@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/bundle/index.js

@@ -1,18 +1,18 @@
 import {
   extractPartition,
   walkClosure
-} from "../chunk-76722EBH.js";
+} from "../chunk-L2SNBIV7.js";
 import "../chunk-CHFZDSE4.js";
 import {
   adoptPartition,
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition,
   unsealDeks
-} from "../chunk-2P2HZEXU.js";
-import "../chunk-26LGBE4T.js";
-import "../chunk-ZCGAHGUS.js";
-import "../chunk-DFEMTNPJ.js";
-import "../chunk-AZAOEIKW.js";
+} from "../chunk-GA2QHD6P.js";
+import "../chunk-C7NTK5I3.js";
+import "../chunk-KPGX66PM.js";
+import "../chunk-AOVDSIL3.js";
+import "../chunk-7E67FJ33.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -31,19 +31,25 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-FISN7WE4.js";
-import "../chunk-SMXWYP24.js";
-import "../chunk-WWGT2MDV.js";
-import "../chunk-ITNUCOXM.js";
+} from "../chunk-K62IUKOD.js";
+import "../chunk-5XIPOCQC.js";
+import "../chunk-5ZOSG3RJ.js";
+import "../chunk-4N5QFSNQ.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-LXQT4WMP.js";
+import "../chunk-OEAATWH5.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-AIWULCUO.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+import "../chunk-25NDNMQ7.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
 import {
   AdoptionStateError,
   BackupCorruptedError,
@@ -54,7 +60,7 @@ import {
   PartitionExtractionError,
   PodVersionConflictError,
   TransferSealError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-cargo/describe-extraction.ts

package/dist/bundle/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-cargo/describe-extraction.ts"],"sourcesContent":["/**\n * Partition-extraction dry-run. Read-only preview of what an\n * `extractPartition` would move: record counts, byte totals, and the\n * timestamp span per collection — computed from raw encrypted\n * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { walkClosure, type WalkClosureOptions } from './walk-closure.js'\n\nexport interface ExtractionPreview {\n  readonly totalRecords: number\n  /** Sum of serialized encrypted-envelope sizes (bytes). */\n  readonly totalBytes: number\n  readonly byCollection: ReadonlyArray<{\n    readonly name: string\n    readonly recordCount: number\n    readonly bytes: number\n    /** Earliest envelope `_ts` in this collection (lexicographic). */\n    readonly oldestTs?: string\n    readonly newestTs?: string\n  }>\n  readonly graph: { readonly depth: number; readonly cyclesDetected: boolean }\n  /** Records the walk reached but whose envelope couldn't be read. */\n  readonly inaccessible: ReadonlyArray<{ readonly collection: string; readonly id: string }>\n}\n\nexport async function describeExtraction(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ExtractionPreview> {\n  const { closure, graph } = await walkClosure(vault, opts)\n\n  const { name: vaultName, adapter } = vault._introspectState()\n  const encoder = new TextEncoder()\n\n  const byCollection: Array<{\n    name: string; recordCount: number; bytes: number; oldestTs?: string; newestTs?: string\n  }> = []\n  const inaccessible: Array<{ collection: string; id: string }> = []\n  let totalBytes = 0\n  let totalRecords = 0\n\n  for (const [collectionName, ids] of closure) {\n    let bytes = 0\n    let oldestTs: string | undefined\n    let newestTs: string | undefined\n    let recordCount = 0\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) {\n        // Walk reached it (via decrypted list) but the raw store read\n        // returned nothing — surface rather than miscount.\n        inaccessible.push({ collection: collectionName, id })\n        continue\n      }\n      recordCount++\n      bytes += encoder.encode(JSON.stringify(env)).length\n      const ts = env._ts\n      if (oldestTs === undefined || ts < oldestTs) oldestTs = ts\n      if (newestTs === undefined || ts > newestTs) newestTs = ts\n    }\n\n    byCollection.push({\n      name: collectionName,\n      recordCount,\n      bytes,\n      // Spread conditionally — exactOptionalPropertyTypes forbids an\n      // explicit `undefined` on an optional property.\n      ...(oldestTs !== undefined ? { oldestTs } : {}),\n      ...(newestTs !== undefined ? { newestTs } : {}),\n    })\n    totalBytes += bytes\n    totalRecords += recordCount\n  }\n\n  byCollection.sort((a, b) => a.name.localeCompare(b.name))\n\n  return Object.freeze({\n    totalRecords,\n    totalBytes,\n    byCollection,\n    graph,\n    inaccessible,\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,mBACpB,OACA,MAC4B;AAC5B,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI;AAExD,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,eAED,CAAC;AACN,QAAM,eAA0D,CAAC;AACjE,MAAI,aAAa;AACjB,MAAI,eAAe;AAEnB,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,QAAI,QAAQ;AACZ,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAElB,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,KAAK;AAGR,qBAAa,KAAK,EAAE,YAAY,gBAAgB,GAAG,CAAC;AACpD;AAAA,MACF;AACA;AACA,eAAS,QAAQ,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE;AAC7C,YAAM,KAAK,IAAI;AACf,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AACxD,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AAAA,IAC1D;AAEA,iBAAa,KAAK;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,kBAAc;AACd,oBAAgB;AAAA,EAClB;AAEA,eAAa,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAExD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/with-cargo/describe-extraction.ts"],"sourcesContent":["/**\n * Partition-extraction dry-run. Read-only preview of what an\n * `extractPartition` would move: record counts, byte totals, and the\n * timestamp span per collection — computed from raw encrypted\n * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { walkClosure, type WalkClosureOptions } from './walk-closure.js'\n\nexport interface ExtractionPreview {\n  readonly totalRecords: number\n  /** Sum of serialized encrypted-envelope sizes (bytes). */\n  readonly totalBytes: number\n  readonly byCollection: ReadonlyArray<{\n    readonly name: string\n    readonly recordCount: number\n    readonly bytes: number\n    /** Earliest envelope `_ts` in this collection (lexicographic). */\n    readonly oldestTs?: string\n    readonly newestTs?: string\n  }>\n  readonly graph: { readonly depth: number; readonly cyclesDetected: boolean }\n  /** Records the walk reached but whose envelope couldn't be read. */\n  readonly inaccessible: ReadonlyArray<{ readonly collection: string; readonly id: string }>\n}\n\nexport async function describeExtraction(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ExtractionPreview> {\n  const { closure, graph } = await walkClosure(vault, opts)\n\n  const { name: vaultName, adapter } = vault._introspectState()\n  const encoder = new TextEncoder()\n\n  const byCollection: Array<{\n    name: string; recordCount: number; bytes: number; oldestTs?: string; newestTs?: string\n  }> = []\n  const inaccessible: Array<{ collection: string; id: string }> = []\n  let totalBytes = 0\n  let totalRecords = 0\n\n  for (const [collectionName, ids] of closure) {\n    let bytes = 0\n    let oldestTs: string | undefined\n    let newestTs: string | undefined\n    let recordCount = 0\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) {\n        // Walk reached it (via decrypted list) but the raw store read\n        // returned nothing — surface rather than miscount.