@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/collection-facade-LVD22JLM.js

@@ -0,0 +1,39 @@
+import {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+} from "./chunk-VJV7GKQK.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-ET67AY6B.js";
+import "./chunk-NUEQU36L.js";
+import "./chunk-UF362QVH.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-EOXAAJTY.js";
+import "./chunk-VEAVKDDB.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-LVD22JLM.js.map

package/dist/computed-EXDMQODG.js

@@ -0,0 +1,11 @@
+import {
+  ComputedFieldError,
+  evalComputedFields
+} from "./chunk-O45M6LDB.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ComputedFieldError,
+  evalComputedFields
+};
+//# sourceMappingURL=computed-EXDMQODG.js.map

package/dist/consent/index.d.ts

@@ -1,10 +1,7 @@
-import { a8 as ConsentStrategy } from '../types-Df28QFKb.js';
-export { a9 as CONSENT_AUDIT_COLLECTION, aa as ConsentAuditEntry, ab as ConsentAuditFilter, ac as ConsentContext, ad as ConsentOp, ae as loadConsentEntries, af as writeConsentEntry } from '../types-Df28QFKb.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { aM as ConsentStrategy } from '../index-DjWbxsjb.js';
+export { aN as CONSENT_AUDIT_COLLECTION, aO as ConsentAuditEntry, aP as ConsentAuditFilter, aQ as ConsentContext, aR as ConsentOp, aS as loadConsentEntries, aT as writeConsentEntry } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/consent/index.js

@@ -2,12 +2,20 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-XJFLDA7A.js";
-import "../chunk-FZU343FL.js";
-import "../chunk-PP6W64Y3.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-TMBXVJKT.js";
+import "../chunk-ZJADGNYF.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/consent/active.ts
+// src/with-audit/consent/active.ts
 function withConsent() {
   return {
     write: writeConsentEntry,

package/dist/consent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/crdt/index.d.ts

@@ -1,5 +1,8 @@
-import { C as CrdtStrategy } from '../strategy-BSxFXGzb.js';
-export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, c as buildLwwMapState, d as buildRgaState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from '../strategy-BSxFXGzb.js';
+import { aC as CrdtStrategy } from '../index-DjWbxsjb.js';
+export { aD as CrdtMode, aE as CrdtState, aF as LwwMapState, aG as RgaState, aH as YjsState, aI as buildLwwMapState, aJ as buildRgaState, aK as mergeCrdtStates, aL as resolveCrdtSnapshot } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';
 
 /**
  * Active CRDT strategy factory. Calling `withCrdt()` returns a

package/dist/crdt/index.js

@@ -3,9 +3,10 @@ import {
   buildRgaState,
   mergeCrdtStates,
   resolveCrdtSnapshot
-} from "../chunk-J66GRPNH.js";
+} from "../chunk-6S7T6WC4.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/crdt/active.ts
+// src/with-commit/crdt/active.ts
 function withCrdt() {
   return {
     buildLwwMapState,

