@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.5

package/dist/{enclave-YFKA3GJT.js → enclave-I5H3GINP.js}

@@ -22,26 +22,26 @@ import {
   sealRecordToHost,
   verifyBrokerProof,
   writeEnvelopeBody
-} from "./chunk-PEY6ZTCF.js";
+} from "./chunk-GEEJPID6.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-QXPOEAKR.js";
+} from "./chunk-SC4JLMZI.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
   evaluateKofN
-} from "./chunk-LLVW4V7R.js";
-import "./chunk-M25ZIEB2.js";
+} from "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
 import {
   computeBidxTarget,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag
-} from "./chunk-5BB3N4KU.js";
+} from "./chunk-G4MFQXYX.js";
 import {
   pbkdf2VerifyDigest
 } from "./chunk-LP7BEXCT.js";
@@ -54,10 +54,10 @@ import {
   decryptDeterministic,
   deriveDeterministicKey,
   deriveKey,
-  derivePassphraseKey,
   derivePresenceKey,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek,
+  deriveSecretKey,
   encrypt,
   encryptBytes,
   encryptBytesWithAAD,
@@ -72,9 +72,9 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "./chunk-5P5AAXYA.js";
-import "./chunk-5BHNQNBI.js";
-import "./chunk-IGM563N5.js";
+} from "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -97,10 +97,10 @@ export {
   deriveClassifyIndexSalt,
   deriveDeterministicKey,
   deriveKey,
-  derivePassphraseKey,
   derivePresenceKey,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek,
+  deriveSecretKey,
   deriveVdigSlotKey,
   encrypt,
   encryptBytes,
@@ -140,4 +140,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-YFKA3GJT.js.map
+//# sourceMappingURL=enclave-I5H3GINP.js.map

package/dist/executor-FCJEH3FU.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-YJ3TREAC.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-FCJEH3FU.js.map

package/dist/executor-OHET7TF7.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-EGU4PWQW.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-OHET7TF7.js.map

package/dist/executor-SHYLIBOM.js

@@ -0,0 +1,26 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-YZN6NRTR.js";
+import "./chunk-TNATF3HB.js";
+import "./chunk-7BIJS6II.js";
+import "./chunk-SBOHNJUD.js";
+import "./chunk-QMMOMBH6.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-K7BADAOS.js";
+import "./chunk-JN3SGXJE.js";
+import "./chunk-ZUDAK436.js";
+import "./chunk-RWW3I3PO.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-SHYLIBOM.js.map

package/dist/export-accessible-FBL6TDSK.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-OMSKGLYA.js";
+import "./chunk-YCAJDK4O.js";
+import "./chunk-YFFEF6HR.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-FBL6TDSK.js.map

package/dist/extract-partition-ZYIRYMTI.js

@@ -0,0 +1,38 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-GP54LU5N.js";
+import "./chunk-S4YERMGJ.js";
+import "./chunk-VEGQYPCP.js";
+import "./chunk-YCAJDK4O.js";
+import "./chunk-YFFEF6HR.js";
+import "./chunk-LC7DSMHR.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-PTT2NB46.js";
+import "./chunk-RWW3I3PO.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-ZYIRYMTI.js.map

package/dist/{fanout-sidecar-HJV3A7PM.js → fanout-sidecar-WWXVHHUH.js}

@@ -1,18 +1,18 @@
 import {
   openEnvelopeJson
-} from "./chunk-PEY6ZTCF.js";
-import "./chunk-QXPOEAKR.js";
-import "./chunk-LLVW4V7R.js";
-import "./chunk-M25ZIEB2.js";
-import "./chunk-5BB3N4KU.js";
+} from "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5BHNQNBI.js";
-import "./chunk-IGM563N5.js";
+} from "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
@@ -71,4 +71,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-HJV3A7PM.js.map
+//# sourceMappingURL=fanout-sidecar-WWXVHHUH.js.map

package/dist/find-LEBUXVL7.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-LEBUXVL7.js.map

package/dist/forget/index.js

@@ -1,16 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-OWE4BNTM.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-I2XEBEEF.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts

