@noy-db/hub 0.10.0-pre.1 → 0.10.0-pre.2

package/dist/{chunk-ZMDSBTFT.js → chunk-ECDM6YRX.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-ZMDSBTFT.js.map
+//# sourceMappingURL=chunk-ECDM6YRX.js.map

package/dist/{chunk-WRLWEYHY.js → chunk-EFINFZIF.js}

@@ -4,6 +4,7 @@ import {
   SEALED_CEK_NS,
   applyRewrappedBody,
   base64ToBuffer,
+  blindedEqual,
   bufferToBase64,
   buildDeleteMarker,
   buildRecordAad,
@@ -72,6 +73,7 @@ import {
   isTombstoneShape,
   issueChallenge,
   makeReservedEnvelopes,
+  matchGroupFields,
   mintBidxTag,
   mintCanary,
   openEnvelopeJson,
@@ -84,6 +86,7 @@ import {
   rekeyEnvelopeIfNeeded,
   rekeyEnvelopeToDek,
   resolveStableCek,
+  revealSealedField,
   revokeSealedRecord,
   rewrapBodyToDek,
   rewrapEnvelope,
@@ -96,7 +99,9 @@ import {
   unwrapKey,
   verifyBrokerProof,
   verifyBytes,
+  verifyDigestField,
   verifyRecordIdentity,
+  verifyTextField,
   wrapCek,
   wrapKey,
   writeEnvelopeBody
@@ -107,6 +112,7 @@ export {
   SEALED_CEK_NS,
   applyRewrappedBody,
   base64ToBuffer,
+  blindedEqual,
   bufferToBase64,
   buildDeleteMarker,
   buildRecordAad,
@@ -175,6 +181,7 @@ export {
   isTombstoneShape,
   issueChallenge,
   makeReservedEnvelopes,
+  matchGroupFields,
   mintBidxTag,
   mintCanary,
   openEnvelopeJson,
@@ -187,6 +194,7 @@ export {
   rekeyEnvelopeIfNeeded,
   rekeyEnvelopeToDek,
   resolveStableCek,
+  revealSealedField,
   revokeSealedRecord,
   rewrapBodyToDek,
   rewrapEnvelope,
@@ -199,9 +207,11 @@ export {
   unwrapKey,
   verifyBrokerProof,
   verifyBytes,
+  verifyDigestField,
   verifyRecordIdentity,
+  verifyTextField,
   wrapCek,
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=chunk-WRLWEYHY.js.map
+//# sourceMappingURL=chunk-EFINFZIF.js.map

package/dist/chunk-EFINFZIF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/index.ts"],"sourcesContent":["/**\n * THE DOOR. This is the ONLY hub file that may import the bound capsule.\n * Everything else in hub imports THIS file.\n *\n * Enforced by `capsule-door-only` in `scripts/check-architecture.mjs`, which\n * fails any other file naming `#capsule`. A door nothing enforces is not a\n * door — the enclave barrel it replaces was reached around 38 times before a\n * check existed.\n *\n * `#capsule` resolves through hub's `imports` map: `capsule/enclave-aes/` by\n * default, or an alternative package when a consumer sets a build condition.\n *\n * ⛔ THE RE-EXPORTS BELOW ARE EXPLICIT, AND MUST STAY THAT WAY.\n * `export * from '#capsule'` is the obvious spelling and it does not build:\n * `#capsule` is EXTERNAL (it has to be, or the capsule choice bakes in at hub's\n * build time), and esbuild cannot enumerate an external module's exports. Every\n * named import through the door then fails with \"No matching export\". Measured\n * 2026-09-12.\n *\n * Generated from `__tests__/enclave-surface.golden.json` — the same artefact\n * the surface test freezes, so the door and the golden cannot drift. Adding a\n * capsule primitive means adding it to the golden and regenerating.\n */\nexport {\n  RecordCodec,\n  SEALED_CEK_NS,\n  applyRewrappedBody,\n  base64ToBuffer,\n  blindedEqual,\n  bufferToBase64,\n  buildDeleteMarker,\n  buildRecordAad,\n  buildRecordEnvelope,\n  buildSealedRecordEnvelope,\n  buildTombstone,\n  capabilities,\n  checkCanary,\n  computeBidxTarget,\n  computeBrokerProof,\n  ctEqualTags,\n  decrypt,\n  decryptBytes,\n  decryptBytesWithAAD,\n  decryptDeterministic,\n  deriveBlobAddressKey,\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  deriveClassifyIndexKey,\n  deriveClassifyIndexSalt,\n  deriveDeterministicKey,\n  deriveEchoKey,\n  deriveKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  deriveSecretKey,\n  deriveVdigSlotKey,\n  encodeEchoParts,\n  encrypt,\n  encryptBytes,\n  encryptBytesWithAAD,\n  encryptDeterministic,\n  envelopeBodyForHash,\n  envelopeBodySize,\n  envelopeOpensUnderAny,\n  evaluateKofN,\n  exportDekSet,\n  exportRecipientPublicKeySpki,\n  findByDet,\n  generateDEK,\n  generateEphemeralKey,\n  generateIV,\n  generateRecipientKeyPair,\n  exportRecipientPrivateKeyPkcs8,\n  importRecipientKeyPair,\n  generateRecoverySecret,\n  generateSalt,\n  generateSigningKeyPair,\n  hasPerRecordKey,\n  hasSealedBody,\n  requireSealedBody,\n  sealedBodyArgs,\n  hkdfAesGcmKey,\n  hmacSha256Hex,\n  hmacSignHex,\n  importCek,\n  importDekSet,\n  importRecipientPublicKeySpki,\n  importTransferKey,\n  importWrappingKey,\n  isDeleteMarker,\n  isRewrappedUnder,\n  isTombstone,\n  isTombstoneShape,\n  issueChallenge,\n  makeReservedEnvelopes,\n  matchGroupFields,\n  mintBidxTag,\n  mintCanary,\n  openEnvelopeJson,\n  pbkdf2VerifyDigest,\n  queryByDet,\n  recipientUnwrap,\n  recipientWrap,\n  recordAadFor,\n  rekeyBlobSet,\n  rekeyEnvelopeIfNeeded,\n  rekeyEnvelopeToDek,\n  resolveStableCek,\n  revealSealedField,\n  revokeSealedRecord,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  rotateRecordCek,\n  sealRecordToHost,\n  sha256Bytes,\n  sha256Hex,\n  signBytes,\n  unwrapCek,\n  unwrapKey,\n  verifyBrokerProof,\n  verifyBytes,\n  verifyDigestField,\n  verifyRecordIdentity,\n  verifyTextField,\n  wrapCek,\n  wrapKey,\n  writeEnvelopeBody,\n} from '#capsule'\n\nexport type {\n  BrokerMemberIdentity,\n  BrokerProofCanonicalParts,\n  DeterministicContext,\n  EchoSecretParts,\n  EnclaveKey,\n  EnclaveKeyPair,\n  EncryptResult,\n  IssuedChallenge,\n  RecordEnvelopeBody,\n  RecordIdentity,\n  RecordRef,\n  RewrappedBody,\n  SealedShredSlot,\n  SealingContext,\n  SecretKeyUsage,\n  VerifyBrokerProofArgs,\n} from '#capsule'\n\nexport type { CapsuleKey, CapsuleKeyPair, CapsuleGroup } from './contract.js'\nexport { CapsuleNotSupportedError } from './contract.js'\n"],"mappings":";AAuBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/{chunk-JM72WDAY.js → chunk-EM56MHN5.js}

@@ -1,18 +1,18 @@
 import {
   PERIODS_COLLECTION
-} from "./chunk-B24ODIKE.js";
+} from "./chunk-JRCO67NG.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-QHG7GQKM.js";
+} from "./chunk-5JNEDW7I.js";
 import {
   isDeleteMarker
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   PeriodChainError,
   PeriodClosedError,
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/periods/periods.ts
 function resolveReopenState(events) {
@@ -208,7 +208,7 @@ function validatePeriodName(name, existing, partition) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-FV6NFTOR.js");
+  const { envelopePayloadHash } = await import("./ledger-BMVUFQ3R.js");
   await ledger.append({
     op: "put",
     collection,
@@ -284,4 +284,4 @@ export {
   purgeMarkersOn,
   withPeriods
 };
-//# sourceMappingURL=chunk-JM72WDAY.js.map
+//# sourceMappingURL=chunk-EM56MHN5.js.map

package/dist/{chunk-YWJMM2WY.js → chunk-EQXOJH6O.js}

@@ -5,18 +5,18 @@ import {
 import {
   ViaGraph,
   matchTargetFieldNames
-} from "./chunk-KOJHCSGS.js";
+} from "./chunk-U7CMJY5P.js";
 import {
   schemaFieldKeys
 } from "./chunk-QJNAHPVT.js";
 import {
   sha256Hex
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   DerivationCycleError,
   DuplicateBehaviorNameError,
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-formula/derivations/strategy-hash.ts
 async function computeStrategyHash(source, outputKeys, derive, sources) {
@@ -246,4 +246,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-YWJMM2WY.js.map
+//# sourceMappingURL=chunk-EQXOJH6O.js.map

package/dist/{chunk-ME6LY5UG.js → chunk-ET3U2C3A.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-WQHEEYQA.js";
+} from "./chunk-NLDBQHDV.js";
 