package/dist/crdt/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/crdt/active.ts"],"sourcesContent":["/**\n * Active CRDT strategy factory. Calling `withCrdt()` returns a\n * `CrdtStrategy` whose methods delegate to the real LWW-Map / RGA /\n * merge / snapshot helpers in `./crdt.ts`. Only reachable through\n * the `@noy-db/hub/crdt` subpath.\n */\n\nimport {\n  buildLwwMapState,\n  buildRgaState,\n  mergeCrdtStates,\n  resolveCrdtSnapshot,\n} from './crdt.js'\nimport type { CrdtStrategy } from './strategy.js'\n\n/**\n * Build the default CRDT strategy. Pass into\n * `createNoydb({ crdtStrategy: withCrdt() })` to enable collections\n * declared with `crdt: 'lww-map' | 'rga' | 'yjs'`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withCrdt } from '@noy-db/hub/crdt'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   crdtStrategy: withCrdt(),\n * })\n * const notes = vault.collection('notes', { crdt: 'lww-map' })\n * ```\n */\nexport function withCrdt(): CrdtStrategy {\n  return {\n    buildLwwMapState,\n    buildRgaState,\n    mergeCrdtStates,\n    resolveCrdtSnapshot,\n  }\n}\n"],"mappings":";;;;;;;;AAgCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/crdt/active.ts"],"sourcesContent":["/**\n * Active CRDT strategy factory. Calling `withCrdt()` returns a\n * `CrdtStrategy` whose methods delegate to the real LWW-Map / RGA /\n * merge / snapshot helpers in `./crdt.ts`. Only reachable through\n * the `@noy-db/hub/crdt` subpath.\n */\n\nimport {\n  buildLwwMapState,\n  buildRgaState,\n  mergeCrdtStates,\n  resolveCrdtSnapshot,\n} from './crdt.js'\nimport type { CrdtStrategy } from './strategy.js'\n\n/**\n * Build the default CRDT strategy. Pass into\n * `createNoydb({ crdtStrategy: withCrdt() })` to enable collections\n * declared with `crdt: 'lww-map' | 'rga' | 'yjs'`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withCrdt } from '@noy-db/hub/crdt'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   crdtStrategy: withCrdt(),\n * })\n * const notes = vault.collection('notes', { crdt: 'lww-map' })\n * ```\n */\nexport function withCrdt(): CrdtStrategy {\n  return {\n    buildLwwMapState,\n    buildRgaState,\n    mergeCrdtStates,\n    resolveCrdtSnapshot,\n  }\n}\n"],"mappings":";;;;;;;;;AAgCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/dead-filter-HQIE2YG7.js

@@ -0,0 +1,28 @@
+import {
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/satellites/dead-filter.ts
+async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
+  const { loadPersistedSchema } = await import("./storage-ADNP2UWI.js");
+  const out = /* @__PURE__ */ new Map();
+  for (const name of collectionNames) {
+    if (name.startsWith("_")) continue;
+    let dek;
+    try {
+      dek = await getDEK(name);
+    } catch {
+      continue;
+    }
+    const persisted = await loadPersistedSchema(store, vaultName, name, dek);
+    const marker = persisted?.satellite;
+    if (!marker) continue;
+    out.set(name, await liveBaseIdSet(store, vaultName, marker.base));
+  }
+  return out;
+}
+export {
+  liveBaseIdSetsForBundle
+};
+//# sourceMappingURL=dead-filter-HQIE2YG7.js.map

package/dist/dead-filter-HQIE2YG7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/decrypt-partition-IHtxEnTi.d.ts

@@ -0,0 +1,21 @@
+/** One decrypted record from an extracted-partition compartment. */
+interface DecryptedRecord {
+    readonly id: string;
+    readonly record: Record<string, unknown>;
+    /** Source envelope write timestamp (ISO) — for last-write-wins merges. */
+    readonly ts: string;
+    /** Source envelope version. */
+    readonly version: number;
+    /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */
+    readonly source?: string;
+    /** ISO-8601 timestamp the provenance source was recorded (FR-5). */
+    readonly sourceTs?: string;
+}
+/**
+ * Decrypt every record of an extracted-partition bundle to plaintext,
+ * grouped by collection. Throws if the bundle isn't an
+ * extracted-partition or the transfer key is wrong.
+ */
+declare function decryptExtractedPartition(bundleBytes: Uint8Array, transferKey: Uint8Array): Promise<Record<string, DecryptedRecord[]>>;
+
+export { type DecryptedRecord as D, decryptExtractedPartition as d };

package/dist/delegation-BJP73GAP.js

@@ -0,0 +1,25 @@
+import {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+} from "./chunk-DV4HUP5G.js";
+import "./chunk-7BWJHO2A.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+};
+//# sourceMappingURL=delegation-BJP73GAP.js.map

