@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/classified-marker-IO5EBW7Q.js

@@ -1,24 +0,0 @@
-import "./chunk-PZ5AY32C.js";
-
-// src/shape/via-classified/config-drift.ts
-function markerForFields(vdigFields) {
-  if (vdigFields === null || vdigFields.size === 0) return null;
-  const digestOnly = [...vdigFields.keys()];
-  return { digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true) };
-}
-async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
-  const marker = markerForFields(vdigFields);
-  if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-OVJKW7BS.js");
-  await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
-}
-async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-Y44CAPE6.js");
-  const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
-  return persisted?.classified?.digestOnly ?? [];
-}
-export {
-  persistClassifiedMarkerForFields,
-  readClassifiedMarkerDigestOnly
-};
-//# sourceMappingURL=classified-marker-IO5EBW7Q.js.map

package/dist/classified-marker-IO5EBW7Q.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shape/via-classified/config-drift.ts"],"sourcesContent":["/**\n * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of\n * the kernel `Collection` so the always-on kernel surface stays lean. The\n * kernel holds only the per-handle memoization; these helpers do the actual\n * persisted-schema read/write (via the persisted-schemas storage seam, lazily\n * imported so the classified spine tree-shakes).\n *\n * Marker semantics: a collection declaring classified digest-only fields writes\n * an `x-classified` marker into its `_schemas/<collection>` record on the first\n * classified write. A handle later opened WITHOUT `classifiedFields` (a naive\n * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's\n * R10 guard.\n *\n * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`\n * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives\n * under `shape/via-classified/`, which the `via-enclave-isolation`\n * architecture guard (#629) forbids from importing `kernel/enclave/` at\n * all, even type-only.\n *\n * @module\n */\nimport type { NoydbStore, VdigFieldPolicy, ClassifiedMarker } from '../../kernel/types.js'\n\n/** Build the marker for a handle's digest-only field map, or null when it declares none. */\nfunction markerForFields(vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null): ClassifiedMarker | null {\n  if (vdigFields === null || vdigFields.size === 0) return null\n  const digestOnly = [...vdigFields.keys()]\n  return { digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true) }\n}\n\n/**\n * Persist the classified marker for a handle's digest-only fields. No-op when\n * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).\n */\nexport async function persistClassifiedMarkerForFields(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null,\n  dek: CryptoKey,\n): Promise<void> {\n  const marker = markerForFields(vdigFields)\n  if (marker === null) return\n  const { persistClassifiedMarker } = await import('../../with-shape/persisted-schemas/register.js')\n  await persistClassifiedMarker({ store, vault, collectionName, dek, marker })\n}\n\n/**\n * Read a collection's persisted classified marker's declared digest-only field\n * set (empty when the collection carries no marker). Cross-session drift signal:\n * the R10 superset guard refuses a handle whose declared classified set does not\n * cover every field in this set.\n */\nexport async function readClassifiedMarkerDigestOnly(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  dek: CryptoKey,\n): Promise<readonly string[]> {\n  const { loadPersistedSchema } = await import('../../with-shape/persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vault, collectionName, dek)\n  return persisted?.classified?.digestOnly ?? []\n}\n"],"mappings":";;;AAwBA,SAAS,gBAAgB,YAAkF;AACzG,MAAI,eAAe,QAAQ,WAAW,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,CAAC,GAAG,WAAW,KAAK,CAAC;AACxC,SAAO,EAAE,YAAY,WAAW,WAAW,OAAO,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,cAAc,IAAI,EAAE;AAClG;AAMA,eAAsB,iCACpB,OACA,OACA,gBACA,YACA,KACe;AACf,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,KAAM;AACrB,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAgD;AACjG,QAAM,wBAAwB,EAAE,OAAO,OAAO,gBAAgB,KAAK,OAAO,CAAC;AAC7E;AAQA,eAAsB,+BACpB,OACA,OACA,gBACA,KAC4B;AAC5B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAA+C;AAC5F,QAAM,YAAY,MAAM,oBAAoB,OAAO,OAAO,gBAAgB,GAAG;AAC7E,SAAO,WAAW,YAAY,cAAc,CAAC;AAC/C;","names":[]}