 // src/kernel/query/relate/join-on.ts
 var RANGE_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "between"]);
@@ -201,4 +201,4 @@ export {
   joinOnDispatch,
   matchDeclaredJoin
 };
-//# sourceMappingURL=chunk-ME6LY5UG.js.map
+//# sourceMappingURL=chunk-ET3U2C3A.js.map

package/dist/{chunk-G2KLVCKO.js → chunk-EU4G7PQH.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-G2KLVCKO.js.map
+//# sourceMappingURL=chunk-EU4G7PQH.js.map

package/dist/{chunk-WJXLTO43.js → chunk-EUCUYK5E.js}

@@ -1,23 +1,23 @@
 import {
   walkClosure
-} from "./chunk-DO33YCSZ.js";
+} from "./chunk-RL6RNDJQ.js";
 import {
   resolveManagedSecret
-} from "./chunk-GU6QXHPZ.js";
+} from "./chunk-OIBFIWVJ.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-BCJAUHSG.js";
+} from "./chunk-2NVQ5SEA.js";
 import {
   createOwnerKeyring,
   mintRosterTag,
   requireRosterKey,
   stampAuthority
-} from "./chunk-WVML7HUZ.js";
+} from "./chunk-UXH4AKH3.js";
 import {
   LedgerStore
-} from "./chunk-RKOXA5GZ.js";
+} from "./chunk-BEKMLYQ4.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
@@ -30,18 +30,18 @@ import {
   importTransferKey,
   openEnvelopeJson,
   wrapKey
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-cargo/active.ts
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-DQ3FVL6H.js");
+      const { extractPartitionCore } = await import("./extract-partition-43CLDRN4.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -243,7 +243,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-V23UJKHT.js");
+    const { createNoydb } = await import("./noydb-AYDNOXAX.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -298,4 +298,4 @@ export {
   withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-WJXLTO43.js.map
+//# sourceMappingURL=chunk-EUCUYK5E.js.map

package/dist/{chunk-EPMX3SCC.js → chunk-EWSIJDWO.js}

@@ -3,14 +3,14 @@ import {
   normalizeMatches,
   normalizeSubqueryOperand,
   readPath
-} from "./chunk-WQHEEYQA.js";
+} from "./chunk-NLDBQHDV.js";
 import {
   isViaPrefixProbe
-} from "./chunk-ZZLIFVZG.js";
+} from "./chunk-ZG7DBIVX.js";
 import {
   FieldNotQueryableError,
   IndexRequiredError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-lookup/indexing/strategy.ts
 var NO_INDEXING = {
@@ -608,4 +608,4 @@ export {
   PersistedCollectionIndex,
   LazyQuery
 };
-//# sourceMappingURL=chunk-EPMX3SCC.js.map
+//# sourceMappingURL=chunk-EWSIJDWO.js.map

package/dist/{chunk-KFYUQMF5.js → chunk-F2FD4LSB.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -49,4 +49,4 @@ export {
   dekKey,
   parseDekKey
 };
-//# sourceMappingURL=chunk-KFYUQMF5.js.map
+//# sourceMappingURL=chunk-F2FD4LSB.js.map

package/dist/{chunk-L4UL4IAR.js → chunk-F7ENMZYJ.js}

@@ -1,6 +1,6 @@
 import {
   historyIdentity
-} from "./chunk-EQ6C2ZPT.js";
+} from "./chunk-E7Y4J4GL.js";
 
 // src/with-commit/history/strategy.ts
 function notEnabled(op) {
@@ -52,4 +52,4 @@ var NO_HISTORY = {
 export {
   NO_HISTORY
 };
-//# sourceMappingURL=chunk-L4UL4IAR.js.map
+//# sourceMappingURL=chunk-F7ENMZYJ.js.map

package/dist/{chunk-5OG7YQX5.js → chunk-FIIVYQOW.js}

@@ -1,16 +1,16 @@
 import {
   getHistory,
   historyIdentity
-} from "./chunk-EQ6C2ZPT.js";
+} from "./chunk-E7Y4J4GL.js";
 import {
   liveRecordIsElevated
-} from "./chunk-KFYUQMF5.js";
+} from "./chunk-F2FD4LSB.js";
 import {
   openEnvelopeJson
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-commit/history/time-machine.ts
 var VaultInstant = class {
@@ -208,4 +208,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-5OG7YQX5.js.map
+//# sourceMappingURL=chunk-FIIVYQOW.js.map

package/dist/{chunk-4RF7DVH2.js → chunk-FPK2LPLR.js}

@@ -1,13 +1,13 @@
 import {
   matchDeclaredJoin
-} from "./chunk-ME6LY5UG.js";
+} from "./chunk-ET3U2C3A.js";
 import {
   readPath
-} from "./chunk-WQHEEYQA.js";
+} from "./chunk-NLDBQHDV.js";
 import {
   DanglingReferenceError,
   JoinTooLargeError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/query/relate/join.ts
 var DEFAULT_JOIN_MAX_ROWS = 5e4;
@@ -43,12 +43,12 @@ function coerceRefKey(value) {
   return null;
 }
 var warnedDanglingKeys = /* @__PURE__ */ new Set();
-function warnOnceDangling(field, target, refId) {
-  const key = `${field}\u2192${target}:${refId}`;
+function warnOnceDangling(field, target) {
+  const key = `${field}\u2192${target}`;
   if (warnedDanglingKeys.has(key)) return;
   warnedDanglingKeys.add(key);
   console.warn(
-    `[noy-db] .join() encountered dangling ref in 'warn' mode: field "${field}" \u2192 "${target}:${refId}" not found. Attaching null.`
+    `[noy-db] .join() encountered a dangling ref in 'warn' mode: field "${field}" \u2192 "${target}" not found. Attaching null. The ref VALUE is deliberately omitted \u2014 use mode: 'strict' to get it, as DanglingReferenceError.refId, in your own catch.`
   );
 }
 var warnedCeilingKeys = /* @__PURE__ */ new Set();
@@ -246,7 +246,7 @@ function attachJoin(left, leg, right, rawId) {
       });
     }
     if (refKey !== null && leg.mode === "warn") {
-      warnOnceDangling(leg.field, leg.target, refKey);
+      warnOnceDangling(leg.field, leg.target);
     }
     merged[leg.as] = null;
   } else {
@@ -270,4 +270,4 @@ export {
   bucketByRefKey,
   resetJoinWarnings
 };
-//# sourceMappingURL=chunk-4RF7DVH2.js.map
+//# sourceMappingURL=chunk-FPK2LPLR.js.map