\n        inaccessible.push({ collection: collectionName, id })\n        continue\n      }\n      recordCount++\n      bytes += encoder.encode(JSON.stringify(env)).length\n      const ts = env._ts\n      if (oldestTs === undefined || ts < oldestTs) oldestTs = ts\n      if (newestTs === undefined || ts > newestTs) newestTs = ts\n    }\n\n    byCollection.push({\n      name: collectionName,\n      recordCount,\n      bytes,\n      // Spread conditionally — exactOptionalPropertyTypes forbids an\n      // explicit `undefined` on an optional property.\n      ...(oldestTs !== undefined ? { oldestTs } : {}),\n      ...(newestTs !== undefined ? { newestTs } : {}),\n    })\n    totalBytes += bytes\n    totalRecords += recordCount\n  }\n\n  byCollection.sort((a, b) => a.name.localeCompare(b.name))\n\n  return Object.freeze({\n    totalRecords,\n    totalBytes,\n    byCollection,\n    graph,\n    inaccessible,\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,mBACpB,OACA,MAC4B;AAC5B,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI;AAExD,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,eAED,CAAC;AACN,QAAM,eAA0D,CAAC;AACjE,MAAI,aAAa;AACjB,MAAI,eAAe;AAEnB,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,QAAI,QAAQ;AACZ,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAElB,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,KAAK;AAGR,qBAAa,KAAK,EAAE,YAAY,gBAAgB,GAAG,CAAC;AACpD;AAAA,MACF;AACA;AACA,eAAS,QAAQ,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE;AAC7C,YAAM,KAAK,IAAI;AACf,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AACxD,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AAAA,IAC1D;AAEA,iBAAa,KAAK;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,kBAAc;AACd,oBAAgB;AAAA,EAClB;AAEA,eAAa,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAExD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-QHJW5EXU.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-D26JB3LZ.js";
+import "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   isQuorum,

package/dist/cargo/index.js

@@ -1,50 +1,56 @@
 import {
   withCargo
-} from "../chunk-M6OST55S.js";
+} from "../chunk-UFILRICG.js";
 import {
   CustodyApi,
   NO_CARGO
-} from "../chunk-TJYQIGAP.js";
+} from "../chunk-BZO4WCJI.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-KXGNJJXB.js";
-import "../chunk-PSMV73A5.js";
-import "../chunk-HCIPRAGS.js";
-import {
-  diffVault
-} from "../chunk-LB7FD65R.js";
-import "../chunk-BGIZAFY7.js";
+} from "../chunk-PXWVF7MC.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
+import {
+  diffVault
+} from "../chunk-LB7FD65R.js";
+import "../chunk-7NS43EXZ.js";
+import "../chunk-BCYQA5BK.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-QHJW5EXU.js";
-import "../chunk-ZCGAHGUS.js";
-import "../chunk-FISN7WE4.js";
-import "../chunk-SMXWYP24.js";
-import "../chunk-WWGT2MDV.js";
-import "../chunk-ITNUCOXM.js";
+} from "../chunk-D26JB3LZ.js";
+import {
+  groupAndReduce,
+  reduceRecords
+} from "../chunk-IGJHJYM6.js";
+import {
+  readPath
+} from "../chunk-IGJCYUT5.js";
+import "../chunk-KPGX66PM.js";
+import "../chunk-K62IUKOD.js";
+import "../chunk-5XIPOCQC.js";
+import "../chunk-BE7N3AXA.js";
+import "../chunk-ARSAMO24.js";
+import "../chunk-5ZOSG3RJ.js";
+import "../chunk-4N5QFSNQ.js";
 import {
   generateULID
 } from "../chunk-ZJADGNYF.js";
 import "../chunk-SVLR4POP.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import {
-  groupAndReduce,
-  reduceRecords
-} from "../chunk-LV7M27WM.js";
-import {
-  readPath
-} from "../chunk-M2YKN37S.js";
-import "../chunk-5LUY7UTV.js";
+} from "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
 import {
   CargoNotEnabledError,
   CrossShardJoinError,
@@ -56,7 +62,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   CargoNotEnabledError,

package/dist/chunk-25NDNMQ7.js

@@ -0,0 +1,70 @@
+import {
+  envelopeBodyForHash
+} from "./chunk-QQJXBZCO.js";
+import {
+  sha256Hex
+} from "./chunk-HUS3J5WM.js";
+
+// src/with-commit/history/ledger/entry.ts
+function canonicalJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(
+        `canonicalJson: refusing to encode non-finite number ${String(value)}`
+      );
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "bigint") {
+    throw new Error("canonicalJson: BigInt is not JSON-serializable");
+  }
+  if (typeof value === "undefined" || typeof value === "function") {
+    throw new Error(
+      `canonicalJson: refusing to encode ${typeof value} \u2014 include all fields explicitly`
+    );
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map((v) => canonicalJson(v)).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const parts = [];
+    for (const key of keys) {
+      parts.push(JSON.stringify(key) + ":" + canonicalJson(obj[key]));
+    }
+    return "{" + parts.join(",") + "}";
+  }
+  throw new Error(`canonicalJson: unexpected value type: ${typeof value}`);
+}
+async function sha256Hex2(input) {
+  return sha256Hex(new TextEncoder().encode(input));
+}
+async function hashEntry(entry) {
+  return sha256Hex2(canonicalJson(entry));
+}
+function paddedIndex(index) {
+  return String(index).padStart(10, "0");
+}
+function parseIndex(key) {
+  return Number.parseInt(key, 10);
+}
+
+// src/with-commit/history/ledger/hash.ts
+async function envelopePayloadHash(envelope) {
+  if (!envelope) return "";
+  return sha256Hex2(envelopeBodyForHash(envelope));
+}
+
+export {
+  canonicalJson,
+  sha256Hex2 as sha256Hex,
+  hashEntry,
+  paddedIndex,
+  parseIndex,
+  envelopePayloadHash
+};
+//# sourceMappingURL=chunk-25NDNMQ7.js.map

package/dist/chunk-25NDNMQ7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/ledger/entry.ts","../src/with-commit/history/ledger/hash.ts"],"sourcesContent":["/**\n * Ledger entry shape + canonical JSON + sha256 helpers.\n *\n * This file holds the PURE primitives used by the hash-chained ledger:\n * the entry type, the deterministic (sort-stable) JSON encoder, and\n * the sha256 hasher that produces `prevHash` and `ledger.head()`.\n *\n * Everything here is validator-free and side-effect free — the only\n * runtime dep is Web Crypto's `subtle.digest` for the sha256 call,\n * which we already use for every other hashing operation in the core.\n *\n * The hash chain property works like this:\n *\n *   hash(entry[i])       = sha256(canonicalJSON(entry[i]))\n *   entry[i+1].prevHash  = hash(entry[i])\n *\n * Any modification to `entry[i]` (field values, field order, whitespace)\n * produces a different `hash(entry[i])`, which means `entry[i+1]`'s\n * stored `prevHash` no longer matches the recomputed hash, which means\n * `verify()` returns `{ ok: false, divergedAt: i + 1 }`. The chain is\n * append-only and tamper-evident without external anchoring.