package/dist/collection-facade-3RAXG2OU.js

@@ -1,38 +0,0 @@
-import {
-  buildPersistedIndexCallbacks,
-  buildRetrievalDocs,
-  embedOnWrite,
-  flushIndex,
-  hasIndexedBlobFields,
-  retrieve,
-  search,
-  similarTo,
-  warmIndex
-} from "./chunk-FGOGS7CE.js";
-import "./chunk-AURFOK3D.js";
-import "./chunk-IIP5WFVT.js";
-import "./chunk-MSVY7ULZ.js";
-import "./chunk-XHD3L3JO.js";
-import "./chunk-Z5YFRMG5.js";
-import "./chunk-XQ7UYPVN.js";
-import "./chunk-6MWUANRF.js";
-import "./chunk-2KOSJTMU.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-AUR7MRHA.js";
-import "./chunk-UNJU345Q.js";
-import "./chunk-3C5CKXFI.js";
-import "./chunk-6G2SCQYS.js";
-import "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  buildPersistedIndexCallbacks,
-  buildRetrievalDocs,
-  embedOnWrite,
-  flushIndex,
-  hasIndexedBlobFields,
-  retrieve,
-  search,
-  similarTo,
-  warmIndex
-};
-//# sourceMappingURL=collection-facade-3RAXG2OU.js.map

package/dist/computed-R62HGCO4.js

@@ -1,11 +0,0 @@
-import {
-  ComputedFieldError,
-  evalComputedFields
-} from "./chunk-KWLD2D75.js";
-import "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  ComputedFieldError,
-  evalComputedFields
-};
-//# sourceMappingURL=computed-R62HGCO4.js.map

package/dist/consent/index.d.ts

@@ -1,22 +0,0 @@
-import { aM as ConsentStrategy } from '../index-DzhNI2vE.js';
-export { aN as CONSENT_AUDIT_COLLECTION, aO as ConsentAuditEntry, aP as ConsentAuditFilter, aQ as ConsentContext, aR as ConsentOp, aS as loadConsentEntries, aT as writeConsentEntry } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active consent strategy. Calling `withConsent()` returns a
- * `ConsentStrategy` that delegates to the real
- * `writeConsentEntry` / `loadConsentEntries` functions. Only
- * reachable through the `@noy-db/hub/consent` subpath.
- */
-
-/**
- * Build the default consent strategy. Pass into
- * `createNoydb({ consentStrategy: withConsent() })` to enable
- * per-operation audit writes into the reserved `_consent_audit`
- * collection.
- */
-declare function withConsent(): ConsentStrategy;
-
-export { ConsentStrategy, withConsent };

package/dist/crdt/index.d.ts

@@ -1,33 +0,0 @@
-import { aC as CrdtStrategy } from '../index-DzhNI2vE.js';
-export { aD as CrdtMode, aE as CrdtState, aF as LwwMapState, aG as RgaState, aH as YjsState, aI as buildLwwMapState, aJ as buildRgaState, aK as mergeCrdtStates, aL as resolveCrdtSnapshot } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active CRDT strategy factory. Calling `withCrdt()` returns a
- * `CrdtStrategy` whose methods delegate to the real LWW-Map / RGA /
- * merge / snapshot helpers in `./crdt.ts`. Only reachable through
- * the `@noy-db/hub/crdt` subpath.
- */
-
-/**
- * Build the default CRDT strategy. Pass into
- * `createNoydb({ crdtStrategy: withCrdt() })` to enable collections
- * declared with `crdt: 'lww-map' | 'rga' | 'yjs'`.
- *
- * @example
- * ```ts
- * import { createNoydb } from '@noy-db/hub'
- * import { withCrdt } from '@noy-db/hub/crdt'
- *
- * const db = await createNoydb({
- *   store, user, secret,
- *   crdtStrategy: withCrdt(),
- * })
- * const notes = vault.collection('notes', { crdt: 'lww-map' })
- * ```
- */
-declare function withCrdt(): CrdtStrategy;
-
-export { CrdtStrategy, withCrdt };