package/dist/chunk-FPK2LPLR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/relate/join.ts"],"sourcesContent":["/**\n * Query DSL `.join()` — eager, single-FK, intra-vault joins.\n *\n * resolves a ref()-declared foreign key into an attached\n * right-side record under an alias, using one of two planner paths\n * selected automatically:\n *\n *   - **nested-loop** — right-side source exposes `lookupById`, so\n *     each left row costs O(1). This is the common path for joins\n *     against a Collection, which backs `lookupById` with a Map\n *     lookup.\n *   - **hash** — right-side has only `snapshot()`. Build a\n *     `Map<id, record>` once, probe per left row. Same asymptotic\n *     cost for our collections, but the path exists as a fallback\n *     for custom QuerySource implementations and as an explicit\n *     test-only override via `{ strategy: 'hash' }`.\n *\n * Scope:\n *\n *   - Equi-joins on declared `ref()` fields only. Joins on\n *     undeclared fields throw at plan time with an actionable error\n *     naming the field and collection.\n *   - Same-vault only. Cross-vault correlation goes\n *     through `queryAcross`; this is an architectural\n *     invariant, not a limitation we plan to lift.\n *   - Hard row ceiling via `JoinTooLargeError` — default 50k per\n *     side, override via `{ maxRows }`. Warns at 80% of the ceiling\n *     on the existing warn channel.\n *   - Three ref-mode behaviors on dangling refs:\n *     strict → `DanglingReferenceError`,\n *     warn → attach `null` with a one-shot warning,\n *     cascade → attach `null` silently (cascade is a delete-time\n *     mode; any dangling refs still present at read time are\n *     mid-flight cascades or orphans from earlier, not a DSL error).\n *\n * Partition-awareness seam:\n *\n * Every `JoinLeg` carries a `partitionScope` field that is always `'all'`.\n * The executor never reads it. See {@link JoinLeg.partitionScope} for the\n * two constraints (#1342) that decide how it may ever be populated — one of\n * them silently invalidates stored materialized views.\n *\n * Joins stay OUT of the ledger: reads don't touch `_ledger/`,\n * including joined reads.\n */\n\nimport type { RefDescriptor, RefMode } from '../../refs.js'\nimport type { Clause } from '../predicate.js'\nimport type { ViaPipeline } from '../../via/pipeline.js'\nimport { readPath } from '../predicate.js'\nimport { matchDeclaredJoin, type JoinOnPlan } from './join-on.js'\nimport { JoinTooLargeError, DanglingReferenceError } from '../../errors.js'\n\n/** Planner strategy for a single join leg. Auto-selected unless overridden. */\nexport type JoinStrategy = 'hash' | 'nested'\n\n/**\n * Which side of a join leg is preserved (#1289).\n *\n *   - `'left'`  — every left row survives, `null` under the alias when the\n *     FK resolves to nothing. This is what `.join()` has always done, and it\n *     is the default for a leg that names no direction.\n *   - `'right'` — every RIGHT record survives, including one nothing points\n *     at; a left row whose FK matches nothing is dropped.\n *   - `'full'`  — the union of the two.\n *\n * `'right'` and `'full'` are the only two that need the reverse index — see\n * {@link outerJoinFromRight}. A forward leg is driven by the left row's FK\n * and never has to ask \"did anything point at this\".\n */\nexport type JoinDirection = 'left' | 'right' | 'full'\n\n/** Default per-side row ceiling before `.join()` throws `JoinTooLargeError`. */\nexport const DEFAULT_JOIN_MAX_ROWS = 50_000\n\n/**\n * Default row ceiling for cross-join expansion. Matches JoinTooLargeError's ceiling.\n *\n * ⭐ #1458 — moved here from `kernel/query/builder.ts`. Find carries no\n * cross-join concept, and a constant is the cheapest thing to leave behind by\n * accident: it would have kept `builder.ts` as the const's home while every\n * reader of it lived in `relate/`.\n */\nexport const DEFAULT_CROSS_JOIN_MAX_ROWS = 50_000\n\n/**\n * Fraction of the row ceiling at which a one-shot warning is emitted.\n * At 80% we warn; at 100% we throw. The warn gives consumers a\n * heads-up before the hard error so they can raise the ceiling or\n * filter further without first hitting a broken query.\n */\nconst JOIN_WARN_FRACTION = 0.8\n\n/**\n * Internal representation of a single join leg in the query plan.\n *\n * This is the primary place the partition seam is honored: every leg carries\n * a `partitionScope` field that is always `'all'` and is never read by the\n * executor. See {@link JoinLeg.partitionScope}.\n */\nexport interface JoinLeg {\n  /** Field on the left-side record holding the foreign key value. */\n  readonly field: string\n  /** Alias key under which the joined right-side record attaches. */\n  readonly as: string\n  /** Target collection name, resolved from the `ref()` declaration. */\n  readonly target: string\n  /** Ref mode controlling behavior on dangling refs at read time. */\n  readonly mode: RefMode\n  /** Manual planner strategy override. `undefined` → auto-select. */\n  readonly strategy: JoinStrategy | undefined\n  /** Per-side row ceiling override. `undefined` → DEFAULT_JOIN_MAX_ROWS. */\n  readonly maxRows: number | undefined\n  /**\n   * Partition scope for future partition-aware joins. Always `'all'` today —\n   * the executor never reads this field. Do not remove even though it looks\n   * unused: it is a plan-shape seam.\n   *\n   * ⛔ TWO CONSTRAINTS BEFORE POPULATING THIS (#1342):\n   *\n   * 1. **It is a `queryHash` input on a HAND-COMPOSED path only — NOT for a\n   *    registered materialized view.** ⚠️ This paragraph asserted the\n   *    opposite until 2026-09-04; the correction is the measurement.\n   *    `MaterializedViewRegistry` feeds `computeQueryHash` from\n   *    `summarizeQueryPlan()` (`materialized-views/registry.ts:201,243`),\n   *    and that summary has never emitted `partitionScope`. `serializePlan()`\n   *    *does* emit `plan.joins` verbatim, and `canonicalizeQueryPlan` is\n   *    exported, so a consumer composing\n   *    `computeQueryHash(name, deps, canonicalizeQueryPlan(serializePlan(q)))`\n   *    by hand does carry the field in their hash. **That composition, and\n   *    only that one, is what this constraint binds** — it is also the\n   *    composition `__tests__/query-partition-scope.test.ts` builds, which is\n   *    why the file read as evidence for the stronger claim.\n   *    ⭐ So populating this field does NOT invalidate registered MVs. The\n   *    reason to leave it alone is smaller and still sufficient: it is a\n   *    DERIVED value — storing it buys nothing, and it is the one leg key\n   *    emitted UNCONDITIONALLY rather than omitted-at-default, so any later\n   *    move to summarise it (see #1389's rule) would shift every joined MV's\n   *    hash at once, for zero gain. Derive the scope in the EXECUTOR from\n   *    clauses the plan already carries. Pinned by\n   *    `__tests__/query-partition-scope.test.ts`, which now pins BOTH paths.\n   *\n   * 2. **The seam-change route was RULED OUT, and the pruning shipped\n   *    anyway** — ADR 0007, \"partitioning is collection-shaped\". Pruning only\n   *    pays on the `scan()` path (`query()` runs over an in-memory,\n   *    already-decrypted cache where `candidateRecords()`'s hash / sorted /\n   *    compound dispatch (#1344, #1345) narrows better than a partition ever\n   *    could). Buying it by teaching `NoydbStore.listPage` a filter would\n   *    have meant lifting the partition key out of the ciphertext into a\n   *    storage key or cleartext metadata — a permanent per-record\n   *    classification handed to the backend, and a change to the published\n   *    `@noy-db/hub/to` contract across every `to-*` adapter. **Ruled no.**\n   *    ⭐ The pruning was bought instead with information the store already\n   *    has: `listPage(vault, **collection**, …)` names the collection in\n   *    cleartext, so a partition modelled as its own collection is never\n   *    fetched because it is never asked for.\n   *\n   * ⭐ **THE SCOPE IS NOW DERIVED, IN THE EXECUTOR, AND THIS FIELD IS STILL\n   * DORMANT.** `kernel/query/relate/partition.ts`'s `resolvePartitionScope()` is the\n   * one decision function — `with-store/partitioned/` and `explain()` both\n   * call it — and it takes the plan's top-level clause list, never a stored\n   * leg. It is sound in one direction only: narrow ONLY on a whitelist of\n   * provable shapes (`==` / `in` on the declared key at the top level of the\n   * AND-ed clause list), and fall back to `'all'` for everything else —\n   * `or` groups, negations, callback clauses, and any Via-covered clause\n   * (its operand is in STORED form, not partition-key space, which is why\n   * `candidateRecords` refuses the index for it too). A partition wrongly\n   * excluded is silently missing data.\n   */\n  readonly partitionScope: 'all' | readonly string[]\n  /**\n   * Which side is preserved (#1289). `undefined` reads as `'left'` — the\n   * pre-#1289 behaviour — so every plan built before this field existed, and\n   * every serialized plan that omits it, keeps its meaning exactly.\n   */\n  readonly direction?: JoinDirection\n  /**\n   * INNER join (#1361) — drop every left row whose alias resolves to nothing,\n   * instead of attaching `null` under it.\n   *\n   * Only `.join()` sets it (a right/full leg already drops on its own side),\n   * and only when the caller passes `{ mode: 'inner' }`. Omitted rather than\n   * written as `false` for the same reason `direction` is: a plan built\n   * without it must serialize byte-identically to a pre-#1361 one, or every\n   * stored `queryHash` moves.\n   */\n  readonly inner?: true\n  /**\n   * A DECLARED, deterministic join predicate (#1339) — composite equality or\n   * a range — instead of the `ref()`-declared FK the rest of this file\n   * resolves. Set only by `.joinOn()`, always through\n   * {@link normalizeJoinOn}, and OMITTED on every other leg: a plan built by\n   * `.join()` must serialize byte-identically to a pre-#1339 one, or every\n   * stored `queryHash` moves (the same discipline `direction` and `inner`\n   * follow above).