\n */\n\n/**\n * A single ledger entry in its plaintext form — what gets serialized,\n * hashed, and then encrypted with the ledger DEK before being written\n * to the `_ledger/` adapter collection.\n *\n * ## Why hash the ciphertext, not the plaintext?\n *\n * `payloadHash` is the sha256 of the record's ENCRYPTED envelope bytes,\n * not its plaintext. This matters:\n *\n *   1. **Zero-knowledge preserved.** A user (or a third party) can\n *      verify the ledger against the stored envelopes without any\n *      decryption keys. The adapter layer already holds only\n *      ciphertext, so hashing the ciphertext keeps the ledger at the\n *      same privacy level as the adapter.\n *\n *   2. **Determinism.** Plaintext → ciphertext is randomized by the\n *      fresh per-write IV, so `hash(plaintext)` would need extra\n *      normalization. `hash(ciphertext)` is already deterministic and\n *      unique per write.\n *\n *   3. **Detection property.** If an attacker modifies even one byte of\n *      the stored ciphertext (trying to flip a record), the hash\n *      changes, the ledger's recorded `payloadHash` no longer matches,\n *      and a data-integrity check fails. We don't do that check in\n *      `verify()` today, but the\n *      hook is there for a future `verifyIntegrity()` follow-up.\n *\n * Fields marked `op`, `collection`, `id`, `version`, `ts`, `actor` are\n * plaintext METADATA about the operation — NOT the record itself. The\n * entry is still encrypted at rest via the ledger DEK, but adapters\n * could theoretically infer operation patterns from the sizes and\n * timestamps. This is an accepted trade-off for the tamper-evidence\n * property; full ORAM-level privacy is out of scope for noy-db.\n */\nimport { sha256Hex as sha256HexBytes } from '../../../kernel/enclave/index.js'\n\nexport interface LedgerEntry {\n  /**\n   * Zero-based sequential position of this entry in the chain. The\n   * canonical adapter key is this number zero-padded to 10 digits\n   * (`\"0000000001\"`) so lexicographic ordering matches numeric order.\n   */\n  readonly index: number\n\n  /**\n   * Hex-encoded sha256 of the canonical JSON of the PREVIOUS entry.\n   * The genesis entry (index 0) has `prevHash === ''` — the first\n   * entry in a fresh vault has nothing to point back to.\n   */\n  readonly prevHash: string\n\n  /**\n   * Which kind of mutation this entry records. only supports\n   * data operations (`put`, `delete`, `amendment`). Access-control\n   * operations (`grant`, `revoke`, `rotate`) will be added in a\n   * follow-up once the keyring write path is instrumented — that's\n   * tracked in the epic issue.\n   *\n   * `'amendment'` is the multi-record audit entry written by the\n   * guards service when an admin/owner uses `withTransactions(...)`\n   * to repair a constraint-violating state. See `amendment` field\n   * below for the structured payload.\n   *\n   * `'lifecycle'` records a non-data audit event (e.g. partition\n   * handover) — `collection`/`id` are empty and the event detail\n   * lives in `reason` (e.g. `'partition-handed-over:<sealId>'`). Like\n   * `amendment`, it carries no data envelope, so `verifyBackupIntegrity`\n   * skips it in the data cross-check (it still participates in the\n   * tamper-evident chain).\n   *\n   * `'forget'` is the single summary entry written by `vault.forget()`\n   * (GDPR crypto-shred). `collection`/`id` are empty and `version`\n   * is 0 — a forget is not scoped to one record. `payloadHash` carries\n   * `sha256Hex(subjectId)` so the ledger PROVES \"subject X existed and\n   * was erased on date D\" without retaining the subject id or any\n   * plaintext; `reason` holds a JSON summary of the shred counts. Like\n   * `amendment`/`lifecycle` it carries no data envelope and is skipped\n   * by the reconstruct walker (it still participates in the chain, so\n   * `verify()` passes after a shred).\n   */\n  readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle' | 'migration' | 'forget'\n\n  /** The collection the mutation targeted. */\n  readonly collection: string\n\n  /** The record id the mutation targeted. */\n  readonly id: string\n\n  /**\n   * The record version AFTER this mutation. For `put` this is the\n   * newly assigned version; for `delete` this is the version that\n   * was deleted (the last version visible to reads).\n   */\n  readonly version: number\n\n  /** ISO timestamp of the mutation. */\n  readonly ts: string\n\n  /** User id of the actor who performed the mutation. */\n  readonly actor: string\n\n  /**\n   * Hex-encoded sha256 over the encrypted envelope's `_data` field, plus its\n   * sealed-field ciphertext map (`_sealed`) when the record carries one —\n   * so the ledger attests to both the open body and every sealed\n   * value. A record with no `_sealed` hashes `_data` alone.\n   * For `put`, this is the hash of the new ciphertext. For `delete`,\n   * it's the hash of the last visible ciphertext at deletion time, or the empty\n   * string if nothing was there to delete. Hashing the ciphertext (not the\n   * plaintext) preserves zero-knowledge — see the file docstring. The exact\n   * recipe lives in `envelopePayloadHash` (`hash.ts`).\n   */\n  readonly payloadHash: string\n\n  /**\n   * Optional human-readable tag describing why this mutation happened.\n   * Threaded through `collection.put(_, _, { reason })`. Common\n   * values include `'import:csv'`, `'import:json'`, `'import:xlsx'` from\n   * `as-*` ImportPlan.apply(), but consumers can use any string for\n   * domain-specific audit filtering. Auto-strip via `canonicalJson` —\n   * absent on the wire, never serialized as `null`.\n   *\n   * Audit consumers filter: `entries.filter(e => e.reason?.startsWith('import:'))`.\n   */\n  readonly reason?: string\n\n  /**\n   * Optional hex-encoded sha256 of the encrypted JSON Patch delta\n   * blob stored alongside this entry in `_ledger_deltas/`. Present\n   * only for `put` operations that had a previous version — the\n   * genesis put of a new record, and every `delete`, leave this\n   * field undefined.\n   *\n   * The delta payload itself lives in a sibling internal collection\n   * (`_ledger_deltas/<paddedIndex>`) and is encrypted with the\n   * ledger DEK. Callers use `ledger.loadDelta(index)` to decrypt and\n   * deserialize it when reconstructing a historical version.\n   *\n   * Why optional instead of always-present: the first put of a\n   * record has no previous version to diff against, so storing an\n   * empty patch would be noise. For deletes there's no \"next\" state\n   * to describe with a delta. Both cases set this field to undefined.\n   *\n   * Note: the canonical-JSON hasher treats `undefined` as invalid\n   * (it's one of the guard rails), so on the wire this field is\n   * either `{ deltaHash: '<hex>' }` or absent from the JSON\n   * entirely — never `{ deltaHash: undefined }`.