package/dist/dead-filter-VNA4M3GP.js

@@ -1,28 +0,0 @@
-import {
-  liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
-import "./chunk-PZ5AY32C.js";
-
-// src/with-shape/satellites/dead-filter.ts
-async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-Y44CAPE6.js");
-  const out = /* @__PURE__ */ new Map();
-  for (const name of collectionNames) {
-    if (name.startsWith("_")) continue;
-    let dek;
-    try {
-      dek = await getDEK(name);
-    } catch {
-      continue;
-    }
-    const persisted = await loadPersistedSchema(store, vaultName, name, dek);
-    const marker = persisted?.satellite;
-    if (!marker) continue;
-    out.set(name, await liveBaseIdSet(store, vaultName, marker.base));
-  }
-  return out;
-}
-export {
-  liveBaseIdSetsForBundle
-};
-//# sourceMappingURL=dead-filter-VNA4M3GP.js.map

package/dist/decrypt-partition-IHtxEnTi.d.ts

@@ -1,21 +0,0 @@
-/** One decrypted record from an extracted-partition compartment. */
-interface DecryptedRecord {
-    readonly id: string;
-    readonly record: Record<string, unknown>;
-    /** Source envelope write timestamp (ISO) — for last-write-wins merges. */
-    readonly ts: string;
-    /** Source envelope version. */
-    readonly version: number;
-    /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */
-    readonly source?: string;
-    /** ISO-8601 timestamp the provenance source was recorded (FR-5). */
-    readonly sourceTs?: string;
-}
-/**
- * Decrypt every record of an extracted-partition bundle to plaintext,
- * grouped by collection. Throws if the bundle isn't an
- * extracted-partition or the transfer key is wrong.
- */
-declare function decryptExtractedPartition(bundleBytes: Uint8Array, transferKey: Uint8Array): Promise<Record<string, DecryptedRecord[]>>;
-
-export { type DecryptedRecord as D, decryptExtractedPartition as d };

package/dist/delegation-ZKII5UBI.js

@@ -1,25 +0,0 @@
-import {
-  DELEGATIONS_COLLECTION,
-  issueDelegation,
-  loadActiveDelegations,
-  revokeDelegation
-} from "./chunk-A4MAD6PO.js";
-import "./chunk-MK2BSS44.js";
-import "./chunk-ZJADGNYF.js";
-import "./chunk-XHD3L3JO.js";
-import "./chunk-Z5YFRMG5.js";
-import "./chunk-XQ7UYPVN.js";
-import "./chunk-6MWUANRF.js";
-import "./chunk-2KOSJTMU.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-AUR7MRHA.js";
-import "./chunk-UNJU345Q.js";
-import "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  DELEGATIONS_COLLECTION,
-  issueDelegation,
-  loadActiveDelegations,
-  revokeDelegation
-};
-//# sourceMappingURL=delegation-ZKII5UBI.js.map