\n   *\n   * ⭐ This is the field that separates `.joinOn()` from `.crossJoin({ on })`.\n   * It is plain JSON, so it survives `serializePlan()` and\n   * `summarizeQueryPlan()` and a materialized view can therefore DEPEND on\n   * it. A closure cannot. See `join-on.ts`.\n   */\n  readonly on?: JoinOnPlan\n  /**\n   * When `true`, this is a dictionary join. The executor\n   * resolves the left-field value against the dict snapshot and\n   * attaches `{ ...labels, key }` rather than a right-side record.\n   * `target` holds the dictionary name (not a collection name).\n   */\n  readonly isDictJoin?: true\n}\n\n/**\n * Minimal shape of a joinable right-side record source.\n *\n * Collections implement this structurally via their `QuerySource`;\n * sources without `lookupById` force the hash-join fallback. Kept as\n * a thin interface so tests can wire up plain-object sources without\n * pulling in the full Collection class.\n *\n * The optional `subscribe` is used by `Query.live()` to merge\n * right-side change streams into the live re-run trigger. Sources\n * that omit `subscribe` still work for live joins — they just\n * don't drive re-fires when their right side mutates. Collection\n * implements `subscribe` by hooking into the existing per-\n * vault event emitter.\n */\nexport interface JoinableSource {\n  snapshot(): readonly unknown[]\n  lookupById?(id: string): unknown\n  /**\n   * Default locale a label-resolving query falls back to when the query\n   * itself is locale-less. Set by a `staticDict()`-backed source from its\n   * `displayLocale` so `{ by: 'label' }` resolves under a locale-less read.\n   * Plain `_dict_*`-backed sources omit it.\n   */\n  readonly displayLocale?: string\n  /**\n   * Sync present-for-join dressing (#626 retirement, #650 Task 6) — when\n   * present and the query carries a locale, each joined right-side record\n   * is passed through this hook (built by the right-side `Collection` from\n   * its own i18n-text + lookup-label bindings) BEFORE it is attached under\n   * the leg's alias — so a joined `i18nText` field resolves to a string\n   * (not a raw `{ locale }` map) and a joined lookup field gains its\n   * `<field>Label`. Locale-less queries leave joined fields raw\n   * (consistent with a locale-less read). Replaces the old `i18nFields`\n   * data field — the join executor no longer resolves i18n locale itself,\n   * it just calls this hook.\n   */\n  readonly presentForJoin?: (record: unknown, locale: string) => unknown\n  /**\n   * The id-paired view of {@link snapshot} (#1289).\n   *\n   * ⚠️ A `Collection` snapshot record does NOT carry its own id — the id is\n   * the cache key, not a field. The forward join never noticed, because it\n   * reads the id off the LEFT row's FK and calls `lookupById`. A right/full\n   * outer join has to ask each RIGHT record \"what is your id, and did\n   * anything point at you\", and there is no field to read it from.\n   *\n   * Optional so a plain-object test source stays valid; `outerJoinFromRight`\n   * falls back to an `id` FIELD on the record, which is what such sources\n   * carry. A real Collection supplies this and the fallback never runs.\n   */\n  snapshotEntries?(): readonly { readonly id: string; readonly record: unknown }[]\n  /**\n   * Via RESULT decode for this source's own records (#1289) — the same\n   * `via.decodeResults` a top-level `toArray()` applies (money's stored\n   * scaled-int → canonical decimal, etc.).\n   *\n   * It exists because Via dressing keys by BARE FIELD NAME: the moment a\n   * record moves under an alias (`{ client: { amount } }`, or both sides of\n   * `crossJoinWith`) the top-level decode cannot see it, and the row silently\n   * serves raw money. Distinct from `presentForJoin`, which is the LOCALE\n   * half (i18n text + lookup labels) and only runs for a locale-carrying\n   * query — this half is locale-free and always applies.\n   */\n  readonly decodeResults?: (record: unknown) => unknown\n  /**\n   * This source's own compiled Via pipeline (#1337 / #1338).\n   *\n   * The two halves above (`presentForJoin`, `decodeResults`) dress a record\n   * that is ON ITS WAY OUT. Ordering, grouping and reduction happen while it\n   * is still under an alias mid-plan, and they need the pipeline itself:\n   * `compareForOrder` to sort an aliased money field by MAGNITUDE rather than\n   * lexically over its stored scaled integer, and `wrapReducers` to rewrite\n   * `sum('client.credit')` into the exact-BigInt money reducer (which also\n   * applies the RIGHT collection's `queryable: 'none'` posture gate — the\n   * gate whose silent absence is why joined aggregation was refused).\n   *\n   * A THUNK, not a property: `_applyMoneyFields` can rebuild a collection's\n   * pipeline after this source object has been handed out, and a copied\n   * reference would go quietly stale — the same discipline `decodeResults`\n   * above already follows.\n   *\n   * Optional: a plain-object test source declares none, and every consumer\n   * treats absence as \"no binding covers anything here\".\n   */\n  readonly via?: () => ViaPipeline | undefined\n  /**\n   * Subscribe to mutations on this source. The callback fires\n   * AFTER the underlying record set has been updated. Returns an\n   * unsubscribe function. Optional — sources without this method\n   * cannot trigger live-join re-fires from their side.\n   */\n  subscribe?(cb: () => void): () => void\n}\n\n/**\n * Join resolution context attached to a `Query` when it's constructed\n * from a `Collection`. Holds everything the `.join()` method needs to\n * translate a field name into a target collection + ref mode, and\n * everything the executor needs to read the right side.\n *\n * Kept as a structural interface so `Vault` can implement it\n * without `Query` needing to import `Vault` (circular-import\n * avoid). The Collection wires this up in its `query()` method using\n * the `joinResolver` back-reference the Vault passes in.\n */\nexport interface JoinContext {\n  /** Name of the left-side (owning) collection. */\n  readonly leftCollection: string\n  /**\n   * The owning collection's default locale. Used to resolve joined\n   * i18n fields at the `join` layer when a terminal call doesn't pass an\n   * explicit locale — so `openVault({ locale })` flows to joins like it does\n   * to `get`/`list`. A per-call `toArray({ locale })` overrides it.\n   */\n  readonly defaultLocale?: string\n  /** Look up a `RefDescriptor` by field name on the left collection. */\n  resolveRef(field: string): RefDescriptor | null\n  /** Resolve a right-side source by target collection name. */\n  resolveSource(collectionName: string): JoinableSource | null\n  /**\n   * Resolve a dictKey join source. Returns a `JoinableSource`\n   * whose snapshot exposes `{ key, ...labels }` records, keyed by the\n   * stable dictionary key. `null` when the field is not a dictKey.\n   *\n   * The source is built from the compartment's in-memory dictionary\n   * snapshot — same data as `DictionaryHandle.list()`, O(1) per lookup.\n   */\n  resolveDictSource?(field: string): JoinableSource | null\n}\n\n/**\n * Does this clause address a field that only exists once join legs are\n * attached — i.e. is its path rooted at a join alias?\n *\n * Only `FieldClause` is inspectable. A `FilterClause` carries an opaque\n * function and a `WherePredicateClause` a named one, so neither can be\n * classified; both stay on the pre-join side, which is where they have\n * always run. See `splitAroundJoins`.\n */\nfunction referencesJoinAlias(clause: Clause, aliases: ReadonlySet<string>): boolean {\n  if (clause.type !== 'field') return false\n  // `where('client.name', …)` addresses the alias; so does the anti-join\n  // form `where('client', '==', null)`, where the path IS the alias.\n  return aliases.has(clause.field.split('.')[0]!)\n}\n\n/**\n * Split a plan's clauses into those evaluable before the join legs run and\n * those that need the joined shape (#1030).\n *\n * Join legs attach after `where` so the left set can be narrowed (and\n * index-driven) first. That is the right default, but it silently broke any\n * predicate addressing a joined alias: the field did not exist yet, so\n * `readPath` returned `undefined`, nothing matched, and the query returned an\n * empty result with no error.\n *\n * The split is deliberately narrow. When no clause addresses an alias — every\n * query written against the previous behaviour — `postJoin` is empty and the\n * caller takes its original path unchanged. The reordered pipeline therefore\n * only ever runs for queries that match nothing today.\n *\n * KNOWN RESIDUAL: `.filter(r => r.client?.name === 'Ann')` cannot be\n * classified (the predicate is a closure), so it still runs pre-join and still\n * sees no alias. Prefer `.where()` for anything addressing a joined field.\n *\n * Shared by the eager `Query` and the streaming `ScanBuilder` so the two\n * cannot drift on which side a clause belongs to.\n */\nexport function splitAroundJoins(\n  clauses: readonly Clause[],\n  joins: readonly JoinLeg[],\n): { readonly preJoin: readonly Clause[]; readonly postJoin: readonly Clause[] } {\n  if (joins.length === 0 || clauses.length === 0) return { preJoin: clauses, postJoin: [] }\n  const aliases = new Set(joins.map(leg => leg.as))\n  const preJoin: Clause[] = []\n  const postJoin: Clause[] = []\n  for (const clause of clauses) {\n    ;(referencesJoinAlias(clause, aliases) ? postJoin : preJoin).push(clause)\n  }\n  return { preJoin, postJoin }\n}\n\n/**\n * Does any `orderBy` entry address a field that only exists once the legs are\n * attached (#1337)?\n *\n * The ordering half of {@link splitAroundJoins}, kept beside it because the\n * two answer the same question about different parts of the plan, and because\n * `Query.toArray()` and `Query.explain()` must not drift on the answer — one\n * decides when the sort runs, the other reports it.