\n   */\n  readonly deltaHash?: string\n\n  /**\n   * Present only when `op === 'amendment'`. Records the human reason,\n   * the role of the actor, the (collection, id, vBefore, vAfter) tuple\n   * for every record touched, and which guard invariants passed.\n   *\n   * See docs/superpowers/specs/2026-05-18-guards-design.md.\n   */\n  readonly amendment?: {\n    readonly reason: string\n    readonly role: 'admin' | 'owner'\n    readonly changes: ReadonlyArray<{\n      readonly collection: string\n      readonly id: string\n      readonly vBefore: number\n      readonly vAfter: number\n    }>\n    readonly invariantsPassed: ReadonlyArray<string>\n  }\n}\n\n/**\n * Canonical (sort-stable) JSON encoder.\n *\n * This function is the load-bearing primitive of the hash chain:\n * `sha256(canonicalJSON(entry))` must produce the same hex string\n * every time, on every machine, for the same logical entry — otherwise\n * `verify()` would return `{ ok: false }` on cross-platform reads.\n *\n * JavaScript's `JSON.stringify` is almost canonical, but NOT quite:\n * it preserves the insertion order of object keys, which means\n * `{a:1,b:2}` and `{b:2,a:1}` serialize differently. We fix this by\n * recursively walking objects and sorting their keys before\n * concatenation.\n *\n * Arrays keep their original order (reordering them would change\n * semantics). Numbers, strings, booleans, and `null` use the default\n * JSON encoding. `undefined` and functions are rejected — ledger\n * entries are plain data, and silently dropping `undefined` would\n * break the \"same input → same hash\" property if a caller forgot to\n * omit a field.\n *\n * Performance: one pass per nesting level; O(n log n) for key sorting\n * at each object. Entries are small (< 1 KB) so this is negligible\n * compared to the sha256 call.\n */\nexport function canonicalJson(value: unknown): string {\n  if (value === null) return 'null'\n  if (typeof value === 'boolean') return value ? 'true' : 'false'\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error(\n        `canonicalJson: refusing to encode non-finite number ${String(value)}`,\n      )\n    }\n    return JSON.stringify(value)\n  }\n  if (typeof value === 'string') return JSON.stringify(value)\n  if (typeof value === 'bigint') {\n    throw new Error('canonicalJson: BigInt is not JSON-serializable')\n  }\n  if (typeof value === 'undefined' || typeof value === 'function') {\n    throw new Error(\n      `canonicalJson: refusing to encode ${typeof value} — include all fields explicitly`,\n    )\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map((v) => canonicalJson(v)).join(',') + ']'\n  }\n  if (typeof value === 'object') {\n    const obj = value as Record<string, unknown>\n    const keys = Object.keys(obj).sort()\n    const parts: string[] = []\n    for (const key of keys) {\n      parts.push(JSON.stringify(key) + ':' + canonicalJson(obj[key]))\n    }\n    return '{' + parts.join(',') + '}'\n  }\n  throw new Error(`canonicalJson: unexpected value type: ${typeof value}`)\n}\n\n/**\n * Compute a hex-encoded sha256 of a string via Web Crypto's subtle API.\n *\n * We use hex (not base64) for hashes because hex is case-insensitive,\n * fixed-length (64 chars), and easier to compare visually in debug\n * output. Base64 would save a few bytes in storage but every encrypted\n * ledger entry is already much larger than the hash itself.\n */\nexport async function sha256Hex(input: string): Promise<string> {\n  return sha256HexBytes(new TextEncoder().encode(input))\n}\n\n/**\n * Compute the canonical hash of a ledger entry. Short wrapper around\n * `canonicalJson` + `sha256Hex`; callers use this instead of composing\n * the two functions every time, so any future change to the hashing\n * pipeline (e.g., adding a domain-separation prefix) lives in one place.\n */\nexport async function hashEntry(entry: LedgerEntry): Promise<string> {\n  return sha256Hex(canonicalJson(entry))\n}\n\n/**\n * Pad an index to the canonical 10-digit form used as the adapter key.\n * Ten digits is enough for ~10 billion ledger entries per vault\n * — far beyond any realistic use case, but cheap enough that the extra\n * digits don't hurt storage.\n */\nexport function paddedIndex(index: number): string {\n  return String(index).padStart(10, '0')\n}\n\n/** Parse a padded adapter key back into a number. Returns NaN on malformed input. */\nexport function parseIndex(key: string): number {\n  return Number.parseInt(key, 10)\n}\n","/**\n * Envelope payload hash — pinned in its own leaf module so consumers\n * (DictionaryHandle, the active history strategy) can import it\n * without dragging in the `LedgerStore` class.\n *\n * see `constants.ts` for the broader rationale.\n *\n * @internal\n */\n\nimport type { EncryptedEnvelope } from '../../../kernel/types.js'\nimport { sha256Hex } from './entry.js'\nimport { envelopeBodyForHash } from '../../../kernel/enclave/index.js'\n\n/**\n * Compute the `payloadHash` value for an encrypted envelope. Used by\n * `LedgerStore.append` for both put (hash the new envelope) and\n * delete (hash the previous envelope) paths, and by\n * `DictionaryHandle` so its ledger entries match the same contract.\n *\n * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext\n * map (`_sealed`) when a record carries one — so the ledger attests to\n * both the open body AND every sealed value … and the verify-digest\n * ciphertext map (`_vdig`), each bound only when present — the `_vdig`\n * binding is the temporal-rollback detector for the C1 splice class.\n * `rotateRecordCek` rewrites `_vdig` with no ledger entry, the same\n * pre-existing rotation property `_sealed`/`_cek` already have\n * (`verifyBackupIntegrity` flags rotated records until re-anchored).\n *\n * Returns the empty string when there is no envelope (delete of a\n * never-existed record). The empty string tolerated by the ledger\n * entry's `payloadHash` field as the canonical \"nothing here\" value.\n */\nexport async function envelopePayloadHash(\n  envelope: EncryptedEnvelope | null,\n): Promise<string> {\n  if (!envelope) return ''\n  // Back-compat: a record with NO sealed fields hashes as sha256 of\n  // `_data` alone — so every pre-existing ledger entry\n  // and every non-sealed backup verifies byte-identically. A record WITH\n  // `_sealed` widens the hash to also bind the sealed-field ciphertext, so the\n  // ledger attests to sealed-value tamper/erasure (a dropped or swapped\n  // `_sealed[field]` now diverges `verifyBackupIntegrity`'s data cross-check).\n  // `envelopeBodyForHash` (the enclave barrel's C1 protected-body access\n  // contract) derives this exact string — see its own doc for the\n  // canonicalization recipe (sorted keys, independent of `_sealed`'s\n  // field-insertion / store-serialization order).\n  //\n  // `_cek` is deliberately NOT bound: a tampered wrapped-CEK already self-\n  // detects (it fails to unwrap), and `rotateRecordCek` rewrites `_cek` with no\n  // ledger entry — binding it would make every legitimate rotation fail verify.