package/dist/derivations/index.d.ts

@@ -1,69 +0,0 @@
-export { w as withDerivation, a as withRollup } from '../with-rollup-ClCHO6-4.js';
-import { bx as DerivationStrategy, by as DerivationContext } from '../index-DzhNI2vE.js';
-export { bz as ArrayOutputSpec, bA as DerivationCapExceededError, bB as DerivationCycleError, bC as DerivationDepthError, bD as DerivationOutputShapeError, bE as DerivationOutputUnknownError, bF as DerivationRegistry, bG as DerivationStrategyHandle, bH as DerivedFromMeta, bI as OutputSpec, bJ as RecordOutputSpec } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-interface RunResult {
-    outputs: Record<string, OutputResult>;
-    failed: boolean;
-}
-/**
- * Per-output result of a strategy invocation. Discriminated by
- * `kind`:
- *
- * - `record` — the existing v1 shape: one value (or a "skipped"
- *   marker if the output was optional and `derive` returned null).
- * - `array` — a list of `(key, value)` entries.
- *   The caller diffs these against the previously-emitted key set
- *   (loaded from the fanout sidecar) to compute deletes + upserts.
- */
-type OutputResult = RecordOutputResult | ArrayOutputResult | FailedOutputResult;
-interface RecordOutputResult {
-    kind: 'record';
-    value: Record<string, unknown>;
-    ok: true;
-    /**
-     * `true` when an optional output returned `null` /
-     * `undefined`. The caller deletes any previously-emitted output at
-     * the same id (mirrors "tombstone for derived data"); a never-emitted
-     * output is a silent no-op. `ok: true` because skipping is a
-     * successful outcome, not a failure.
-     */
-    skipped?: boolean;
-}
-interface ArrayOutputResult {
-    kind: 'array';
-    ok: true;
-    /** One `(key, value)` per derived row. Empty array means "all prior outputs for this source go." */
-    entries: ReadonlyArray<{
-        readonly key: string;
-        readonly value: Record<string, unknown>;
-    }>;
-}
-interface FailedOutputResult {
-    kind: 'failed';
-    ok: false;
-    error: Error;
-    /** Always empty on failure; present so consumers don't have to narrow. */
-    value: Record<string, unknown>;
-}
-/**
- * Stateless functions that execute a derivation strategy. Persistence
- * (encrypt + store.put) is the caller's job — typically
- * `DerivationRegistry.onSourceWrite` which iterates run() results and
- * writes each output via `Collection.put`.
- */
-declare const DerivationExecutor: {
-    /**
-     * Run `derive` once, validate output shape against the spec, stamp
-     * `_derivedFrom` onto every output. Returns per-output success or
-     * failure; throws only for shape mismatches (a contract violation).
-     */
-    run<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(strategy: DerivationStrategy<TSource, TOutputs>, source: TSource & {
-        id: string;
-    }, sourceVersion: number, strategyHash: string, ctx: DerivationContext): Promise<RunResult>;
-};
-
-export { DerivationExecutor, DerivationStrategy };

package/dist/derive-5D2C3WG4.js

@@ -1,21 +0,0 @@
-import {
-  derivePersistedSchema,
-  isZod4Schema,
-  isZodSchema
-} from "./chunk-HBTT7YQX.js";
-import "./chunk-XHD3L3JO.js";
-import "./chunk-Z5YFRMG5.js";
-import "./chunk-XQ7UYPVN.js";
-import "./chunk-6MWUANRF.js";
-import "./chunk-2KOSJTMU.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-AUR7MRHA.js";
-import "./chunk-UNJU345Q.js";
-import "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  derivePersistedSchema,
-  isZod4Schema,
-  isZodSchema
-};
-//# sourceMappingURL=derive-5D2C3WG4.js.map

package/dist/describe/index.d.ts

@@ -1,4 +0,0 @@
-export { et as CollectionDescription, f5 as CollectionMeta, fB as DescribeOptions, fC as DescribedField, g3 as FieldMeta, iX as SemanticType } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';