\n *\n * ⚠️ Only `plan.joins` legs count. A `crossJoin` alias lives in the CLAUSE\n * list and its expansion already runs before ordering, so an ordering over\n * one has never needed moving.\n */\nexport function orderReferencesJoinAlias(\n  orderBy: readonly { readonly field: string }[],\n  joins: readonly JoinLeg[],\n): boolean {\n  if (joins.length === 0 || orderBy.length === 0) return false\n  const aliases = new Set(joins.map(leg => leg.as))\n  return orderBy.some(entry => aliases.has(entry.field.split('.')[0]!))\n}\n\n/**\n * Does any leg drop left rows (#1361)?\n *\n * The entry condition for every terminal that must run the legs even though\n * nothing addresses an alias: an inner leg is no longer projection-only, so\n * `count()`, `exists()` and the ordering placement in `toArray()` all have to\n * ask. Kept beside {@link splitAroundJoins} and {@link orderReferencesJoinAlias}\n * because the three answer the same family of question, and because\n * `Query.toArray()` and `Query.explain()` must not drift on the answer.\n */\nexport function joinsDropLeftRows(joins: readonly JoinLeg[]): boolean {\n  return joins.some(leg => leg.inner === true)\n}\n\n/**\n * Coerce an unknown FK value into a lookup key string.\n *\n * Legitimate ref values are strings or numbers — the same narrowing\n * the write-time `enforceRefsOnPut` path applies. Anything else\n * (objects, arrays, booleans, null, undefined) is treated as \"no\n * ref\" and returns `null`, so the join attaches `null` instead of\n * running `String({})` and producing `'[object Object]'` as a\n * bucket key. This matches the lint rule guidance and keeps\n * bizarre FK values from producing silently-wrong lookups.\n */\nexport function coerceRefKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n\n/**\n * Warn-channel deduplication for dangling-ref `'warn'` mode (family#167).\n *\n * ⛔ THE REF VALUE NEVER REACHES THE LOG. It used to: the message carried\n * `\"<target>:<refId>\"`, and `refId` is decrypted record content — a ref field\n * is routinely an email, an account number or a customer id. `console.warn`\n * goes wherever the host collects logs: a file, a shipper, a cloud sink. That\n * is outside the zero-knowledge boundary this library exists to hold, and it\n * leaked on an ordinary read path, in the mode a caller picks to be lenient.\n *\n * ⚠️ Keyed by `field → target` now, not by value — so one line per leg instead\n * of one per dangling id. No information is lost: the id was never usable from\n * a log without the leak, and `mode: 'strict'` hands it to the CALLER, who\n * already holds the plaintext, as `DanglingReferenceError.refId`.\n */\nconst warnedDanglingKeys = new Set<string>()\nfunction warnOnceDangling(field: string, target: string): void {\n  const key = `${field}→${target}`\n  if (warnedDanglingKeys.has(key)) return\n  warnedDanglingKeys.add(key)\n  console.warn(\n    `[noy-db] .join() encountered a dangling ref in 'warn' mode: ` +\n      `field \"${field}\" → \"${target}\" not found. Attaching null. ` +\n      `The ref VALUE is deliberately omitted — use mode: 'strict' to get it, ` +\n      `as DanglingReferenceError.refId, in your own catch.`,\n  )\n}\n\n/**\n * Track row-ceiling warnings to fire only once per (target, side).\n * Prevents per-query spam when a consumer is running the same query\n * repeatedly (e.g. in a reactive loop).\n */\nconst warnedCeilingKeys = new Set<string>()\nfunction warnCeilingApproaching(\n  target: string,\n  side: 'left' | 'right',\n  rows: number,\n  maxRows: number,\n): void {\n  const key = `${target}:${side}`\n  if (warnedCeilingKeys.has(key)) return\n  warnedCeilingKeys.add(key)\n  const pct = Math.round((rows / maxRows) * 100)\n  console.warn(\n    `[noy-db] .join() ${side} side is at ${pct}% of the ${maxRows}-row ` +\n      `ceiling for target \"${target}\" (${rows} rows). Streaming joins over ` +\n      `scan() are not yet supported for collections that need to exceed this.`,\n  )\n}\n\n/**\n * Apply every join leg in the plan against a base set of left-side\n * rows. Called by the query executor after `where` / `orderBy` /\n * `offset` / `limit` have narrowed the left set.\n *\n * Each leg attaches a `leg.as` field to every row. Returns a new\n * array of plain objects — the original left rows are not mutated\n * (structural sharing is fine for the inner fields, but the\n * top-level object is a fresh clone so consumers can further mutate\n * safely).\n *\n * **Ordering:** joins run AFTER orderBy / limit / offset by DEFAULT, so\n * \"top 10 invoices with client\" sorts and paginates the left side first\n * (index-driven) and joins only the page. Two things flip that, and both\n * are decided by the plan, never by a flag: a `where` addressing an alias\n * (#1030, {@link splitAroundJoins}) and an `orderBy` addressing one (#1337,\n * {@link orderReferencesJoinAlias}). Either one moves the sort and the page\n * to AFTER the legs, because neither can be evaluated against a row where\n * the alias does not exist yet. ⚠️ That query necessarily loses the\n * index-driven ordering fast path — the cost of sorting on a field the\n * index does not hold. `Query.explain()` names which placement a plan gets.\n *\n * An INNER leg (#1361) moves only the PAGE, not the sort: the drop removes\n * rows, so `limit` must observe it, but the ordering is on a left-side field\n * that the drop cannot reorder. `toArray()` therefore sorts pre-join, joins,\n * and slices after — and `explain()` reports `pre-join` on the sort and\n * `post-join` on the page rather than one word for both.\n *\n * **Multi-FK chaining:** each leg's `maxRows` is enforced\n * against the current left-row count independently. Because\n * joins are equi-joins on the target's primary key (one-to-one or\n * one-to-null), the left row count is constant across legs — no\n * cartesian blowup. The per-leg left-side check is still necessary\n * so that a later leg with a tighter ceiling correctly fires on a\n * query like `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`,\n * which should throw on the second leg if the left set exceeds 50.\n */\nexport function applyJoins(\n  rows: readonly unknown[],\n  joins: readonly JoinLeg[],\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  if (joins.length === 0) return [...rows]\n\n  let result: unknown[] = [...rows]\n  for (const leg of joins) {\n    result = applyOneJoin(result, leg, context, locale)\n  }\n  return result\n}\n\n/**\n * One leg, plus the #1361 inner-join drop.\n *\n * The drop is applied to the leg's OUTPUT rather than threaded through the\n * three producers (nested-loop, hash, dict) — an unmatched row is `null` under\n * the alias in all three by construction, and `attachJoin` has already run, so\n * a strict-mode `DanglingReferenceError` still fires for a dangling ref that\n * `inner` would otherwise hide.\n */\nfunction applyOneJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  const rows = applyOneJoinRaw(leftRows, leg, context, locale)\n  if (leg.inner !== true) return rows\n  return rows.filter(row => row !== null && typeof row === 'object' && (row as Record<string, unknown>)[leg.as] != null)\n}\n\nfunction applyOneJoinRaw(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  // Dict join path — resolve left-field value against the\n  // dictionary snapshot and attach { key, ...labels } under leg.as.\n  if (leg.isDictJoin) {\n    const dictSource = context.resolveDictSource?.(leg.field)\n    if (!dictSource) {\n      throw new Error(\n        `.join() field \"${leg.field}\" on \"${context.leftCollection}\" is declared as a ` +\n          `dictKey join but the dict source could not be resolved. ` +\n          `Ensure the dictionary has at least one entry.`,\n      )\n    }\n    const out: unknown[] = []\n    const snapshot = dictSource.snapshot()\n    const dictMap = new Map<string, unknown>()\n    for (const entry of snapshot) {\n      const k = readPath(entry, 'key')\n      if (typeof k === 'string') dictMap.set(k, entry)\n    }\n    for (const left of leftRows) {\n      const rawId = readPath(left, leg.field)\n      const key = coerceRefKey(rawId)\n      const dictEntry = key === null ? undefined : dictMap.get(key)\n      out.push({ ...(left as Record<string, unknown>), [leg.as]: dictEntry ?? null })\n    }\n    return out\n  }\n\n  const source = context.resolveSource(leg.target)\n  if (!source) {\n    throw new Error(\n      `.join() cannot resolve target collection \"${leg.target}\" ` +\n        `(referenced from field \"${leg.field}\" on \"${context.leftCollection}\"). ` +\n        `Make sure the target collection has been opened via vault.collection() ` +\n        `at least once before running the query.`,\n    )\n  }\n\n  const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS\n\n  // Per-leg left-side ceiling check. In a\n  // multi-FK chain, each leg's `maxRows` is enforced independently\n  // against the current left-row count, so\n  // `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`\n  // correctly throws on the second leg if the left set exceeds 50.\n  if (leftRows.length > maxRows) {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: -1,\n      maxRows,\n      side: 'left',\n      message:\n        `.join() left side has ${leftRows.length} rows, exceeding the ${maxRows}-row ` +\n        `ceiling for target \"${leg.target}\". Filter the left side further with ` +\n        `where()/limit() before joining, or raise the ceiling via { maxRows }. ` +\n        `Streaming joins over scan() are not yet supported.`,\n    })\n  }\n  if (leftRows.length > maxRows * JOIN_WARN_FRACTION) {\n    warnCeilingApproaching(leg.target, 'left', leftRows.length, maxRows)\n  }\n\n  const rightSnapshot = source.snapshot()\n  if (rightSnapshot.length > maxRows) {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: rightSnapshot.length,\n      maxRows,\n      side: 'right',\n      message:\n        `.join() right side \"${leg.target}\" has ${rightSnapshot.length} rows, ` +\n        `exceeding the ${maxRows}-row ceiling. Raise the ceiling via { maxRows } ` +\n        `if the data genuinely fits in memory, or track  for streaming joins.