\n  //\n  // RESIDUAL: a backup containing sealed records created BEFORE this change\n  // stored `payloadHash` over `_data` only, so it will fail the data cross-check\n  // and must be re-anchored (re-`put`/re-baseline). Sealed fields are new, so\n  // this is expected to affect ~no real vault.\n  //\n  // The two branches are NOT domain-separated — D1 pins the no-`_sealed` branch\n  // to exactly `sha256(_data)`, so it cannot carry a discriminator tag. An actor\n  // with raw-store write access could therefore set a non-sealed record's `_data`\n  // equal to the canonical-JSON string below and collide a sealed record's hash —\n  // but doing so overwrites `_data` itself, which then no longer GCM-decrypts, so\n  // it only suppresses the verify signal on an already-destroyed record; it cannot\n  // silently erase one sealed field while leaving the record readable.\n  return sha256Hex(envelopeBodyForHash(envelope))\n}\n"],"mappings":";;;;;;;;AA2NO,SAAS,cAAc,OAAwB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,uDAAuD,OAAO,KAAK,CAAC;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,OAAO,UAAU,eAAe,OAAO,UAAU,YAAY;AAC/D,UAAM,IAAI;AAAA,MACR,qCAAqC,OAAO,KAAK;AAAA,IACnD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM;AACZ,UAAM,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK;AACnC,UAAM,QAAkB,CAAC;AACzB,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,UAAU,GAAG,IAAI,MAAM,cAAc,IAAI,GAAG,CAAC,CAAC;AAAA,IAChE;AACA,WAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,EAAE;AACzE;AAUA,eAAsBA,WAAU,OAAgC;AAC9D,SAAO,UAAe,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvD;AAQA,eAAsB,UAAU,OAAqC;AACnE,SAAOA,WAAU,cAAc,KAAK,CAAC;AACvC;AAQO,SAAS,YAAY,OAAuB;AACjD,SAAO,OAAO,KAAK,EAAE,SAAS,IAAI,GAAG;AACvC;AAGO,SAAS,WAAW,KAAqB;AAC9C,SAAO,OAAO,SAAS,KAAK,EAAE;AAChC;;;AChQA,eAAsB,oBACpB,UACiB;AACjB,MAAI,CAAC,SAAU,QAAO;AA4BtB,SAAOC,WAAU,oBAAoB,QAAQ,CAAC;AAChD;","names":["sha256Hex","sha256Hex"]}

package/dist/chunk-2JMMY7HZ.js

@@ -0,0 +1,188 @@
+import {
+  putDerivedOutput
+} from "./chunk-DGH65E7Q.js";
+import {
+  wrapDbWithPredicates
+} from "./chunk-3G4KMVUN.js";
+import {
+  canonicalGroupKey,
+  groupAndReduce
+} from "./chunk-IGJHJYM6.js";
+import {
+  applyI18nLocale
+} from "./chunk-BE7N3AXA.js";
+import {
+  LocaleNotSpecifiedError,
+  MaterializedViewTooLargeError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/materialized-views/executor.ts
+var DEFAULT_MAX_ROWS = 1e5;
+async function materializeQueryResult(q, mvName, i18nLocale, i18nFields) {
+  if (typeof q?.toArray === "function") {
+    return await q.toArray();
+  }
+  if (typeof q?.run === "function") {
+    const runOpts = i18nLocale !== void 0 ? { locale: i18nLocale, i18nFields } : void 0;
+    const result = await Promise.resolve(q.run(runOpts));
+    if (Array.isArray(result)) {
+      return result;
+    }
+    return [result];
+  }
+  throw new Error(
+    `MV "${mvName}": query() must return a Query<T>, Aggregation, or GroupedAggregation. Got something without a .toArray() or .run() terminal.`
+  );
+}
+async function materializeUnionResult(spec, db) {
+  const unified = [];
+  for (const arm of spec.unionSources) {
+    const coll = db.collection(arm.collection);
+    let q = coll.query();
+    if (arm.join?.length) {
+      for (const leg of arm.join) {
+        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy });
+      }
+    }
+    const sourceRows = q.toArray();
+    for (const r of sourceRows) {
+      const mapped = arm.map(r);
+      if (mapped == null) continue;
+      unified.push(mapped);
+    }
+  }
+  if (!spec.groupBy) return unified;
+  const groupFields = typeof spec.groupBy === "string" ? [spec.groupBy] : spec.groupBy;
+  if (spec.i18nLocale !== void 0 && spec.i18nFields !== void 0) {
+    const groupI18n = {};
+    for (const f of groupFields) {
+      const d = spec.i18nFields[f];
+      if (d !== void 0) groupI18n[f] = d;
+    }
+    if (Object.keys(groupI18n).length > 0) {
+      for (let i = 0; i < unified.length; i++) {
+        unified[i] = applyI18nLocale(unified[i], groupI18n, spec.i18nLocale, void 0, "mv");
+      }
+    }
+  }
+  for (const f of groupFields) {
+    for (const row of unified) {
+      const v = row[f];
+      if (v !== null && typeof v === "object") {
+        throw new LocaleNotSpecifiedError(
+          f,
+          `Materialized view "${spec.name}" groups by "${f}", whose value is a raw i18n locale map \u2014 an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`
+        );
+      }
+    }
+  }
+  if (!spec.aggregate) {
+    const seen = /* @__PURE__ */ new Map();
+    for (const row of unified) {
+      const k = canonicalGroupKey(groupFields, row);
+      if (!seen.has(k)) seen.set(k, row);
+    }
+    return [...seen.values()];
+  }
+  return groupAndReduce(unified, groupFields, spec.aggregate, spec.moneyFields);
+}
+var MaterializedViewExecutor = {
+  async refresh(reg, accessor) {
+    const spec = reg.spec;
+    const outputColl = accessor.getCollection(reg.outputCollection);
+    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS;
+    const onEmpty = spec.onEmpty ?? "delete";
+    const strict = spec.strict ?? false;
+    const baseCtx = accessor.getQueryContext();
+    const ctxForQuery = spec.predicates ? wrapDbWithPredicates(baseCtx, spec.predicates) : baseCtx;
+    let rows;
+    if (spec.unionSources) {
+      rows = await materializeUnionResult(spec, ctxForQuery);
+    } else {
+      const q = spec.query(ctxForQuery);
+      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields);
+    }
+    if (rows.length > maxRows) {
+      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows);
+    }
+    const txCtx = accessor.getActiveTxContext();
+    const adapter = outputColl.adapter;
+    const vaultName = outputColl.vault;
+    const newIds = /* @__PURE__ */ new Set();
+    const enrichedRows = [];
+    for (const row of rows) {
+      const id = spec.rowKey(row);
+      newIds.add(id);
+      const meta = {
+        mvName: spec.name,
+        queryHash: reg.queryHash,
+        sourceVersions: {},
+        materializedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } });
+    }
+    let written = 0;
+    let failed = 0;
+    for (const { id, record } of enrichedRows) {
+      try {
+        if (txCtx !== null) {
+          const prior = await adapter.get(vaultName, reg.outputCollection, id);
+          txCtx._executed.push({
+            op: { type: "put", vaultName, collectionName: reg.outputCollection, id },
+            priorEnvelope: prior
+          });
+        }
+        if (accessor.dispatchCtx) {
+          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === "written") written++;
+        } else {
+          await outputColl.put(id, record);
+          written++;
+        }
+      } catch (err) {
+        failed++;
+        if (strict) throw err;
+        console.warn(`[mv] "${spec.name}" row write failed:`, err);
+      }
+    }
+    let deleted = 0;
+    if (onEmpty === "delete") {