package/dist/describe/index.js

@@ -1 +0,0 @@
-//# sourceMappingURL=index.js.map

package/dist/dev-unlock-DDTafVO6.d.ts

@@ -1,263 +0,0 @@
-import { cY as Role, c8 as UnlockedKeyring } from './index-DzhNI2vE.js';
-
-/**
- * Session tokens —
- *
- * After a vault is unlocked (via passphrase, WebAuthn, OIDC, or magic-
- * link), the caller can call `createSession()` to get a session token that
- * allows re-establishing the KEK for the session lifetime without re-running
- * PBKDF2 or any interactive auth challenge.
- *
- * Security model
- * ──────────────
- * A session consists of two pieces that must both be present to recover the
- * KEK:
- *
- *   1. The **session key** — a non-extractable AES-256-GCM CryptoKey that
- *      exists only in memory. "Non-extractable" is enforced by the WebCrypto
- *      API: the key object cannot be serialized, exported, or sent over
- *      postMessage. When the JS context is GC'd (tab close, navigation away,
- *      worker termination) the key becomes unrecoverable.
- *
- *   2. The **session token** — a JSON object that carries the KEK wrapped
- *      with the session key (AES-256-GCM, fresh IV per session), plus
- *      unencrypted session metadata (sessionId, userId, vault, role,
- *      expiresAt). The token can be serialized to JSON and stored in
- *      sessionStorage or passed across callsites within the same tab, but
- *      it is useless without the session key.
- *
- * The session key is kept in a module-level Map indexed by sessionId. Callers
- * that need to re-use a session must hold on to the sessionId returned from
- * `createSession()`; the key is looked up automatically by `resolveSession()`.
- *
- * Revocation: `revokeSession()` removes the entry from the Map. Because the
- * key is non-extractable, removal is sufficient — no one holds a serializable
- * copy of the key.
- *
- * Tab-scoped lifetime: the module-level Map lives only as long as the JS
- * module. Tab close → module unloaded → Map GC'd → all session keys gone.
- * This is the zero-effort logout: closing the tab is always a secure logout.
- *
- * Expiry: `createSession()` accepts a `ttlMs` option. `resolveSession()`
- * checks `expiresAt` and throws `SessionExpiredError` if the token is stale,
- * even if the session key is still in the Map.
- */
-
-/** The serializable part of a session token. Safe to store in sessionStorage. */
-interface SessionToken {
-    readonly _noydb_session: 1;
-    /** Unique session identifier (ULID). Use this as the handle for resolve/revoke. */
-    readonly sessionId: string;
-    readonly userId: string;
-    readonly vault: string;
-    readonly role: Role;
-    /** ISO timestamp — resolveSession() rejects this token after this time. */
-    readonly expiresAt: string;
-    /** KEK wrapped with the session key (AES-256-GCM). Base64. */
-    readonly wrappedKek: string;
-    /** IV used for the wrapping operation. Base64. */
-    readonly kekIv: string;
-}
-/** Result returned from `createSession()`. */
-interface CreateSessionResult {
-    /** Serializable token — store in sessionStorage or pass to `resolveSession()`. */
-    token: SessionToken;
-    /** The sessionId — use this handle for `resolveSession()` and `revokeSession()`. */
-    sessionId: string;
-}
-/** Options for `createSession()`. */
-interface CreateSessionOptions {
-    /**
-     * Session lifetime in milliseconds. Defaults to 60 minutes.
-     * After this duration, `resolveSession()` throws `SessionExpiredError`.
-     */
-    ttlMs?: number;
-}
-/**
- * Create a session for an already-unlocked keyring.
- *
- * Call this after any successful unlock (passphrase, WebAuthn, OIDC,
- * magic-link). The returned `sessionId` is the handle for later
- * `resolveSession()` and `revokeSession()` calls.
- *
- * The session key is generated fresh (non-extractable) and stored in the
- * module-level Map. The KEK from `keyring.kek` is exported (it must be
- * extractable — it was derived by `deriveKey()` which sets extractable: false,
- * but it's unwrapped from the keyring which sets extractable: true) and then
- * re-wrapped with the session key.
- *
- * @param keyring - An already-unlocked keyring whose `kek` is available.
- * @param vault - The vault name this session is scoped to.
- * @param options - Optional session configuration.
- */
-declare function createSession(keyring: UnlockedKeyring, vault: string, options?: CreateSessionOptions): Promise<CreateSessionResult>;
-/**
- * Resolve a session token back into an UnlockedKeyring.
- *
- * Looks up the session key by `sessionId`, checks the token is not expired,
- * then decrypts the payload to reconstruct the keyring's DEK set.
- *
- * Throws `SessionExpiredError` if the token's `expiresAt` is in the past.
- * Throws `SessionNotFoundError` if the session key is not in the store
- * (tab was reloaded, session was revoked, or the sessionId is wrong).
- *
- * @param token - The SessionToken from `createSession()`.
- */
-declare function resolveSession(token: SessionToken): Promise<UnlockedKeyring>;
-/**
- * Revoke a session by removing its key from the store.
- *
- * After revocation, `resolveSession()` will throw `SessionNotFoundError`
- * for this sessionId. The session token (if held by the caller) becomes
- * permanently useless. This is the explicit logout path.
- *
- * No-op if the session was already expired or does not exist.
- */
-declare function revokeSession(sessionId: string): void;
-/**
- * Check if a session is still alive (key in store + not expired).
- * Does not decrypt anything — purely a metadata check.
- */
-declare function isSessionAlive(token: SessionToken): boolean;
-/**
- * Revoke all active sessions. Used by `Noydb.close()` to ensure that
- * closing the instance destroys all session state, not just the keyring