`,\n    })\n  }\n  if (rightSnapshot.length > maxRows * JOIN_WARN_FRACTION) {\n    warnCeilingApproaching(leg.target, 'right', rightSnapshot.length, maxRows)\n  }\n\n  // `join`-layer dressing (#650 Task 6, #626 retirement). When the query\n  // carries a locale (per-call or the owning collection's default) and the\n  // right side declares a `presentForJoin` hook, resolve each matched right\n  // record through it before it's attached. Locale-less → leave raw.\n  const effLocale = locale ?? context.defaultLocale\n  const presentResolve: ((right: unknown) => unknown) | undefined =\n    effLocale !== undefined && source.presentForJoin !== undefined\n      ? (right) =>\n          right !== null && typeof right === 'object'\n            ? source.presentForJoin!(right, effLocale)\n            : right\n      : undefined\n\n  // #1339 — a declared `on` replaces the FK lookup entirely: there is no\n  // ref, so neither `lookupById` nor the id-keyed hash means anything. It\n  // runs BEFORE the strategy/direction selection below because it answers\n  // both questions itself (see `join-on.ts` for which strategy serves which\n  // shape, and at what cost).\n  if (leg.on !== undefined) {\n    return declaredJoin(leftRows, leg, leg.on, rightSnapshot, maxRows, presentResolve)\n  }\n\n  // Strategy selection: explicit override wins; otherwise prefer\n  // nested-loop when the source exposes lookupById (O(1) per row),\n  // falling back to hash join when it doesn't.\n  const strategy: JoinStrategy =\n    leg.strategy ?? (source.lookupById ? 'nested' : 'hash')\n\n  // #1289 — a right/full outer join cannot be driven by the left row's FK,\n  // because the rows it must produce are exactly the ones no FK names. It\n  // reverses the index instead: bucket the LEFT rows by their FK value, then\n  // walk the right snapshot asking each record \"did anything point at me\".\n  const direction = leg.direction ?? 'left'\n  if (direction !== 'left') {\n    return outerJoinFromRight(leftRows, leg, source, direction, presentResolve)\n  }\n\n  if (strategy === 'nested' && source.lookupById) {\n    // Bind through an arrow so the `this` context of lookupById\n    // doesn't drift — same pattern as the existing candidateRecords\n    // helper in builder.ts.\n    const lookup = (id: string): unknown => source.lookupById?.(id)\n    return nestedLoopJoin(leftRows, leg, lookup, presentResolve)\n  }\n  return hashJoin(leftRows, leg, rightSnapshot, presentResolve)\n}\n\n/**\n * Execute a declared-`on` leg (#1339).\n *\n * The match set comes from `join-on.ts`; this function is only the part that\n * has to agree with the rest of `.join()` — the alias attachment, the\n * present/decode dressing, and the OUTPUT ceiling.\n *\n * ⚠️ The output ceiling is not redundant with the two side ceilings above. A\n * ref join is one-to-one, so `output === leftRows`; a declared join is\n * many-to-many, so 1,000 × 1,000 rows both comfortably under a 50,000-row\n * side ceiling can produce a million rows. Checking as rows are produced is\n * what makes an unbounded theta join an error rather than a hang.\n */\nfunction declaredJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  on: JoinOnPlan,\n  rightSnapshot: readonly unknown[],\n  maxRows: number,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const matches = matchDeclaredJoin(leftRows, on, rightSnapshot, maxRows, produced => {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: rightSnapshot.length,\n      maxRows,\n      side: 'output',\n      message:\n        `.joinOn(\"${leg.target}\") produced more than ${maxRows} rows (${produced} and counting) from ` +\n        `${leftRows.length} left x ${rightSnapshot.length} right. A declared \\`on\\` is many-to-many, so ` +\n        `the per-side ceilings do not bound the result. Narrow the predicate, filter the left side ` +\n        `with where()/limit() before joining, or raise the ceiling via { maxRows }.`,\n    })\n  })\n  const out: unknown[] = []\n  for (const { left, right } of matches) {\n    const dressed = presentResolve && right !== undefined ? presentResolve(right) : right\n    // `rawId` is `undefined` on purpose: a declared join has no ref, so\n    // \"matched nothing\" is never a DANGLING ref — `attachJoin` reads a null\n    // key as \"no reference at all\" and attaches null without consulting the\n    // ref mode. An unmatched row is data, not corruption.\n    out.push(attachJoin(left, leg, dressed, undefined))\n  }\n  return out\n}\n\nfunction nestedLoopJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  lookupById: (id: string) => unknown,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const out: unknown[] = []\n  for (const left of leftRows) {\n    const rawId = readPath(left, leg.field)\n    const key = coerceRefKey(rawId)\n    let right = key === null ? undefined : lookupById(key)\n    if (presentResolve && right !== undefined) right = presentResolve(right)\n    out.push(attachJoin(left, leg, right, rawId))\n  }\n  return out\n}\n\nfunction hashJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  rightSnapshot: readonly unknown[],\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  // Build the right-side hash once per query execution. We key on\n  // the `id` field because ref() always points to a target's primary\n  // key — non-equi and non-id joins are out of scope for.\n  const rightMap = new Map<string, unknown>()\n  for (const record of rightSnapshot) {\n    const rawId = readPath(record, 'id')\n    const key = coerceRefKey(rawId)\n    if (key !== null) {\n      rightMap.set(key, record)\n    }\n  }\n  const out: unknown[] = []\n  for (const left of leftRows) {\n    const rawId = readPath(left, leg.field)\n    const key = coerceRefKey(rawId)\n    let right = key === null ? undefined : rightMap.get(key)\n    if (presentResolve && right !== undefined) right = presentResolve(right)\n    out.push(attachJoin(left, leg, right, rawId))\n  }\n  return out\n}\n\n/**\n * Bucket the left rows by the FK value they carry, so the right side can be\n * asked \"did anything point at this record\" in O(1).\n *\n * This IS the reverse index #1289 names. It is built per execution and lives\n * only for the length of the join: nothing is persisted, no store is touched,\n * and it costs one pass over the left set that the forward path does not pay.\n * Left rows with a null/uncoercible FK are absent from every bucket — they are\n * \"no reference at all\", never a match.\n */\nfunction reverseIndex(leftRows: readonly unknown[], field: string): Map<string, unknown[]> {\n  return bucketByRefKey(leftRows, left => readPath(left, field))\n}\n\n/**\n * The reverse-FK index, generalised over what sits in the bucket (#1352).\n *\n * `outerJoinFromRight` buckets bare left ROWS by their FK; `traverse()`\n * buckets id-paired ENTRIES, because a child row alone cannot say what its\n * own id is (a Collection snapshot record carries no `id` field — the id is\n * the cache key). Same question — \"who points at this?\" — same coercion\n * rules, so it is deliberately one implementation rather than two that can\n * drift on what counts as a usable FK value.\n *\n * `readKey` extracts the raw FK from an item; `coerceRefKey` then decides\n * whether it is a key at all. An item whose FK is nullish, or is neither a\n * string nor a number, is dropped — \"no reference\", not \"a reference to\n * `[object Object]`\".\n */\nexport function bucketByRefKey<V>(\n  items: readonly V[],\n  readKey: (item: V) => unknown,\n): Map<string, V[]> {\n  const buckets = new Map<string, V[]>()\n  for (const item of items) {\n    const key = coerceRefKey(readKey(item))\n    if (key === null) continue\n    const bucket = buckets.get(key)\n    if (bucket) bucket.push(item)\n    else buckets.set(key, [item])\n  }\n  return buckets\n}\n\n/**\n * Right / full outer join (#1289).\n *\n * Walks the RIGHT snapshot as the driving relation. A right record with a\n * non-empty bucket emits one row per left row in it (identical in shape to\n * what the forward path would have produced); a right record nothing points\n * at emits a LEFT-LESS row — `{ [leg.as]: right }` and nothing else, which is\n * SQL's \"the left columns are NULL\" rendered in an object language.\n *\n * `'full'` then appends the left rows the right side never claimed, in their\n * original order, with `null` under the alias — i.e. exactly the rows the\n * forward left-outer path would emit for them, ref-mode behaviour included.\n * `'right'` drops those rows, but still runs the ref-mode check on them: a\n * strict dangling ref is a data-integrity finding, and hiding it behind a\n * change of join direction would make corruption depend on which method the\n * caller happened to type.\n */\nfunction outerJoinFromRight(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  source: JoinableSource,\n  direction: JoinDirection,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const byRight = reverseIndex(leftRows, leg.field)\n  const matchedLeft = new Set<unknown>()\n  const out: unknown[] = []\n\n  // Prefer the id-paired view: a Collection record has no `id` field, so\n  // reading one off the record would leave every bucket unmatched and turn a\n  // right join into \"every right record is an orphan\" — wrong, and quietly so\n  // in `cascade`/`warn` mode. The field fallback serves plain-object sources.\n  const entries: readonly { id: string | null; record: unknown }[] =\n    source.snapshotEntries?.() ??\n    source.snapshot().map(record => ({ id: coerceRefKey(readPath(record, 'id')), record }))\n\n  for (const { id: rid, record: right } of entries) {\n    const dressed = presentResolve ? presentResolve(right) : right\n    const bucket = rid === null ? undefined : byRight.get(rid)\n    if (bucket === undefined || bucket.length === 0) {\n      // Nothing points at this record — the row that only a right/full outer\n      // join can produce.