+      const priorIds = await listOutputIds(outputColl);
+      for (const priorId of priorIds) {
+        if (newIds.has(priorId)) continue;
+        try {
+          const outAny = outputColl;
+          if (typeof outAny._internalDelete === "function") {
+            await outAny._internalDelete(priorId, txCtx);
+            deleted++;
+          } else {
+            await outputColl.delete(priorId);
+            deleted++;
+          }
+        } catch (err) {
+          failed++;
+          if (strict) throw err;
+          console.warn(`[mv] "${spec.name}" tombstone failed for id="${priorId}":`, err);
+        }
+      }
+    }
+    return { written, deleted, failed };
+  }
+};
+async function listOutputIds(outputColl) {
+  const cAny = outputColl;
+  const adapter = cAny.adapter;
+  const vault = cAny.vault;
+  const name = cAny.name;
+  if (typeof adapter?.list !== "function") return [];
+  try {
+    const ids = await adapter.list(vault, name);
+    return [...ids];
+  } catch {
+    return [];
+  }
+}
+
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=chunk-2JMMY7HZ.js.map

package/dist/chunk-2JMMY7HZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/executor.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport { MaterializedViewTooLargeError, LocaleNotSpecifiedError } from '../../kernel/errors.js'\nimport type { MaterializedFromMeta, MVQueryContext, MaterializedViewStrategy } from './types.js'\nimport type { RegisteredMV } from './registry.js'\nimport { wrapDbWithPredicates } from './registry.js'\nimport { groupAndReduce } from '../../with-lookup/aggregate/groupby.js'\nimport { canonicalGroupKey } from '../../with-lookup/aggregate/canonical-key.js'\nimport { applyI18nLocale, type I18nTextDescriptor } from '../../via/i18n/core.js'\nimport { putDerivedOutput, type PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\n\n/**\n * Accessor shape passed in from the owning Vault. Mirrors v1's\n * `DerivationStaleAccessor` — provides the per-collection resolver\n * and the active TxContext so refresh writes/tombstones register on\n * `_executed` for rollback symmetry.\n */\nexport interface MVExecutorAccessor {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  /**\n   * Vault-shaped accessor passed to the MV's `query()` callback at\n   * each refresh. Same instance the registry used at registration\n   * time; threading through the executor lets the refresh path\n   * re-evaluate the closure against the live vault state.\n   */\n  getQueryContext(): MVQueryContext\n  /**\n   * #638 Task 5 — ctx for `putDerivedOutput`'s frozen-period skip+audit. #641: the lazy\n   * resolve-on-read caller (`stale.ts#resolveStaleMVOnRead`) now supplies one too — built at\n   * the `Collection.get()`/`list()` entry point with a `'resolve-on-read'` sentinel id (no\n   * real \"reacting write\" for a read-triggered materialize, mirroring `refreshView()`'s\n   * `'refreshView'` sentinel). Still declared optional here since `MVExecutorAccessor` is a\n   * general shape and a future caller could reasonably omit it.\n   */\n  dispatchCtx?: PutDerivedOutputCtx\n}\n\nexport interface RefreshResult {\n  /** Rows newly written / overwritten. */\n  written: number\n  /** Rows tombstoned via `_internalDelete` (only when `onEmpty: 'delete'`). */\n  deleted: number\n  /** Failed row writes (non-strict mode). */\n  failed: number\n}\n\n/** Default cost ceiling — overridable per-MV via `spec.maxRows`. */\nconst DEFAULT_MAX_ROWS = 100_000\n\n/**\n * Materialize a query terminal that may be a `Query<T>` (call\n * `.toArray()`), an `Aggregation<R>` (call `.run()` returning a\n * single object — wrap as a one-row array), or a `GroupedAggregation<R>`\n * (call `.run()` returning an array of grouped rows). Branches on\n * available terminal at runtime — no type-discrimination at registration.\n */\nasync function materializeQueryResult(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  q: any,\n  mvName: string,\n  i18nLocale?: string,\n  i18nFields?: Record<string, I18nTextDescriptor>,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  if (typeof q?.toArray === 'function') {\n    // Query<T> — non-aggregate path. `.toArray()` returns Promise<T[]>.\n    return await q.toArray()\n  }\n  if (typeof q?.run === 'function') {\n    // Aggregation<R> or GroupedAggregation<R>. `.run()` is synchronous\n    // and returns either a single object (Aggregation) or an array of\n    // rows (GroupedAggregation). Promise.resolve() normalizes both\n    // sync and async (future) variants.\n    // Query-form MV grouping: when the MV declares i18nLocale, pass it +\n    // i18nFields so a GroupedAggregation resolves i18n group keys before\n    // bucketing (the Aggregation path ignores the extra arg).\n    const runOpts = i18nLocale !== undefined ? { locale: i18nLocale, i18nFields } : undefined\n    const result: unknown = await Promise.resolve(q.run(runOpts))\n    if (Array.isArray(result)) {\n      return result as ReadonlyArray<Record<string, unknown>>\n    }\n    // Single-aggregate result — wrap as one-row array. The consumer's\n    // `rowKey()` should return a stable identity (often a literal\n    // constant like `'total'`) since there's only one row.\n    return [result as Record<string, unknown>]\n  }\n  throw new Error(\n    `MV \"${mvName}\": query() must return a Query<T>, Aggregation, or GroupedAggregation. ` +\n      `Got something without a .toArray() or .run() terminal.`,\n  )\n}\n\n/**\n * Materialize a UNION-form MV: read every arm's source\n * collection, apply each arm's `map` to project rows into the unified\n * MV row shape, concatenate the mapped streams, then optionally run\n * `groupBy` + `aggregate` over the result.\n *\n * Modes (driven by `spec.groupBy` / `spec.aggregate`):\n *\n *   - No `groupBy` → return the concatenated mapped rows unchanged.\n *   - `groupBy` without `aggregate` → dedupe by composite group key,\n *     keep the first row seen per key (later arms don't overwrite\n *     earlier arms — Map insertion order rules).\n *   - `groupBy` + `aggregate` → delegate to the shared `groupAndReduce`\n *     pipeline used by `Query.groupBy().aggregate()`.\n *\n * Per-arm `map` is the schema-unification boundary; the strategy's\n * `TRow` type parameter enforces that every arm projects into the\n * same shape at compile time.\n *\n * @internal\n */\nasync function materializeUnionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewStrategy<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const unified: TRow[] = []\n  for (const arm of spec.unionSources!) {\n    const coll = db.collection<Record<string, unknown>>(arm.collection)\n    // Optional per-arm FK joins: chain `.join(field, { as, ... })` for\n    // each declared leg before terminating. The aliased right-side\n    // record lands at `sourceRow[leg.as]`, where the arm's `map` reads\n    // it. Cast to `any` because the chained join widens the row type but\n    // the executor treats every row as `Record<string, unknown>` — same\n    // pattern the query-form join path uses.