- * cache.
- */
-declare function revokeAllSessions(): void;
-/**
- * Return the number of active sessions currently in the store.
- * Useful for diagnostics and tests.
- */
-declare function activeSessionCount(): number;
-
-/**
- * Dev-mode persistent unlock —
- *
- * Solves the developer inner-loop friction: hot-reload destroys the session
- * (page navigation semantics), forcing a passphrase re-entry every refresh.
- *
- * This module provides an opt-in, deliberately-named escape hatch that lets
- * developers store the keyring payload in sessionStorage or localStorage so
- * the vault auto-unlocks on every page load — without a passphrase,
- * without a biometric prompt, without any OIDC flow.
- *
- * ⚠️ WARNING — this is a loaded footgun ⚠️
- * ─────────────────────────────────────────
- * The keyring payload stored by this module contains the DEKs. Whoever has
- * access to sessionStorage/localStorage has access to the DEKs. On a shared
- * development machine, a compromised browser extension, or a mis-configured
- * origin, this is a complete key exposure.
- *
- * This module is ONLY safe for local development. It must NEVER be active
- * in production builds.
- *
- * Guardrails (all enforced by the module, not by the caller)
- * ──────────────────────────────────────────────────────────
- * 1. **Production guard:** `enableDevUnlock()` throws immediately if
- *    `process.env.NODE_ENV === 'production'` or if `import.meta.env?.PROD === true`
- *    (Vite convention). Also throws if the hostname is NOT localhost or 127.0.0.1.
- *
- * 2. **Explicit acknowledgement string:** the caller must pass
- *    `acknowledge: 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'` or the call
- *    throws. This string appears in every grep for `devUnlock` in the codebase,
- *    making it impossible to enable this feature accidentally.
- *
- * 3. **Scope is vault + userId:** the storage key includes both the
- *    vault name and the userId, so dev-unlock for vault-A does
- *    NOT auto-unlock vault-B.
- *
- * 4. **Storage scope:** default is `sessionStorage` (cleared on tab close).
- *    `localStorage` is opt-in and requires an additional
- *    `persistAcrossTabs: true` flag in the options.
- *
- * 5. **Clear method:** `clearDevUnlock()` removes the stored payload. Wire
- *    this to a dev toolbar button or `Ctrl+Shift+L` so clearing is one action.
- *
- * 6. **Console banner:** on first enable, a highly visible console warning
- *    fires. Cannot be suppressed.
- *
- * Usage
- * ─────
- * ```ts
- * // In your dev entry point only (guarded by import.meta.env.DEV):
- * if (import.meta.env.DEV) {
- *   const { enableDevUnlock, loadDevUnlock } = await import('@noy-db/hub')
- *   enableDevUnlock('my-compartment', 'alice', keyring, {
- *     acknowledge: 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY',
- *   })
- * }
- *
- * // On page load:
- * if (import.meta.env.DEV) {
- *   const keyring = await loadDevUnlock('my-compartment', 'alice')
- *   if (keyring) {
- *     // Skip unlock prompt, use keyring directly
- *   }
- * }
- * ```
- */
-
-interface DevUnlockOptions {
-    /**
-     * Required: the exact string 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'.
-     * Any other value causes `enableDevUnlock()` to throw.
-     */
-    acknowledge: string;
-    /**
-     * If `true`, stores in localStorage (persists across tabs and browser restarts).
-     * If `false` (default), stores in sessionStorage (cleared on tab close).
-     */
-    persistAcrossTabs?: boolean;
-}
-/**
- * Serialize and store a keyring to browser storage for dev-mode auto-unlock.
- *
- * Throws immediately if:
- *   - The acknowledge string is wrong.
- *   - Running in a production environment (NODE_ENV=production).
- *   - Running on a non-localhost hostname.
- *
- * Emits a highly visible console warning that cannot be suppressed.
- *
- * @param vault - The vault name.
- * @param userId - The user ID.
- * @param keyring - The unlocked keyring to persist.
- * @param options - Options including the required acknowledge string.
- */
-declare function enableDevUnlock(vault: string, userId: string, keyring: UnlockedKeyring, options: DevUnlockOptions): Promise<void>;
-/**
- * Load a dev-mode keyring from browser storage.
- *
- * Returns `null` if no dev-unlock state is stored for this vault + user,
- * or if the stored payload is malformed.
- *
- * Does NOT perform the production environment check — it's safe to CALL
- * `loadDevUnlock` in production (it will simply return `null` because no
- * dev-unlock state was ever written). The guard only fires on `enableDevUnlock`.
- *
- * @param vault - The vault name.
- * @param userId - The user ID.
- * @param options - Optional storage override.
- */
-declare function loadDevUnlock(vault: string, userId: string, options?: {
-    persistAcrossTabs?: boolean;
-}): Promise<UnlockedKeyring | null>;
-/**
- * Remove dev-unlock state from browser storage.
- *
- * Safe to call in production (no-op if no dev state exists).
- */
-declare function clearDevUnlock(vault: string, userId: string, options?: {
-    persistAcrossTabs?: boolean;
-}): void;
-/**
- * Check if dev-unlock state exists for this vault + user.
- *
- * Safe to call in production (returns false if nothing is stored).
- */
-declare function isDevUnlockActive(vault: string, userId: string, options?: {
-    persistAcrossTabs?: boolean;
-}): boolean;
-
-export { type CreateSessionOptions as C, type DevUnlockOptions as D, type SessionToken as S, type CreateSessionResult as a, activeSessionCount as b, clearDevUnlock as c, createSession as d, enableDevUnlock as e, isSessionAlive as f, revokeAllSessions as g, revokeSession as h, isDevUnlockActive as i, loadDevUnlock as l, resolveSession as r };