package/dist/derivations/index.d.ts

@@ -1,11 +1,8 @@
-export { w as withDerivation } from '../with-derivation-DFnFByiQ.js';
-import { aN as DerivationStrategy, aO as DerivationContext } from '../types-Df28QFKb.js';
-export { aP as ArrayOutputSpec, aQ as DerivationRegistry, aR as DerivationStrategyHandle, aS as DerivedFromMeta, aT as OutputSpec, aU as RecordOutputSpec } from '../types-Df28QFKb.js';
-export { g as DerivationCapExceededError, h as DerivationCycleError, i as DerivationDepthError, j as DerivationOutputShapeError, k as DerivationOutputUnknownError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+export { w as withDerivation, a as withRollup } from '../with-rollup-DEKGI9vb.js';
+import { bx as DerivationStrategy, by as DerivationContext } from '../index-DjWbxsjb.js';
+export { bz as ArrayOutputSpec, bA as DerivationCapExceededError, bB as DerivationCycleError, bC as DerivationDepthError, bD as DerivationOutputShapeError, bE as DerivationOutputUnknownError, bF as DerivationRegistry, bG as DerivationStrategyHandle, bH as DerivedFromMeta, bI as OutputSpec, bJ as RecordOutputSpec } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 interface RunResult {
@@ -64,7 +61,7 @@ declare const DerivationExecutor: {
      * `_derivedFrom` onto every output. Returns per-output success or
      * failure; throws only for shape mismatches (a contract violation).
      */
-    run<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown>>>(strategy: DerivationStrategy<TSource, TOutputs>, source: TSource & {
+    run<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(strategy: DerivationStrategy<TSource, TOutputs>, source: TSource & {
         id: string;
     }, sourceVersion: number, strategyHash: string, ctx: DerivationContext): Promise<RunResult>;
 };

package/dist/derivations/index.js

@@ -1,19 +1,30 @@
 import {
-  withDerivation
-} from "../chunk-RAZ4OVLL.js";
+  withDerivation,
+  withRollup
+} from "../chunk-KNZB6JMR.js";
 import {
   DerivationRegistry
-} from "../chunk-DE6GKS6G.js";
+} from "../chunk-XUBPSPKD.js";
+import "../chunk-FUOE7UUV.js";
 import {
   DerivationExecutor
-} from "../chunk-DO7C2TOG.js";
+} from "../chunk-LEJIKBBB.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,
   DerivationCycleError,
@@ -22,6 +33,7 @@ export {
   DerivationOutputShapeError,
   DerivationOutputUnknownError,
   DerivationRegistry,
-  withDerivation
+  withDerivation,
+  withRollup
 };
 //# sourceMappingURL=index.js.map

package/dist/derive-BME7HDWO.js

@@ -0,0 +1,21 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-5I35DOHK.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-BME7HDWO.js.map

package/dist/{dev-unlock-B4kDxep_.d.ts → dev-unlock-Bmm2pgJ0.d.ts}

@@ -1,4 +1,4 @@
-import { b0 as Role, b1 as UnlockedKeyring } from './types-Df28QFKb.js';
+import { cY as Role, c8 as UnlockedKeyring } from './index-DjWbxsjb.js';
 
 /**
  * Session tokens —

package/dist/discriminant-BN9REW3o.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Type-guard helper for narrowing discriminated-union records.
+ *
+ * `Collection<T>` correctly threads `T` through `get` / `query` / `scan`, but
+ * accessing member-specific fields after reading from a `Collection<Union>`
+ * still requires a narrowing step in application code. In regular `.ts` files
+ * a simple `if (r.kind === 'IV')` block narrows correctly; in vue-tsc /
+ * template contexts the inline comparison is sometimes not enough, and the
+ * helper below makes the guard portable and avoids `as unknown as …` casts.
+ *
+ * **Usage with Collection<T>**
+ *
+ * ```ts
+ * import { isDiscriminant } from '@noy-db/hub'
+ *
+ * type IV = { kind: 'IV'; invoiceNo: string; amount: number }
+ * type RE = { kind: 'RE'; receiptNo: string; paidAt: string }
+ * type Receipt = IV | RE | ...
+ *
+ * const receipts = await vault.collection<Receipt>('receipts').query().toArray()
+ *
+ * // Filter approach — result is IV[], invoiceNo accessible without cast:
+ * const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
+ * console.log(ivs[0].invoiceNo)
+ *
+ * // Branch approach:
+ * for (const r of receipts) {
+ *   if (isDiscriminant(r, 'kind', 'IV')) {
+ *     console.log(r.invoiceNo)  // r: IV here
+ *   }
+ * }
+ * ```
+ *
+ * @module
+ */
+/**
+ * Type-guard for narrowing a discriminated-union record by its discriminant.
+ *
+ * Returns `true` when `record[key] === value`, and narrows `record` to
+ * `Extract<T, Record<K, V>>` — the exact union member(s) that carry that
+ * discriminant value.
+ *
+ * The discriminant key is a parameter (not hardcoded to `'kind'`), so this
+ * works with any field name: `'kind'`, `'type'`, `'tag'`, etc.
+ *
+ * @example
+ *   const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
+ *   // ivs: IV[]  — invoiceNo accessible, no cast needed
+ *
+ * @typeParam T - The union type of the record (e.g. `Receipt`). Both type-alias
+ *   unions and interface-extended unions work; use a `type` alias (`type Receipt = IV | RE`) for best
+ *   results.
+ * @typeParam K - The discriminant key (must be a key of `T`).
+ * @typeParam V - The discriminant value to match. The `const` modifier ensures
+ *   TypeScript infers the string literal (e.g. `'IV'`), not the full union
+ *   `T[K]`, so the predicate resolves to the exact member type.
+ */
+declare function isDiscriminant<T, K extends keyof T, const V extends T[K]>(record: T, key: K, value: V): record is Extract<T, Record<K, V>>;
+
+export { isDiscriminant as i };