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let q: any = coll.query()\n    if (arm.join?.length) {\n      for (const leg of arm.join) {\n        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n      }\n    }\n    const sourceRows = q.toArray() as ReadonlyArray<Record<string, unknown>>\n    for (const r of sourceRows) {\n      const mapped = arm.map(r)\n      // null / undefined means \"omit this source row\" — skip without\n      // pushing so groupBy/aggregate never see a null entry.\n      if (mapped == null) continue\n      unified.push(mapped)\n    }\n  }\n\n  if (!spec.groupBy) return unified\n\n  const groupFields: readonly string[] =\n    typeof spec.groupBy === 'string' ? [spec.groupBy] : spec.groupBy\n\n  // i18n-aware group keys. An `i18nText` group field carries a raw\n  // `{ locale: string }` map, an unstable object key. When `i18nLocale` is\n  // declared (with `i18nFields` describing those fields), resolve the declared\n  // group-key i18n fields to it at the `mv` layer FIRST — the same unified-rows\n  // boundary where money is threaded — so buckets are stable strings and the\n  // `mv`-layer `onMissing` policy fires here.\n  if (spec.i18nLocale !== undefined && spec.i18nFields !== undefined) {\n    const groupI18n: Record<string, I18nTextDescriptor> = {}\n    for (const f of groupFields) {\n      const d = spec.i18nFields[f]\n      if (d !== undefined) groupI18n[f] = d\n    }\n    if (Object.keys(groupI18n).length > 0) {\n      for (let i = 0; i < unified.length; i++) {\n        unified[i] = applyI18nLocale(unified[i] as Record<string, unknown>, groupI18n, spec.i18nLocale, undefined, 'mv') as TRow\n      }\n    }\n  }\n  // Guard (always): a remaining object-valued group key — an undeclared i18n\n  // field or a locale-less MV — would bucket on a map. Refuse, don't bucket wrong.\n  for (const f of groupFields) {\n    for (const row of unified) {\n      const v = (row as Record<string, unknown>)[f]\n      if (v !== null && typeof v === 'object') {\n        throw new LocaleNotSpecifiedError(\n          f,\n          `Materialized view \"${spec.name}\" groups by \"${f}\", whose value is a raw i18n locale map — ` +\n            `an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at ` +\n            `the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`,\n        )\n      }\n    }\n  }\n\n  // groupBy without aggregate — dedupe by composite key, keep first\n  // seen row per key. Useful for cross-arm uniqueness (e.g. unify two\n  // sibling collections, keeping one row per natural key).\n  if (!spec.aggregate) {\n    const seen = new Map<string, TRow>()\n    for (const row of unified) {\n      const k = canonicalGroupKey(groupFields, row as Record<string, unknown>)\n      if (!seen.has(k)) seen.set(k, row)\n    }\n    return [...seen.values()]\n  }\n\n  // groupBy + aggregate — delegate to the shared pipeline used by\n  // `Query.groupBy().aggregate()`. Result rows carry each grouped\n  // field in declaration order followed by the spec's reducer outputs.\n  return groupAndReduce<Record<string, unknown>>(unified, groupFields, spec.aggregate, spec.moneyFields)\n}\n\n/**\n * Run an MV's `query()` and write the result rows to the output\n * collection. Same-DEK encryption: routes through the standard\n * `Collection.put` pipeline, so the output collection's DEK is what\n * gets used (matches the v2 spec's \"same DEK as the left-most source\"\n * invariant — `Collection.put` looks up the DEK by collection name,\n * and the output collection IS the MV's owned collection).\n *\n * Stamps `_materializedFrom` onto every emitted row.\n *\n * **Tombstoning:** when `spec.onEmpty: 'delete'` (default), rows\n * that existed in a prior refresh but no longer appear in the new\n * materialized result are deleted via `Collection._internalDelete` —\n * the housekeeping bypass primitive prevents user\n * `onDelete` guards on the output collection from firing on these\n * system-internal deletes. `onEmpty: 'keep'` opts out (rows from\n * prior refreshes linger even when the new result lacks them).\n *\n * **Cost ceiling:** if the materialized row count exceeds\n * `spec.maxRows` (default 100k), throws `MaterializedViewTooLargeError`\n * before any writes hit the store — so strict-mode rollback is\n * clean.\n *\n * **Strict mode:** `spec.strict === true` re-throws on any\n * row-write failure; the active TxContext registration means the\n * source-write rolls back atomically via `revertExecuted`.\n *\n * @internal\n */\nexport const MaterializedViewExecutor = {\n  async refresh(\n    reg: RegisteredMV,\n    accessor: MVExecutorAccessor,\n  ): Promise<RefreshResult> {\n    const spec = reg.spec\n    const outputColl = accessor.getCollection(reg.outputCollection)\n    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS\n    const onEmpty = spec.onEmpty ?? 'delete'\n    const strict = spec.strict ?? false\n\n    // 1. Materialize the query (branches on terminal shape). If the\n    //    MV declared predicates, wrap the query context the same way\n    //    the registry did at registration time so `.wherePredicate()`\n    //    calls resolve to the registered functions.\n    const baseCtx = accessor.getQueryContext()\n    const ctxForQuery: MVQueryContext = spec.predicates\n      ? wrapDbWithPredicates(baseCtx, spec.predicates)\n      : baseCtx\n    // UNION-form strategies: read every arm, map to the unified\n    // row shape, concatenate, then optionally groupBy + aggregate. The\n    // single-source `query()` path is untouched.\n    let rows: ReadonlyArray<Record<string, unknown>>\n    if (spec.unionSources) {\n      rows = await materializeUnionResult(spec, ctxForQuery)\n    } else {\n      const q = spec.query!(ctxForQuery)\n      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields)\n    }\n\n    // 2. Cost ceiling check BEFORE any writes — keeps the rollback\n    //    clean if the source-write is wrapped in a transaction.\n    if (rows.length > maxRows) {\n      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows)\n    }\n\n    const txCtx = accessor.getActiveTxContext()\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const adapter = (outputColl as any).adapter as {\n      get(v: string, c: string, i: string): Promise<EncryptedEnvelope | null>\n    }\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const vaultName = (outputColl as any).vault as string\n\n    // 3. Compute the post-refresh id set so we can diff against the\n    //    prior-emitted id set for tombstoning (when onEmpty === 'delete').\n    const newIds = new Set<string>()\n    const enrichedRows: Array<{ id: string; record: Record<string, unknown> }> = []\n    for (const row of rows) {\n      const id = spec.rowKey(row)\n      newIds.add(id)\n      const meta: MaterializedFromMeta = {\n        mvName: spec.name,\n        queryHash: reg.queryHash,\n        sourceVersions: {},\n        materializedAt: new Date().toISOString(),\n      }\n      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } })\n    }\n\n    // 4. Write the new rows.