\n      out.push({ [leg.as]: dressed })\n      continue\n    }\n    for (const left of bucket) {\n      matchedLeft.add(left)\n      out.push(attachJoin(left, leg, dressed, readPath(left, leg.field)))\n    }\n  }\n\n  for (const left of leftRows) {\n    if (matchedLeft.has(left)) continue\n    // Unmatched left row: `attachJoin` with an undefined right applies the\n    // ref mode (strict throws, warn warns once) and attaches null.\n    const row = attachJoin(left, leg, undefined, readPath(left, leg.field))\n    if (direction === 'full') out.push(row)\n  }\n\n  return out\n}\n\n/**\n * Attach the resolved right-side record (or null) to the left row\n * under the alias, applying ref-mode semantics for the dangling\n * case.\n *\n * A left-side record whose FK field is null/undefined is NOT a\n * dangling ref — it's \"no reference at all\", which is always\n * allowed regardless of mode. This matches the write-time\n * `enforceRefsOnPut` behavior: \"Nullish ref values are allowed —\n * treat them as 'no reference'.\"\n *\n * Only non-null FKs pointing at non-existent targets trigger the\n * mode behavior.\n */\nfunction attachJoin(\n  left: unknown,\n  leg: JoinLeg,\n  right: unknown,\n  rawId: unknown,\n): unknown {\n  if (left === null || typeof left !== 'object') {\n    // Pathological input — return as-is. Shouldn't happen in\n    // practice because QuerySource yields objects, but defensive\n    // because plan execution is untyped at this layer.\n    return left\n  }\n  const merged: Record<string, unknown> = { ...(left as Record<string, unknown>) }\n\n  // \"No ref at all\" — null/undefined FK value, or a non-string/non-\n  // number FK that coerceRefKey treated as no-ref. Never throws\n  // regardless of mode; matches the write-time policy that nullish\n  // refs are allowed.\n  const refKey = coerceRefKey(rawId)\n  if (right === undefined) {\n    if (refKey !== null && leg.mode === 'strict') {\n      throw new DanglingReferenceError({\n        field: leg.field,\n        target: leg.target,\n        refId: refKey,\n        message:\n          `.join() strict dangling: record references \"${leg.target}:${refKey}\" ` +\n          `via field \"${leg.field}\", but no such record exists. Use ref() mode 'warn' ` +\n          `or 'cascade' if dangling refs are acceptable, or run ` +\n          `vault.checkIntegrity() to find and fix the orphans.`,\n      })\n    }\n    if (refKey !== null && leg.mode === 'warn') {\n      warnOnceDangling(leg.field, leg.target)\n    }\n    // For 'cascade' and null refs we attach null silently. Cascade\n    // is a delete-time mode; any dangling refs visible at read time\n    // are either mid-flight or pre-existing orphans, not a DSL error.\n    merged[leg.as] = null\n  } else {\n    merged[leg.as] = right\n  }\n  return merged\n}\n\n/**\n * Test-only: reset the join warning deduplication state between\n * tests. Production code never calls this — the dedup state is\n * intentionally process-scoped so a noisy query doesn't spam the\n * console once per component render.\n */\nexport function resetJoinWarnings(): void {\n  warnedDanglingKeys.clear()\n  warnedCeilingKeys.clear()\n}\n"],"mappings":";;;;;;;;;;;;AAyEO,IAAM,wBAAwB;AAU9B,IAAM,8BAA8B;AAQ3C,IAAM,qBAAqB;AAoQ3B,SAAS,oBAAoB,QAAgB,SAAuC;AAClF,MAAI,OAAO,SAAS,QAAS,QAAO;AAGpC,SAAO,QAAQ,IAAI,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC,CAAE;AAChD;AAwBO,SAAS,iBACd,SACA,OAC+E;AAC/E,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,EAAG,QAAO,EAAE,SAAS,SAAS,UAAU,CAAC,EAAE;AACxF,QAAM,UAAU,IAAI,IAAI,MAAM,IAAI,SAAO,IAAI,EAAE,CAAC;AAChD,QAAM,UAAoB,CAAC;AAC3B,QAAM,WAAqB,CAAC;AAC5B,aAAW,UAAU,SAAS;AAC5B;AAAC,KAAC,oBAAoB,QAAQ,OAAO,IAAI,WAAW,SAAS,KAAK,MAAM;AAAA,EAC1E;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAeO,SAAS,yBACd,SACA,OACS;AACT,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,EAAG,QAAO;AACvD,QAAM,UAAU,IAAI,IAAI,MAAM,IAAI,SAAO,IAAI,EAAE,CAAC;AAChD,SAAO,QAAQ,KAAK,WAAS,QAAQ,IAAI,MAAM,MAAM,MAAM,GAAG,EAAE,CAAC,CAAE,CAAC;AACtE;AAYO,SAAS,kBAAkB,OAAoC;AACpE,SAAO,MAAM,KAAK,SAAO,IAAI,UAAU,IAAI;AAC7C;AAaO,SAAS,aAAa,OAA+B;AAC1D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;AAiBA,IAAM,qBAAqB,oBAAI,IAAY;AAC3C,SAAS,iBAAiB,OAAe,QAAsB;AAC7D,QAAM,MAAM,GAAG,KAAK,SAAI,MAAM;AAC9B,MAAI,mBAAmB,IAAI,GAAG,EAAG;AACjC,qBAAmB,IAAI,GAAG;AAC1B,UAAQ;AAAA,IACN,sEACY,KAAK,aAAQ,MAAM;AAAA,EAGjC;AACF;AAOA,IAAM,oBAAoB,oBAAI,IAAY;AAC1C,SAAS,uBACP,QACA,MACA,MACA,SACM;AACN,QAAM,MAAM,GAAG,MAAM,IAAI,IAAI;AAC7B,MAAI,kBAAkB,IAAI,GAAG,EAAG;AAChC,oBAAkB,IAAI,GAAG;AACzB,QAAM,MAAM,KAAK,MAAO,OAAO,UAAW,GAAG;AAC7C,UAAQ;AAAA,IACN,oBAAoB,IAAI,eAAe,GAAG,YAAY,OAAO,4BACpC,MAAM,MAAM,IAAI;AAAA,EAE3C;AACF;AAuCO,SAAS,WACd,MACA,OACA,SACA,QACW;AACX,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC,GAAG,IAAI;AAEvC,MAAI,SAAoB,CAAC,GAAG,IAAI;AAChC,aAAW,OAAO,OAAO;AACvB,aAAS,aAAa,QAAQ,KAAK,SAAS,MAAM;AAAA,EACpD;AACA,SAAO;AACT;AAWA,SAAS,aACP,UACA,KACA,SACA,QACW;AACX,QAAM,OAAO,gBAAgB,UAAU,KAAK,SAAS,MAAM;AAC3D,MAAI,IAAI,UAAU,KAAM,QAAO;AAC/B,SAAO,KAAK,OAAO,SAAO,QAAQ,QAAQ,OAAO,QAAQ,YAAa,IAAgC,IAAI,EAAE,KAAK,IAAI;AACvH;AAEA,SAAS,gBACP,UACA,KACA,SACA,QACW;AAGX,MAAI,IAAI,YAAY;AAClB,UAAM,aAAa,QAAQ,oBAAoB,IAAI,KAAK;AACxD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,kBAAkB,IAAI,KAAK,SAAS,QAAQ,cAAc;AAAA,MAG5D;AAAA,IACF;AACA,UAAM,MAAiB,CAAC;AACxB,UAAM,WAAW,WAAW,SAAS;AACrC,UAAM,UAAU,oBAAI,IAAqB;AACzC,eAAW,SAAS,UAAU;AAC5B,YAAM,IAAI,SAAS,OAAO,KAAK;AAC/B,UAAI,OAAO,MAAM,SAAU,SAAQ,IAAI,GAAG,KAAK;AAAA,IACjD;AACA,eAAW,QAAQ,UAAU;AAC3B,YAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,YAAY,QAAQ,OAAO,SAAY,QAAQ,IAAI,GAAG;AAC5D,UAAI,KAAK,EAAE,GAAI,MAAkC,CAAC,IAAI,EAAE,GAAG,aAAa,KAAK,CAAC;AAAA,IAChF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,QAAQ,cAAc,IAAI,MAAM;AAC/C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,6CAA6C,IAAI,MAAM,6BAC1B,IAAI,KAAK,SAAS,QAAQ,cAAc;AAAA,IAGvE;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,WAAW;AAO/B,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,SACE,yBAAyB,SAAS,MAAM,wBAAwB,OAAO,4BAChD,IAAI,MAAM;AAAA,IAGrC,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,UAAU,oBAAoB;AAClD,2BAAuB,IAAI,QAAQ,QAAQ,SAAS,QAAQ,OAAO;AAAA,EACrE;AAEA,QAAM,gBAAgB,OAAO,SAAS;AACtC,MAAI,cAAc,SAAS,SAAS;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW,cAAc;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,SACE,uBAAuB,IAAI,MAAM,SAAS,cAAc,MAAM,wBAC7C,OAAO;AAAA,IAE5B,CAAC;AAAA,EACH;AACA,MAAI,cAAc,SAAS,UAAU,oBAAoB;AACvD,2BAAuB,IAAI,QAAQ,SAAS,cAAc,QAAQ,OAAO;AAAA,EAC3E;AAMA,QAAM,YAAY,UAAU,QAAQ;AACpC,QAAM,iBACJ,cAAc,UAAa,OAAO,mBAAmB,SACjD,CAAC,UACC,UAAU,QAAQ,OAAO,UAAU,WAC/B,OAAO,eAAgB,OAAO,SAAS,IACvC,QACN;AAON,MAAI,IAAI,OAAO,QAAW;AACxB,WAAO,aAAa,UAAU,KAAK,IAAI,IAAI,eAAe,SAAS,cAAc;AAAA,EACnF;AAKA,QAAM,WACJ,IAAI,aAAa,OAAO,aAAa,WAAW;AAMlD,QAAM,YAAY,IAAI,aAAa;AACnC,MAAI,cAAc,QAAQ;AACxB,WAAO,mBAAmB,UAAU,KAAK,QAAQ,WAAW,cAAc;AAAA,EAC5E;AAEA,MAAI,aAAa,YAAY,OAAO,YAAY;AAI9C,UAAM,SAAS,CAAC,OAAwB,OAAO,aAAa,EAAE;AAC9D,WAAO,eAAe,UAAU,KAAK,QAAQ,cAAc;AAAA,EAC7D;AACA,SAAO,SAAS,UAAU,KAAK,eAAe,cAAc;AAC9D;AAeA,SAAS,aACP,UACA,KACA,IACA,eACA,SACA,gBACW;AACX,QAAM,UAAU,kBAAkB,UAAU,IAAI,eAAe,SAAS,cAAY;AAClF,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW,cAAc;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,SACE,YAAY,IAAI,MAAM,yBAAyB,OAAO,UAAU,QAAQ,uBACrE,SAAS,MAAM,WAAW,cAAc,MAAM;AAAA,IAGrD,CAAC;AAAA,EACH,CAAC;AACD,QAAM,MAAiB,CAAC;AACxB,aAAW,EAAE,MAAM,MAAM,KAAK,SAAS;AACrC,UAAM,UAAU,kBAAkB,UAAU,SAAY,eAAe,KAAK,IAAI;AAKhF,QAAI,KAAK,WAAW,MAAM,KAAK,SAAS,MAAS,CAAC;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,eACP,UACA,KACA,YACA,gBACW;AACX,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,QAAQ,OAAO,SAAY,WAAW,GAAG;AACrD,QAAI,kBAAkB,UAAU,OAAW,SAAQ,eAAe,KAAK;AACvE,QAAI,KAAK,WAAW,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,SACP,UACA,KACA,eACA,gBACW;AAIX,QAAM,WAAW,oBAAI,IAAqB;AAC1C,aAAW,UAAU,eAAe;AAClC,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,MAAM;AAChB,eAAS,IAAI,KAAK,MAAM;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,QAAQ,OAAO,SAAY,SAAS,IAAI,GAAG;AACvD,QAAI,kBAAkB,UAAU,OAAW,SAAQ,eAAe,KAAK;AACvE,QAAI,KAAK,WAAW,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;AAYA,SAAS,aAAa,UAA8B,OAAuC;AACzF,SAAO,eAAe,UAAU,UAAQ,SAAS,MAAM,KAAK,CAAC;AAC/D;AAiBO,SAAS,eACd,OACA,SACkB;AAClB,QAAM,UAAU,oBAAI,IAAiB;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,aAAa,QAAQ,IAAI,CAAC;AACtC,QAAI,QAAQ,KAAM;AAClB,UAAM,SAAS,QAAQ,IAAI,GAAG;AAC9B,QAAI,OAAQ,QAAO,KAAK,IAAI;AAAA,QACvB,SAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAmBA,SAAS,mBACP,UACA,KACA,QACA,WACA,gBACW;AACX,QAAM,UAAU,aAAa,UAAU,IAAI,KAAK;AAChD,QAAM,cAAc,oBAAI,IAAa;AACrC,QAAM,MAAiB,CAAC;AAMxB,QAAM,UACJ,OAAO,kBAAkB,KACzB,OAAO,SAAS,EAAE,IAAI,aAAW,EAAE,IAAI,aAAa,SAAS,QAAQ,IAAI,CAAC,GAAG,OAAO,EAAE;AAExF,aAAW,EAAE,IAAI,KAAK,QAAQ,MAAM,KAAK,SAAS;AAChD,UAAM,UAAU,iBAAiB,eAAe,KAAK,IAAI;AACzD,UAAM,SAAS,QAAQ,OAAO,SAAY,QAAQ,IAAI,GAAG;AACzD,QAAI,WAAW,UAAa,OAAO,WAAW,GAAG;AAG/C,UAAI,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC;AAC9B;AAAA,IACF;AACA,eAAW,QAAQ,QAAQ;AACzB,kBAAY,IAAI,IAAI;AACpB,UAAI,KAAK,WAAW,MAAM,KAAK,SAAS,SAAS,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,aAAW,QAAQ,UAAU;AAC3B,QAAI,YAAY,IAAI,IAAI,EAAG;AAG3B,UAAM,MAAM,WAAW,MAAM,KAAK,QAAW,SAAS,MAAM,IAAI,KAAK,CAAC;AACtE,QAAI,cAAc,OAAQ,KAAI,KAAK,GAAG;AAAA,EACxC;AAEA,SAAO;AACT;AAgBA,SAAS,WACP,MACA,KACA,OACA,OACS;AACT,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAI7C,WAAO;AAAA,EACT;AACA,QAAM,SAAkC,EAAE,GAAI,KAAiC;AAM/E,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,UAAU,QAAW;AACvB,QAAI,WAAW,QAAQ,IAAI,SAAS,UAAU;AAC5C,YAAM,IAAI,uBAAuB;AAAA,QAC/B,OAAO,IAAI;AAAA,QACX,QAAQ,IAAI;AAAA,QACZ,OAAO;AAAA,QACP,SACE,+CAA+C,IAAI,MAAM,IAAI,MAAM,gBACrD,IAAI,KAAK;AAAA,MAG3B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ;AAC1C,uBAAiB,IAAI,OAAO,IAAI,MAAM;AAAA,IACxC;AAIA,WAAO,IAAI,EAAE,IAAI;AAAA,EACnB,OAAO;AACL,WAAO,IAAI,EAAE,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAQO,SAAS,oBAA0B;AACxC,qBAAmB,MAAM;AACzB,oBAAkB,MAAM;AAC1B;","names":[]}