package/dist/guards/index.js

@@ -2,7 +2,7 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-5OZCCLNC.js";
+} from "../chunk-TSNRZSRC.js";
 import {
   GuardRegistry
 } from "../chunk-YMUGBZN2.js";
@@ -11,14 +11,14 @@ import {
 } from "../chunk-JK733I5V.js";
 import {
   GuardExecutor
-} from "../chunk-N4FZ6ITM.js";
+} from "../chunk-EGU4PWQW.js";
 import {
   AmendmentForbiddenError,
   FieldFrozenError,
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,

package/dist/history/index.js

@@ -8,7 +8,7 @@ import {
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-JA5O7UEZ.js";
+} from "../chunk-UVBHM7AK.js";
 import {
   diff,
   formatDiff
@@ -17,12 +17,12 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-ZJGZDOQO.js";
+} from "../chunk-5ATANZSW.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "../chunk-I7FD46FF.js";
-import "../chunk-NM4LVUXH.js";
+import "../chunk-PTT2NB46.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -30,16 +30,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-JLHKBAFY.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-RWW3I3PO.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/history/active.ts

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-2RMDVWGB.js";
+} from "../chunk-2CRZOVDI.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-25G7U6RD.js";
+} from "../chunk-WQN5SM7P.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-BZEPJJOK.js";
+} from "../chunk-K7BADAOS.js";
 import {
   applyI18nLocale,
   enforceScript,
@@ -25,17 +25,17 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-XGVDLQJE.js";
-import "../chunk-STR7WBOB.js";
-import "../chunk-JLHKBAFY.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-JN3SGXJE.js";
+import "../chunk-ZUDAK436.js";
+import "../chunk-RWW3I3PO.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -46,7 +46,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/i18n/densify.ts