package/dist/discriminant-BN9REW3o.d.ts

@@ -1,60 +0,0 @@
-/**
- * Type-guard helper for narrowing discriminated-union records.
- *
- * `Collection<T>` correctly threads `T` through `get` / `query` / `scan`, but
- * accessing member-specific fields after reading from a `Collection<Union>`
- * still requires a narrowing step in application code. In regular `.ts` files
- * a simple `if (r.kind === 'IV')` block narrows correctly; in vue-tsc /
- * template contexts the inline comparison is sometimes not enough, and the
- * helper below makes the guard portable and avoids `as unknown as …` casts.
- *
- * **Usage with Collection<T>**
- *
- * ```ts
- * import { isDiscriminant } from '@noy-db/hub'
- *
- * type IV = { kind: 'IV'; invoiceNo: string; amount: number }
- * type RE = { kind: 'RE'; receiptNo: string; paidAt: string }
- * type Receipt = IV | RE | ...
- *
- * const receipts = await vault.collection<Receipt>('receipts').query().toArray()
- *
- * // Filter approach — result is IV[], invoiceNo accessible without cast:
- * const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
- * console.log(ivs[0].invoiceNo)
- *
- * // Branch approach:
- * for (const r of receipts) {
- *   if (isDiscriminant(r, 'kind', 'IV')) {
- *     console.log(r.invoiceNo)  // r: IV here
- *   }
- * }
- * ```
- *
- * @module
- */
-/**
- * Type-guard for narrowing a discriminated-union record by its discriminant.
- *
- * Returns `true` when `record[key] === value`, and narrows `record` to
- * `Extract<T, Record<K, V>>` — the exact union member(s) that carry that
- * discriminant value.
- *
- * The discriminant key is a parameter (not hardcoded to `'kind'`), so this
- * works with any field name: `'kind'`, `'type'`, `'tag'`, etc.
- *
- * @example
- *   const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
- *   // ivs: IV[]  — invoiceNo accessible, no cast needed
- *
- * @typeParam T - The union type of the record (e.g. `Receipt`). Both type-alias
- *   unions and interface-extended unions work; use a `type` alias (`type Receipt = IV | RE`) for best
- *   results.
- * @typeParam K - The discriminant key (must be a key of `T`).
- * @typeParam V - The discriminant value to match. The `const` modifier ensures
- *   TypeScript infers the string literal (e.g. `'IV'`), not the full union
- *   `T[K]`, so the predicate resolves to the exact member type.
- */
-declare function isDiscriminant<T, K extends keyof T, const V extends T[K]>(record: T, key: K, value: V): record is Extract<T, Record<K, V>>;
-
-export { isDiscriminant as i };