\n    let written = 0\n    let failed = 0\n    for (const { id, record } of enrichedRows) {\n      try {\n        if (txCtx !== null) {\n          const prior = await adapter.get(vaultName, reg.outputCollection, id)\n          txCtx._executed.push({\n            op: { type: 'put', vaultName, collectionName: reg.outputCollection, id },\n            priorEnvelope: prior,\n          })\n        }\n        if (accessor.dispatchCtx) {\n          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === 'written') written++\n        } else {\n          await outputColl.put(id, record)\n          written++\n        }\n      } catch (err) {\n        failed++\n        if (strict) throw err\n         \n        console.warn(`[mv] \"${spec.name}\" row write failed:`, err)\n      }\n    }\n\n    // 5. Tombstone rows that existed before but don't appear now.\n    //    `onEmpty: 'keep'` skips this pass entirely. Uses\n    //    `_internalDelete` so a user-registered `onDelete` on the\n    //    output collection does NOT fire on housekeeping (composition fix).\n    let deleted = 0\n    if (onEmpty === 'delete') {\n      const priorIds = await listOutputIds(outputColl)\n      for (const priorId of priorIds) {\n        if (newIds.has(priorId)) continue\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const outAny = outputColl as any\n          if (typeof outAny._internalDelete === 'function') {\n            await outAny._internalDelete(priorId, txCtx)\n            deleted++\n          } else {\n            // Defensive fallback — should never hit in real flow since\n            // every Collection has `_internalDelete`.\n            await outputColl.delete(priorId)\n            deleted++\n          }\n        } catch (err) {\n          failed++\n          if (strict) throw err\n           \n          console.warn(`[mv] \"${spec.name}\" tombstone failed for id=\"${priorId}\":`, err)\n        }\n      }\n    }\n\n    return { written, deleted, failed }\n  },\n}\n\n/**\n * List ids currently present in the MV's output collection via the\n * adapter directly (avoids triggering the lazy resolve-on-read path\n * we're INSIDE). Returns an empty array if the collection doesn't\n * exist or the adapter doesn't surface a list method.\n *\n * @internal\n */\nasync function listOutputIds(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  outputColl: Collection<any>,\n): Promise<string[]> {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const cAny = outputColl as any\n  const adapter = cAny.adapter as { list?: (v: string, c: string) => Promise<readonly string[]> }\n  const vault = cAny.vault as string\n  const name = cAny.name as string\n  if (typeof adapter?.list !== 'function') return []\n  try {\n    const ids = await adapter.list(vault, name)\n    return [...ids]\n  } catch {\n    return []\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkDA,IAAM,mBAAmB;AASzB,eAAe,uBAEb,GACA,QACA,YACA,YACiD;AACjD,MAAI,OAAO,GAAG,YAAY,YAAY;AAEpC,WAAO,MAAM,EAAE,QAAQ;AAAA,EACzB;AACA,MAAI,OAAO,GAAG,QAAQ,YAAY;AAQhC,UAAM,UAAU,eAAe,SAAY,EAAE,QAAQ,YAAY,WAAW,IAAI;AAChF,UAAM,SAAkB,MAAM,QAAQ,QAAQ,EAAE,IAAI,OAAO,CAAC;AAC5D,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,aAAO;AAAA,IACT;AAIA,WAAO,CAAC,MAAiC;AAAA,EAC3C;AACA,QAAM,IAAI;AAAA,IACR,OAAO,MAAM;AAAA,EAEf;AACF;AAuBA,eAAe,uBACb,MACA,IACiD;AACjD,QAAM,UAAkB,CAAC;AACzB,aAAW,OAAO,KAAK,cAAe;AACpC,UAAM,OAAO,GAAG,WAAoC,IAAI,UAAU;AAQlE,QAAI,IAAS,KAAK,MAAM;AACxB,QAAI,IAAI,MAAM,QAAQ;AACpB,iBAAW,OAAO,IAAI,MAAM;AAC1B,YAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,QAAQ;AAC7B,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,CAAC;AAGxB,UAAI,UAAU,KAAM;AACpB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,cACJ,OAAO,KAAK,YAAY,WAAW,CAAC,KAAK,OAAO,IAAI,KAAK;AAQ3D,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,YAAgD,CAAC;AACvD,eAAW,KAAK,aAAa;AAC3B,YAAM,IAAI,KAAK,WAAW,CAAC;AAC3B,UAAI,MAAM,OAAW,WAAU,CAAC,IAAI;AAAA,IACtC;AACA,QAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,eAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,GAA8B,WAAW,KAAK,YAAY,QAAW,IAAI;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,KAAK,aAAa;AAC3B,eAAW,OAAO,SAAS;AACzB,YAAM,IAAK,IAAgC,CAAC;AAC5C,UAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,KAAK,IAAI,gBAAgB,CAAC;AAAA,QAGlD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,KAAK,WAAW;AACnB,UAAM,OAAO,oBAAI,IAAkB;AACnC,eAAW,OAAO,SAAS;AACzB,YAAM,IAAI,kBAAkB,aAAa,GAA8B;AACvE,UAAI,CAAC,KAAK,IAAI,CAAC,EAAG,MAAK,IAAI,GAAG,GAAG;AAAA,IACnC;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAKA,SAAO,eAAwC,SAAS,aAAa,KAAK,WAAW,KAAK,WAAW;AACvG;AA+BO,IAAM,2BAA2B;AAAA,EACtC,MAAM,QACJ,KACA,UACwB;AACxB,UAAM,OAAO,IAAI;AACjB,UAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,SAAS,KAAK,UAAU;AAM9B,UAAM,UAAU,SAAS,gBAAgB;AACzC,UAAM,cAA8B,KAAK,aACrC,qBAAqB,SAAS,KAAK,UAAU,IAC7C;AAIJ,QAAI;AACJ,QAAI,KAAK,cAAc;AACrB,aAAO,MAAM,uBAAuB,MAAM,WAAW;AAAA,IACvD,OAAO;AACL,YAAM,IAAI,KAAK,MAAO,WAAW;AACjC,aAAO,MAAM,uBAAuB,GAAG,KAAK,MAAM,KAAK,YAAY,KAAK,UAAU;AAAA,IACpF;AAIA,QAAI,KAAK,SAAS,SAAS;AACzB,YAAM,IAAI,8BAA8B,KAAK,MAAM,KAAK,QAAQ,OAAO;AAAA,IACzE;AAEA,UAAM,QAAQ,SAAS,mBAAmB;AAE1C,UAAM,UAAW,WAAmB;AAIpC,UAAM,YAAa,WAAmB;AAItC,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,eAAuE,CAAC;AAC9E,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,OAAO,GAAG;AAC1B,aAAO,IAAI,EAAE;AACb,YAAM,OAA6B;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,WAAW,IAAI;AAAA,QACf,gBAAgB,CAAC;AAAA,QACjB,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzC;AACA,mBAAa,KAAK,EAAE,IAAI,QAAQ,EAAE,GAAG,KAAK,mBAAmB,KAAK,EAAE,CAAC;AAAA,IACvE;AAGA,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,EAAE,IAAI,OAAO,KAAK,cAAc;AACzC,UAAI;AACF,YAAI,UAAU,MAAM;AAClB,gBAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,EAAE;AACnE,gBAAM,UAAU,KAAK;AAAA,YACnB,IAAI,EAAE,MAAM,OAAO,WAAW,gBAAgB,IAAI,kBAAkB,GAAG;AAAA,YACvE,eAAe;AAAA,UACjB,CAAC;AAAA,QACH;AACA,YAAI,SAAS,aAAa;AACxB,cAAI,MAAM,iBAAiB,YAAY,IAAI,QAAQ,SAAS,WAAW,MAAM,UAAW;AAAA,QAC1F,OAAO;AACL,gBAAM,WAAW,IAAI,IAAI,MAAM;AAC/B;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ;AACA,YAAI,OAAQ,OAAM;AAElB,gBAAQ,KAAK,SAAS,KAAK,IAAI,uBAAuB,GAAG;AAAA,MAC3D;AAAA,IACF;AAMA,QAAI,UAAU;AACd,QAAI,YAAY,UAAU;AACxB,YAAM,WAAW,MAAM,cAAc,UAAU;AAC/C,iBAAW,WAAW,UAAU;AAC9B,YAAI,OAAO,IAAI,OAAO,EAAG;AACzB,YAAI;AAEF,gBAAM,SAAS;AACf,cAAI,OAAO,OAAO,oBAAoB,YAAY;AAChD,kBAAM,OAAO,gBAAgB,SAAS,KAAK;AAC3C;AAAA,UACF,OAAO;AAGL,kBAAM,WAAW,OAAO,OAAO;AAC/B;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ;AACA,cAAI,OAAQ,OAAM;AAElB,kBAAQ,KAAK,SAAS,KAAK,IAAI,8BAA8B,OAAO,MAAM,GAAG;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,SAAS,OAAO;AAAA,EACpC;AACF;AAUA,eAAe,cAEb,YACmB;AAEnB,QAAM,OAAO;AACb,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,KAAK;AACnB,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,SAAS,SAAS,WAAY,QAAO,CAAC;AACjD,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,WAAO,CAAC,GAAG,GAAG;AAAA,EAChB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;","names":[]}