package/dist/index.d.ts

@@ -6,12 +6,12 @@
  * A TypeScript library that encrypts every record with AES-256-GCM before it
  * reaches any storage backend. The store (file, DynamoDB, S3, IndexedDB, …)
  * only ever sees ciphertext — it has no way to read or tamper with your data
- * without the user's passphrase.
+ * without the user's secret.
  *
  * ## Architecture in one diagram
  *
  * ```
- * Passphrase
+ * Secret
  *   └─► PBKDF2-SHA256 (600K iterations) → KEK  [memory only]
  *         └─► AES-KW unwrap → DEK per collection  [memory only]
  *               └─► AES-256-GCM encrypt/decrypt
@@ -25,7 +25,7 @@
  * import { jsonFile } from '@noy-db/to-file'
  *
  * const db = await createNoydb({ store: jsonFile({ dir: './data' }) })
- * const acme = await db.openVault('acme', { passphrase: 'hunter2' })
+ * const acme = await db.openVault('acme', { secret: 'hunter2' })
  * const invoices = acme.collection<Invoice>('invoices')
  *
  * await invoices.put('inv-001', { amount: 1200, client: 'Acme Corp' })
@@ -90,6 +90,10 @@ export type { WrappedPodNoydbStore, WrapPodStoreOptions, WrappedBundleNoydbStore
 export { readPlaintextRecord } from './kernel/debug.js';
 export type { WriteQueue } from './kernel/write-queue.js';
 export type { WriteEvent, WriteHook } from './port/with/write-hooks.js';
+/** #841 — the option shape `vault.collection()` takes, so callers can name it. */
+export type { OpenCollectionOptions } from './port/with/collection-options.js';
+/** #839 — the named type-level shape `vault.collection()` accepts. */
+export type { CollectionShape, SensitiveOf, IndexedOf, MoneyOf } from './kernel/types.js';
 export type { SchemaIntrospection } from './with-shape/introspection/types.js';
 export type { FieldMeta, SemanticType } from './with-shape/introspection/field-meta.js';
 export type { CollectionMeta, VaultMeta } from './with-shape/introspection/meta.js';
@@ -162,8 +166,8 @@ export { enrollAuthenticator, removeAuthenticator, findAuthenticator, } from './
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './with-party/team/authenticators.js';
 export { QuickUnlockStore } from './with-party/session/unlock-state.js';
 export type { QuickUnlockState } from './with-party/session/unlock-state.js';
-export { rotatePassphrase as keyringRotatePassphrase, recoverPassphrase as keyringRecoverPassphrase, } from './with-party/team/rotate-recover.js';
-export type { RotatePassphraseInput, RecoverPassphraseInput, RecoverPassphraseResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './with-party/team/rotate-recover.js';
+export { rotateSecret as keyringRotateSecret, recoverSecret as keyringRecoverSecret, } from './with-party/team/rotate-recover.js';
+export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './with-party/team/rotate-recover.js';
 export { loadCover, saveCover, readCover, resolveSchema as resolveCoverSchema, validateCoverInput, isCover, COVER_FIELDS, DEFAULT_COVER_SCHEMA, COVER_RECORD_ID, } from './with-party/directory/cover/index.js';
 export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, SetCoverInput, } from './with-party/directory/cover/index.js';
 export { readPodCover } from './with-pod/bundle.js';
@@ -193,9 +197,9 @@ export type { PaperRecoveryEntry, PaperRecoveryDoc, ShamirRecoveryEntry, ShamirR
 export type { EnrollRecoveryResult, RotateRecoveryOptions, RotateRecoveryResult, } from './with-party/team/rotate-recover.js';
 export { mintWrappedDeksBlob, unwrapDeksFromBlob } from './with-party/team/wrapped-deks.js';
 export type { WrappedDeksBlob } from './with-party/team/wrapped-deks.js';
-export type { SealingKeyProvider, SealedPassphrase, SealedEnvelope, RecipientHint, RecipientSealer } from './with-party/team/managed-passphrase.js';
+export type { SealingKeyProvider, SealedSecret, SealedEnvelope, RecipientHint, RecipientSealer } from './with-party/team/managed-secret.js';
 export type { ShamirRecoveryProvider } from './with-party/team/shamir-recovery-provider.js';
-export { MemorySealingKeyProvider, MemoryRecipientSealer, sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen, loadSealedPassphrase, saveSealedPassphrase, parseSealedEnvelope, SEALED_PASSPHRASE_RECORD_ID, } from './with-party/team/managed-passphrase.js';
+export { MemorySealingKeyProvider, MemoryRecipientSealer, sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen, loadSealedSecret, saveSealedSecret, parseSealedEnvelope, SEALED_SECRET_RECORD_ID, } from './with-party/team/managed-secret.js';
 export { recoverUser } from './with-party/team/peer-recover.js';
 export type { RecoverUserOptions } from './with-party/team/peer-recover.js';
 export { hasExportCapability, evaluateExportCapability } from './with-party/team/keyring.js';
@@ -305,8 +309,8 @@ export { PolicyDeniedError, RecoveryNotEnrolledError, RecoveryProfileNotImplemen
 export type { VaultPolicy, GatePolicy, GateName, BuiltInGateName, FactorKind, FactorRequirement, FactorProof, FactorProofBundle, WarningRules, ActiveTier, } from './kernel/types.js';
 export type { PolicyDenyReason } from './kernel/errors.js';
 export type { CheckGateContext } from './with-party/policy/index.js';
-export { validatePassphrase, assertStrongPassphrase, estimateEntropy, WeakPassphraseError, } from './kernel/validation.js';
-export type { PassphrasePolicy, PassphraseValidationResult, WeakPassphraseReason, } from './kernel/validation.js';
+export { validateSecret, assertStrongSecret, estimateEntropy, WeakSecretError, } from './kernel/validation.js';
+export type { SecretPolicy, SecretValidationResult, WeakSecretReason, } from './kernel/validation.js';
 export { Query, executePlan, evaluateClause, evaluateFieldClause, readPath, CollectionIndexes, applyJoins, DEFAULT_JOIN_MAX_ROWS, DEFAULT_CROSS_JOIN_MAX_ROWS, resetJoinWarnings, buildLiveQuery, count, sum, avg, min, max, moneySum, moneyMin, moneyMax, reducerBuilder, Aggregation, reduceRecords, GroupedQuery, GroupedQueryN, GroupedAggregation, groupAndReduce, GROUPBY_WARN_CARDINALITY, GROUPBY_MAX_CARDINALITY, ScanBuilder, } from './kernel/query/index.js';
 export type { QueryPlan, QuerySource, OrderBy, Operator, Clause, FieldClause, FilterClause, GroupClause, IndexDef, HashIndex, JoinLeg, JoinContext, JoinableSource, JoinStrategy, LiveQuery, LiveUpstream, Reducer, ReducerOptions, ReducerBuilder, AggregateSpec, AggregateResult, AggregationUpstream, LiveAggregation, GroupedRow, GroupedRowN, ScanPageProvider, } from './kernel/query/index.js';
 export type { QueryField, IndexFieldName } from './kernel/types.js';