package/dist/{chunk-2EF2Z4UN.js → chunk-FQEUJGBV.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -149,4 +149,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-2EF2Z4UN.js.map
+//# sourceMappingURL=chunk-FQEUJGBV.js.map

package/dist/{chunk-UORWAG7K.js → chunk-FY4FFNKK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-UORWAG7K.js.map
+//# sourceMappingURL=chunk-FY4FFNKK.js.map

package/dist/{chunk-WA4ZPMKP.js → chunk-GDCYZGPB.js}

@@ -1,7 +1,7 @@
 import {
   FieldFrozenError,
   InvariantError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/guards/executor.ts
 var GuardExecutor = {
@@ -77,4 +77,4 @@ function deepEqual(a, b) {
 export {
   GuardExecutor
 };
-//# sourceMappingURL=chunk-WA4ZPMKP.js.map
+//# sourceMappingURL=chunk-GDCYZGPB.js.map

package/dist/{chunk-3HDBDUX2.js → chunk-H6Q7GKLI.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-3HDBDUX2.js.map
+//# sourceMappingURL=chunk-H6Q7GKLI.js.map

package/dist/{chunk-654RE5YC.js → chunk-HDAPQF6Q.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-UORWAG7K.js";
+} from "./chunk-FY4FFNKK.js";
 import {
   loadPersistedSchema
-} from "./chunk-IF2M43G4.js";
+} from "./chunk-PBRD75JF.js";
 
 // src/with-shape/introspection/walk.ts
 var INTERNAL_PREFIX = "_";
@@ -268,4 +268,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=chunk-654RE5YC.js.map
+//# sourceMappingURL=chunk-HDAPQF6Q.js.map

package/dist/{chunk-B5PWQMZN.js → chunk-HRLMUZLI.js}

@@ -1,10 +1,10 @@
 import {
   ENCLAVE_SCHEME
-} from "./chunk-B6EWMGFX.js";
+} from "./chunk-NUBI6PYH.js";
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-RRI3JBD6.js";
+} from "./chunk-XMARKBUC.js";
 import {
   bytesToB64url,
   computeFieldHashes,
@@ -18,10 +18,10 @@ import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   AttestationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/attestation/issue.ts
 async function issueAttestationCore(ctx, args) {
@@ -62,4 +62,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-B5PWQMZN.js.map
+//# sourceMappingURL=chunk-HRLMUZLI.js.map

package/dist/{chunk-QWC2PRUR.js → chunk-HRNQYGLQ.js}

@@ -1,6 +1,6 @@
 import {
   PortabilityNotEnabledError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/portability/strategy.ts
 var NO_PORTABILITY = {
@@ -27,4 +27,4 @@ var NO_PORTABILITY = {
 export {
   NO_PORTABILITY
 };
-//# sourceMappingURL=chunk-QWC2PRUR.js.map
+//# sourceMappingURL=chunk-HRNQYGLQ.js.map