receipt = IV | RE | ...
+ *
+ * const receipts = await vault.collection<Receipt>('receipts').query().toArray()
+ *
+ * // Filter approach — result is IV[], invoiceNo accessible without cast:
+ * const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
+ * console.log(ivs[0].invoiceNo)
+ *
+ * // Branch approach:
+ * for (const r of receipts) {
+ *   if (isDiscriminant(r, 'kind', 'IV')) {
+ *     console.log(r.invoiceNo)  // r: IV here
+ *   }
+ * }
+ * ```
+ *
+ * @module
+ */
+/**
+ * Type-guard for narrowing a discriminated-union record by its discriminant.
+ *
+ * Returns `true` when `record[key] === value`, and narrows `record` to
+ * `Extract<T, Record<K, V>>` — the exact union member(s) that carry that
+ * discriminant value.
+ *
+ * The discriminant key is a parameter (not hardcoded to `'kind'`), so this
+ * works with any field name: `'kind'`, `'type'`, `'tag'`, etc.
+ *
+ * @example
+ *   const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
+ *   // ivs: IV[]  — invoiceNo accessible, no cast needed
+ *
+ * @typeParam T - The union type of the record (e.g. `Receipt`). Both type-alias
+ *   unions and interface-extended unions work; use a `type` alias (`type Receipt = IV | RE`) for best
+ *   results.
+ * @typeParam K - The discriminant key (must be a key of `T`).
+ * @typeParam V - The discriminant value to match. The `const` modifier ensures
+ *   TypeScript infers the string literal (e.g. `'IV'`), not the full union
+ *   `T[K]`, so the predicate resolves to the exact member type.
+ */
+declare function isDiscriminant<T, K extends keyof T, const V extends T[K]>(record: T, key: K, value: V): record is Extract<T, Record<K, V>>;
+
+export { isDiscriminant as i };