package/dist/enclave-NHORSWSF.js

@@ -0,0 +1,125 @@
+import {
+  RecordCodec,
+  SEALED_CEK_NS,
+  envelopeBodyForHash,
+  findByDet,
+  hasPerRecordKey,
+  makeReservedEnvelopes,
+  openEnvelopeJson,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  writeEnvelopeBody
+} from "./chunk-MCHVVJIA.js";
+import {
+  buildDeleteMarker,
+  buildTombstone,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape
+} from "./chunk-QA2KUPCP.js";
+import {
+  ctEqualTags,
+  deriveVdigSlotKey,
+  evaluateKofN
+} from "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import {
+  computeBidxTarget,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag
+} from "./chunk-HYR4WZZ3.js";
+import {
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveDeterministicKey,
+  deriveKey,
+  derivePassphraseKey,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  generateDEK,
+  generateIV,
+  generateSalt,
+  hmacSha256Hex,
+  importCek,
+  sha256Hex,
+  unwrapCek,
+  unwrapKey,
+  wrapCek,
+  wrapKey
+} from "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  RecordCodec,
+  SEALED_CEK_NS,
+  base64ToBuffer,
+  bufferToBase64,
+  buildDeleteMarker,
+  buildTombstone,
+  computeBidxTarget,
+  ctEqualTags,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  deriveDeterministicKey,
+  deriveKey,
+  derivePassphraseKey,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  deriveVdigSlotKey,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  envelopeBodyForHash,
+  evaluateKofN,
+  findByDet,
+  generateDEK,
+  generateIV,
+  generateSalt,
+  hasPerRecordKey,
+  hmacSha256Hex,
+  importCek,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeReservedEnvelopes,
+  mintBidxTag,
+  openEnvelopeJson,
+  pbkdf2VerifyDigest,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  sha256Hex,
+  unwrapCek,
+  unwrapKey,
+  wrapCek,
+  wrapKey,
+  writeEnvelopeBody
+};
+//# sourceMappingURL=enclave-NHORSWSF.js.map

package/dist/executor-FE6X4LFX.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-LEJIKBBB.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-FE6X4LFX.js.map

package/dist/executor-KSHKRJXP.js

@@ -0,0 +1,25 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-LL2NIVUR.js";
+import "./chunk-WZSCE6RM.js";
+import "./chunk-3QSIU3UT.js";
+import "./chunk-NUEQU36L.js";
+import "./chunk-UF362QVH.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-DFVUTGT2.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-EOXAAJTY.js";
+import "./chunk-VEAVKDDB.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-KSHKRJXP.js.map

package/dist/executor-ZHTJJICG.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-VWRRVE6D.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-ZHTJJICG.js.map

package/dist/export-accessible-DACHM5VT.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-OT76OZL6.js";
+import "./chunk-QSFOZUYL.js";
+import "./chunk-OXCSVM3B.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-DACHM5VT.js.map

package/dist/extract-partition-RNENZZ4T.js

@@ -0,0 +1,36 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-YMVQD5Q5.js";
+import "./chunk-T7WSLRAU.js";
+import "./chunk-XH7XP3OL.js";
+import "./chunk-QSFOZUYL.js";
+import "./chunk-OXCSVM3B.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-UF362QVH.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-RNENZZ4T.js.map